Privacy Policy

When you choose to apply for a role with any NEXT Group company we need to process personal data about you. This privacy policy helps you to understand how we use your personal data, who we share it with and the rights that you have. For more information on your rights and how to exercise them, head straight to the ‘Your Rights’ section later in this policy.

This privacy policy applies if you apply for a job with any NEXT Group company. If you are successful in your application our employee privacy policy will apply.

We change the terms of this privacy policy from time to time and you should check it regularly. The last updated date is shown at the beginning of the document. If we make any material changes we will take steps to bring it to your attention.

When we say “we”, “our” or “us” in this policy we are referring to the companies that make up the NEXT Group. The NEXT Group company that controls your personal data will depend on the company you work for, which will be detailed in your employment contract or such other engagement documentation in place with you, for example, your consultancy agreement or as notified to you from time to time by your agency.

The companies that make up the NEXT Group are:

Next Retail Limited, Next Holdings Limited, Next Distribution Limited, Next Manufacturing Limited, Next Sourcing Limited, Next Retail (Ireland) Limited, Next Pension Trustees Limited, Next Germany GmbH, NEXT (US) LLC, Next General Trading LLC, Next General Trading FZE, Next Beauty Limited, Lipsy Limited, Victoria’s Secret (VS Brands Holdings UK Limited), GAP (West Apparel UK Holdings Limited), Reiss (Pink Topco Limited), JoJo Maman Bébé (Regent BidCo 1 Limited), Joules (The Harborough Hare Holdings Limited), Fatface (Bridgetown Holdco Limited) and Ginkgo Kalone Investments, S.L.

We are the data controller, which means we are responsible for deciding how and why your personal data is used. We’re also responsible for making sure it is kept safe, secure and handled legally. You will be employed by one company in the NEXT Group however data will be shared between different companies in the group to meet our and your needs.

We operate to the highest standards when protecting your personal data and respecting your privacy. If you have any questions about your personal data, or how we use it, you can contact our Data Protection Officer via email at dataprotection@next.co.uk or by writing to our registered office at the below address:

Data Protection Officer, NEXT Group, Desford Road, Enderby, Leicester, LE19 4AT.

You have a number of “Data Subject Rights”, we have explained below what they are and how you can exercise them. You can read more about these rights on the Information Commissioner's Office website at www.ico.org.uk 

• Right of access - You have the right to request a copy of the personal data that we hold about you.
• Right to rectification – If you think any of your personal data that we hold is inaccurate, you have the right to request it is updated. We may ask you for evidence to show it is inaccurate. You can update most of your data through the NEXT Careers Portal.
• Right to erasure (also known as the Right to be Forgotten) and the right to restriction of processing - You have the right to request that we stop processing, or delete the personal data that we hold. However, as we process most of your data in connection with your employment/engagement with us, we may have a lawful basis or an obligation to continue to process your personal data and we may not be able to delete it.
• Right to data portability – You have the right to ask us to electronically transfer your personal data to another organisation in certain circumstances.
• Rights with regards to automated decision making, including profiling – We sometimes use your personal data to make decisions by automated means. You have the right not to be subject to a decision based solely on automated processing, which has legal effects for you or affects you in any other significant way.
• Right to withdraw Consent – Where we are relying on your consent for processing you can withdraw or change your consent at any time. We only rely on your consent to process your personal data in limited circumstances.
• Right to object – You have the right to object to the processing of your personal data in certain situations.

The above rights may be limited in some circumstances, for example, if fulfilling your request would reveal personal data about another person, if you ask us to delete data which we are required to have by law, or if we have compelling legitimate interests to keep it. We will let you know if that is the case and will then only use your data for these purposes. 

If you have any general questions or want to exercise any of your rights, please contact dataprotection@next.co.uk. In order to maintain the security of applicants personal details, we may need to request proof of identity before we disclose personal data to you in response to any request.

We encourage you to get in touch if you have any concerns with how we collect or use your personal data. You have the right to lodge a complaint directly with the Information Commissioner's Office, the data protection regulator in the UK, you can do this by visiting the ICO website: ico.org.uk/make-a-complaint/

In applying for a role with us we will collect:

• Biographical information about you, including your name, address and contact details, including email address and telephone number, date of  birth and gender
• Details of medical or health conditions, including whether or not you have a disability for which NEXT needs to make reasonable adjustments in the recruitment process or if you are successful in your application
• Details of your qualifications, skills, experience and employment history, including start and end dates with previous employers
• Information about your nationality and entitlement to work in the UK including your National Insurance number,  this may also include taking copies of your  driving licence, passport, birth certificate, and proof of current address, such as bank statements and council tax bills
• Your CV and a covering letter
• For some roles we will ask for details of dismissals in the past 5 years and details of unspent criminal convictions to enable us to establish whether or not you have committed an unlawful act or been involved in dishonesty or other improper conduct
• During the interview and selection process we may also ask you to complete online competency tests and our interviewers may take personal notes for their own benefit
• If you are an internal candidate we may ask your current manager for information about you
• If you are an external candidate we may contact the individuals that you have told us will act as your reference
• If you are successful in your application, and depending on the type of role you have applied for, we will process data from other sources such as fraud checks and Disclosure Barring Service (DBS) checks. If you work in our Nursery we will conduct additional enhanced DBS checks.

We ask you to provide some more sensitive information about you such as sexual orientation and data revealing race or ethnic origin. This is known as special category data. We collect this data at recruitment so we are able to report on the diversity of our applicants and for auditing the fairness of our recruitment process. You are under no obligation to provide this information and it will not affect your application if you choose not to.

If you are successful in joining NEXT, then the special category data you provide us with during recruitment will be stored on your colleague record but will remain segregated. When we process ethnic origin or sexual orientation data we do so on the basis of your explicit consent. 

We work with a number of trusted third parties who provide us with services to help run our business. Anybody we work with is subject to stringent security and data protection assessments before we begin to do business with them and on an ongoing basis. 

We have contracts in place with all suppliers that help us to ensure security and privacy of your personal data, these are reviewed and updated regularly and always in line with data protection laws.

We may share data with:

• Our employees, contractors, agents and/or professional advisors
• Third party service providers who require access to your data to provide the service to NEXT, for example; recruitment agencies or background check providers
• Third Parties that provide processing services to NEXT such as hosting providers and workflow management providers
• Government departments where we are under a legal obligation to do so. For example HMRC to fulfil our taxation compliance and reporting obligations, the Police to prevent fraud and other criminal offences, or to the Court Service to comply with a court order
• Credit Reference Agencies (for example Experian) if a credit check is required for your job role
• Other members of the NEXT Group to enable efficient shared services, for example; shared recruitment services
• Third party service providers who require access to your data to provide the service to NEXT, for example; technical assessments, psychometric testing and personality insights tests

Our main operations are based in the UK and your personal data is generally processed, stored and used within the UK . In some instances your personal data may be processed outside the UK. We work with suppliers and partners who may make use of Cloud and /or hosted technologies across multiple geographies.

If and when this is the case we take steps to ensure there is an appropriate level of security so your personal data is protected in the same way as if it was being used within the UK.

Where we need to transfer your personal data outside the UK, and if the recipient country has not been determined as providing an equivalent adequate level of protection as the UK and EU, we will use one of the following safeguards:

• The use of European Commission approved standard contractual clauses in contracts for the transfer of personal data to third countries.
• The International Data Transfer Agreement or Addendum for the transfer of personal data to third countries.
• For transfers to certified U.S. organisations, we rely on the EU-U.S. Data Privacy Framework for data from the EEA and its UK Extension for data from the UK.

Where required, these safeguards are supplemented by a Transfer Risk Assessment to validate the protection of your personal data in the destination country.

We may utilise automated decision-making, including profiling, in specific situations. This includes instances where it aligns with our legitimate interests or when it is necessary for establishing a contract with you, granting us the right to do so.

You have the right, in certain scenarios, not to be subject to a decision that significantly impacts you and is based exclusively on automated processing. Furthermore, you have the option to request a human review or challenge major decisions made solely through automated means.

We always ensure that personal data is secure by continuously developing our security systems and training for our employees. We have implemented appropriate technical and organisational security measures designed to protect your personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, unauthorised access, and other unlawful or unauthorised forms of processing, in accordance with applicable law.