Privacy policy for recruitment using Teamtailor

The service for handling recruitments and simplifying the hiring process (the "Service") is powered by Teamtailor on behalf of Want2BThere Limited ("Controller", “we” or “us”). It is important that the persons using the Service to apply for work with us ("Users” or “you”) feel safe with, and are informed about, how we handle User's personal data in the recruitment process. 

You are being provided with this privacy policy (the “Privacy Policy”) because you are applying for work with us (whether as an employee, worker or contractor). It makes you aware of how and why your personal data will be used, namely for the purposes of the recruitment exercise, and how long it will usually be retained for. This means that we are responsible for deciding how we hold and use personal information about you.

We strive to maintain the highest possible standard regarding the protection of personal data. We process, manage, use, and protect and retain User's Personal Data in accordance with this Privacy Policy. This Privacy Policy provides Users with certain information that must be provided under applicable privacy legislation. References to “applicable privacy legislation” in this Privacy Policy mean any law applicable to us from time to time relating to the processing of personal data and/or privacy as in force as at the date of this Privacy Policy, or as re-enacted, amended, superseded, repealed or consolidated, including without limitation the EU General Data Protection Regulation 2016/679 ("GDPR"), the Data Protection Act 2018, and from 1 January 2021, the "UK GDPR" (which is the EU General Data Protection Regulation 2016/679 as it forms part of the law of England, Wales, Scotland and Northern Ireland by virtue of the European Union (Withdrawal) Act 2018). This Privacy Policy  does not form part of any contract of employment or other contract to provide services. We may update this Privacy Policy at any time.

1. General

Want2BThere Limited is the  data “Controller" for the purposes of applicable privacy legislation. This means that we are responsible for deciding how we hold and use personal information about you. We will comply with data protection law and principles, which means that Users’ data will be used lawfully, fairly and in a transparent way; collected only for valid purposes that we have clearly explained to you and not used in any way that is incompatible with those purposes;   relevant to the purposes we have told you about and limited only to those purposes;   accurate and kept up to date; kept only as long as necessary for the purposes we have told you about and kept securely.

2. Collection of personal data

We are responsible for the processing of the personal data that the Users contribute to the Service, or for the personal data that we in other ways collect with regards to the Service.

When and how we collect personal data

In connection with your application for work with us, we will collect, store, and use the following categories of personal information about you:

• The information a User has provided to us when making an application through the Service (in your curriculum vitae and application,  including name, title, address, telephone number, personal email address, date of birth, gender, employment history and qualifications) or otherwise, adding personal data about themselves either personally or by using a third-party source such as Facebook or LinkedIn; and
• Any information you provide to us  when you use the Service to connect with our staff, adding personal data about yourself either personally or using a third-party source such as Facebook or LinkedIn;
• Any information provided during an interview or in the chat (provided through the website that uses the Service) and such data is of relevance to the application procedure; 
• Any information your references provide to us in relation to you; and
• Any other information provided by the User by video, audio or other media.

We may also collect, store and use the following types of more sensitive personal information if a User provides this, such as:

• Information about your race or ethnicity, religious beliefs, sexual orientation and political opinions.
• Information about your health, including any medical condition, health and sickness records.

It is important that the personal information we hold about you during any recruitment process is accurate and up to date. Please let us know straight away if your personal information changes the recruitment process. 

We collect data from third parties, such as Facebook, Linkedin, recruitment agencies introducing Users to us, references provided by Users and through other public sources. This is referred to as “Sourcing” and will be manually performed by our employees or automatically in the Service.

In some cases, existing employees can make recommendations about potential applicants. Such employees will add personal data about such potential applicants. In the cases where this is made, the potential applicant is considered a User in the context of this Privacy Policy and will be informed about the processing.

The types of personal data collected and processed

The categories of personal data that can be collected through the Service can be used to identify natural persons from names, e-mails, pictures and videos, information from Facebook and LinkedIn-accounts, answers to questions asked through the recruiting, titles, education and other information that the User or others have provided through the Service. Only data that is relevant for the recruitment process is collected and processed.

Purpose and lawfulness of processing

The purpose of the collecting and processing of personal data is to manage recruiting. The lawfulness of the processing of personal data is our legitimate interest to simplify and facilitate recruitment. We will use the personal information we collect about Users to assess their skills, qualifications, and suitability for the role, carry out reference checks, communicate with Users about the recruitment process, keep records relating to our hiring processes and comply with legal or regulatory requirements. We also need to process Users personal information to decide whether to enter into a contract of employment with a User. It is in our legitimate interests to decide whether to appoint you to a role since it would be beneficial to our business to appoint someone to that role. We also need to process your personal information to decide whether to enter into a contract with you. 

We will only use your personal information when the law allows us to, which will normally be 

• Where we need to in order to consider your application and throughout your participation in any recruitment process with us
• Where we need to comply with a legal obligation.
• Where it is necessary for our legitimate interests (or those of a third party) and your interests and fundamental rights do not override those interests.

We may also use your personal information in the following situations, which are likely to be rare: (i)  Where we need to protect your interests (or someone else's interests) or (ii) where it is necessary in the public interest. 

We may process special categories of personal information in the following circumstances: 

• In limited circumstances, with your explicit written consent.
• Where we need to carry out our legal obligations and in line with our data protection policy.
• Where it is required in the public interest, such as for equal opportunities monitoring, and in line with our data protection policy. 
• Less commonly, we may process this type of information where necessary in relation to legal claims or to protect your interests (or someone else's interests) and you are not capable of giving your consent, or where you have already made the information public.

We do not envisage that we will process information about criminal convictions.

We do not need your consent if we use special categories of your personal information in accordance with our written policy to carry out our legal obligations or exercise specific rights in the field of employment law.

Users will not be subject to decisions that will have a significant impact on them based solely on automated decision-making.

The consent of the data subject

The User consents to the collection and processing of its personal data for the purpose of the Controller’s recruiting processes as set out in this Privacy Policy. The User consents to the collection of personal data through the Service, when that User:

• makes an application through the Service, adding personal data about themselves either personally or by using a third-party source as Facebook or LinkedIn, and understands that the Controller may use external sourcing-tools to add additional information; and
• uses the Service to connect to the Controller’s recruitment department, adding personal data about themselves either personally or by using a third-party source such as Facebook or LinkedIn.

The User also consents to the Controller collecting publicly available information about the User and compiling them for use in recruitment purposes.

The User has the right to withdraw his or her consent at any time, by contacting the Controller using the contact details listed in section 9 below. Using this right may however, mean that the User can not apply for a specific job or otherwise use the Service.

Storage and transfers

The personal data collected through the Service is stored and processed inside the UK and/or the EU/EEA, such third country that is considered by the European Commission to have an adequate level of protection, or processed by such suppliers that have entered into such binding agreements that fully complies with the lawfulness of third country transfers or to other suppliers where the adequate safeguards are in order to protect the rights of the data subjects whose data is transferred. A copy of the “model clauses” approved by the European Commission for such purposes can be found on the European Commission website or at the link here.

How long the personal data will be processed

If a User does not object or withdraw their consent  to the processing of their personal data, the personal data will be stored and processed by us for a period of 12 months after we have communicated to the User our decision about whether or not to appoint the User to the role as an applicant (User) may be interesting for future recruitment and for this purpose we may store Users’ Personal Data for this period. After this period, Users are asked if they would like us to destroy their details or retain them for a further specified period and their details are securely destroyed in accordance with applicable laws and regulations unless the User requests us to retain their details for a further period. If you as a User wish not to have your Personal Data processed for this purpose (future recruitment) please contact us using the contact details in section  9 below.

3. Users’ rights

Under certain circumstances, by law Users have the right to:

• Request access to your personal information (commonly known as a "data subject access request"). This enables you to receive a copy of the personal information we hold about you and to check that we are lawfully processing it.
•  Request correction of the personal information that we hold about you. This enables you to have any incomplete or inaccurate information we hold about you corrected.
•  Request erasure of your personal information. This enables you to ask us to delete or remove personal information where there is no good reason for us continuing to process it. You also have the right to ask us to delete or remove your personal information where you have exercised your right to object to processing (see below).
•  Object to processing of your personal information where we are relying on a legitimate interest (or those of a third party) and there is something about your particular situation which makes you want to object to processing on this ground. 
•  Request the restriction of processing of your personal information. This enables you to ask us to suspend the processing of personal information about you, for example if you want us to establish its accuracy or the reason for processing it.
•  Request the transfer of your personal information to another party.

If you want to review, verify, correct or request erasure of your personal information, object to the processing of your personal data, or request that we transfer a copy of your personal information to another party, please contact us using the contact details set out at section 9 below.

A User also has the right to lodge a complaint to the supervisory authority regarding the processing of personal data relating to him or her, if the User considers that the processing of personal data infringes the legal framework of privacy law. The supervisory authority in the UK is the Information Commissioner's Office.

4. Security

We take the measures that can be reasonably expected to make sure that the personal data of Users and others are processed safely and in accordance with this Privacy Policy and applicable privacy legislation. We have put in place appropriate security measures to prevent Users personal information from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. In addition, we limit access to Users personal information to those employees, agents, contractors and other third parties who have a business need-to-know. They will only process your personal information on our instructions and they are subject to a duty of confidentiality. 

However, transfers of information over the internet and mobile networks can never occur without any risk, so all transfers are made on the own risk of the person transferring the data. It is important that Users also take responsibility to ensure that their data is protected. It is the responsibility of the User to ensure that their login information is kept secret.

5. Sharing of personal datas

We will not sell or otherwise transfer Users’ personal data to third parties.

We will only sharer Users’ Personal Data with:

• our group companies and where relevant our contractors and sub-contractors, acting as our Processors and Sub-Processors in accordance with our instructions, for the provision of the Service and for the processing of your application and consideration of you for the role in question;
• authorities or legal advisors in cases where criminal or improper behaviour is suspected or disclosure is required by law. 

We will only transfer Users’ personal data to third parties that we have confidence in. We carefully choose partners to ensure that the User’s personal data is processed in accordance with  current applicable privacy legislation. All our third-party service providers and other entities in the group are required to take appropriate security measures to protect your personal information in line with our policies. We do not allow our third-party service providers to use your personal data for their own purposes. We only permit them to process your personal data for specified purposes and in accordance with our instructions.

We work with the following categories of processors of personal data; Teamtailor, who supplies the Service, server and hosting companies, e-mail reference companies, video processing companies, information-sourcing companies, analytical service companies and other companies with regards to supplying the Service.

We have put in place appropriate security measures to prevent your personal information from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. In addition, we limit access to your personal information to those employees, agents, contractors and other third parties who have a business need-to-know. They will only process your personal information on our instructions and they are subject to a duty of confidentiality. 

We have put in place procedures to deal with any suspected data security breach and will notify you and any applicable regulator of a suspected breach where we are legally required to do so.

6. Aggregated data (non-identifiable personal data)

We may share aggregated data with third parties. The aggregated data has in such instances been compiled from information that has been collected through the Service and can, for example, consist of statistics of internet traffic or the geological location for the use of the Service. The aggregated data does not contain any information that can be used to identify individual persons and is therefore not personal data.

7. Cookies

When Users use the Service, information about their usage may be stored as cookies. Cookies are passive text files that are stored in the internet browser on the User’s device, such as computer, mobile phone or tablet, when using the Service. We use cookies to improve the User’s usage of the Service and to gather information about, for example, statistics about the usage of the Service. This is done to secure, maintain and improve the Service. The information that is collected through the cookies can in some instances be personal data and is, in such instances, regulated by the Cookie Policy.

Users can at any time disable the use of cookies by changing the local settings in their devices. Disabling of cookies can affect the experience of the Service, for example disabling some functions in the Service.

8. Changes

We reserve the right to update this Privacy Policy at any time, and we will provide Users with a new Privacy Policy  if we make any substantial updates whilst you are engaged in any recruitment process with us. We may also notify you in other ways from time to time about the processing of your personal information. 

9. Contact

For questions, further information about our handling of personal data or to exercise your rights please contact raphael.frascogna@loveholidays.com

Date of last update: 2 December 2020