How we collect information from You
We collect and process information that you provide when you apply for a role. This includes information provided through an online job site (including Workable), via email, when you contact Us, in person at interviews and/or by any other method, including through the Video Interview feature and your visits to Workable’s Website.
Information we collect from other sources
Workable provides Us with the facility to link the data you provide to Us, with other publicly available information about you that you have published on the Internet – this may include sources such as LinkedIn and other social media profiles. Please note that We may obtain your contact details from publicly available sources, including content that you have made public on social network sites or similar sites for professional purposes to make initial contact with you for recruitment purposes. If We contact you in this way you will be given the opportunity to opt out of receiving any further information about career opportunities with Us and you can subsequently opt out at any time by contacting email@example.com.
Workable’s technology allows Us to search various databases – some publicly available and others not, which may include your personal data (include your CV or Resumé), to find possible candidates to fill Our job openings. Where We find you in this way We will obtain your personal data from these sources.
We may receive your personal data from a third party who recommends you as a candidate for a specific job opening or for Our business more generally. In considering Your application We may also obtain information from third party sources, including any referees that you specify, recruitment agencies, background check agencies and educational institutions.
Automated decision making/profiling
We may use Workable’s technology to select appropriate candidates for Us to consider, based on criteria expressly identified by us, or typical in relation to the role for which you have applied. The process of finding suitable candidates is automatic and based on standard criteria such as relevant qualifications, however any decision as to who We may contact or engage to fill the job opening will be made by Our staff.
Disclosure of Your Information
As set out above, We pass your information to Our third party service providers, including Workable, who use it only in accordance with Our instructions and as otherwise required by law.
Where you have applied for a job opening through the Indeed Apply functionality, and where you have consented to this disclosure, We will disclose to Indeed certain personal data that We hold, including but not limited to a unique identifier used by Indeed to identify you, and information about your progress through Our hiring process for the applicable job opening, as well as tangible, intangible, visual, electronic, present, or future information that We hold about you, such as your name, contact details and other information involving analysis of data relating to you as an applicant for employment (collectively “Disposition Data”). Indeed’s Privacy Notice in respect of Indeed’s use of the Disposition Data is available on Indeed’s website.
Where you have applied to a job opening through another service provider, We may disclose data similar to the Disposition Data defined above to such service provider. The service provider shall be the data controller of this data and shall therefore be responsible for complying with all applicable law in respect of the use of that data following its transfer by Us.
We may also provide personal data relating to you to third parties including background check applications or agencies or to referees indicated on your CV or during the recruitment process.
During the recruitment process we may issue you with a voluntary candidate survey via Culture Amp. In this case, Culture Amp will need to process your personal data on Our behalf and in accordance with Our instructions. The survey is completely voluntary, with results to be recorded anonymously.
If your application is successful, We may also share your contact details with team members as part of our onboarding process.
We may share your personal data with:
- law enforcement agencies, other governmental agencies or third parties if We are required by law to do so; and
- other business entities should We plan to merge with or be acquired by that business entity, or if We undergo a re-organisation with that entity.
How We Store Your Personal Data
We take appropriate measures to ensure that all personal data is kept secure including security measures to prevent personal data from being accidentally lost, or used or accessed in an unauthorised way. We limit access to your personal data to those who have a genuine business need to know it. Those processing your information will do so only in an authorised manner and are subject to a duty of confidentiality.
We also have procedures in place to deal with any suspected data security breach. We will notify you and any applicable regulator of a suspected data security breach where We are legally required to do so.
Unfortunately, the transmission of information via the internet is not completely secure. Although We will do Our best to protect your personal data, We cannot guarantee the security of your data transmitted through any online means, therefore any transmission remains at your own risk.
Where We store your personal data
Where We store your personal data in Our own systems, it is stored in the UK and/or the EEA.
The data that We collect from you and process using Workable’s Services may be transferred to, and stored at, a destination outside the EEA or UK. It may also be processed by staff operating outside the UK or EEA who work for Us or for one of Our suppliers. Where necessary We may also share your data with our other Exscientia offices in different jurisdictions. Data protection laws and practices are likely to be different across different jurisdictions and may be less stringent than those within the jurisdiction in which you are resident. In such cases, We will ensure that there are adequate safeguards in place to protect your personal data that comply with our legal obligations.
In particular, your data may be accessible to i) Workable’s staff in the USA or ii) may be stored by Workable’s hosting service provider on servers in the USA as well as in the EU or the UK. The USA does not have the same data protection laws as the United Kingdom and EEA. A Data Processor Agreement has been signed between Workable Software Limited and its overseas group companies, and between Workable Software Limited and each of its processors. These data processor agreements are based on the current version of the European Standard Contractual Clauses and International Data Transfer Agreement / International Data Transfer Addendum (as applicable), and are designed to help safeguard your privacy rights and give you remedies in the unlikely event of a misuse of your personal data.
If you would like further information please contact Us (see ‘Contact’ below). We will not otherwise transfer your personal data outside of the UK or EEA or to any organisation (or subordinate bodies) governed by public international law or which is set up under any agreement between two or more countries.
How long We keep your personal data
If your application for employment is unsuccessful then We may continue to hold your personal data for a further 24 months, in case We need to consult it in the future if you make another application or become an employee, or if a dispute arises about an application that you have made or in order to contact you if potentially suitable job opportunities become available in the future (provided that you have indicated to Us that you wish to be considered for future roles). Your personal data will not be retained for longer than is reasonably required for the relevant purposes for which it was collected, or as otherwise permitted by applicable law.
Under the UK GDPR you have the right to:
- request access to and information about the processing of your personal data;
- request Us to correct any mistakes in your information that We hold;
- request the deletion of your personal data ;
- receive the personal data concerning you which you have provided to Us, in a structured, commonly used and machine-readable format and have the right to transmit those data to a third party in certain situations;
- object at any time to processing of personal data concerning you;
- object to decisions being taken by automated means that produce legal effects concerning you or similarly significantly affect you;
- request the withdrawal of any consent that you have given for the processing of your personal data unless there is another lawful basis for the continued processing of that data; and
- request the restriction of Our processing of your personal data in certain circumstances.
For further information on each of those rights, including the circumstances in which they apply, see the Guidance from the UK Information Commissioner’s Office (ICO) on individuals' rights under the General Data Protection Regulation.
If you would like to exercise any of those rights, please:
- contact Us using Our Contact details below,
- let Us have enough information to identify you,
- let Us have proof of your identity and address, and
- let Us know the information to which your request relates.
How to complain
We hope that We can resolve any query or concern you raise about Our use of your information.
The GDPR and UK GDPR also give you right to lodge a complaint with a supervisory authority, in particular in the European Union (or European Economic Area) state where you work, normally live or where any alleged infringement of data protection laws occurred. The supervisory authority in the UK is the Information Commissioner who may be contacted at http://ico.org.uk/concerns/ or telephone: +44303-123-1113.
All questions, comments and requests regarding this Privacy Notice should be addressed to firstname.lastname@example.org.