Candidate Data Privacy Notice
1. Introduction
1.1 You are being provided with a copy of this privacy notice because you are applying for work with us (whether as an employee, worker or contractor) (Recruitment Exercise). Via Ventures UK Limited and our associated companies (Company, we, us and our) will be the data controller of your personal data in the course of the Recruitment Exercise. The purpose of this privacy notice is to make you aware of what personal data we will hold, how and why your personal data will be used, namely for the purpose of the Recruitment Exercise, and how long it will be retained for. It provides you with certain information which we are required to notify you of under data protection law.
1.2 If you have any questions about this privacy notice please contact [email protected].
2. What data do we process
Personal data means any information describing or relating to an identified or identifiable individual. In the course of the Recruitment Exercise we may collect the following types of personal data about you for the purposes described in this privacy notice:
2.1 Personal details
Your name, gender, nationality, date of birth, age, personal contact details (e.g., address, telephone or mobile number, e-mail), national ID number, immigration and eligibility to work information, driver’s licence, languages spoken, and/or details of any disability and any reasonable adjustments required as a result;
2.2 Recruitment and selection data
Skills and experience, qualifications, references, CV and application, interview and assessment data, vetting and verification information (e.g., results of educational and professional verification, right to work verification, credit reference check, and/or financial sanction check ), information related to the outcome of your application, details of any offer made to you;
2.3 any other personal data which you choose to disclose to us during the course of the recruitment exercise whether verbally or in written form (for example in work emails);
3. Special categories of data
To the extent permitted by applicable laws the Company may collect and process a limited amount of personal data within the above data listed at paragraph 2 falling into special categories, sometimes called sensitive personal data. This term means information relating to:
3.1 racial or ethnic origin;
3.2 religious or philosophical beliefs;
3.3 physical or mental health (including details of accommodations or adjustments);
3.4 trade union membership;
3.5 sexual orientation;
3.6 biometric and genetic data [although we do not collect or expect to hold this type of data]; and
3.7 criminal records and information regarding criminal offences or proceedings.
4. How does the Company collect data?
4.1 The Company mainly collects and records your personal data from you. You will provide this information directly to the Company personnel managing the Recruitment Exercise or enter it into our systems (for example, through your participation in recruitment and selection processes, emails and instant messages you send or through verbal information which is recorded electronically or manually).
4.2 We also obtain some information from third parties: for example, references from a previous employer, medical reports from external professionals, information from recruitment consultants or where we employ a third party to carry out a background check (where permitted by applicable law). The Company also engages a third party, Checkr, to verify your employment history.
4.3 Some data may be obtained from publicly accessible sources.
4.4 In the event that particular information is required by the contract or statute this will be indicated at the time of collection. We will also let you know where there are consequences of you not providing the information requested. Failure to provide some information will mean that we cannot continue with the Recruitment Exercise as the Company will not have the personal data we believe to be necessary for the effective and efficient administration of the Recruitment Exercise.
5. What are the purposes for which data is processed and what is our legal basis for carrying out the processing?
5.1 Whenever the Company processes your personal data we do so on the basis of a legal basis or justification for that processing. Processing of special categories of data is always justified on the basis of an additional lawful condition. In the majority of cases, the processing of your personal data will be justified on one of the following basis:
(a) the processing is necessary for compliance with a legal obligation to which the Company is subject; or
(b) where there is no legal obligation we will process your data where the processing is necessary for the performance of a contract to which you are a party or in order to take steps at your request prior to entering into such a contract;
(c) where the above two grounds do not apply we may process your personal data where the processing is necessary for the legitimate interests pursued by the Company, except where such interests are overridden by your interests or fundamental rights and freedoms which require protection of personal data.
5.2 We have set out below the purposes we may use your personal data for and the legal basis we rely on in each case:
Purpose for processing | The lawful basis we rely on |
|---|---|
Offers of employment and on-boarding Making job offers, providing contracts of employment or engagement and preparing to commence your employment or engagement where you accept an offer from us | Some of this processing is necessary for the compliance with legal obligations to which the Company is subject including the requirement to issue written particulars or terms of employment and the requirement not to unlawfully discriminate in the terms of any offer to you. Additional processing is necessary to take steps to enter into the contract between you and the Company and to perform that contract because we will need information to make an appropriate offer to you and administer your employment contract if you join us. The remainder of the processing is necessary for the purpose of the legitimate interests pursued by the Company. The Company has a legitimate interest in ensuring the effective engagement of staff on appropriate terms and conditions of employment and that there is a smooth transition into employment for successful candidates and that information supplied in the recruitment process which is relevant to ongoing employment is maintained. This will contribute towards the Company continuing to meet its business objectives, maintain its reputation and attract high calibre employees. |
Future job opportunities To contact you if you are not successful in your initial application should another potentially suitable vacancy arise during the [six] months following completion of the recruitment process for the role you originally applied for | This processing is necessary for the purpose of the legitimate interests pursued by the Company. The Company has a legitimate interest in maintaining an appropriate pool of talent who have shown an interest in working for the Company and who are potentially suitable candidates for employment. This will potentially benefit both initially unsuccessful candidates and the Company. It will contribute towards the Company continuing to meet its business objectives, maintain its reputation and attract high calibre employees. |
Recruitment feedback and complaints To deal with any query, challenge or request for feedback received in relation to our recruitment decisions | This processing is necessary for the compliance with legal obligations to which the Company is subject including ensuring that the Company is able to demonstrate its compliance with data protection laws and anti-discrimination laws. Beyond legal compliance processing is necessary for the purpose of the legitimate interests pursued by the Company. The Company has a legitimate interest in being able to provide feedback to candidates and to be able to defend any challenge or claim made in connection with our recruitment decision. This will assist the Company to avoid the risk of financial exposure or costs incurred through challenges to recruitment decisions and to maintain its reputation. |
Complaints, claims and litigation To enforce our legal rights and obligations, and for any purposes in connection with any complaint or legal claim made by, against or otherwise involving you | This processing is necessary for the purpose of the legitimate interests pursued by the Company. The Company has a legitimate interest in protecting its organisation from breaches of legal obligations owed to it and defending itself against litigation. This is needed to ensure that the Company's legal rights and interests are protected appropriately, to protect the Company's reputation and to protect the Company from other damage or loss. This is important to protect the business of the Company and ensure its continued success and growth. This supports the Company's immediate and long-term business goals and outcomes. |
Legal or regulatory disclosures To comply with lawful requests by public authorities (including without limitation to meet national security or law enforcement requirements), discovery requests, or where otherwise required or permitted by applicable laws, court orders, government regulations, or regulatory authorities (including without limitation data protection, tax and employment), whether within or outside your country | This processing is necessary for the compliance with legal obligations to which the Company is subject where there is a legal obligation to disclose information or a court or other legal order to provide information is place. Where not legally required, processing is necessary for the purpose of the legitimate interests pursued by the Company. The Company has a legitimate interest in cooperating with relevant authorities, government bodies or regulators for the provision of information where appropriate. The Company wishes to maintain its reputation as a good corporate citizen and to act ethically and appropriately in all the countries in which it does business. |
5.3 Additional legal basis we rely on where we process special category data
The special categories of personal data that are processed by the Company are set out above. Where we process special categories of data it will be justified by a condition set out at paragraph 5.1 above and also by one of the following additional condition
(a) the processing is necessary for the purposes of carrying out the obligations and exercising the rights of you or the Company in the field of employment law, social security and social protection law, to the extent permissible under applicable laws;
(b) the processing is necessary for the purposes of occupational medicine, for the assessment of your working capacity, medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems and services, to the extent permitted by applicable laws;
(c) the processing is necessary to protect your vital interests or of another person where you are physically or legally incapable of giving consent (for example in exceptional emergency situations, such as a medical emergency);
(d) the processing is necessary for purposes authorised by applicable law. This includes those purposes set out in Schedule 1 of the Data Protection Act 2018:
(i) the processing is necessary for the prevention or detection of unlawful acts where it must be carried out without consent so as not to prejudice those purposes;
(ii) the processing is necessary for the provision of confidential counselling, advice or support or other similar service provided confidentially;
(iii) the processing is necessary for an insurance purpose for the purposes of measures or decisions with respect to you;
(iv) the processing is necessary for making a determination in connection with eligibility for benefits payable under an occupational pension scheme;
(e) the processing is necessary for the establishment, exercise or defence of legal claims; or
(f) in exceptional circumstances the processing is carried out subject to your explicit consent (as explained below).
5.4 The purposes we use special category personal data for and the additional legal basis that applies
We have identified a number of purposes for collecting and processing your special category personal data. These are set out below together with the additional legal basis we rely on in each case:
Purpose for processing | Additional lawful basis for special category data processing |
|---|---|
Documentation such as work permits, details of residency, proof of citizenship will be processed to assess and review eligibility to work for the Company in the jurisdiction in which you work | This processing is necessary for the purposes of carrying out the obligations and exercising the rights of you or the Company in the field of employment law, social security and social protection law, to the extent permissible under applicable laws. In particular, the requirement to check that you are legally permitted to work in your jurisdiction. |
Your racial or ethnic origin, religion, philosophical or political belief, sexual orientation or disability status may be used for the collection of statistical data subject to local laws, or where required to record such characteristics to comply with equality and diversity requirements of applicable local legislation or to keep the Company’s commitment to equal opportunity under review | Where not legally required this processing is necessary for the public interest of ensuring equality of opportunity or treatment between people of different racial or ethnic origins, holding different religious or philosophical beliefs, people with different states of physical or mental health or people of different sexual orientation with a view to enabling such equality to be promoted or maintained. |
Health and medical information may be used to comply with employment, health and safety or social security laws. For example, to make reasonable accommodations or adjustments and avoid unlawful discrimination or dealing with complaints arising in this regard. | This processing is necessary for the purposes of carrying out the obligations and exercising the rights of you or the Company in the field of employment law, social security and social protection law, to the extent permissible under applicable laws. In particular, those laws set out in this section. To the extent that this data is managed by our occupational health advisers, this processing is necessary for the purposes of preventive or occupational medicine, for the assessment of your working capacity, medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems and services, to the extent permitted by applicable laws. |
Special category personal data of any type may be used in the event of a complaint, claim or litigation or potential claim or litigation by, against or involving you. | This processing is necessary to establish, exercise or defend legal claims. |
5.5 We may seek your consent to certain processing which is not otherwise justified under one of the above basis. If consent is required for the processing in question, it will be sought from you separately to ensure that it is freely given, informed and explicit. Information regarding such processing will be provided to you at the time that consent is requested, along with the impact of not providing any such consent. You should be aware that it is not a condition or requirement of your recruitment to agree to any request for consent from the Company.
5.6 Processing data relating to criminal convictions and offences
Personal data relating to criminal convictions and offences will only be processed where authorised by applicable laws. For example:
(a) [a criminal record check may be carried out on recruitment or transfer or intermittently where ongoing screening is required where authorised by applicable laws;] or
(b) an allegation of a criminal offence or conviction arising during your relationship with the Company may be processed where required or authorised by applicable law. For example:
(i) where we have a legal or regulatory requirement to report an offence; or
(ii) where applicable laws authorise the Company to process information about the offence (e.g., in a disciplinary process) for the purpose of making decisions regarding your relationship with the Company.
6. Automated decision making and profiling
We do not currently rely on automated decision making.
7. Retention of personal data
7.1 The Company endeavours to ensure that personal data are kept as current as possible and that irrelevant or excessive data are deleted or made anonymous as soon as reasonably practicable.
7.2 We generally retain personal data for as long as is required to satisfy the purpose for which it was collected. This will usually be the period of the Recruitment Exercise plus the length of any applicable statutory limitation period thereafter. However, some personal data may be retained for varying time periods in order to comply with legal and regulatory obligations and for other legitimate business reasons.
8. Disclosures of personal data
8.1 Within the Company, your personal data can be accessed by or may be disclosed internally on a need-to-know basis to:
(a) local and global People team, including managers and team members involved in the recruitment exercise;
(b) [local and executive] management responsible for managing or making decisions in connection with your relationship with the Company;
(c) system administrators; and
(d) where necessary for the performance of specific tasks or system maintenance by staff in the Company teams such as the Finance and IT Department and the Global HR information systems support team.
8.2 Your personal data is also accessed by third parties whom we work together with (including without limitation, Greenhouse Software, BrightHire, Inc., and CodeSignal, Inc. and their associated companies and sub-contractors) for providing us with services, such as hosting, supporting and maintaining the framework of our HR information systems.
8.3 Personal data will also be shared with certain interconnecting systems such as the main HR system and local payroll and benefits systems. Data contained in such systems may be accessible by providers of those systems, their associated companies and sub-contractors.
8.4 Examples of third parties with whom your data may be shared (if necessary) include lawyers, consultants and other professional advisors. The Company expects such third parties to process any data disclosed to them in accordance with applicable law, including with respect to data confidentiality and security. Where these third parties act as a data processor they carry out their tasks on our behalf and upon our instructions for the above mentioned purposes. In this case your personal data will only be disclosed to these parties to the extent necessary to provide the required services.
9. Security of data
The Company is committed to protecting the security of the personal data you share with us. The Company uses a variety of technical and organisational methods to secure your personal data in accordance with applicable laws.
10. International Transfer of Personal Data
10.1 In the course of the Recruitment Exercise your personal data (including special categories of personal data) will be transferred to associated companies of the Company to process for the purposes described in this privacy notice. This will be applicable for example where the relevant company or a manager from that company is responsible for conducting or approving the Recruitment Exercise. Some of these associated companies or managers are located outside the European Union (for example in the USA, Canada, and Mexico).
10.2 Personal data will also be transferred to third parties (eg service providers or regulators as set out above), who may have systems or suppliers located outside the European Union.
10.3 As a result, your personal data may be transferred outside of the European Union to countries whose data protection laws may be less stringent.
10.4 The Company will ensure that appropriate or suitable safeguards are in place to protect your personal information and that transfer of your personal information is in compliance with applicable data protection laws.
10.5 The Company will ensure that appropriate or suitable safeguards are in place to protect your personal information and that transfer of your personal information is in compliance with applicable data protection laws.
11. Your rights as a data subject
11.1 Right to access, correct and delete your personal data
You have the right to request access to any of your personal data that the Company may hold, and to request correction of any inaccurate data relating to you. You have the right to request deletion of any irrelevant data we hold about you.
11.2 Data portability
Where we are relying upon your consent or the fact that the processing is necessary for the performance of a contract to which you are party as the legal basis for processing, and that personal data is processed by automatic means, you have the right to receive all such personal data which you have provided to the Company in a structured, commonly used and machine-readable format, and also to require us to transmit it to another controller where this is technically feasible.
11.3 Right to restriction of processing
You have the right to restrict our processing of your personal data where:
you contest the accuracy of the personal data until we have taken sufficient steps to correct or verify its accuracy;
(a) the processing is unlawful, but you do not want us to erase the data;
(b) we no longer need the personal data for the purposes of the processing, but you require them for the establishment, exercise or defence of legal claims; or
(c) you have objected to processing justified on legitimate interest grounds (see below) pending verification as to whether the Company has compelling legitimate grounds to continue processing.
Where personal data is subjected to restriction in this way we will only process it with your consent or for the establishment, exercise or defence of legal claims.
11.4 Right to withdraw consent
Where we have relied on your consent to process particular information and you have provided us with your consent to process data, you have the right to withdraw such consent at any time.
11.5 Right to object to processing justified on legitimate interest grounds
Where we are relying upon legitimate interest to process data, then you have the right to object to that processing. If you object, we must stop that processing unless we can either demonstrate compelling legitimate grounds for the processing that override your interests, rights and freedoms or where we need to process the data for the establishment, exercise or defence of legal claims. Where we rely upon legitimate interest as a basis for processing we believe that we can demonstrate such compelling legitimate grounds, but we will consider each case on an individual basis.
11.6 Right to complain
You also have the right to lodge a complaint with a supervisory authority if you consider that the processing of your personal data infringes applicable law.
If you want to review, verify, correct or request erasure of your personal data, object to the processing or request that we transfer a copy of your personal information to another party, please contact [email protected].