Candidate Privacy Notice

This notice explains how The NeoBankers Group Limited (“the Company”) uses the personal data of people who apply to work with the Group, including people who send a speculative application. It is given under Articles 13 and 14 of the UK General Data Protection Regulation (“UK GDPR”) and should be read with the Privacy and Cookie Policy. References to “the Group” are to the Company and its subsidiaries.

1. Who is responsible for your data

The Company is the controller of the personal data described in this notice. It is a private company limited by shares, incorporated in England and Wales (Company No. 13821747), with its registered office at 5th Floor, 167–169 Great Portland Street, London W1W 5PF, United Kingdom. Where a role is with another Group company, that company is also a controller of your data for that role, and you will be told which company it is.

Questions about this notice, and requests to exercise your rights, should be sent through the Data protection request form.

2. Whom this notice covers

This notice covers applicants for advertised roles, people who send a speculative application through the Careers form, candidates invited to interview, and people who apply for an engagement as an independent contractor. It also covers referees, whose contact details candidates provide.

3. What personal data the Company collects

• Identity and contact details: title, name, e-mail address, telephone number, and country of residence.
• Your application: your introduction, area of expertise, years of experience, current role and employer, LinkedIn profile, and preferred location, as entered in the Careers form.
• Documents the Group asks for: a CV, covering letter, qualifications, and examples of work, if the Group invites you to the next stage. Please do not send a CV with your first note.
• Selection records: notes of conversations and interviews, assessment results, and the reasons for a decision.
• References: obtained only with your agreement and normally only after an offer.
• Right-to-work information: identity and immigration documents, checked before any engagement in the United Kingdom.
• Adjustments: information about health or disability, only if you choose to give it so that the Group can make reasonable adjustments.
• Criminal records: checked only where the role requires it and the law permits it, and only after you have been told about the check.

The Company does not ask for equality monitoring information.

4. Where the data comes from

Most data comes from you. Other data may come from referees you name, from professional profiles you point the Group to, from former employers or schools confirming what you have told the Group, and, where section 3 allows, from a provider of background checks. If you choose to verify through LinkedIn on the Careers form, LinkedIn gives the Company your name, verified email address, profile photo and account identifier (see section 23 of the Privacy and Cookie Policy).

5. Why the Company uses your data and on what legal basis

• To consider your application and communicate with you: steps taken at your request before entering into a contract (Article 6(1)(b)) and the Company’s legitimate interest in recruiting suitable people (Article 6(1)(f)).
• To keep a speculative application for a future role: the Company’s legitimate interest in considering you when a suitable need arises (Article 6(1)(f)). You may object at any time.
• To check your right to work in the United Kingdom: legal obligation under the Immigration, Asylum and Nationality Act 2006 (Article 6(1)(c)).
• To make reasonable adjustments: obligations under the Equality Act 2010 (Article 9(2)(b) and paragraph 1 of Schedule 1 to the Data Protection Act 2018).
• To carry out a criminal record check where the role requires it: Article 10 of the UK GDPR and the relevant condition in Schedule 1 to the Data Protection Act 2018.
• To protect candidates from recruitment fraud and to establish, exercise, or defend legal claims: the Company’s legitimate interests (Article 6(1)(f)) and, for special category data, Article 9(2)(f).

Where the Company relies on legitimate interests, it has considered them against your rights and freedoms. You may ask for details of that assessment.

6. Whether you must provide your data

You do not have to apply or give any information. Without the information the Careers form asks for, the Group cannot consider your application. Before any engagement in the United Kingdom, the right-to-work check is a legal requirement. Verification through LinkedIn is optional: it helps the Group confirm your details and reply sooner, and an application sent without it is considered in the same way.

7. Automated decisions

No decision about a candidate is made solely by automated means, including profiling. People in the Group read every application and make every decision. See the AI Use statement.

8. Who receives your data

• Directors and members of the Executive Committee involved in the decision, and the people you would work with.
• Another Group company, where the role is with that company.
• Referees you name, and, where section 3 allows, a provider of background checks.
• Service providers that host the Company’s systems and e-mail, acting only on its instructions under a data processing agreement.
• Professional advisers, and public authorities or courts where the law requires it.

The Company does not sell your data or share it with others for their marketing.

9. Transfers outside the United Kingdom

Your data is held in the United Kingdom and may be shared with Group companies in the European Economic Area and Switzerland, which the United Kingdom treats as providing adequate protection. Any transfer to another country is made only under adequacy regulations or with appropriate safeguards, such as the International Data Transfer Agreement or the International Data Transfer Addendum to the EU standard contractual clauses. You may ask for a copy of the safeguards used.

10. How long the Company keeps your data

• Unsuccessful applications: 6 months after the decision is communicated, the period in which a claim under the Equality Act 2010 may be brought. The data is then deleted.
• Speculative applications: 12 months from receipt, unless you ask for deletion earlier. The data is then deleted.
• Successful candidates: the data becomes part of the personnel or contractor file and is kept as set out in the privacy notice given at the start of the engagement.
• Right-to-work records: for the duration of the engagement and 2 years after it ends, as Home Office guidance requires.

Longer retention applies only where a claim has been made or is reasonably expected. See the Data Retention Schedule.

11. Your rights

You have the right to access your data; to have it corrected; to have it erased; to restrict its use; to object to its use where the Company relies on legitimate interests; and to receive data you have provided in a portable format where the law allows. You may withdraw your application at any time. To exercise a right, use the Data protection request form. The Company replies within one month, which may be extended by two further months for complex requests, and tells you if it does so.

You may complain to the Information Commissioner’s Office (ico.org.uk; 0303 123 1113; Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF). The Company asks that you raise the matter with it first, so that it can try to resolve it. If you live in the European Economic Area or Switzerland, you may also complain to your local data protection authority or the Swiss Federal Data Protection and Information Commissioner.

12. Security

Access to application data is limited to the people who need it for the decision. The Company protects the data with technical and organisational measures appropriate to the risk; see the Information Security Statement.

13. Recruitment fraud

The Group never charges candidates a fee and does not recruit by e-mail or messaging application. Applications are accepted only through the Careers form. An offer that does not follow these rules is not from the Group; report it through Security and fraud.

14. Changes to this notice

The Company reviews this notice at least once a year and when its recruitment practice changes. The version published on this website is the current one.