About this Notice

Barratt Redrow plc is committed to protecting and respecting your privacy. This notice explains why we collect your personal information and how we use it when you engage with us.

Who we are

The Barratt Redrow plc Group (referred to in this document as "we", "us", "our" and "Barratt Redrow") is the Data Controller for your personal information under the Data Protection Legislation.

Our Head Office address is:

Barratt Redrow plc
Barratt House
Cartwright Way
Forest Business Park
Bardon Hill
Coalville
Leicestershire
LE67 1UF

Barratt Redrow consists of several companies and brands that share your information to better manage your relationship with us. Our brands include:

• Barratt Homes
• David Wilson Homes
• Redrow Homes
• Barratt London
• BD Living
• Wilson Bowden Developments

The Companies in our group including their ICO registration numbers are as follows:

In addition to the above we operate several joint ventures with other organisations that we have a material interest in.

Please note that this notice does not apply if you are an investor or if you navigate to the Barratt Redrow plc website operated on our behalf by Investis. The Notice for this site can be found here.

All data protection matters are managed at Barratt Redrow Group head office. Inquiries can be sent to dataprotectionmanager@barrattredrow.co.uk

This Privacy Notice applies to UK based Suppliers and Contractors of Barratt Redrow plc (the "Company", "we", "us" or "Barratt").

We are required under data protection legislation to notify you of the information contained in this Privacy Notice.

The Company is a "data controller" in relation to your personal data and for some purposes, also a "data processor". This means that we are responsible for deciding how we hold and use personal information about you.

We value the privacy of those who provide personal information to us. Please read this Privacy Notice carefully to understand how we handle your personal information. This Privacy Notice describes:

1.1 what personal information we collect about our UK-based Contractors and potential Contractors;

1.2 how we use and otherwise process it;

1.3 the basis upon which we process it;

1.4 with whom it is shared; and

1.5 how it is stored;

This notice also describes other important topics relating to information privacy. The overarching legislation is the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

2. Who does this notice apply to?

2.1 This notice applies to current and former staff, employees and Contractors, including Subcontractors and Suppliers holding CSCS cards. This notice does not form part of any contract of employment or other contract to provide services, and in particular this notice does not otherwise imply any relationship. It applies to all of your personal data that we process.

3. Data protection principles

We will comply with applicable data protection and privacy laws. These provide that the personal data we hold about you must be:

(a) used lawfully, fairly and in a transparent way;

(b) collected only for valid purposes that we have clearly explained to you and not used in any way that is incompatible with those purposes;

(c) relevant to the purposes we have told you about and limited only to those purposes;

(d) accurate and kept up to date;

(e) kept only as long as necessary for the purposes we have told you about; and

(f) kept securely.

4. The information that we hold about you

4.1 Personal data, or personal information, means any information about an individual from which that person can be identified. It does not include data which cannot be linked to an individual in any way (i.e. anonymous data).

4.2 There are "special categories" of more sensitive personal data which require a higher level of protection and we have set out more details about this at section 8 below.

5 Information collection

5.1 We collect, store and use any of the following categories of information about you and we refer to this as "personal information" or "personal data" throughout this Privacy Notice.

When you interact with us, you may provide us with or we may obtain personal information about you, such as information regarding your:

• personal contact details such as name, title, addresses, telephone numbers, and personal email addresses;
• position;
• trade;
• employer;
• nationality;
• details of induction and or training that you have completed or are due to complete;
• date of birth;
• gender;
• next of kin, details of family members and emergency contacts;
• signature;
• medical conditions that might affect your or other health and safety on site;
• start date and leaving date;
• location of workplace; and
• driving licence (including copies where we are required to hold such information for identification or insurance purposes where you are to use our vehicles);

We may collect personal information about you in as described above, directly from:

• you, where submitted by you to us directly in the course of your working with us;
• the CSCS database or other similar databases;
• your employer;
• via the CSCS cards used in connection with the Card Scheme; and
• our own databases of records which we may compile using data from the above sources;

We will always aim to make it clear which personal information is necessary for you to provide and which personal information is optional. However, if you are unsure as to whether you are required to provide any particular piece of personal information please ask.

6. How is your information collected?

6.1 We will receive most of this personal information from you directly.

6.2 We may sometimes collect additional information from other third parties including former employers, occupational health advisors, academic or professional bodies.

7. Use of your personal information

7.1 We collect, use and store your personal information for a number of purposes, including those set out in appendix 1 of this Privacy Notice.

7.2 Your family and emergency contact information: Separately, we may process personal information about your family, next of kin, emergency contacts so that we can contact them in an emergency type situation. If you disclose information about your family to us or include it in written, electronic or phone communications, we may also have access to this in our systems. If you share personal information with us that relates to other people (for example, former employees or your next of kin), you will need to check with that person that they are happy for you to share it with us, and for us to use it in accordance with this Privacy Notice.

8. Our legal bases for using your personal information

8.1 In order to comply with data privacy laws, we need to have legal bases for using your personal information for the purposes set out in this Privacy Notice. We have set out more detail about the legal bases we rely on to process your data in appendix 1. We consider that in nearly all cases, our legal basis will be one or more of the following:

(a) our use of your personal information is necessary for the performance of our obligations under our contract with you (for example, to pay you, communicate with you or to confer a benefit under the terms of your employment contract); or

(b) our use of your personal information is necessary for complying with our legal obligations, particularly as your employer/engager (or prospective employer/engager) (for example, providing employee personal information to HMRC, health and safety at work or conducting legally required checks on your right to work in the UK); or

(c) where our use of your personal information is not necessary for the performance of our contractual obligations, or compliance with our legal obligations, it is necessary for the purposes of our legitimate interests or the legitimate interests of a third party

8.2 Some of the above grounds for processing will overlap and there may be several grounds which justify our use of your personal information.

8.3 Where we are relying on our legitimate interests or the legitimate interests of a third party, we have explained, in this Privacy Notice, what those legitimate interests are

9. Why we collect and use sensitive personal data

9.1 Sensitive personal data, so called "special categories" of personal data, require higher levels of protection. We need to have further justification for collecting, storing and using this. Special category data is personal data relating to racial or ethnic origins; political opinions; religious and philosophical beliefs; trade union membership; genetic data; biometric data; health data; sex life or sexual orientation. We may process special categories of personal data in the following general circumstances:

(a) In limited circumstances, with your explicit written consent.

(b) Where we need to carry out our legal obligations and/or exercise rights conferred on us by law and in line with our data protection and information handling policy.

(c) Where it is needed in the public interest, such as, in some circumstances, for equal opportunities monitoring or in relation to an occupational pension scheme, and in line with our data protection and information handling policy.

(d) Where it is needed to assess your working capacity on health grounds, subject to appropriate confidentiality safeguards.

(e) Less commonly, we may process this type of information where it is needed in relation to legal claims or where it is needed to protect your (or someone else's) interests and you are not capable of giving your consent, or where you have already made the information public.

(f) We may undertake drugs and alcohol testing.

(g) We may send special category data for DE&I reporting, the reporting will always be an anonymised aggregate level.

9.2 We will use sensitive personal data in the following ways:

(a) We will use information about your physical or mental health, or disability status, to ensure your health and safety in the workplace and to assess your fitness to work, to provide appropriate workplace adjustments.

(b) We will use information about your physical and/or mental health, or disability status, to meet our health and safety obligations and to assess fitness for work, including testing for drugs and alcohol; to provide appropriate workplace adjustments; for the purpose of preventative or occupational medicine or medical diagnosis; to provide appropriate workplace adjustments; to monitor and manage sickness absence and to administer the provision of healthcare or treatment.

9.3 We do not need your consent if we use special categories of your personal data in accordance with this Privacy Notice to carry out our legal obligations or exercise specific rights in the field of employment law. In limited circumstances, we may ask you for your written consent to allow us to process certain particularly sensitive data. If we do so, we will provide you with details of the information that we would like and the reason we need it, so that you can carefully consider whether you wish to consent. You should be aware that it is not a condition of your contract with us that you agree to any request for consent from us for the processing of your personal information or special categories of personal data. Consent may be withdrawn at any time by contacting dataprotectionmanager@barrattredrow.co.uk .

10. Information about criminal convictions

10.1 We may carry out background checks relating to criminal convictions (DBS checks) and request or hold information regarding criminal convictions. We also collect data on unspent convictions during your application process.

11. Monitoring

11.1 We reserve the right to monitor, audit, copy, store or delete any network traffic over our systems. This includes a right to retrieve or access the contents of messages, inboxes or to undertake searches of our email systems for the purposes of monitoring or investigating wrongful acts, to comply with any of our legal or regulatory obligations, or, occasionally to ensure the effective operation of our business (for example in the event of unexpected absence and where access to business emails is required). Anything learned by us as a result of such monitoring may be used in relation to disciplinary proceedings. All monitoring activities will be undertaken in accordance with the laws that apply to us.

12. How we share your personal information (and who with)

12.1 We may have to share your data with third parties, including third-party service providers and other entities in our group.

12.2 We require third parties to respect the security of your data and to treat it in accordance with the law.

12.3 Disclosure within the Company's group:

(a) Your business related information will be made available to other Company employees, temporary employees and contractors and with customers, suppliers and agencies in the course of administering your employment or providing our services. This includes your name, work contact details, position related information, employee photo and other related details.

(b) Your personal information may be shared with any company that is a member of the Company's group, where it is in our legitimate interests to do so for internal administrative purposes, to effectively operate the employment relationship with you and/or the workforce generally, for management purposes, corporate strategy, auditing and monitoring, system maintenance support and hosting of data and/or research and development. Access to your personal information is limited to those employees who need to know the personal information, and may include your managers and their designees, as well as employees in the HR, recruitment, corporate services, legal, information technology, and finance departments.

(c) We may also share your personal information with our group companies where they provide products and services to us, such as IT systems, data hosting, HR services, legal support, payroll and benefits administration and recruitment.

12.4 Disclosure to other third parties:

(a) We will share your personal data with third parties where required by law, where it is necessary to administer the working relationship with you or where we have another legitimate interest in doing so.

(b) We will share your personal information with the following categories of third parties:

(i) other parties such as legal and regulatory authorities (including government departments and HMRC), accountants, auditors, lawyers, insurers and other outside professional advisors;

(ii) customers, clients or suppliers (to the extent they need it) – this will usually just be your business contact details and related information; and

(iii) companies that provide products and services to us, such as:

(A) payroll providers and our bank;
(B) benefits and pension providers/administrators;
(C) insurance companies, including those providing medical insurance and group income protection (and our insurance brokers);
(D) training providers and travel/hotel/venue providers;
(E) parties requesting an employment reference for you;
(F) HR services, such as external advisors, applicant tracking providers/systems, for surveys;
(G) cloud storage providers;
(H) police and immigration authorities;
(I) occupational health assessment providers and medical professionals; and/or
(J) IT systems suppliers and support, including providers of HR systems and benefits management, email archiving, telecommunications suppliers, back-up and disaster recovery and cyber security services; and other outsourcing providers, such as contract lease management, and off-site storage providers.
(K) Third parties who can provide us with platforms to allow mentor services
(L) Perform right to work checks

(c) We will also disclose your personal information to third parties in some other circumstances:

(i) if we sell or buy any business or assets, we may disclose your personal information to the prospective seller or buyer of such business or assets;

(ii) if the Company or substantially all of its assets are acquired by a third party, in which case personal information held by the Company will be one of the transferred assets;

(iii) if we are under a duty to disclose or share your personal information in order to comply with any legal obligation, any lawful request from government or law enforcement officials and as may be required to meet national security or law enforcement requirements or prevent illegal activity;

(iv) to enforce our contract with you, to respond to any claims, to protect our rights or rights of a third party, to protect the safety of any person or to prevent any illegal activity; and/or

(v) to protect the rights, property or safety of the Company, our employees or other persons.

(d) Further and as referred to above we undertake processing of your personal information for the purposes of site safety. We may ask you whether you have disclosed to your employer, personal information that we collect from you which relates to health and safety, and where that personal data has not already been disclosed by you (to your employer), we may ask whether we can disclose or share that information with your employer where we have a legitimate interest in so doing where necessary for the purposes of site safety. However we will only do so with your consent. If we wish to share or disclose the same, we will provide you with full details of the information that we would wish to disclose, so that you can carefully consider whether you wish to consent.

"Third parties" includes third-party service providers (including contractors and designated agents) and other entities who work within the Barratt Group.

12.5 Restrictions on use of your personal information by those we share it with

12.6 Some of these companies may use your data in countries which are outside of the European Economic Area.

12.7 Any third parties with whom we share your personal information are limited (by law and/or by contract) in their ability to use your personal information and the purposes for which they use it. We will always ensure that any third parties with whom we share your personal information are subject to privacy and security obligations consistent with this Privacy Notice and applicable laws. In respect of third party service providers who are processing data on our behalf, we only permit them to process personal data for specified purposes and in accordance with our instructions.

12.8 Other than as we have set out in this Privacy Notice, we will not share your personal information to any third party without notifying you and/or obtaining your consent. Where our actions are based on you having given your consent for us to use your information in a particular way, but you later change your mind, you should contact us at dataprotectionmanager@barrattredrow.co.uk to notify us of this and we will stop doing so.

13. Transfers of information

13.1 As set out above, personal information may be processed outside of the UK by employees working for us outside the UK, or other members of our group or third parties located outside of the UK. Please be aware that countries which are outside the UK may not offer the same level of protection for personal information as in the UK, although our collection, storage and use of your personal information will continue to be governed by this Privacy Notice.

13.2 When transferring personal information outside the UK, we will:

(a) ensure that the country in which your personal information will be processed has been deemed "adequate" by the relevant UK authorities under Article 45 of the UK GDPR; or

(b) ensure Compliance with the International Data Transfer regime

13.3 Further details on the steps we take to protect your personal information in these cases is available from us on request by contacting us at dataprotectionmanager@barrattredrow.co.uk .

14. Retention of personal information

14.1 We have identified retention guidelines for different types of HR data taking into account the purpose for which data is collected, statutory obligations in respect of the retention of data and limitation periods for the bringing of claims where the data may be evidentially relevant.

14.2 The indicative retention periods are:

(a) Recruitment records: 6 months after the later of the point of collection, notification to candidates of the outcome of the recruitment exercise or last contact with the candidate on this. Recruitment information may be transferred to a successful candidate's employment file to the extent it is relevant to the ongoing relationship*.

(b) Personnel records: While employment continues and up to 7 years after employment ceases. However, we will review your records at intervals during employment and upon termination of employment to assess whether earlier deletion of any particular record is appropriate (where the data is no longer required for the purposes for which it was collected and any relevant limitation periods have expired). There may be some aspects of your information we need to keep for longer such as pension data.
*We retain personal information following recruitment exercises to demonstrate, if required, that candidates have not been discriminated against on prohibited grounds and that recruitment exercises are conducted in a fair and transparent way.

14.3 In some circumstances we may anonymise your personal information so that it can no longer be associated with you, in which case we may use such information without further notice to you.

14.4 Once it is no longer necessary to retain your personal information, we will securely destroy it in accordance with applicable laws and regulations.

15. Change of purpose

15.1 We will only use your personal data for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose. If we need to use your personal data for an unrelated purpose, we will notify you and we will explain the legal basis which allows us to do so.

15.2 Please note that we may process your personal data without your knowledge or consent, in compliance with the above rules, where this is required or permitted by law.

16. Your rights

16.1 You have certain rights in relation to your personal information. If you would like further information in relation to these or would like to exercise any one of them, please contact dataprotectionmanager@barrattredrow.co.uk .

16.2 In certain circumstances, you have the right to request that we:

(a) provide you with a copy of any personal information which we hold about you;

(b) update any of your personal information which is out of date, incorrect or incomplete;

(c) delete any personal information which we hold about you if it is no longer necessary in relation to the purposes for which it was collected or processed (or, in some instances, where you have withdrawn your consent or objected to the processing);

(d) restrict the way that we process your personal information;

(e) provide your personal information to a third party;

(f) consider any valid objections which you have to our use of your personal information (where we are relying on our legitimate interests (or those of a third party) as the basis for the processing or that the processing is in the public interest); and

(g) provide a copy of any agreement under which your personal data is transferred outside of the UK.

16.3 We will consider all such requests and provide our response within the time period stated by applicable law. Please note, however, that certain personal information may be exempt from such requests in certain circumstances, which may include if we need to keep processing your personal information for our legitimate interests or to comply with a legal obligation. There will be certain circumstances where the right does not apply to you under law and we will review this when we consider a request.

16.4 We may request you provide us with information necessary to confirm your identity and ensure your right to access the information (or to exercise any of your other rights). This is another appropriate security measure to ensure that personal information is not disclosed to any person who has no right to receive it.

16.5 You will not have to pay a fee to access your personal information (or to exercise any of the other rights). However, we may charge a reasonable fee if your request for access is clearly unfounded or excessive. Alternatively, we may refuse to comply with the request in such circumstances.

16.6 If you have any questions or concerns about our use of your personal information, please contact dataprotectionmanager@barrattredrow.co.uk .

17. Right to withdraw consent

17.1 In the limited circumstances where our processing is based on your having provided consent to the collection, processing and transfer of your personal data for a specific purpose, you have the right to withdraw your consent for that specific processing at any time.

17.2 To withdraw your consent, please contact dataprotectionmanager@barrattredrow.co.uk. Where these circumstances apply, once we have received notification that you have withdrawn your consent, we will no longer process your information for the purpose or purposes you originally agreed to, unless we have another legitimate basis for doing so in law.

18. Keeping us updated

18.1 It is important that the personal information we hold about you is accurate and current. Please keep us informed if your personal information changes during your working relationship with us.

19. Security

19.1 The Company is committed to protecting personal information from loss, misuse, disclosure, alteration, unauthorised access and destruction and takes all appropriate precautions to safeguard the confidentiality of personal information. Although we make every effort to protect the personal information which you provide to us, the transmission of information over the internet is not completely secure. As such, you acknowledge that we cannot guarantee the security of your personal information transmitted to us over the internet that any such transmission is at your own risk. Once we have received your personal information, we will use strict procedures and security features to prevent unauthorised access.

19.2 Where we have given you (or where you have chosen) a password which enables you to access any account with us, you are responsible for keeping this password confidential. We ask you not to share any password with anyone.

20. Automated decision-making

20.1 Automated decision-making takes place when an electronic system uses personal information to make a decision without human intervention. You will not be subject to decisions that will have a significant impact on you based solely on automated decision-making, unless the following exceptions apply: 1. When the decision is authorised by law; 2. When the decision is necessary for a contract; 3 When the decision is based on your explicit consent.

21. Third party websites

21.1 You may, from time to time, during your employment, access links to or other websites operated by third parties (e.g. training providers, industry news sources and bulletins). Please note that this Privacy Notice only applies to the personal information that we collect from or about you and we cannot be responsible for personal information collected and stored by third parties. Third party websites have their own terms and conditions and privacy policies, and you should read these carefully before you submit any personal information to these websites. We do not endorse or otherwise accept any responsibility or liability for the content of such third party websites or third party terms and conditions or policies.

22. Changes to our Privacy Notice

22.1 Any significant changes we make to our Privacy Notice in the future will be notified to you in writing. Please check back frequently to see any updates or changes.

23. Further questions or making a complaint

23.1 If you have any queries or complaints about our collection, use or storage of your personal information, or if you wish to exercise any of your rights in relation to your personal information, please contact dataprotectionmanager@barrattredrow.co.uk. We will investigate and attempt to resolve any such complaint or dispute regarding the use or disclosure of your personal information.

23.2 You may also make a complaint to the data protection supervisory authority in the UK, the Information Commissioner's Office (https://ico.org.uk/). Alternatively, you may seek a remedy through local courts if you believe your rights have been breached.

The practices described in this Privacy Notice statement are current personal information protection policies, as of June 2025.

If you have any questions about this Privacy Notice, please contact dataprotectionmanager@barrattredrow.co.uk

If you still have a concern about how we process your personal information you also have the right to report it to the Information Commissioners Office (ICO).

Appendix 1 - Lawful Grounds for processing Personal Data

Updated October 2025