Recruitment Privacy Statement
Effective:?February 2, 2023
Introduction and Statement Scope
We are ²ÝÝ®ÊÓƵ, a group of companies with offices all over the world. We are committed to protecting the personal information of all prospective ²ÝÝ®ÊÓƵ personnel and handling information fairly, responsibly, and in accordance with applicable law.?
This Recruitment Privacy Statement (¡°Privacy Statement¡±) describes how ²ÝÝ®ÊÓƵ uses personal information as part of our recruitment practices? for companies in the ²ÝÝ®ÊÓƵ group.?
?
In addition to this Privacy Statement, ²ÝÝ®ÊÓƵ or authorized third parties may provide further supplementary transparency information to keep you informed (for example, during relevant touch points, or within emails, FAQs, briefings with you, or within the tools made available).?
?
This Privacy Statement applies to all prospects or potential employees, applicants or candidates, including in relation to any work, employee, engagement, contractor, intern, and other opportunities with ²ÝÝ®ÊÓƵ. It also provides details on your personal information rights and how to exercise your Privacy Rights with us.?
?
¡°Personal information¡± is information that relates to an identifiable individual processed by automatic means or potentially forming part of a structured manual filing system.?
?
¡°Processing¡± or ¡°Process¡± includes various personal information-based activities (for example, when ²ÝÝ®ÊÓƵ collects, uses, discloses, deletes, transfers, and stores personal information).
Quick Links
We recommend that you read this Privacy Statement completely to ensure you are fully informed of the ways we may process personal information in connection with our recruitment practices. If you only want to access a particular section, you can click on the relevant link below to jump to that section:
?
Personal Information We Collect and Our Purposes
?
Who We Share Your Personal Information With
?
?
?
?
?
?
?
Updates to This Privacy Statement
?
?
What personal information do we collect and process?
Personal information we collect directly from you.
In connection with prospective personnel and our recruitment activities, ²ÝÝ®ÊÓƵ may collect and process certain personal information. This may be collected directly from you when you apply for a role with ²ÝÝ®ÊÓƵ or during in-person or online meetings.
?
You can apply for a role at ²ÝÝ®ÊÓƵ using a number of third-party career sites; for example, SEEK and LinkedIn. Doing so will connect your profile from these systems with the ²ÝÝ®ÊÓƵ job application.
?
Third party sources.
?
We typically collect personal information directly from you (for example, when entering your personal information within any applications), but there may be situations where we collect personal information from other sources. Other personal information is generated in the course of your applications for example, by recruiting teams and ²ÝÝ®ÊÓƵ systems.?
?
We may also collect the following information from third-parties and information sources:?
?
Information provided by entities you have asked to support you in finding a job, including recruiting agencies, educational institutions, professional organizations, or alumni resume sharing platforms
Information provided by ²ÝÝ®ÊÓƵ personnel who have referred you for a job
Information provided by background checking agencies, including (where permitted under applicable law) criminal background checks, and security clearance checks (to the extent applicable to relevant government work) to verify the accuracy of information you have provided
Information provided by referees in response to reference requests
Information collected from publicly available sources, including any business, professional, or social media platforms you use or other relevant information available online
Information provided in connection with potential target companies that may join the ²ÝÝ®ÊÓƵ group through a merger, acquisition, or purchase of assets?
The table below provides a summary of the typical recruitment purposes, examples of the personal information and the Lawful Bases for the processing under applicable law. You can read more on ¡°Lawful Bases¡± in the sections below.
| Purpose(s) | Examples of Personal Information that may be Processed | Lawful Bases for Processing |
|---|---|---|
| Prospect and applicant recruitment and job application(s) | Careers site and account registration details: email and password for our sites ? Contact details: full and known names, address, email address, phone number and other contact information ? Information concerning your job application(s): letters, details included in your CV, r¨¦sum¨¦, education records, languages, experience and background information, employment history/previous employers, job titles/positions, reasons for moving roles and notice periods, your skills, academic/professional qualifications/certifications, details of any memberships or professional and private interests, hobbies (which? may include information revealing ¡°Sensitive Personal Information¡± described further below), transcripts, and employment references? ? Role interests: including the role you have expressed an interest in and future jobs and professional goals ? Details of your immigration/visa status: regarding nationality, citizenship, work eligibility and authorizations ? |
Legitimate interests |
| Facilitate our recruitment processes, facilitate and manage in-person and online meetings and assessments | Information includes:??
|
Legitimate interests |
| Make a hiring decision for current or future employment opportunities | Our assessment of your application, interview notes, opinions, references, and suitability ? Any checks we may make to verify any information provided, including your identity, academic and professional qualifications, background checks in respect of information connected with your right to work, and other relevant public information ? Records of our decision-making process ? |
Legal obligation Contract/pre-contract steps Legitimate interests |
| Verify your information and carry out necessary checks | If relevant, and to the extent required or permitted by local law, we process information:
|
Legal obligation Contract/pre-contract steps Legitimate interests |
| Comply with applicable laws or requests and protect our business from security or similar threats | The information depends on the nature of the request, but as an example, may include information about your role and activities if a regulator makes enquiries |
Legal obligation |
| Provide reports on the diversity of our recruitment talent pools and will need to send reports to the relevant authorities covering a particular time period in certain ²ÝÝ®ÊÓƵ locations required by law.? | To the extent required or permitted by local law, information on your nationality, racial and ethnic origin, gender, sexual orientation, religion, disability and age (see more on this below) | Legal obligation Legitimate interests Consent (where required by law) |
| Defend ²ÝÝ®ÊÓƵ against potential complaints on enquiries? | The information depends on the nature of the complaint or enquiry and who raises this; the data may include your own and third-party views about you or the concern raised, comments regarding suitability, and other responses in connection with your application and our handling of this | Legitimate interests |
| Improve ²ÝÝ®ÊÓƵ processes and services as well as statistical and security analysis | Feedback: any information on the ²ÝÝ®ÊÓƵ recruitment process provided to ²ÝÝ®ÊÓƵ personnel or via voluntary surveys initiated by ²ÝÝ®ÊÓƵ | Legitimate interests |
| Contacting you about future ²ÝÝ®ÊÓƵ opportunities | If you are not appointed to a role initially, we would like to add your details to our internal talent and candidate pool to consider and contact you for future opportunities that might be a match. We will keep your personal information in our talent pool for a reasonable period under applicable law. ? You can advise your talent acquisition Workmate if you would prefer not to be contacted for future roles. You can also update your contact preferences with ²ÝÝ®ÊÓƵ at any time. See ¡°Your Privacy Rights¡± below. |
Legitimate interests Consent (where required) |
Sensitive Personal Information
?
The definition of sensitive personal information varies based on your jurisdiction, but may include any information that reveals your racial or ethnic origin, political opinions, religious or philosophical beliefs; and data concerning your health, sexual orientation, trade-union membership, biometric data, and criminal history; and the contents of your communications where ²ÝÝ®ÊÓƵ is not an intended recipient, precise geolocation (¡°Sensitive Personal Information¡±). We do not collect or process any Sensitive Personal Information about you unless it¡¯s to operate our business, for legitimate employment-related purposes, or where otherwise permitted by, or necessary to comply with, applicable laws.?
?
For example, information about your racial or ethnic origin, gender (including gender identity), sexual orientation, and disabilities may be collected for the purposes of assessing, creating, and cultivating a diverse and inclusive work environment such as ²ÝÝ®ÊÓƵ VIBE? initiatives, compliance with equal employment opportunity obligations, or complying with anti-discrimination laws and government or associated reporting obligations.
?
Information that we collect automatically.
?
When you visit the ²ÝÝ®ÊÓƵ Recruitment site, we use cookies, tracking pixels, and scripts. For more information about the technologies we use and how you can control these technologies, please review the ??
?
Aggregating and analyzing personal information.
?
²ÝÝ®ÊÓƵ may de-identify, aggregate, or anonymize your personal information for privacy and security purposes. This may include using information in de-identified reports, analyzing and presenting summaries for you in tools and/or for ²ÝÝ®ÊÓƵ management in order to consider trends and people strategies for the workforce, or third-party learning opportunities. Aggregation may involve the de-identified information from other ²ÝÝ®ÊÓƵ applicants or personnel and where relevant, comparing aggregated and pooled data with past or future personnel information, responses, industry benchmarks, and comparisons as well as relevant advice or research.
?
Successful applicants.
?
If you accept a role at ²ÝÝ®ÊÓƵ, the information collected during the recruitment process may form part of your personnel file or profile, to the fullest extent allowable, and will be processed in accordance with our Employment Privacy Statement, which will be provided to you.
Who we share your personal information with.
²ÝÝ®ÊÓƵ takes care to only access or disclose personal information to those internally and externally who require access to perform their legitimate tasks and duties and in line with the purposes outlined above.?
?
We will disclose your personal information to the following categories of recipients:
²ÝÝ®ÊÓƵ Group members around the world in order to administer the recruitment processes, including managers, administrators, and our People & Purpose teams.
Background-checking or other screening providers and third parties that verify employment history, academic and professional achievements, and assist with the collection and preparation of applications for security clearances for relevant projects (when necessary).
Third-party service providers that support the ²ÝÝ®ÊÓƵ Recruitment process (such as recruitment or executive search agencies involved in your recruitment or third-party survey tool providers designated by ²ÝÝ®ÊÓƵ)
Third parties such as courts, regulators, tribunals, or professional advisers to comply with our legal and regulatory obligations or address legal matters, including where necessary to abide by law, regulation or contract, or to respond to a court order, administrative, or judicial process.
Third parties as necessary to establish, exercise, or defend against potential, threatened, or actual litigation.
Public authorities and their authorized agents in response to lawful requests.
Third parties where you have consented or otherwise instructed ²ÝÝ®ÊÓƵ to share your personal data.
²ÝÝ®ÊÓƵ personnel authorized to access or discuss personal information must comply with confidentiality, privacy and security policy requirements.?
We will implement appropriate measures to provide assurance that third-party organizations that we use to process data on our behalf use information in a manner consistent with this Privacy Statement and with applicable law, and that the security and confidentiality of the information is maintained. This is in addition to the privacy and security obligations applicable to the third party in connection with their processing. Third-party recipients may have their own privacy statements outlining their approach, which you may wish to consult.
²ÝÝ®ÊÓƵ does not ¡°sell¡± to third parties, or ¡°share¡± with third parties for targeted advertising purposes, the personal information that it collects or processes as part of the recruitment, employment, or personnel management process or any related processes (including as those terms are defined under the California Privacy Rights Act).
Legal Basis for Processing
If you or the ²ÝÝ®ÊÓƵ role are located in Europe, our legal basis or grounds for collecting and using your personal information as described in this Privacy Statement falls into the following categories under applicable law. The ground will depend on the information concerned and the specific context and purposes for which we collect it.?
?
- Legitimate Interest: We process certain data for recruitment, employment, and corporate legitimate interests of ²ÝÝ®ÊÓƵ and third parties and consider individual privacy impacts. Legitimate interests for ²ÝÝ®ÊÓƵ and third parties include administering an efficient recruitment process now, managing and assessing applicants effectively, and ²ÝÝ®ÊÓƵ¡¯s future interests to reconnect talented individuals with future opportunities. We will not rely on this ground where your interests and fundamental rights outbalance and override in our reasonable view.
- Performance of a Contract: We process personal information to perform our obligations under an agreement we have with you or to take steps prior to entering an employment contract with you, where you are considered for employment. For example, we use your personal information to make you a job offer or complete a contract of employment or services with you.?
- Other Legal Bases: In some cases, we may have a legal obligation to process your personal information, such as in response to a court or regulator order. We also may need to process your personal information to protect vital interests, or to exercise, establish, or defend legal claims.
- Consent: In some cases, we ask you for your consent to process your personal information for specific activities/initiatives. You can withdraw your consent at any time, which will not affect the lawfulness of the processing before your consent was withdrawn. If you would like to withdraw your consent, you can do so by contacting us as provided in the ¡°How to contact us¡± section below.??
In some cases, such as background checks, you may also advise the third-party service provider of a consent withdrawal.?
?
When personal information is required.
?
²ÝÝ®ÊÓƵ will inform you if there is a legal or recruitment business requirement to provide personal information. Generally, we will ask for what is reasonably necessary. If you are unable to provide the requisite information we will explain the consequences or delays in respect of your applications. ²ÝÝ®ÊÓƵ considers the various lawful bases available and the most suitable under applicable law.??
?
Where ²ÝÝ®ÊÓƵ or a third party seeks consent for certain processing purposes in accordance with applicable law, you should not feel obliged to provide this because consent (where it is required for a specific processing initiative or activity) is a voluntary ground.
?
We may have additional lawful bases and grounds where Sensitive Personal Information is processed.
International Data Transfers
²ÝÝ®ÊÓƵ operates as a global business and may process prospect and candidate personal information in countries where:?
?
We are recruiting for certain talent and roles?
You have applied for a job
²ÝÝ®ÊÓƵ, its recruiters, managers, or ²ÝÝ®ÊÓƵ subcontractors, customers, or relevant third-party recipients have operations?
As ²ÝÝ®ÊÓƵ is headquartered and conducts global business from the United States, we process personal information in the United States and other countries outside the European Economic Area, United Kingdom, and Switzerland (together ¡°Europe¡±).?
?
Local privacy laws may be different in your home location. For such transfers, we take appropriate safeguards to protect your personal information, fundamental rights and freedoms, and the exercise of your rights in accordance with applicable law by ensuring:?
?
That the recipient country provides an adequate level of data protection based on the European Commission¡¯s adequacy decisions pursuant to Article 45 of the GDPR; or?
We enter into ¡°standard contractual clauses¡± approved by the European Commission in its Implementing Decision as referred to in Article 46 of the GDPR or competent UK authority (as applicable) with the data importer (you have a right to request a copy of these standard contractual clauses by contacting us using the contact details set out below in the ¡°How to Contact Us¡± section).
?
Where applicable, we implement additional contractual, technical, and organizational measures to ensure that your personal information which is transferred outside of Europe is subject to an essentially equivalent level of protection.
?
Third-party organizations processing personal information for ²ÝÝ®ÊÓƵ must comply with applicable privacy laws and the approved transfer safeguards in order to protect your personal information in any country where they undertake processing.
Data Retention
²ÝÝ®ÊÓƵ securely stores and retains your personal information as long as needed to fulfill legitimate business purposes, including those described in this Privacy Statement and in accordance with applicable laws. As a summary indication, we keep personal information for a reasonable period:?
?
Following a recruitment process and our hiring decision in order to respond to potential legal, compliance, or complaints involving ²ÝÝ®ÊÓƵ operations; and??
To keep you informed of future vacancies and maintain accurate records of your preferences.?
You can update your contact preference regarding future contact at any time, but please be aware that we may need to retain wider data for prevailing lawful purposes that apply at that point if you later enquire about deletion.
Your Rights Over Your Personal?Data
Depending where you are located, you may have certain legal rights over personal information we hold about you. These include the right to:??
?
- Obtain access to your personal information that is being processed by us, have inaccurate personal information corrected, and request the deletion of some of your personal information.?
- Object to the processing of your personal information carried out on the basis of our legitimate interests.?
- Ask us to restrict the processing of your personal information.?
- Request the portability of your personal information in a structured, commonly used and machine-readable format if the processing is carried out on the basis of consent or a personal contract.?
- Withdraw your consent at any time, if we have collected and processed your personal information for a specific activity with your consent. Withdrawing your consent will not affect the lawfulness of any processing we conducted prior to your withdrawal, nor will it affect processing of your personal information conducted in reliance on lawful processing grounds other than consent.
- Lodge a complaint with a data protection supervisory authority. As a rule, you can contact the supervisory authority of your usual place of residence, your place of work, or the registered office of the controller. You may also request the details of your competent supervisory authority by using the contact details below in the ¡°How to Contact Us¡± section.
We may require you to provide information from which we can satisfy ourselves as to your identity.
?
²ÝÝ®ÊÓƵ will not discriminate against you for exercising your Privacy Rights. We will explain how the rights mentioned above operate in a given situation, including:
?
- If the right and its availability differ in your location or because of the legal basis for the processing activity or ²ÝÝ®ÊÓƵ¡¯s prevailing processing needs?
- How the rights of others interact with a specific request.?
²ÝÝ®ÊÓƵ does not make decisions based solely on automated processing that produce legal or similarly significant effects as part of the recruitment processing activities covered by this Privacy Statement.
?
You, or an authorized individual who we can verify is acting on your behalf, can exercise the applicable rights by contacting us using the contact details at the bottom of this Privacy Statement or by submitting your request through our . If you are able to provide details of your concern, this may assist ²ÝÝ®ÊÓƵ expedite the response. In any event, we will respond without undue delay and keep you updated. In Europe, this is usually within one month of your request.
?
Additional Information for California Residents
For California residents, if you are submitting a request to access, please specify whether you would like to access personal information categories or specific pieces of personal information. In addition to many of the rights described above, California residents have the right to opt out of a business¡¯s sale of your personal information or sharing of your personal information to third parties for targeted advertising. ²ÝÝ®ÊÓƵ does not sell your personal information or share your personal information with third parties for targeted advertising. ²ÝÝ®ÊÓƵ also does not use your Sensitive Personal Information for any purpose other than to operate our business, for legitimate recruitment-related purposes, or where otherwise permitted by, or necessary to comply with, applicable laws, and therefore does not provide a right to limit the use of Sensitive Personal Information.
?
When you submit a request, we will first acknowledge receipt of your request within 10 business days after receipt of your request. We will provide a substantive response to your request within 45 calendar days after its receipt. If we require more time (up to 90 days or the permitted time frame), we will inform you of the reason and extension period in writing.
?
Only you or an authorized agent (as described below) may make a verifiable consumer request related to your personal information.
?
How to Authorize an Agent. You may designate an authorized agent to submit your verifiable consumer request on your behalf only if the authorized agent has your written permission to do so and you have taken steps to verify your identity directly with us.
How We Verify Your Request. To respond to your request, we must verify your identity and/or the authority of your authorized agent. We will only use the personal data provided to us in that context to verify your identity or the authority of your authorized agent to make the request. Making a verifiable consumer request does not require you to create an account with us. To allow us to verify your request, we may require that you provide at least two pieces of personal information that we already have in our possession, if we cannot already verify you. We will verify your consumer request by comparing the information you provide to information already in our possession, and take additional steps to minimize the risk of fraud.
Security
We maintain appropriate security arrangements. We use technical, organizational, and contractual measures to provide a level of security aiming to protect the information against incidents and the risks involved.?
?
Please note security of information transmitted through the internet can never be guaranteed. You are responsible for maintaining the security of your password or other form of authentication involved in accessing password-protected or secured areas of any ²ÝÝ®ÊÓƵ recruitment web page. Access to and use of password-protected and/or secure areas of any ?²ÝÝ®ÊÓƵ recruitment web pages? is restricted to authorized users only.
Third-Party Certifications
E.U.-U.S. and Swiss-U.S. Privacy Shield
²ÝÝ®ÊÓƵ adheres to the principles of the EU-U.S. and Swiss-U.S. Privacy Shield Frameworks. To learn more, visit our Privacy Shield Notice here.
?
APEC Participation
?
The ²ÝÝ®ÊÓƵ privacy practices, described in this Privacy Statement, comply with the APEC Cross-Border Privacy Rules (¡°CBPR¡±) system. The APEC CBPR system provides a framework for organizations to ensure protection of personal information transferred among participating APEC economies. More information about the APEC framework can be found .
?
Updates to This Privacy Statement
We may update this Privacy Statement from time to time in response to changing legal, technical, or business developments. When we update this Privacy Statement, we will take appropriate measures to inform you, consistent with the significance of the changes we make.?
?
You can see when this Privacy Statement was last updated by checking the ¡°last updated¡± date displayed at the top of this Privacy Statement.
How to Contact Us
If you have any questions about this Privacy Statement, wish to exercise your rights, or to contact our Data Protection Officer, please submit your request through our . You may also contact us at one of the mailing addresses below:
²ÝÝ®ÊÓƵ, Inc.
Attn.: Privacy
6110 Stoneridge Mall Road?
Pleasanton, CA 94588
USA
²ÝÝ®ÊÓƵ Limited
Attn.: Privacy
Kings Building, May Lane?
Dublin 7?
Ireland
For European prospects and candidates, the ²ÝÝ®ÊÓƵ affiliate in the country you applied for a role or conducting the recruitment search process will be the ¡°data controller¡± in relation to your personal information. For a list of ²ÝÝ®ÊÓƵ affiliates and their contact details, please see here.
?
If you have an unresolved privacy or data use concern that we have not addressed satisfactorily, please contact our U.S.-based third-party dispute resolution provider (free of charge) at:?.