Privacy notice — NFCC Application Portal
Last updated: 9 September 2026
This notice explains how National Fire Chiefs Council Limited (“NFCC”, “we”, “us”) collects and uses personal data when you use this Application Portal at applicationform.nfcc.org.uk. It should be read alongside NFCC’s main privacy policy.
1. Who we are
The data controller is:
National Fire Chiefs Council Limited
71–75 Shelton Street, Covent Garden, London, WC2H 9JQ
Registered in England as a limited company: 3677186
Registered charity: 1074071
Our Data Protection Officer (DPO) is Rohan Watson. Contact: Rohan.watson@nfcc.org.uk.
Recruitment queries: recruitment@nfcc.org.uk.
2. What this portal is for
We use this portal to advertise NFCC vacancies (permanent, contract, Board Member and Lead Officer roles) and to receive, shortlist, score and manage applications. If you apply, we process your data so we can assess your suitability, contact you, take up references after an offer, meet our equality monitoring duties, and keep records of the recruitment exercise.
3. Personal data we collect
3.1 Data you give us when you apply
The fields collected depend on the type of vacancy.
All employed / contract roles typically include:
- Identity and contact details: title, forename(s), surname, previous names, home address, telephone number, email address
- Right to work and eligibility: confirmation you have the right to work in the UK and that you live permanently in the UK (a contractual requirement for employed roles), National Insurance number, whether you hold a full driving licence
- Application content: full employment history (including gaps), education, professional qualifications and training, membership of professional bodies, supporting statement against the role specification
- Referee details (name, position, address, telephone, email) for two referees — we ask you not to nominate friends or family. Referees are contacted only after an offer of employment
- Where you saw the vacancy advertised
- Equality monitoring: ethnicity, nationality, sex/gender, disability and any adjustment information you choose to give
- Unspent criminal convictions or cautions (you do not need to disclose spent convictions under the Rehabilitation of Offenders Act 1974) and any explanation you provide
Board Member and Lead Officer (sector) applications additionally collect:
- Work email address and the Fire and Rescue Service (FRS) you work for
- Further equality monitoring: gender reassignment (whether your gender identity is the same as sex recorded at birth), age range, marital status, sexual orientation, religion or belief
Most monitoring questions include a “Prefer not to say” option. You do not have to complete an application, but we cannot consider you for a role without the information needed to assess it.
3.2 Data we generate about your application
- A unique application ID and the job unique reference
- Date and time you started and submitted the application
- Shortlisting / approval status and the reviewer’s identity
- Scores given by named panel members against the published criteria, and the date scored
3.3 Staff and panel users
If you log in to administer vacancies or score applications we process your name and work email address. NFCC staff authenticate via Microsoft Entra ID (work account). External panel members receive a time-limited one-time login link by email.
3.4 Technical data
The site uses a session cookie so the service can function (for example to keep a member of staff logged in). We also load a standard JavaScript library from Google’s public CDN so the forms work. We do not use the applicant pages for marketing profiling.
4. Special category and criminal offence data
Some of the information above is special category data under UK GDPR Article 9 (racial or ethnic origin, health/disability, sexual orientation, religious or philosophical belief, data concerning gender reassignment) or criminal offence data under Article 10 and the Data Protection Act 2018.
We collect this because:
- equality monitoring lets us see who applies, who is shortlisted and who is appointed, so we can identify under-representation and improve our processes
- disability information lets us consider reasonable adjustments
- unspent conviction information is relevant to recruitment and safeguarding in a public-safety organisation
On sector (Board / Lead Officer) applications we state that equality monitoring is intended to be detached from selection decisions and used in anonymised form. Monitoring answers are stored on the same application record as your other answers, and access is restricted to authorised recruitment / HR administrators. Panel scorers are shown your employment history, education, memberships and supporting statement rather than monitoring fields.
5. Why we use your data (purposes and lawful bases)
| Purpose | UK GDPR Article 6 basis | Additional condition (special category / criminal offence data) |
|---|---|---|
| Receiving and assessing your application, shortlisting, interview and offer | Article 6(1)(b) — steps at your request prior to entering a contract (and, for staff users, performance of their employment / engagement) | DPA 2018 Schedule 1 paragraph 1 (employment, social security and social protection) where relevant |
| Confirming right to work and UK residence for employed roles | Article 6(1)(c) legal obligation and Article 6(1)(b) contract | Not usually special category |
| Equality and diversity monitoring and reporting | Article 6(1)(f) legitimate interests — running a fair, lawful and representative recruitment process as a charity serving UK fire and rescue | Article 9(2)(g) substantial public interest + DPA 2018 Schedule 1 paragraph 8 (equality of opportunity or treatment). You may select “Prefer not to say” |
| Reasonable adjustments | Article 6(1)(c) and 6(1)(b) | Article 9(2)(b) employment obligations and/or Schedule 1 paragraph 16 (support for individuals with a particular disability or medical condition) |
| Criminal conviction / caution questions | Article 6(1)(f) legitimate interests and, where applicable, 6(1)(b)/(c) | DPA 2018 Part 3 / Schedule 1 conditions relating to employment and preventing or detecting unlawful acts. Spent convictions need not be disclosed |
| Contacting referees after an offer | Article 6(1)(b) and 6(1)(f) | n/a for referee contact details (those individuals are also data subjects — see section 7) |
| Defending legal claims and keeping an audit of recruitment decisions | Article 6(1)(f) legitimate interests and 6(1)(c) where a statutory limitation period applies | Schedule 1 paragraph 33 (legal claims) where special category data is retained for that purpose |
Our legitimate interests are to recruit people who can do the role, run a fair process, protect NFCC and the public, and improve diversity. Those interests are balanced against your rights: we collect only what the form needs, restrict access, and anonymise identifying fields after the retention period.
6. How we collect, use, store and delete data
- Collect: you enter data yourself in this multi-page web form. You are asked to check answers before moving on, because submitted pages cannot be edited in the portal.
- Use: NFCC HR / recruitment staff review applications. A confirmation email is sent to you. A notification is sent to the hiring manager (application content for shortlisting) and a fuller record is sent to recruitment@nfcc.org.uk. Named scorers mark applications against the vacancy criteria. Administrators can export a spreadsheet of applications for a vacancy and produce equality monitoring charts.
- Store: applications are stored in an NFCC SQL Server database hosted by our UK website hosting provider. Email is sent via that provider’s mail service from NFCCApplicationForm@webmail.nfcc.org.uk.
- Incomplete applications: if you leave an application unfinished and later try to resume after it has timed out, the portal will tell you the previous data has been anonymised and you must start again.
- Delete / anonymise: identifying fields (name, previous names, NI number, address, telephone, email, employment history, education, memberships, supporting statement and referee details) are overwritten with “anonymised” for records whose application start date is more than 365 days old. Administrators can also permanently delete an individual application and its scores. If you are appointed, relevant data may be copied into NFCC’s HR / personnel files and kept under those retention rules instead.
7. Who we share data with
We do not sell your data. We share it only as needed for recruitment:
- NFCC HR / recruitment team — full application, including monitoring and conviction answers
- Hiring managers and scoring panel members (NFCC staff and, where the vacancy requires it, external FRS colleagues) — the evidence needed to score the role. External scorers access the portal with a short-lived email link
- Referees you name — contacted only after an offer; we will share the minimum needed to request a reference
- Our hosting and email provider (WebsiteLive / Web Wiz infrastructure at websitelive.net) — stores the database and sends system email as our processor
- Microsoft — staff sign-in via Microsoft Entra ID
- Professional advisers, auditors or regulators if required, and law enforcement or the courts if the law requires it
If you give us someone else’s details (a referee), you must have a reason to do so and should tell them you have listed them.
8. International transfers
The application database and mail service used by this portal are provided on UK-hosted infrastructure. Staff authentication uses Microsoft Entra ID. Microsoft may process sign-in data in accordance with its customer agreements and UK-approved transfer mechanisms. We do not routinely send application files outside the UK. If that ever changed, we would put appropriate safeguards in place (for example the UK International Data Transfer Agreement or an adequacy regulation).
9. How long we keep it
- Identifying application data is anonymised 12 months after the application was started, unless a longer period is needed (for example an appointment, a complaint, or a legal claim).
- Equality monitoring data may remain in anonymised / aggregated reports after identifiers are removed so we can track trends.
- Successful candidates’ data needed for employment will be kept in line with NFCC’s HR retention schedule.
- Staff login and scoring records are kept for the same recruitment cycle and audit period.
If you have not heard from us within 21 days of the vacancy closing date, your application has not progressed. We do not provide feedback at that stage because of the volume of applications.
10. How we look after your data
Access to the administration and scoring areas is limited to authenticated users. Applicant records that have been anonymised cannot be resumed. We use TLS for email submission to the mail server. NFCC has procedures to detect, assess and respond to personal data breaches and will notify the ICO and affected people where the law requires it.
Please do not include highly sensitive information in free-text boxes unless we have asked for it.
11. Your rights
Under UK GDPR you can ask us to:
- access a copy of your personal data
- correct inaccurate or incomplete data
- erase data in certain circumstances
- restrict or object to certain processing
- receive data you provided in a portable format
- withdraw consent where we rely on consent (we do not rely on consent for the core recruitment process)
These rights are not absolute. To exercise them, email Rohan.watson@nfcc.org.uk or recruitment@nfcc.org.uk. We may need to confirm your identity.
You can also complain to us at confidential@nfcc.org.uk. We aim to acknowledge within 30 days. You have the right to complain to the Information Commissioner’s Office at ico.org.uk/make-a-complaint or 0303 123 1113.
12. Children
This portal is for people applying for NFCC roles. It is not aimed at children. Age-range monitoring on some forms includes “19 or under” for equality statistics only. We do not knowingly recruit anyone below the legal minimum age for the role.
13. Automated decisions
We do not use automated decision-making or AI profiling to accept or reject applications. Shortlisting and scoring are done by people.
14. Changes
We will update this notice when the portal or the law changes. The date at the top will change when we do.
