CANDIDATE PRIVACY NOTICE

Last updated: June 2023
Previous version: October 2022

C&W", "we" or "us") respects the privacy rights of individuals and is committed to handling personal information responsibly and in accordance with applicable law. It is important that you read all of this privacy notice ("Privacy Notice") carefully as it sets out how we collect use, retain, share and delete the personal information we receive when you apply for a job or other role with us and the rights you have in connection with that information. The term "applicants" is used in this Privacy Notice to refer to anyone who applies for a job role, or who otherwise seeks to carry out work with or for us (whether on a permanent or non-permanent basis). 

If you have any comments or questions about this Privacy Notice, please contact us using the contact details set out at the bottom of this Privacy Notice.

1. Categories of Personal Information we receive when you apply

   You can visit the recruitment section of our website ("Website") and search for jobs without providing Personal Information. However, we do collect certain information automatically from your device when you visit our Website. For further information, please see the privacy notice that applies to the use of our Website generally, including the recruitment section of the Website. 

   Note also that your use of our Website is governed by our Terms of Use.

   The Personal Information we collect may be provided by you directly, or we may obtain Personal Information automatically or from third parties such as references, prior employers, places of education, or other data sources.

   Where permitted by, and in accordance with applicable law, the types of Personal Information we collect and use can include:

2. Identification data and contact details – including your name, address, email address, phone number and other contact information, gender, race or ethnic origin, sexual orientation, marital status, veteran status, date of birth, nationality/ies, national identifiers (such as national ID/passport, social security number(s)), physical characteristics or description, and other personal and online identifiers.
3. Employment history – such as previous employers and job titles/positions.
4. Background information – such as academic/professional qualifications, job qualifications, education, details included in your CV/résumé (which might include details of any memberships or interests constituting sensitive personal information), transcripts and employment references.
5. Details of your nominated referees (including their name, contact details, employer, and job role).
6. Details of your residency, citizenship, visa status, work permit status, and military status.
7. Previous applications/roles (information relating to previous applications you have made to the C&W Group and/or any previous employment history with the C&W Group).
8. Job application information – such as the roles for which you are applying, your job application and related documentation/communications, cover letters, information from interviews and phone screenings, compensation/benefits requests, relocation information.
9. Health information, physical limitations and special accommodations needed.
10. CCTV/Building access control – for the purposes of any visit to a C&W premises (e.g. for interview), please note that we may deploy CCTV and/or building access controls (which involve the processing of CCTV images and/or other Personal Information such as visitor name and time of access to the building) for security and law enforcement purposes, to establish, exercise or defend our legal rights and/or to protect the vital interests of any person. 
11. Information required for us to comply with laws, including at the direction of law enforcement authorities or court orders.
12. Other information linked to the Personal Information above or that you voluntarily provide throughout the process, including through assessment centres / exercises and interviews. 

We will obtain your explicit consent to process any of the above Personal Information, if required to do so by applicable law.

In some circumstances, to the extent permitted by, and in accordance with, applicable law, we may need to collect, or request on a voluntary disclosure basis, some Personal Information above that falls under a sub-category of “Sensitive Personal Information,” or a similar term, as defined by certain laws. We collect Sensitive Personal Information as necessary to fulfil legitimate recruitment-related purpose, and do not use such information to infer characteristics about you. For example, we may collect information about your racial/ethnic origin, gender and disabilities for the purposes of equal opportunities monitoring, to comply with anti-discrimination or other laws and for government reporting obligations (any reports produced by us in this context would not directly identify you, unless we are legally required to do so); or information about your physical or mental condition to consider accommodations for the recruitment process or at job offer stage for the purposes of making any necessary accommodations for the relevant job role. You may provide, on a voluntary basis, other Sensitive Personal Information during the recruitment process. 

We do not collect biometric information at this time.

Personal Information collected from other sources and operation of a talent pool

We may collect Personal Information other than directly from you, for example:

1. Information provided by recruitment or executive search agencies.
2. References provided by referees.
3. Other background information provided or confirmed by academic institutions and training or certification providers.
4. Criminal records data obtained through criminal records checks (in countries where such checks are permitted by applicable law and are carried out). 
5. Information provided by background checking agencies and other external database holders (for example credit reference agencies and professional / other sanctions registries). 
6. Information collected from publicly available sources, including any professional social media platforms you use or other relevant information available online.
7. From other C&W group companies for the purposes outlined in this Privacy Notice.

(in each case where permissible by, and in accordance with applicable law, including any requirement in relation to obtaining your consent, and, in the case of criminal records checking, use of background checking agencies, and collecting information from publicly available sources, where justified by reference to the job role, in which case you will be provided with further information prior to the checks being carried out). 

Unsuccessful Applications

If your application is unsuccessful, we will add your Personal Information to our talent pool for the purposes of creating a profile about you within such talent pool. We may combine the Personal Information you provide to us with information obtained from third party sources, including publicly available sources for such purposes (e.g., publicly available platforms on which you publish a professional profile). 

We will retain this profile information for a period (as per Section 6 below) to identify job opportunities for which you may be suitable from time to time and to contact you about such opportunities (and to ensure that we do not contact you again in relation to the same or similar roles). You can opt out of your inclusion in the talent pool at any time by contacting the email address in Section 9 below. If required by law, we will obtain your consent before including your Personal Information in the talent pool.

Successful Applications

If you are accepted for a role at C&W, the information collected during the recruitment process will also be used to assist with the process of on-boarding (including establishing systems access and preparing for induction), and will form part of your ongoing staff member record (where relevant to the ongoing employment relationship), subject to our internal employee privacy notice.

1. Purposes for processing Personal Information

   We collect and use Personal Information for our business purposes, which include, without limitation:

• managing and improving our recruitment and hiring processes
• assessing your skills, qualifications, and background for a particular role, and communicating with you about your application
• ·organizing interviews and tests, verifying your information, and carrying out reference checks or background checks, where applicable.
• for operational purposes, such as maintaining and improving our business operations, technology, and security.
• complying with government-required reporting.
• complying with applicable laws, regulations, legal processes, or enforceable government requests as necessary, such as by detecting and protecting against security incidents, fraud, and illegal activity.

   

1. Categories of third parties we may share Personal Information with

   We do not share or release your Personal Information except in the limited circumstances described below.  When we permit a third party to access Personal Information, we expect that they only use or disclose your Personal Information in a manner consistent with this Privacy Notice and that the security and confidentiality of the information is maintained.

   With your consent

   We do not sell or share your Personal Information, and will not sell or share your Personal Information, without your explicit consent. You may agree or direct us to share your Personal Information with others in order to fulfil services you request or as part of the hiring process.

   Transfers to other group companies

   We may share your Personal Information with other members of the C&W Group for processing in accordance with the purposes set out in this Privacy Notice. 

   Transfers to vendors and others on our behalf

   We may make Personal Information available to our employees, contractors, consultants and other parties who require such information to assist us with establishing and managing aspects of our relationship with you. We may also share your Personal Information with service providers or with other parties in a manner consistent with the use and disclosure provisions of this Privacy Notice. This may include recruitment or executive search agencies, background checking or other screening providers and relevant local criminal records checking agencies (where relevant), and IT service providers.

   To comply with our legal obligations or to prevent harm

   We may preserve or disclose information about you where necessary to abide by law, regulation, or contract; to respond to a court order, administrative or judicial process, including, but not limited to, a subpoena, government audit or search warrant; to respond to lawful requests by public authorities (including for tax, immigration, health and safety, company registry, national security, or law enforcement purposes); to communicate with relevant regulators, where C&W proposes to provide regulated training to you as part of the potential role; and as necessary, to establish, exercise or defend against potential, threatened or actual legal claims. We may also disclose Personal Information where necessary to prevent, detect, or investigate illegal activity, fraud, abuse, violations of our terms, or threats to the security of our services or the physical safety of any person.

    

2. Individuals in the European Economic Area and the United Kingdom: Your Rights Regarding Personal Information

   Applicants within the European Economic Area (EEA) and the United Kingdom (UK) have certain rights under GDPR and other applicable data protection laws in relation to the processing of your Personal Information. These include the right to:

3. request access, correction, update or deletion of your Personal Information. You have the right to make such a request at any time.
4. restrict or object to processing of your Personal Information. You have the right to ask us to restrict processing of your Personal Information under certain circumstances or to object to the processing of your Personal Information on grounds relating to your personal situation.
5. portability. Whenever we process your Personal Information based on your consent or based on an agreement, you have the right to have a copy of your Personal Information in a usable electronic format transferred to you or to another party. This applies to Personal Information you have provided to us.
6. lodge a complaint with your local data protection authority or regulatory body about our collection and use of your Personal Information. For more information, please contact your local data protection authority. 

How you can exercise your rights

If you wish to exercise one of your rights stated above or have any questions about our use of your Personal Information, please use the contact information at the bottom of this Privacy Notice. We will respond to any requests we receive from individuals wishing to exercise their data protection rights in accordance with applicable data protection laws. We may in some instances not be able to comply with your request. Please note that we may request you to provide us with additional information in order to confirm your identity and ensure that you are entitled to access the relevant Personal Information.

Depending on your country of residence, you may also raise any questions or concerns you have regarding Personal Information with your local data protection authority.

Our legal basis for processing Personal Information

We only process your Personal Information when we have a legal basis to do so and for the purposes outlined in this Privacy Notice. We process your Personal Information:

1. to comply with our legal obligations, including applicable immigration and/or employment laws and regulations. 
2. to take steps prior to entering an employment contract with you, where you are considered for employment. 
3. to protect the rights and interests of the C&W Group, our employees, applicants, and others, as required and permitted by applicable law.
4. with your voluntary consent.
5. to meet our legitimate interests, including, for example, conducting our recruitment processes, managing applicants, responding to requests from, and other communications with, public, governmental, judicial or other regulatory authorities, and protecting our rights, property or security and those of job applicants.

If we process your Personal Information on the basis of your consent, then you can withdraw your consent at any time. Withdrawing your consent will not affect the lawfulness of any processing we conducted prior to your withdrawal, nor will it affect processing of your Personal Information conducted in reliance on lawful processing grounds other than consent.

You can choose not to provide Personal Information to us. However, when we are required by law to collect Personal Information about you, your failure to provide this information may prevent or delay the fulfilment of our legal obligations and may impact our ability to employ you.

International data transfers

Your Personal Information may be transferred internationally, including from the EEA to a country outside it, for the purposes referred to under this Privacy Notice. These countries may have data protection laws that are different to the laws of your country (and, in some cases, may not be as protective).

Specifically, our Website servers are located in the United States, and our group companies and third-party service providers are based around the world. This means that when we collect your Personal Information, we may process it in any of these countries. For example, we use a recruitment platform that entails the processing of recruitment personal data in the US.

C&W implements safeguards necessary to comply with GDPR (see Section 5 “Securing your Personal Information”), and you may request more information on particular safeguards at any time by using the contact information at the bottom of this Privacy Notice.  

1. Securing your Personal Information

   We take steps to safeguard your Personal Information in accordance with this Privacy Notice. These include implementing appropriate safeguards up to and including the European Commission’s Standard Contractual Clauses (under Article 46.2 of the General Data Protection Regulation) for transfers of Personal Information across international borders. 

   In the context of certain arrangements with our third-party service providers we additionally rely on Transfer Risk Assessments (TRA) (pursuant to Article 45 of the General Data Protection Regulation).

   We implement reasonable technical, administrative and physical controls to safeguard the Personal Information under our control against loss and unauthorised alteration or disclosure. We use role-based access controls to limit access to your Personal Information on a strict need-to-know basis consistent with the purposes for which we have collected such information. We use appropriate anti-malware and intrusion detection systems to guard against unauthorised access to our network, and we have an incident response plan in place to quickly respond to any suspected leak or breach of Personal Information. Despite our efforts, no website or internet transmission is completely secure and we cannot guarantee the security of your Personal Information stored or sent to us. You should also take adequate precautions to protect your Personal Information.

    

2. Data retention periods

   Personal Information will be stored in accordance with applicable laws and kept as long as needed to carry out the purposes described in this Privacy Notice or as otherwise required by applicable law. 

   We use the following criteria to determine how long to retain Personal Information:

   • Our relationship with you, and the products and services we provide to you;
   • Your requests to us regarding your information, or our products or services;
   • Any legal obligations to retain the data, or for our own legal purposes (such as enforcing our agreements or litigation);
   • Recommendations and legal requirements in applicable labor and employment; and
   • Technical considerations and feasibility, and the level of protections in place for your Personal Information.
     
     

   If your application is unsuccessful and you do not opt-out of inclusion of your Personal Information in our talent pool, we will keep your profile information for 12 months from the date that you submitted your application (or the latest update of your details by you). Prior to deleting your profile information, we may send you a reminder to give you an option to keep your Personal Information in our talent pool after the above period. If you agree, we will keep your Personal Information for an additional 12-month period. If required to do so under applicable law in a particular country, we will obtain your explicit consent to inclusion of your details in the talent pool.

   Where we undertake vetting for certain positions (where permissible and in accordance with applicable law), we will destroy the information obtained by a vetting exercise as soon as possible, or in any case, within 6 months (retaining only a record of the result). 

   In general, we will not hold recruitment records beyond the statutory period in which a claim arising from the recruitment process may be brought unless there is a clear business reason for exceeding this period.

    

3. California Privacy Rights

   Under the California Consumer Privacy Act of 2018 (“CCPA”) and the California Privacy Rights Act of 2020 (“CPRA”), California residents may have the right to:

   • Transparency. Businesses that collect Personal Information subject to the above listed laws are required to provide you with notice regarding the categories of Personal Information to be collected, the purposes for which the categories of Personal Information are collected or used, whether that information is sold or shared, and the length of time we intend to retain each category of Personal Information, or if that is not possible, the criteria used to determine that period, among other information.
   • Opt out of the sale or sharing of Personal Information. Although California residents have the right to opt out of the transfer of Personal Information to third parties for valuable consideration or cross-context behavioral advertising purposes, C&W does not sell or share your Personal Information.
   • Access the categories and specific pieces of Personal Information we have collected about you, the categories of sources from which the Personal Information is collected, the business purpose for collecting the Personal Information, and the categories of third parties with whom C&W shares Personal Information.
   • Limit the use and disclosure of sensitive Personal Information.
   • Correct inaccurate or obsolete Personal Information that C&W may maintain.
   • Delete Personal Information under certain circumstances.
   • Not be discriminated against on the basis of your exercising any of the rights afforded by the CCPA and CPRA.

   To request access to, correct, or delete your Personal Information, please contact us by emailing privacynorthamerica@cushwake.com or calling this toll-free number: +1-844-339-8836. You may alternatively complete and submit the appropriate online request form in our online request portal by following the below links:

   Access My Information

   Delete My Information

   Please specify in your request what Personal Information you would like to access, correct or delete.

   We will first acknowledge receipt of your request within 10 business days and provide a substantive response within 45 calendar days after its receipt. If we require more time (up to 90 days or the permitted timeframe), we will inform you of the reason and extension period in writing.

   Only you or an authorized agent may make a verifiable consumer request related to your Personal Information. To respond to your requests, we must verify your identity.

   • How to Authorize an Agent. You may designate an authorized agent to submit your verified consumer request on your behalf, but only if you have completed the Agent Authorization Form and you have taken steps to verify your identity directly with us.
   • How We Verify Your Request. We will only use the Personal Information provided in the context of your request to verify your identity or the authority of your authorized agent to make the request. Depending on the request, we may need you to submit or acknowledge the request from your work-provided email or other account or provide at least two pieces of Personal Information we already have in our possession, including your emergency contact person or last four digits of your Social Security Number. We will verify your request by comparing the information you provide to information already in our possession to minimize the risk of fraud.

      

4. Changes to this Privacy Notice

   We may modify or update this Privacy Notice to account for changes in our collection and use of your Personal Information, or due to updates in applicable law. If we make a material change to this Privacy Notice, we will notify you of the change, as appropriate. For administrative changes, we may provide indication by updating the “Last Updated” date at the top of this Privacy Notice.

    

5. Contact details

We welcome data protection and privacy related questions. Please address any questions or requests relating to this Privacy Notice:

• For USA and Canada please contact: privacynorthamerica@cushwake.com
• For Europe, Middle East and Africa please contact: privacyemea@cushwake.com
• For South America please contact: DPO.Brasil@cushwake.com
• For Asia, Pacific, Australia, and New Zealand please contact: privacyapac@cushwake.com
• For Greater China please contact: GChina.Privacy@cushwake.com