You are using an unsupported browser. Please switch to a different browser to get the best experience.
  1. The following sets out the types of personal data we collect on our websites:
    • Personal Details: title, first and last name, address, telephone numbers, email address.
    • Consents: consents, permissions, or preferences that you have specified, such as whether you wish to receive direct marketing by subscribing to receive Restore news and media alerts and Restore regulatory news alerts.
    • Website Access Details: your computers unique identifier (e.g. IP Address), the date and time you accessed the website, passwords to access alerts preferences.
    • Security Information: security clearances and vetting information.
    • Correspondence: responses, comments, views and opinions when you communicate to us with us for instance when making a complaint and record a video interview.
  2. Purpose and Use of Personal Data
    The main purpose for using your personal information is to:

    • Improve and monitor the operation of our website; and
    • Deliver any requested services, such as job alerts.

    We use information held about you in the following ways: –

    • To contact you, for instance, to arrange a service;
    • To contact you with relevant marketing communications (please refer to section 9 below);
    • To administer our website and for internal operational purposes to make user experience more efficient (including troubleshooting) and to analyse how the systems are used;
    • To enable you to participate in interactive features within our website;
    • To prevent unauthorised access and modifications to systems;
    • To ensure business policies are adhered.
  3. Legal Basis for Processing Your Personal Data
    Data protection and privacy laws requires us to have a “legal basis” or “lawful ground” to collect and use your personal information. We will only collect, use and share your personal information where we are satisfied that we have an appropriate legal basis to do this. This may include:

    • We have obtained your prior consent, for instance when you sign up to marketing.
    • We need to use your personal information in connection with the performance of a contract with you or to take steps at your request prior to entering into a contract with us.
    • We need to use your personal information to comply with a relevant legal or regulatory obligation that we have.
    • Where it is necessary for our legitimate interests (or those of a third party) as a commercial organisation (to the extent that your interests and fundamental rights do not override those interests), such as:
      • To detect and protect against fraud;
      • To make sure we are following our own internal procedures so we can deliver a quality service;
      • Establishing, exercising or defending our legal rights in the event of a claim;
      • Monitoring, managing and operating our website IT systems and ensuring security of those systems; and/or
      • In connection with compliance, regulatory and investigative purposes as necessary.

    Some of the above grounds for processing will overlap and there may be several grounds which justify our use of your personal information. If you have any queries about our legal basis for using your personal information, please contact the DPO via the details set out below.

    How do we justify our legitimate interests?

    We carry out balancing tests for the data we processed based on our legitimate interests. You can obtain information about these balancing tests by contacting the DPO on the details below.


    Restore sometimes handles personal information relying on exemptions under the applicable data protection law. Any permitted handling of personal information under such exemptions will take priority over this Privacy Policy to the extent of any inconsistency.

  4. When Is Special Category And Criminal Offence Personal Data Collected And Used?
    Special categories of personal data are particularly sensitive and require higher levels of protection. They include information about your health status, racial or ethnic origin, political views, religious or similar beliefs, sex life or sexual orientation, genetic or biometric identifiers and trade union membership.Restore do not collect special category information from our websites.
  5. Direct Marketing
    We may use your personal information to contact you if you subscribed and consented to receive Restore news and media alerts, Restore regulatory news alerts or job alerts about future employment opportunities with Restore.You can manage your mailing preferences or tell us that you no longer wish to be receive these communications from us by:

    • Using the unsubscribe option included on email correspondence;
    • Logging into your online account, such as your careers account or news alert account, and changing your preferences or deleting the account; or
    • Sending us an email to ???

    If you have any other questions or concerns, please contact our DPO using the details below.

    Job Match Emails

    If you are a job applicant, we would like to send you “job match” emails to inform you about other employment opportunities at Serco which we think you would be suitable for you. Job match emails are different to job alerts, which you voluntarily set up to alert you of any future opportunities which we post online.

    If you do NOT want to receive job match emails, please tick the opt out box when making your job application. Every job match email will also contain an option to unsubscribe from future job match emails. We will never send you job match emails when you have informed us that you do not wish to receive them, and they will not contain any marketing or promotional material other than Restore branding.

    Unless you unsubscribe earlier, we will send you job match emails for a period of 12 months from the date you last logged into the Restore careers portal, after which your details shall be deleted from our records.

  6. Sharing Your Personal Information With Others
    We will only disclose personal information to a third party in very limited circumstances, or where we are permitted to do so by law. The third parties to whom we provide your personal data include:

    • Other organisations within the Restore Group of companies, where such disclosure is necessary to provide you with our services or to manage our business (e.g. the purposes of recruitment).
    • Customers where required for specific business purposes.
    • Banks and payment providers to authorise and complete payments.
    • Credit reference agencies and organisations working to prevent fraud in financial services.
    • Restore’s third-party providers including information technology suppliers and infrastructure support services, law firms and other third party suppliers/partner organisations.
    • Service providers which assist in drafting and sending requested news and job alerts.
    • Professional advisors (e.g. legal advisors, insurance organisations and auditors).
    • Government, regulatory and law enforcement bodies where we are required in order:
      • To comply with our legal obligations; To exercise our legal rights (e.g. pursue or defend a claim); and For the prevention, detection, and investigation of crime.

    We may transfer your personal information to third parties in connection with a reorganisation, restructuring, merger, acquisition, sale or transfer of assets, or changing services suppliers provided that the receiving party agrees to treat your personal information in a manner consistent with this Privacy Policy.

    Restore will only share your personal data with our contracted service providers when we have established, they have adequate and sufficient data protection controls and security controls in place. We also implement contractual obligations on these third parties to ensure they can only use your data to provide services to Restore for the purposes listed above. The third parties cannot pass your details onto any other parties unless instructed to by Restore.

  7. Security Of Your Personal Data
    Restore takes precautions including administrative, technical and physical measures to safeguard your personal information against loss, theft and misuse, as well as against unauthorised access, modification, disclosure, alteration and destruction. We protect electronic data using a variety of security measures including (but not limited to):

    • Password access;
    • Data back-up;
    • Encryption;
    • Firewalls;
    • Placing confidentiality requirements on employees and service providers and providing training to ensure that your personal data is handled correctly; and
    • Destroying or permanently anonymising personal information if it is no longer needed for the purposes it was collected.
  8. Retention of Your Personal Data
    Restore will only retain your personal information for the period necessary to fulfil the purposes outlined in this Privacy Policy and as otherwise needed to comply with applicable law and internal company policies. Where your personal information is no longer needed, we will ensure that it is disposed of in a secure manner. Below are the general criteria we use to determine how long we will keep your personal information, where upon we will either delete or anonymise the data:

    • Direct marketing and subscribed mailings: When you register to receive Restore news and media alerts, Restore regulatory news alerts or job alerts about future employment opportunities, we will retain these details until you notify us that you no longer wish to receive such communications (e.g. unsubscribing) (please refer to Section 9 above).

    In some circumstances we may store your personal information for longer periods of time where we are required to do so in accordance with legal or regulatory requirements or so that we have an accurate record of your dealings with us in the event of any complaints or challenges, or if we reasonably believe there is a prospect of litigation relating to your personal information or dealings.

  9. Your Legal Rights
    You have legal rights in connection with personal information. Under certain circumstances, by law you have the right to:

    • Request access to your personal information (commonly known as a “data subject access request”). This enables you to receive a copy of the personal information we hold about you and to check that we are lawfully processing it.
    • Request correction of the personal information that we hold about you. This enables you to have any incomplete or inaccurate information we hold about you corrected.
    • Object to processing of your personal information by us or on our behalf which has our legitimate interests as its legal basis for that processing, if you believe your fundamental rights and freedoms outweigh our legitimate interests. If you raise an objection, we have an opportunity to demonstrate that we have compelling legitimate interests which override your rights and freedoms.
    • Request the transfer of your personal information. You can ask us to provide your personal information to you in a structured, commonly used, machine-readable format, or you can ask to have it transferred directly to another data controller, but in each case only where: (i) the processing is based on your consent or on the performance of a contract with you; and (ii) the processing is carried out by automated means.
    • Obtain a copy, or reference to, the personal data safeguards used for transfers outside the European Union. We may redact data transfer agreements to protect commercial terms.
    • Withdraw consent to processing where the legal basis for processing is solely justified on the grounds of consent (please refer to section 9 for details about withdrawing consent to receiving news and alerts).
    • Request the restriction of processing of your personal information. This enables you to ask us to suspend the processing of personal information about you, but only where:
      • Its accuracy is contested, to allow us to verify its accuracy;
      • The processing is unlawful, but you do not want it erased;
      • It is no longer needed for the purposes for which it was collected, but we still need it to establish, exercise or defend legal claims; or
      • You have exercised the right to object, and verification of overriding grounds is pending.
    • Request erasure of your personal information (commonly known as the “right to be forgotten”). This enables you to ask us to delete or remove personal information in limited circumstances, where:
      • It is no longer needed for the purposes for which it was collected;
      • You have withdrawn your consent (where the data processing was based on consent);
      • Following a successful right to object (see Object to processing);
      • It has been processed unlawfully; or
      • To comply with a legal obligation to which Serco is subject.

    We are not required to comply with your request to erase personal information if the processing of your personal information is necessary for a number of reasons, including: (i) for compliance with a legal obligation; or (ii) for the establishment, exercise or defence of legal claims.

    You can also object at any time to your personal information being processed for direct marketing, profiling or automated decision-making.

    We can continue to use your personal information following a request for restriction, where:

    • We have your consent;
    • To establish, exercise or defend legal claims; or
    • To protect the rights of another natural or legal person.

    If you want to exercise any of these rights, please submit your requests in writing to the DPO via the contact details set out in Section ?? below. Please note, to ensure security of personal information, we may ask you to verify your identity before proceeding with any such request.

    We reserve the right to charge a fee where permitted by law, for instance if your request is manifestly unfounded or excessive.

    We may not always be able to fully address your request, for example if it would impact the duty of confidentiality we owe to others, or if we are legally entitled to deal with the request in a different way.

  10. Data Protection Contacts
    We have appointed a Data Protection Officer (DPO) to oversee compliance with this Privacy Policy. If you have any questions about this Privacy Policy or how we handle your personal information, please address these to:Data Protection Officer Restore PLC 7-10 Chandos Street
    W1G 9DQ

    Alternatively, please email  [email protected] or call +44 (0)7889 537076.

    Supervisory authority

    If you have any questions, concerns or complaints regarding this Privacy Policy or how we manage your personal information, we encourage you to first contact our DPO. However you have a right to contact your  local supervisory authority at any time and lodge a complaint (which in the UK is the Information Commissioner’s Office). The supervisory authority will then investigate your complaint accordingly.

  11. Changes To This Privacy Policy
    This Privacy Policy was last reviewed and updated April 2021. We may amend this Privacy Policy from time to time to keep it up to date with legal requirements and the way we operate our business. Please regularly check this page for the latest version of this Privacy Policy.