Privacy policy for the JATO Dynamics employer branding and recruitment

Date of publication: September 2024

We at JATO Dynamics Limited manage our and all our group companies’ recruitment process. This includes recruitment carried out through our career site (“Career Site”). In this Privacy Notice, we explain how we process your personal data if:

You visit our Career Site (you being a “Visitor”)

1. You visit our Career Site (you being a “Visitor”)
2. You connect with us via our Career Site, to create a profile with us and receive information about current or future vacancies with us (you being a “Connecting Candidate”)
3. You apply for a position with us, via our Career Site or a third party service (you being an ”Applying Candidate”)
4. We collect information about you from other parties, sites and services, since we believe your profile is of interest for our current or future vacancies (you being a “Sourced Candidate”)
5. We receive information about you from our employees or partners (including recruitment agencies), since they believe your profile is of interest for our current or future vacancies (you being a “Referred Candidate”)
6. We receive information about you from a Candidate, who lists you as their reference (you being a “Reference”).

This Privacy Notice also describes what rights you have when we process your personal data, and how you can exercise these rights.

When we use the term “Candidate” in this Privacy Notice, we are referring to each of Connecting Candidates; Applying Candidates; Sourced Candidates; and Referred Candidates, unless we say otherwise.

If you are successful in joining JATO, then your personal data collected during the recruitment process will become part of your employee file and will be processed in accordance with a separate privacy notice that applies to JATO’s employees, workers and contractors. A copy of that privacy notice will be provided to you when you are on-boarded.

1. About processing of personal data

Personal data is all information that can be directly or indirectly linked to a living, physical person. Examples of personal data are: name, e-mail address, telephone number and IP address. Processing of personal data means any operation carried out on personal data - such as collecting, storing, creating, analysing, sharing, and deleting personal data.

There are laws and regulations on how companies may process personal data, so-called data protection laws. Different data protection laws apply to different types of use of personal data, and in different parts of the world. Examples of a data protection law that is relevant for our use of your personal data as described in this Privacy Notice, if you are in the UK, is the UK General Data Protection Regulation (UK GDPR) or if you are in the EU, is the EU General Data Protection Regulation (EU GDPR).

Most obligations under the UK GDPR/EU GDPR apply to the so-called controller. A controller is the entity that decides for which purposes personal data will be processed, and how the processing will be executed. The controller can use a so-called processor, who in turn can use a so-called sub-processor. A processor or sub-processor is an entity that is only allowed to process personal data as instructed by the controller and may not use the personal data for its own purposes.

We are the controller when we process your personal data as described in this Privacy Notice.

2. What personal data do we process?

All individuals

• Device information - If you visit our Career Site, we will collect information about your device, such as IP address, browser type and version, session behaviour, traffic source, screen resolution, preferred language, geographic location, operating system and device settings/usage.
• Technical and statistical data - If you visit our Career Site, we will collect technical and statistical data about your use of the site, and your activity on the site.
• Communications data - We will collect and store your communication with us, including the information you provided in the communication. This may include the content of emails, video recordings, messages on social media, the information you add to your account with us, surveys, etc.
• Contact details - Such as your name, email address, telephone number and physical address.

Candidates

• Information from interviews, assessments and other information from the recruitment process - Such as notes from interviews with you, results from assessments and tests made and salary requirements.
• Information in your application - Such as your CV, cover letter, work samples, references, letters of recommendation and education.
• Information in your public profile - Meaning the information we collect about you from public sources such as LinkedIn (including if you choose to apply for a position via LinkedIn), the website of your current employer or other social media platforms.
• Information from background checks. We may perform background checks on you, where justified by the particular role you are applying for and subject to the applicable laws of the country you are located in. Such checks may include right to work and credit reports and criminal offences checks. You will receive more information about the nature of a background check before it begins and no checks will be undertaken without your express prior consent, where this is required by applicable law.
• Information provided by references - Meaning the information we receive from our employees or partners who refer you to us, or by the persons you have listed as your references.

3. Where do we receive your personal data from?

All individuals

• From the Career Site. If you visit our Career Site, we collect technical and statistical information about how you use the Career Site, and information from your device.
• Directly from you. Most of the information we process about you, we receive directly from you, for example when you apply for a position with us or connect with us. You can always choose not to provide us with certain information. However, some personal data is necessary for us to process your application or provide you with the information you request from us.

References

• From the person for whom you are a reference. If a Candidate lists you as their reference, we will collect your contact details from the Candidate to be able to contact you.

Candidates

• From public sources. We may collect personal data about you from public sources, such as LinkedIn, the website of your current employer or other social media platforms.
• From our references. We may receive information about you from our employees or partners (such as recruitment agencies), when they believe your profile is of interest for our current or future vacancies.
• From your references. If you provide us with references, we may collect information about you from them.
• Data we create ourselves or in cooperation with you. Information about your application and profile is usually created by us, or by us in cooperation with you, during the recruitment process. This may for example include notes from interviews with you, assessments and results of tests.
• Background check providers. Where we conduct such checks, these providers may include the relevant government agency, credit reference agencies and criminal offences database providers.

4. For what purposes do we process your personal data?

To be able to process your personal data under some data protection laws, we need to have a so-called ‘legal basis’. A legal basis is a reason for processing the personal data that is justified under those laws. We’ve set out below, what purpose we use your personal data for, who is affected by that processing, what type of personal data we use for that purpose and the legal basis we are relying on. Where the legal basis is ‘Legitimate interests’, we have concluded that the relevant handling of your personal data is necessary to achieve the purpose specified and that our interest is not overridden by your interests or fundamental rights and freedoms, particularly taking into consideration the safeguards that we put in place.

Under the data protection laws applicable to your personal data, to the extent that our handling of your personal data is based on consent, you may be entitled to withdraw consent. If you wish to withdraw consent please contact us at people@jato.com. This will not affect any processing carried out before you withdraw your consent.

If you have questions about or need further information concerning the legal basis on which we will process your personal data, please let us know by contacting us at people@jato.com

For recruiting purposes, to determine your eligibility to work, qualifications for employment, and to make hiring decisions. For instance, we may process your personal data when evaluating your potential for engagement and communicating with you about the hiring process.

Affected individuals: Candidates.

Categories of personal data used: All the categories of personal data listed above can be used for this purpose.

Lawful basis: Legitimate interests; Consent.

Collect and evaluate your professional profile on our own initiative. This also includes communicating with you regarding your profile.

Affected individuals: Sourced Candidates; Referred Candidates.

Categories of personal data used: All the categories of personal data listed above may be used for this purpose.

Lawful basis: Legitimate interests.

Record the interview(s) with you.

Affected individuals: Candidates.

Categories of personal data used: Communications data.

Lawful basis: Consent; To take steps prior to entering into a contract with you, for example an employment contract.

Contact you directly about specific, future vacancies with us.

Affected individuals: Candidates.

Categories of personal data used: All the categories of personal data listed above may be used for this purpose.

Lawful basis: Consent.

For equal opportunities monitoring, compliance with anti-discrimination laws, or government-reporting obligations.

Affected individuals: Candidates.

Categories of personal data used: All the categories of personal data listed above can be used for this purpose.

Lawful basis: Consent; Legal obligations.

To understand and improve our recruitment process. For instance, including efforts to promote diversity, equity, and inclusion, where legally permissible.

Affected individuals: Candidates.

Categories of personal data used: All the categories of personal data listed above can be used for this purpose.

Lawful basis: Consent; Legitimate interests.

Where you have voluntarily agreed to have your personal data processed.

Affected individuals: Candidates.

Categories of personal data used: All the categories of personal data listed above can be used for this purpose.

Lawful basis: Consent.

To establish, exercise, or defend against legal claims.

Affected individuals: The individual(s) affected by the legal issue - this may include persons from all categories of individuals listed above.

Categories of personal data used: All the categories of personal data listed above can be used for this purpose.

Lawful basis: Legal claims; Legal obligations.

To protect the safety, security, and integrity of our property (such as our website, databases and other assets); to protect the rights of those who interact with us or others; and to detect, prevent, and respond to security incidents or other malicious, deceptive, fraudulent, or illegal activity.

Affected individuals: The individual(s) affected by the issue.

Categories of personal data used: All the categories of personal data listed above can be used for this purpose.

Lawful basis: Legitimate interests; Public interest; Legal claims; Vital interests; Legal obligations.

Collect information about your use of the Career Site, using cookies and other tracking technologies, as described in our Cookie Policy.

Affected individuals: Visitors.

Categories of personal data used: Device information.

Lawful basis: Legitimate interests.

Analyse how the Career Site and its content is being used and is performing, to get statistics and to improve operational performance.

Affected individuals: Visitors.

Categories of personal data used: Device information; Technical and statistical data.

Lawful basis: Legitimate interests.

Contact you to ask for your participation in surveys

Affected individuals: Candidates.

Categories of personal data used: All the categories of personal data listed above may be used for this purpose.

Lawful basis: Consent.

Contact you to ask you to provide information about a Candidate and evaluate the information you provide.

Affected individuals: References.

Categories of personal data used: Contact details; Communications data.

Lawful basis: Legitimate interests.

To the extent that we process any sensitive personal data relating to you, we will do so because: the processing is necessary to carry out our obligations under employment, social security or social protection law; the processing is necessary for the establishment, exercise or defence of a legal claim; the processing is necessary for reasons of substantial public interest; or you have given your explicit consent to us to process that information (where legally permissible). You are under no obligation to provide this type of data to us during the recruitment process. However, if you do not provide it, we may not be able to process your application properly or at all.

5. Automated decision making

Typically, we do not use your personal data for so-called “automated decision-making”. We will inform you separately if your personal data is made subject to automated decision-making.

6. Whom do we share your personal data with?

Our service providers. We share your personal data with our suppliers who provide us with services and functionality in connection with our recruitment process. For example, this includes recruitment agencies and the supplier of our Career Site ‘TeamTailor’. Where we use any AI powered functionality available as part of the Career Site, the data in your CV is transferred by TeamTailor to its sub-processor, OpenAI to provide this functionality.

Professional Advisors. We share your personal data with advisors such as lawyers, accountants and auditors.

Our group companies. We share your personal data with our group companies, when they provide us with services and functionality related to our recruitment process, such as access to particular systems and software, or where we are recruiting on their behalf.

Companies providing cookies on the Career Site. If you consent to it, cookies are set by other companies than us, who will use the data collected by these cookies in accordance with their own privacy notices. You can find information about which cookies this applies to in our Cookie Policy.

To comply with legal obligations. We will share your personal data with authorities and other public actors to comply with our legal obligations, including where necessary to abide by law, regulation or contract, or to respond to a court order, administrative or judicial process.

To parties involved in legal proceedings. If needed to protect or defend our rights, we share your personal data with public authorities or with other parties involved in a potential or existing legal proceeding. This can, for example, be in the case of discrimination claims.

Mergers and acquisitions etc. In connection with a potential merger, sale of company assets, financing, or acquisition of all or part of our business to another company, we may share your personal data with other parties involved in the process.

7. How we protect your Personal Information.

We have implemented industry standard security measures to keep your personal data secure and confidential, including and not limited to:

• limiting access to your personal data strictly on a need-to-know basis, such as to respond to your inquiry or request; and
• implementing physical, electronic, administrative, technical and procedural safeguards that comply with applicable laws and regulations to protect your personal data from unauthorised or inappropriate access, alteration, disclosure and destruction. Where we share your personal data with third parties, we require them by contract to have similar security controls in place.

It is important for you to protect against unauthorised access to your password and to your computer, when using Career Site. Be sure to sign off when you have finished use of a shared computer.

8. When do we transfer your personal data outside of the UK/European Economic Area (EEA), and how do we protect it then?

Due to the global nature of JATO’s business, we may transfer your personal data between the companies within the JATO group and to third parties located outside your country of residence. The level of protection for personal data is not the same in all countries. However, we will take reasonable steps and implement measures as described in this Privacy Notice to keep your personal data secure. Where the recipients of your personal data are based outside of the UK/EEA or in countries that are not deemed to have adequate data protection laws, we will ensure that a safeguard recognised by the UK GDPR/EU GDPR is used to enable the transfer. We use the following safeguards:

• A decision by the UK or EU Commission that the country outside of the UK/EEA to which your personal data is transferred has an adequate level of protection, which corresponds to the level of protection afforded by the UK GDPR or EU GDPR respectively. In particular, we rely on the UK’s adequacy regulations for the EEA and for the US via the EU-U.S. Data Privacy Framework and the EU Commission’s adequacy decision for the US via the so-called EU-US Data Privacy Framework, and the adequacy decision for the UK.
• Entering into the UK’s standard international data transfer agreement or EU Commission’s standard clauses or the UK’s addendum to the EU’s standard clauses with the recipient of the personal data outside the UK/EEA. This means that the recipient guarantees that the level of protection for your personal data afforded by the UK GDPR/EU GDPR still applies, and that your rights are still protected.

If you want more information about the cases in which your personal data is transferred outside the EU/EEA, you can contact us using the contact details in Section 10 and 11 below.

9. For how long do we keep your personal data?

All individuals

If we process your personal data for the purpose of being able to protect and enforce our rights, we will keep your personal data until the relevant legal issue has been fully and finally resolved.

Visitors

We keep your personal data for one (1) year for security purposes. The retention periods for cookies are set out in our Cookie Policy. We keep your personal data to analyse the performance of the Career Site for as long as we keep personal data about you for other purposes.

Candidates

If you are a Connecting Candidate (only), we keep your personal data for as long as you remain connected with us.

For other types of Candidates, we keep your personal data to decide if you are a suitable candidate for the relevant vacancy(ies) with us.

If you don’t succeed in the initial recruitment process, we keep your personal data for as long as needed to consider, and potentially contact you, for relevant future job openings.

If you are hired, we will keep your personal data during your employment, for other purposes than those stated above, which you will be informed of.

References

We keep your personal data for as long as we keep the personal data of the Candidate for whom you acted as a reference.

10. What rights do you have, and how can you exercise them?

In this section, you will find information about the rights you have when we process your personal data. As described below, some of the rights only come into play when we process your personal data under a particular legal basis.

If you want to exercise any of the rights listed here, we suggest that you:

• Visit the Data & Privacy page on our Career Site, where we offer features to let you exercise your rights;
• Log in to your account with us, where you can use the settings in the account to exercise your rights; or
• Contact us directly at people@jato.com

Right to be informed

You have the right to be informed about how we process your personal data. You also have the right to be informed if we plan to process your personal data for any purpose other than that for which it was originally collected.

We provide you with such information through this Privacy Notice, through updates on our Career Site (see also Section 12 below), and by answering any questions you may have for us.

Right to access your personal data.

You have the right to know if we process personal data about you, and to receive a copy of the data we process about you. In connection with receiving the copy of your data, you will also receive information about how we process your personal data.

Right to access and to request a transfer of your personal data to another recipient (“data portability”).

You can request a copy of the personal data relating to you that we process for the performance of a contract with you, or based on your consent, in a structured, commonly used, machine-readable format. This will allow you to use this data somewhere else, for example to transfer it to another recipient. If technically feasible, you also have the right to request that we transfer your data directly to another recipient.

Right to have your personal data deleted (“right to be forgotten”).

In some cases, you have the right to have us delete personal data about you. This is for example the case if it’s no longer necessary for us to process the data for the purpose for which we collected it; if you withdraw your consent; if you have objected to the processing and there are no legitimate, overriding justifications for the processing. (For the separate right to object, see below.)

Right to object against our processing of your personal data.

You have the right to object to processing of your personal data which is based on our legitimate interest, by referencing your personal circumstances.

Right to restrict processing.

If you believe that the personal data we process about you is inaccurate, that our processing is unlawful, or that we don’t need the information for a specific purpose, you have the right to request that we restrict the processing of such personal data. If you object to our processing, as described just above, you can also request us to restrict processing of that personal data while we make our assessment of your request.

When our processing of your personal data is restricted, we will (with the exception of storage) only process the data with your consent or for the establishment, exercise or defence of legal claims, to protect the rights of another natural or legal person, or for reasons relating to an important public interest.

Right to rectification.

You have the right to request that we rectify inaccurate information, and that we complete information about you that you consider incomplete.

Right to withdraw your consent.

When we process your personal data based on your consent, you have the right to withdraw that consent at any time. If you do so, we will stop processing your data for the purposes you’ve withdrawn your consent for. However, it doesn’t affect the lawfulness of processing that was based on your consent before it was withdrawn.

Right to review – automated decision making.

We do not currently use automated decision making. Should this change, we will inform you about why and how any such decision was made, the significance of it, and the possible consequences of it. You will also have the right to human intervention, to express your point of view, and to contest the decision.

Right to raise a complaint.

We would appreciate the opportunity to deal with any complaint you have directly. Please contact us at people@jato.com. If you are not satisfied with our response, you have the right to make a complaint to the Data Protection Authority in the country where you live, or in the place where you think an issue in relation to your data has arisen.

For the UK, you can raise a complaint with the Information Commissioner’s Office. You can find their contact details here.

For the EU, you can also lodge a complaint with your national Data Protection Authority, which you can find listed here.

11. Where can you turn with comments or questions?

If you want to get in touch with us to exercise your rights, or if you have any questions, comments or concerns about how we handle your personal data, you can reach us by sending an email to people@jato.com

12. Updates to this Privacy Notice

We update this Privacy Notice when necessary - for example, because we start processing your personal data in a new way, because we want to make the information even clearer to you, or if it’s necessary to do so to comply with applicable data protection laws.

We encourage you to regularly check this page for any changes. You can always check the top of this page to see when this Privacy Notice was last updated.