Last updated 20 October 2022
Achilles Information Limited and its subsidiaries (“Achilles”,”we” and ”our”) are committed to protecting your privacy and meeting our legal obligations when you apply for a job or you (or an agent acting on your behalf) share your employment details with us.
This privacy notice explains what personal data Achilles collects about employment and contractor candidates (“you” and ”your”) as a data controller during the recruitment process and how we will use it. A full list of the Achilles entities covered by this privacy notice can be found at section 11.
As an information led business, we place great importance in ensuring the quality, confidentiality, integrity and availability of the data we hold, and in meeting our data protection obligations where we process personal data. Achilles is committed to protecting the security of your personal data. We use a variety of technical and organisational measures to help protect your personal data from unauthorised access, use or disclosure.
We update this privacy notice from time to time in response to changes in applicable laws and regulations, to our processing practices and to products and services we offer. When changes are made, we will update the ‘Last Updated’ date at the top of this page. Please review this privacy notice periodically to check for updates.
When you apply for a role (whether as an employee or a contractor) or submit your CV (or similar employment information) to us, whether directly or through an agency, or are interviewed by us we will collect your personal data. This may include:
• Name and contact details, date and place of birth
• Work history and employment positions held
• Salary, other compensation and benefits information
• Nationality / visa / right to work permit information
• Academic and professional qualifications, education and skills
• Photographs or videos you submit with your application
• Demographic information
• Any other information you choose to give us
• Records we create during interviews or correspondence with you
• Results of pre-employment screening checks
We may also collect some sensitive personal data about you, such as disability information. We will only do this to make reasonable adjustments to enable candidates to apply for jobs with us, attend interviews and to start work with us if successful. Also, to ensure we meet our legal obligations when recruiting.
We use the personal data you share with us in a variety of ways, including to:
• Process your application (including by adding you to our HR and people management system)
Communicate with you, including by telephone, email and SMS
• Assess your suitability, skills and experience for the role you have applied for
• Set up and conduct interviews by telephone and in person
• Contact third party references you have provided us
• Conduct pre-employment screening checks
If your candidacy is not successful or if you (or an employment agency on your behalf) have submitted your CV or application to us on a speculative basis, we may also add your details to our list of suitable candidates for future roles (our ‘talent pool’) and may contact you again should a suitable role arise.
When processing your personal data for the purposes of administering your job application, assessing your candidacy for a role, communicating with you and contacting third party references we do so with your consent. By submitting your application, you are confirming your consent to us processing your personal data for these purposes. You can withdraw your consent at any time, by contacting us at dataprivacy@achilles.com or by writing to us at the address below.
If we process any sensitive personal data, including performing pre-employment screening checks, we will do so only with your explicit consent or where we are required to do so by law. We will ask for your explicit consent in these circumstances.
If your job application is unsuccessful, and unless you ask us not to, your details will be added to our talent pool and we may make contact with you again (including by telephone, email or SMS). This is because it is in our legitimate interests to maintain the details of, and stay in contact with, suitable candidates for future roles. You can object to being in our talent pool at any time, by contacting us at dataprivacy@achilles.com or by writing to us at the address below.
Less commonly, we may process your personal data in relation to legal claims.
Achilles is a global business, and it is possible that we may share your data with our group companies, including those in countries outside the UK and European Economic Area (the “EEA”) where the data protection laws are not equivalent to those within the UK or EEA. We do so using Standard Contractual Clauses approved by the European Commission and/or the International Data Transfer Agreement (IDTA) approved by the UK Parliament (as applicable) which contractually oblige our group companies in those countries to the standard expected within the EEA and/or the UK.
We may also share your data with trusted service providers and suppliers to our business who process data on our behalf. This includes, for example, cloud service providers (e.g our HR and people management system, which is cloud service provided to us by a third party). In such cases, our service providers and suppliers are data processors and may only use the data in line with our instructions and not for any other purpose. This and other obligations are agreed in the contract we enter into with them.
Within Achilles, your personal data will only be shared with those who need to have access to it. This will primarily be our HR personnel and hiring managers.
It is possible that we may be required to share your data to comply with applicable laws or with valid legal processes, such as in response to a court order or with government or law enforcement agencies.
We will retain your personal data for only as long as is necessary for the recruitment process. If your candidacy is successful and you are employed by us, your data will be processed and retained as set out in our employee privacy notice, provided to you with your employment paperwork.
If your candidacy is not successful, we will retain your CV, application details and interview notes for 12 months (from the date of first receipt of your details). During this time, we may add your information to our talent pool unless you ask us not to or subsequently object to us doing so.
We will also retain personal data where it is necessary to comply with our legal obligations or as necessary in relation to legal claims. This is rare but may mean we need to retain your data for longer than 12 months.
Individuals whose personal data we hold, and process have the following rights:
• You have the right of access to your personal data and can request copies of it and information about our processing of it.
• If the personal data we hold about you in incorrect or incomplete, you can ask us to rectify or add to it.
• Where we are using your personal data with your consent, you can withdraw your consent at any time.
• Where we are using your personal because it is in our legitimate interests to do so, you can object to us using it this way.
• In some circumstances, you can restrict our processing of your data, request a machine-readable copy of your personal data to transfer to another service provider and compel us to erase your personal data.
• You have the right not to be subject to a decision based solely on automated processing (including profiling) that produces legal effects concerning you or similarly significantly affects you.
If you wish to exercise your rights, please contact us at dataprivacy@achilles.com or write to us at the address provided below.
You will not have to pay a fee to access your personal data (or to exercise any of the other rights). However, we may charge a reasonable fee if your request for access is clearly unfounded or excessive. Alternatively, we may refuse to comply with the request in such circumstances.
You can also lodge a complaint with your local data protection supervisory authority. In the UK, this is the ICO (https://ico.org.uk/make-a-complaint/). In the EEA, there are national and regional data protection authorities (a list is available here: https://edpb.europa.eu/about-edpb/about-edpb/members_en).
The Achilles companies covered by this privacy notice are Achilles Information Limited, Achilles Procurement Services Limited, Achilles Information AS, Achillevs Information AB, Achilles Information Aps, Achilles Information GmbH, Achilles Information Slovakia S.R.O. and Achilles South Europe S.L.
You can contact Achilles in relation to data protection and this privacy notice by writing to:
General Counsel
Achilles
30 Western Avenue
Milton
Abingdon
OX14 4SH
United Kingdom
Alternatively, you can email us at dataprivacy@achilles.com