Candidate Privacy Notice

1. Introduction

   This Privacy Notice (“Notice”) explains how Nomo Fintech collects and uses personal data about job candidates (prospective employees) in connection with their application for employment.

   This Notice explains, amongst other things:

   • Who we are
   • How to contact us
   • The personal data we collect about you
   • How we collect your personal data
   • The lawful bases and conditions we rely on to process your personal data
   • How we use your personal data
   • Who we share your personal data with
   • How long we retain your personal data
   • How we protect your personal data
   • Your data protection rights
   • How to make a complaint

2. Who we are

   Nomo Fintech is a technology business that provides its clients with solutions to power their online digital banking services and is part of the Boubyan Banking Group. Nomo Fintech is a trading name of BB2 Digital Technology Services Limited and BB2 Digital Technology Services ME Limited.

   BB2 Digital Technology Services Limited and BB2 Digital Technology Services ME Limited (hereinafter “Nomo Fintech”) are separate independent controllers of any job candidate personal data that they collect and process. The primary controller responsible for the collection and processing of job candidate personal data is identified in the relevant job advert.

   In this Notice Nomo Fintech may be referred to as “we”, “us”, “our” or “Nomo Fintech”.

3. How to contact us

   Our contact details are provided on our careers portal or you can write to us at the relevant address below:

   • BB2 Digital and Technology Services Limited 20 Churchill Place, Canary Wharf, London, E14 5HJ
   • BB2 Digital and Technology Services ME Limited Innovation Hub, Unit 506, Level 5, Dubai International Financial Centre

   If you have any questions about the contents of this Notice or the way we collect and use your personal data, please contact the Human Resources Department in the first instance (email: hr@nomo.tech) or if you prefer you can contact our Data Protection Officer by email: dpo@bb2.tech

4. Personal data we collect about you

   4.1 We collect and process the following categories of personal data about you in connection with your job application:

   4.1.1 Contact details: Includes name, postal address, email address, telephone number and any additional contact information provided.

   4.1.2 Personal details: Includes age, date of birth, gender, place of birth, race, religion, nationality, country of residence, marital status, number of dependants, languages spoken and details about any disabilities and related adjustments we make during the recruitment and selection process.

   4.1.3 Identity details: Includes identity documentation, e.g. passport, national identification documentation (e.g. Emirates ID).

   4.1.4 Recruitment and selection details: Includes information about your application for employment, CV, skills, experience and employment history, educational and professional qualifications professional memberships, licenses and certifications (including any publicly available information relating to the same), interview and assessment outcomes, employment references, vetting and background screening (e.g. credit history, financial sanctions, and where appropriate and permitted by applicable local laws, criminal record checks), immigration status and right to work information and any other pertinent information.

   4.1.5 Remuneration, financial and benefit details: Includes details about your current salary package, bonus and commission entitlements and benefits.

   4.1.6 Equality and diversity monitoring details: Where permitted by applicable laws, includes racial or ethnic origin, gender, sexual orientation, age, marital or civil partnership status, religion or similar beliefs and disability details.

   4.1.7 Security monitoring details: Where permitted by applicable laws, includes CCTV recordings, photo images, building access control logs and any other security monitoring and authentication data collected when you visit our office premises.

   4.1.8 Miscellaneous details: Includes any other miscellaneous personal data you choose to share with us during the recruitment and selection process.

5. Special categories of personal data

   5.1 Where permitted by the applicable data protection laws, we collect and process special categories of personal data as part of the information described above in section 4. For the purpose of this Notice, special categories of personal data (also commonly referred to as sensitive personal data) is personal data relating to racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data, health data, data concerning an individual's sex life or sexual orientation, or data relating to criminal convictions or alleged offences.

   5.2 The presumption is that special categories of personal data is more likely to be of a private nature and could be used in a discriminatory way or have a greater impact on individuals if misused. It therefore needs to be treated with greater care than other personal data.

   5.3 We generally only collect and process special categories of personal data, where necessary to comply with our legal obligations, exercise our rights as an employer or where you provide us with your explicit consent.

6. How we collect your personal data

   6.1 We collect personal data from you directly and you are required to provide any personal data that we reasonably require to fulfil our obligations in connection with your job application and comply with our legal obligations. Where you refuse or are unable to provide information we reasonably require to fulfil our obligations, we may be unable to progress your job application. Where the provision of specific information is mandatory, we will highlight this at the time of collection. We will also let you know if there are any consequences as result of you failing to provide information that we require.

   6.2 We rely on the availability of accurate personal data to manage and administer the recruitment and selection process. You should therefore ensure that any personal data you provide to us is accurate and complete to the best of your knowledge.

   6.3 Where you provide us with personal data about third party individuals, such as information about your spouse, civil partner, children, dependants, beneficiaries or emergency contacts, where appropriate, you are required to provide these individuals with a copy of this Notice beforehand, or alternatively, ensure they are otherwise made aware of how their personal data will be used by us.

   6.4 In addition to collecting personal data from you directly, we may also collect some personal data about you indirectly from other third parties, such as recruitment agencies, previous employers, your referees, publicly available websites (e.g. LinkedIn), employment vetting and background screening providers and educational and professional membership bodies.

   6.5 We also collect some personal data automatically such as CCTV recordings, photo images, building access control logs and any other security monitoring and authentication data collected when you visit our office premises.

7. Lawful bases and conditions for processing

   7.1 We are required to satisfy one or more of the lawful bases for processing personal data set out in the applicable data protection laws, before collecting and processing personal data about you. When we collect and process personal data, we rely on one or more of the following lawful bases:

   1. Performance of a contract

   Where necessary, we collect and process personal data to assess your job application, offer you employment, process your acceptance of the job offer, onboard you as an employee and fulfil our obligations in the employment contract and any other agreement that you enter into with us.

   b. Legal obligations

   Where necessary, we collect and process personal data to enable us to meet our legal obligations, such as obligations and duties we are required to discharge as an employer and any other applicable legal obligations.

   c. Vital interests

   Where necessary, we collect and process personal data to protect your vital interests or the interests of other persons.

   d. Legitimate interests

   Where necessary, we collect and process personal data to pursue our legitimate interests or the interests of a third party, except where your interests or fundamental rights and freedoms override our interests.

   e. Consent

   In some limited circumstances we rely on your consent to collect and process your personal data, e.g. where you ask us to disclose your personal data to a third party.

   7.2 We are required to satisfy one or more of the conditions for processing special categories of personal data set out in the applicable data protection laws, before collecting and processing special categories of personal data about you. When we collect and process special categories of personal data, we rely on one or more of the following conditions:

   1. Employment and social security

   Where necessary, we collect and process special categories of personal data to fulfil our obligations and exercise specific rights in the field of employment, social security and social protection law.

   1. Vital interests

   Where necessary, we collect and process special categories of personal data to protect your vital interests or the interests of others persons, where you are physically or legally incapable of giving consent, e.g. in medical emergency situations.

   1. Establishment, exercise and defence of legal claims

   Where necessary, we collect and process special categories of personal data to exercise or defend legal claims, prospective legal claims or other claims of a similar nature.

   1. Substantial public interest

   Where necessary, we collect and process special categories of personal data for reasons of substantial public interest.

   1. National laws

   Where necessary, we collect and process special categories of personal data, where the processing is authorised by applicable national laws.

   1. Explicit consent

   In some limited circumstances we rely on your explicit consent to collect and process special categories of personal data.

8. How we use your personal data

   8.1 This section describes in more detail how we use your personal data and special categories of personal data and which of the lawful bases and conditions (described above in section 7) we rely on to carry out the processing.

No.	Processing Purpose	Lawful Bases and Conditions
8.1.1	Recruitment and selection We assess your suitability for the role and make decisions about your recruitment and selection.	Personal data lawful bases We carry out some aspects of this processing to comply with our legal obligations. We carry out some aspects of this processing to take steps to enter into the employment contract with you. We carry out some aspects of this processing to pursue our legitimate interests, i.e. we have a legitimate interest in assessing the suitability of job candidates that apply for job roles with us, to ensure they are competent to perform their roles and of good repute.
8.1.2	Communications We communicate with you to keep you abreast of developments during the recruitment and selection process.	Personal data lawful bases We carry out this processing to pursue our legitimate interests, i.e. we have a legitimate interest in communicating with job candidates during the recruitment and selection process in an effective and efficient manner.
8.1.3	Vetting and background screening Where permitted by applicable laws, we conduct pre-employment and ongoing background screening checks, including right work to checks, to ensure you are suitable to perform your role.	Personal data lawful bases We carry out some aspects of this processing to comply with our legal obligations. We carry out some aspects of this processing to pursue our legitimate interests, i.e. we have a legitimate interest in assessing the suitability of job candidates that apply to work for us, to ensure they are competent to perform their roles and of good repute. Condition for special categories of personal data We carry out some aspects of this processing to fulfil our obligations and exercise specific rights in the field of employment, social security and social protection law, e.g. to carry out immigration and right to work checks. We carry out some aspects of this processing where necessary for reasons of substantial public interest where the processing is permitted by applicable national laws, e.g. where national laws permit processing to prevent or detect crime and other unlawful acts.
8.1.4	Offers of employment We may make offers of employment and take steps to onboard you where you accept an offer of employment.	Personal data lawful bases We carry out some aspects of this processing to comply with our legal obligations. We carry out some aspects of this processing to take steps to enter into the employment contract with you. We carry out some aspects of this processing to pursue our legitimate interests, i.e. we have a legitimate interest in ensuring job candidates are engaged on appropriate terms and are onboarded in a timely and efficient manner.
8.1.5	Audits and assessments We conduct audits and assessments to ensure our recruitment and selection process is carried out in accordance with our internal policies and procedures and our legal obligations.	Personal data lawful bases We carry out some aspects of this processing to comply with our legal obligations. We carry out some aspects of this processing to pursue our legitimate interests, i.e. we have a legitimate interest in setting appropriate policies aligned to corporate governance best practice and our legal obligations, and monitoring compliance across our workforce to ensure adherence and a sound system of internal controls.
8.1.6	Physical and logical security We manage the physical and logical security of our office premises, information technology systems, confidential information and intellectual property.	Personal data lawful bases We carry out this processing to pursue our legitimate interests, i.e. we have a legitimate interest in protecting the security of our office premises and the confidentiality, integrity and availability of our information technology systems and information assets.
8.1.7	Legal obligations We discharge our legal obligations in connection with your job application and any other applicable legal obligations.	Personal data lawful bases We carry out some aspects of this processing to comply with our legal obligations. Condition for special categories of personal data We carry out some aspects of this processing to fulfil our obligations and exercise specific rights in the field of employment, social security and social protection law, e.g. to comply with health and safety legislation when job candidates visit our office premises or where a job candidate has a disability and we make related adjustments during the recruitment and selection process.
8.1.8	Equality and diversity monitoring Where permitted by applicable laws, we conduct monitoring to ensure equality of opportunity and diversity in connection with your job application and to comply with anti-discrimination laws.	Personal data lawful bases We carry out some aspects of this processing to comply with our legal obligations. We carry out some aspects of this processing to pursue our legitimate interests, i.e. we have a legitimate interest in preventing unlawful discrimination and ensuring the equality of treatment of job candidates during the recruitment and selection process. Condition for special categories of personal data We carry out some aspects of this processing on a voluntary basis with your explicit consent. Where you choose to provide us with equality and diversity monitoring data, you are consenting to the collection and processing of your data for this purpose.
8.1.9	Human resources records We maintain appropriate recruitment and selection records relating to your job application.	Personal data lawful bases We carry out some aspects of this processing to comply with our legal obligations. We carry out some aspects of this processing to enable us to take steps to perform the contract of employment with you. We carry out some aspects of this processing to pursue our legitimate interests, i.e. we have a legitimate interest in maintaining appropriate records relating to job candidates to manage the recruitment and selection process and defend ourselves from legal claims. Condition for special categories of personal data We carry out some aspects of this processing to fulfil our obligations and exercise specific rights in the field of employment, social security and social protection law. We carry out some aspects of this processing to exercise or defend legal claims, prospective legal claims or other claims of a similar nature
8.1.10	Legal claims and disputes We investigate, exercise and defend legal claims and disputes and enforce our rights, including where these relate to you in the context of your employment.	Personal data lawful bases We carry out this processing to pursue our legitimate interests, i.e. we have a legitimate interest in managing complaints, enforcing our legal rights and defending legal claims. Condition for special categories of personal data We carry out some aspects of this processing to exercise or defend legal claims, prospective legal claims or other claims of a similar nature.
8.1.11	Preventing and detecting crime We prevent and detect crime within our organisation and facilitate the apprehension and prosecution of offenders.	Personal data lawful bases We carry out this processing to pursue our legitimate interests, i.e. we have a legitimate interest in preventing and detecting crime, including fraud and other unlawful acts within our organisation, so as to protect our business, employees and clients. Condition for special categories of personal data We carry out some aspects of this processing where necessary for reasons of substantial public interest where the processing is permitted by applicable national laws, e.g. where national laws permit processing to prevent or detect crime and other unlawful acts.
8.1.12	Business continuity and emergency planning We manage business continuity and ensure the health and safety and well-being of job candidates while they are on our premises.	Personal data lawful bases We carry out some aspects of this processing to comply with our legal obligations. We carry out some aspects of this processing to pursue our legitimate interests, i.e. we have a legitimate interest in ensuring the objectives and operational activities of our organisation are not jeopardised by unforeseen circumstances and that we protect the health and safety and well-being of job candidates while they are on our premises. We carry out some aspects of this process to protect the vital interests of our job candidates or the interests of other persons, e.g. in emergency situations we may disclose job candidate information to emergency services personnel Condition for special categories of personal data We carry out some aspects of this processing to protect the vital interests of job candidates or the interests of other persons, where a job is candidate physically or legally incapable of giving consent, e.g. in medical emergency situations.
8.1.13	Miscellaneous We may process any other miscellaneous personal data that you choose to share with us during the recruitment and selection process.	Personal data lawful bases We are likely to carry out this processing on the basis of legitimate interests. However, we will let you know if a different lawful basis applies to the processing of any voluntary information you share with us.

9. Who we share your personal data with

   9.1 We share your personal data with the following categories of recipients:

   9.1.1 Recruitment agencies: Where you are represented by a recruitment agency during the job application and recruitment process, and the sharing of data with the agency is necessary to consider your application, make you a job offer and manage and administer your onboarding as an employee.

   9.1.2 Our employees, including Human Resources, line managers and other employees: On a strict need-to-know basis, where necessary to manage and administer the recruitment and selection process.

   9.1.3 Background screening providers: Where necessary to conduct employment vetting and good repute checks, e.g. these may include, credit reference agencies, educational and examining bodies, professional membership bodies, public authorities and government agencies.

   9.1.4 Other Boubyan Banking Group companies: Where necessary to operate our business.

   9.1.5 Public authorities, regulators and government agencies: Where necessary for us to comply with our legal and regulatory obligations.

   9.1.6 Legal advisors, insurers and claims investigators: Where necessary to obtain legal advice or investigate, exercise or defend legal claims, insurance claims or other similar claims.

   9.1.7 Third party partners and service providers: Where we engage third party partners or outsource our processing operations to service providers that process personal data on our behalf. Where these service providers act as our agents, the processing activities will remain under our control and will be carried out in accordance with our strict instructions and security standards.

   9.1.8 Law enforcement agencies: Where necessary for the prevention and detection of crime or the apprehension or prosecution of offenders.

   9.1.9 Successors of our business: Where our organisation is sold to, acquired by or merged with another organisation, in whole or in part.

10. International data transfers

    10.1. We are established in the United Kingdom (“UK”) and the Dubai International Financial Centre (“DIFC”). However, we operate on a global worldwide basis and we may therefore transfer your personal data to countries or territories outside the UK or DIFC. Some of these countries or territories may not be considered by data protection regulators to provide an adequate level of protection. We have therefore implemented additional safeguards to ensure your personal data receives an adequate level of protection, such as regulatory approved standard contractual clauses, and where necessary and appropriate, other risk-based safeguards.

    10.2 If you require further information about the safeguards we have in place to protect your personal data when we make international data transfers, please contact our Data Protection Officer by email: dpo@bb2.tech

11. How long we retain your personal data

    11.1 We generally retain your personal data for as long as is necessary to fulfil the purpose for which it was collected and other purposes required by law. The retention period will usually include the period of the recruitment and selection process and the applicable statute of limitation period following this, although it’s important to note that some personal data may be retained for longer to comply with applicable legislation, e.g. health and safety legislation. When personal data is no longer required it will either be anonymised so that it no longer relates to you, or securely destroyed.

    11.2 Notwithstanding the above, it is important note that if we offer you employment, different retention periods will apply to the collection and processing of your personal data. If you require further information concerning the predefined retention periods that apply to your personal data, please contact the Human Resources Department.

12. Automated decision making

    We do not use your personal data to make significant automated decisions about you without human involvement. We will notify you if we make changes to the way we collect and process your personal data in this respect.

13. How we protect your personal data

    We are committed to protecting the personal data entrusted to us and we have therefore implemented appropriate technical and organisational measures to ensure that your personal data is afforded an adequate level of security protection, including where practicable, access controls, encryption, pseudonymisation and anonymisation measures.

14. Your data protection rights

    14.1 You have the following rights in relation to the processing of your personal data:

    14.1.1 Right of access: You have the right to request a copy of the personal data we hold about you.

    14.1.2 Right to rectification: You have the right to request the rectification of any inaccurate or incomplete personal data we hold about you.

    14.1.3 Right to erasure: You have the right to request the erasure of your personal data if there is no compelling reason for us to continue holding it.

    14.1.4 Right to restrict processing: You have the right to request that we temporarily restrict the processing of your personal data in certain circumstances.

    14.1.5 Right to data portability: You the right to ask us to provide your personal data to another organisation in a commonly used machine readable format, where you originally provided the information and the processing is based on your consent or the performance of a contract.

    14.1.6 Right to object: You have the right to object to the processing of your personal data.

    14.1.7 Rights in relation to automated decision-making and profiling: You have the right to object to automated decisions we make about you using your personal data, which have been taken solely by automated means without human involvement.

    14.1.8 Right to withdraw consent: Where we rely on your consent to process your personal data, you have the right change your mind and withdraw your consent at any stage.

    14.2 It is important to note that some of the data protection rights outlined above may only be exercised in certain circumstance and may be subject to legal exemptions. If we are unable to fulfil a request from you to exercise your rights, we will write to inform you of the reason for refusal.

    14.3 If you wish to exercise your data protection rights or require further information concerning these rights, please contact the Human Resources Department in the first instance.

15. How to make a complaint

    15.1 If you wish to make a complaint about the way we collect and use your personal data, you should raise this with the Human Resources Department in the first instance or if you prefer you can contact our Data Protection Officer by email: dpo@bb2.tech

    15.2 You also have the right to complain to the relevant data protection regulator at any stage:

    • UK Regulator Information Commissioner’s Office Wycliffe House, Water Lane, Wilmslow, SK9 5AF Website: ico.org.uk
    • DIFC Regulator Commissioner of Data Protection Dubai International Financial Centre Authority, Level 14, The Gate Building, O. Box: 74777, Dubai, UAE email: commissioner@dp.difc.ae

16. Employee privacy notice

    In the event that you are offered employment with us a separate Employee Privacy Notice will be provided to you to explain how we make use of the personal data we collect and process about you in connection with your employment.

17. Changes to this Notice

    We reserve the right to update this Notice from time-to-time to ensure it accurately reflects the way we collect and process your personal data. Any changes to this Notice will be published on our careers portal. You should therefore periodically review this Notice on our careers portal to ensure you understand how we collect and use your personal data.

Data Subject

Means a living, identifiable individual about whom Personal Data is processed.

Personal Data

means Data which relates to a living individual who can be identified from those Data or from those Data and other information which is in the possession of or is likely to come into our possession as Data Controller or Data Processor, as the case may be. Personal Data include opinions and any indications of our intentions towards an individual.

Processing

Includes obtaining, recording, holding, altering, retrieving, consulting, using, disclosing, blocking, erasing or destroying Personal Data.

Related Policy

Any Nomo Fintech policy which is expressly referred to in this Privacy Notice or any which is referred to in any compulsory training provided by Nomo Fintech.

Special Category Data

Means information about the Data Subject relating to the (a) racial or ethnic origin, (b) political opinions, (c) religious beliefs or other beliefs of a similar nature, (d) trade union membership, (e) physical or mental health or condition, (f) sexual life, (g) commission or alleged commission by any offence, and (h) any proceedings for any offence committed or alleged to have been committed, the disposal of such proceedings or the sentence of any court in such proceedings.

You, your

Means each Candidate in receipt of this Privacy Notice whether by notice, URL link or other form of communication.

This Privacy Notice applies to current and former candidates. This Privacy Notice does not constitute an offer of employment, form part of any contract of employment or other contract to provide services.

Nomo Fintech is the Data Controller in respect of the Personal Data Processed and, in this notice, references to “we”, “us” or “our” are references to Nomo Fintech.

This means that we are responsible for deciding how we hold and use Personal Data about you. You are being sent a copy of this Privacy Notice because you are applying for work with us (whether as an employee, worker or contractor). It makes you aware of how and why your Personal Data will be used, namely for the purposes of the recruitment exercise, and how long it will usually be retained for. It provides you with certain information that must be provided under the UK General Data Protection Regulation (UK GDPR).

1. Controller’s and Data Protection Officer’s contact details

Your Data is collected by: BB2 Digital Technology Services Limited, a private limited liability company registered in England and Wales under company number 13074216, having its registered address at 20 Churchill Place, Canary Wharf, London, E14 5HJ.

If you have any questions in relation to our use of your Data or this Recruitment Privacy Notice, please contact our Data Protection Officer (“DPO”) at DPO@nomo.tech.

2. Data Protection Principles

We will comply with Data Protection Law which state that the data we hold about you must be:

• used lawfully, fairly and in a transparent way;
• collected only for valid purposes that we have clearly explained to you and not used in any way that is incompatible with those purposes;
• adequate and relevant to the purposes we have told you about and limited only to those purposes;
• accurate and kept up to date;
• kept only as long as necessary for the purposes we have told you about; and
• kept securely.

3. What personal information we collect

In connection with your application to work with us, we will collect, store, and use the following categories of Data about you. If you fail to provide certain information when requested, we may not be able to progress your application.

Information provided in your curriculum vitae, cover letter or during the interview process including: your name, date of birth, age, gender, home address, personal email address, education, qualification and work experience details, remuneration details and references (as applicable).

Information collected or created by us during the recruitment process including: interview notes, test results, immigration/naturalisation records and correspondence between us.

Information about criminal convictions and credit checks: we carry out background and credit checks as part of the recruitment process.

Special categories of personal information including: information relating to disabilities, or physical or mental health information; race or ethnicity, religious beliefs and sexual orientation; and biometric information in the event you provide us with a photograph on your application.

Such Data may also include: name; title; address and address history; telephone number; personal email; date of birth; gender; employment history including salary and dates of employment; reason for leaving; dates employed and position whilst employed; qualifications; reference information; work status; visa requirements; eligibility to work; address history; education history; identification number; credit status and supporting documents for example, a copy of your government issued ID; certificates showing professional qualifications; documents that you provide that verify any gaps in your employment history; and any other Personal Data you make available.

4. How do we collect the data?

Data is collected directly from you, third-party sites, including but not limited to LinkedIn, or from an employment agency, job site or background check provider. We may sometimes collect additional information from third parties including former employers or credit reference agencies. We will collect additional data in the course of our recruitment process.

We may collect Data about Candidates from the following sources:

• You, the Candidate.
• Recruitment agencies (only where the agencies have obtained your consent to pass on your application for employment purposes).
• Background check providers.
• Publicly accessible sources for example your LinkedIn profile, Facebook and/or Twitter profile.
• Your named references.
• The Disclosure and Barring Service or equivalent.

5. How we use personal information

Pursuant to Data Protection Law, we have to inform you about the purposes for which we will Process or use your Data and these are listed below:

• Assess your skills, qualifications, and suitability for the work or advertised role.
• Carry out background and reference checks, where applicable.
• Assess your right to work in the UK (or other locations) in compliance with immigration rules.
• Communicate with you about the recruitment process.
• Keep records related to our hiring or recruitment processes.
• Carry out data analytics including the profiles of those applying for roles with us.
• Comply with legal or regulatory requirements for example comply with the duty to make reasonable adjustments for disabled job applicants and with other disability discrimination obligations.
• Comply with specific regulatory requirements of our customers.
• Manage the recruitment process, and ensure effective HR, personnel management and business administration.
• Monitor equal opportunities.
• Enable us to establish, exercise or defend possible legal claims.

We may Process Data about you in compliance with our Lawful Basis (see below) and/or where this is required or permitted by law. Some of the above grounds for Processing will overlap and there may be several grounds which justify our use of your Data.

We will only use your Data for the purpose for which it was collected, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purposes. If we need to use your Data for an unrelated purpose, we will notify you and we will explain the legal basis which allows us to do so. We may also process your Data without your knowledge or consent, in compliance with the above rules, where this is permitted or required by law.

6. Why we use personal information

Under Data Protection Law, Data Controllers must justify the use of Data by establishing a “Lawful Basis” of Processing. Below we set out each Lawful Basis in relation to your Personal Data and Special Category Data. We will use the information collected from you because:

• it is necessary for us to do so before entering into a contract with you;
• we need to process your information in order to comply with a legal or regulatory obligation; and/or
• because we or a third party have a legitimate interest to:
• ensure the effective administration and management of the recruitment process;
• ensure we hire a suitable individual for a role; or
• deal with disputes and accidents and take legal or other professional advice or ascertain your fitness to work.

Having received your CV and covering letter we will then process that information to decide whether you meet the basic requirements to be shortlisted for the role. If you do, we will decide whether your application is an appropriate fit and whether to invite you for an interview. If we decide to contact you for an interview, we will use the information you provide during the interview stages to decide whether to offer you the role or work. If we decide to offer you the role or work, we will then take up references, carry out a criminal record check and/or carry out any other relevant checks before confirming your appointment.

If the collection of any of your Data is not mandatory (for example, where we collect information on a voluntary disclosure basis for equal opportunities monitoring), we will let you know this before we collect it, as well as the consequences of failing to provide us with this information (if any).

If you fail to provide Data when requested, which is necessary for us to consider your application (such as evidence of qualifications or work history), we will not be able to process your application successfully. For example, if we require a credit check or references for this role and you fail to provide us with relevant details, we will not be able to take your application further.

7. How we use special category personal information

We may process your special categories of personal information:

• to consider whether we need to provide appropriate adjustments during the recruitment process, for example, whether adjustments need to be made during a test or interview;
• to ensure meaningful equal opportunity monitoring and reporting; or
• to comply with any legal or regulatory obligation.

8. When we use special category personal information

We may use special categories of Personal Data collected about you where:

• you have provided your explicit consent;
• we need to do so to carry out our legal obligations;
• it is necessary for the establishment, exercise or defence of legal claims in relation to court cases;
• there is a substantial public interest; or
• it is needed to protect your interests (or someone else's interests) and you are not capable of giving your consent.

9. Information about criminal convictions

As part of the recruitment process, we ask you for information in relation to unspent criminal convictions and we carry out criminal background checks. We use this information and these checks:

• to assess your suitability for a regulated role;
• to protect your interests, our interests and third-party interests; or
• because it is necessary in relation to legal claims. We are allowed to use your personal information in this way where it is necessary to carry out our employment rights and obligations.

10. Retention of your information

The periods for which Data will be stored and the criteria used to determine retention periods or whether Data can be removed will depend on the information in question, its relevance or sensitivity; however, generally, Data will be removed if it has been superseded by other relevant or up to date information, if it is out of date, irrelevant or no longer necessary.

Generally, this means that your Data will be retained until the end of your employment application, or work relationship with us plus a reasonable period thereafter once we have communicated to you our decision about whether to appoint you to a role or offer you work. We retain your Data for that period so that we can show, in the event of a legal claim, that we have not discriminated against Candidates on prohibited grounds and that we have conducted the recruitment exercise in a fair and transparent way. After this period, we will securely destroy your Data in accordance with our Data Retention Policy. In some circumstances we may anonymise your Data so that it can no longer be associated with you, in which case we may use such information without further notice to you.

11. Change of Purpose

We will only use your Data for the purpose for which it was collected, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purposes. If we need to use your Data for an unrelated purpose, we will notify you and we will explain the legal basis which allows us to do so. We may also process your Data without your knowledge or consent, in compliance with the above rules, where this is permitted or required by law.

12. Who may we share your personal data with?

We will only share your Data with the following third parties for the purposes of processing your application:

• recruitment agencies and platforms, such as LinkedIn and CW Jobs;
• applicant tracking systems, such as Lever;
• background check and online test providers;
• credit reference agencies; and/or
• regulators and competent authorities.

All our third-party service providers and other entities in the group are required to take appropriate security measures to protect your personal information in line with our policies. We do not allow our third-party service providers to use your personal data for their own purposes. We only permit them to process your personal data for specified purposes and in accordance with our instructions.

Your Data may also be shared and processed by other companies within our group, for example where they provide services to us, for entering a contract with you for the provision of our services or to perform obligations under that contract. The transfer of this information is governed by an International Data Processing and Transfer Agreement (Intra-Group) contract including any applicable transfer mechanisms.

13. Data transfers

We may transfer the Data we collect about you to countries outside the UK for the purposes of administrating the recruitment process. For example, we use Lever Inc. to receive and manage applications submitted through the website. This information is hosted by Lever in the United States of America.

Where we transfer your Data outside the UK, we make sure that your data is protected and that the transfer is subject to appropriate safeguards or is otherwise permitted under applicable law. Those may include (i) adequacy decisions as issued by the UK Information Commissioner’s Office; (ii) entering into the UK International Data Processing Agreement and/or Addendum to the EU Standard Contractual Clauses (SCCs), as applicable.

If you would like further details of such safeguards, please notify us at the address above.

14. Your rights: You have the following rights in connection to your information

Under certain circumstances, by law you have the right to:

• Request access to your personal information (commonly known as a "data subject access request"). This enables you to receive a copy of the personal information we hold about you and to check that we are lawfully processing it.
• Request correction of the personal information that we hold about you. This enables you to have any incomplete or inaccurate information we hold about you corrected.
• Request erasure of your personal information. This enables you to ask us to delete or remove personal information where there is no good reason for us continuing to process it. You also have the right to ask us to delete or remove your personal information where you have exercised your right to object to processing (see below).
• Object to processing of your personal information where we are relying on a legitimate interest (or those of a third party) and there is something about your particular situation which makes you want to object to processing on this ground. You also have the right to object where we are processing your personal information for direct marketing purposes.
• Request the restriction of processing of your personal information. This enables you to ask us to suspend the processing of personal information about you, for example if you want us to establish its accuracy or the reason for processing it.
• Request the transfer of your personal information to another party.
• If you want to review, verify, correct or request the erasure of your personal information, object to the processing of your personal data, or request that we transfer a copy of your personal information to another party, please contact the DPO in writing.

Right to withdraw consent

When you applied for this role, you provided consent to us processing your personal information for the purposes of the recruitment exercise. You have the right to withdraw your consent for processing for that purpose at any time. To withdraw your consent, please contact the DPO at the address listed above. Once we have received notification that you have withdrawn your consent, we will no longer process your application and, subject to our retention policy, we will dispose of your personal data securely.

You also have a right to complain to a supervisory authority, in particular:

• where the UK GDPR applies, you can make a complaint to the Information Commissioner’s Office (Tel: 0303 123 1113 or at www.ico.org.uk).

15. Providing us with up-to-date Data

The requirement for you to provide us with Data is a contractual requirement as well as in some cases, a statutory one, necessary to enter into a contract and working relationship. The contract could be an employment contract or in relation to work more generally. If you do not provide us with the Data we request in order to fulfil a contractual requirement, this may impact our ability to proceed with employment or candidacy for employment or work or affect entitlement to pay and benefits, for example, and also impact our ability to comply with other legal obligations.

16. Local laws

Please note this notice has been drafted in respect of the UK and EEA data privacy requirements. To the extent any other local applicable laws conflict with the contents of this privacy notice, such applicable laws shall prevail.

17. Changing this Privacy Notice

We reserve the right to update this Privacy Notice at any time, and it will provide you with a new Privacy Notice when we make substantial changes. We may also notify you in other ways from time to time about the processing of your Data.

Any questions about this Privacy Notice should be directed to DPO@nomo.tech.