Processing of Candidates’ Personal Data
1. Contact Details of the Data Controller
Data Controller
W EXECUTIVE UK LIMITED (W Executive)
Company Number: 15207872
Registered office: Mappin House, 4 Winsley Street, London, United Kingdom, W1W 8HF
Email: privacy@wexecutive.uk
EU Legal Representative under Art. 27 GDPR
W EXECUTIVE SRL
Registered Office:
Email: privacy@wexecutive.it
2. Categories of Personal Data We Use
We use your identification and contact data, such as first name, surname, place and date of birth, tax code, nationality, address, phone number and e-mail address, data concerning your educational and professional background and career path such as qualifications, work experience and any other data you may have included in your CV, or you have anyhow provided us with; when your register to our website, and you create an account, we use also your usage data (such as, log-in, log-out, account creation, account deletion, consents preferences).
Please do not add in your CV any information not related with work purposes. We only process information that is strictly necessary, proportionate and relevant to the role. This is the reason why sometimes we may process “special categories of personal data” (pursuant to art. 9 of the General Data Protection Regulation (”GDPR”) and of the UK General Data Protection Regulation (“UK GDPR”) such as health related data, whenever, and only when, this is necessary for the specific job position we are considering for you. Similarly, we may process data relating to criminal records and offences or related security measures only in cases this is necessary and relevant for the tasks or responsibility of the job role in accordance with the laws and/or regulations we are subject.
We may collect the data directly from you or from other sources, such as public recruiting websites, professional social networks (within the limits set out in this privacy notice). We may collect information from your former employers only in the final stage of the recruiting process and only if you will express your consent.
3. Why We Use Your Data and Data Retention Period
3.1 Providing Recruiting Services
Why we use your data
To provide you with our recruiting services, which include: the possibility for you to apply for specific positions; your inclusion in our pool of candidates; the evaluation of your CV and profile also for different positions; the possibility to be contacted by us for receiving questionnaires about your knowledges; the transmission of your data to potential employers in the final phase of the process (only non-identifying data).
Legal conditions for processing
The performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract.
For Special categories of data, (processed only when necessary to evaluate the application for a specific job position) the legal basis is also the necessity of carrying out the obligations and exercising the rights in the field of employment law, social security and social protection law, to the extent permissible under applicable laws (art. 9.2.b) GDPR and UK GDPR).
Data retention period
For 24 months from your application or from the last time our staff managed your data for a job application, with your involvement.
3.2 Providing a Personal Account on Our Website
Why we use your data
To provide you with a personal account on our website, which includes: the creation of your account, the possibility to update or modify your information, the possibility to apply for specific job positions, the possibility to delete your profile and account.
Legal conditions for processing
The performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract.
Data retention period
For 24 months from your last activity.
3.3 Ensuring the Security of Your Account and Our Website
Why we use your data
To ensure the security of your account and of our website: we use your usage data and identification data to maintain our systems secure.
Legal conditions for processing
Our legitimate interest to keep our systems secure.
Data retention period
Consents preferences and last activities on your profiles are held for 24 months. Logs data is held for at least 6 months.
3.4 Processing Publicly Available Information
Why we use your data
We may process publicly available information published only on professional social media in order to compare it with the data you provide.
Legal conditions for processing
Our legitimate interest to verify the information you provide for a proper evaluation of your application.
Data retention period
For 24 moths from your application or from the last time our staff managed your data for a job application with your involvement.
3.5 Conducting Background Checks
Why we use your data
We may process your data to conduct background checks from your former employers. Sometimes, in the final stage of the process, we may ask your former employers to provide us with references.
Legal conditions for processing
We will ask Your consent.
3.6 Establishing, Exercising or Defending Legal Claims
Why we use your data
To establish, exercise or defend legal claims.
Legal conditions for processing
Legitimate interest of the Company to protect and defend its rights.
Data retention period
For the time necessary for the establishment, exercise, or defence of legal claims.
After the above-mentioned retention periods have expired, all data stored in our data base will be deleted or anonymised.
3.7 How We Manage Your Data During the Recruiting Process
We would like to inform you that in the context of our recruiting activities we can rely on an automatic system which allows us to filter through CVs in our data base, through relevant key words, such as, knowledges, education, job title, availability.
This tool analyses all the candidates’ information in our data base and matches it with the key words and then provides us with a smaller pool of candidates with a ranking according to their suitability for the role.
This is just a first shortlisting since there is always a recruiter supervising the process and evaluating the candidates’ profiles, so there is no automated decision.
This tool allows us to enhance and make more efficient our selection’s process, and to provide an innovative service for our candidates and clients.
4. Your Obligations to Provide Data
The provision of data related to the management of your application for recruiting purposes is mandatory. If you do not provide us with the information, we cannot provide our services to you.
It is not necessary to register to our website to apply for a job advertised on our website, it is optional to create an account/ or You must register in order to apply for jobs advertised on our website.
Consent for conducting background checks is optional. If you do not consent, we will still evaluate your CV and your information for the recruiting services.
Data used for defending our rights and for comparing the information we have with the one published on professional social media is already available, but you can object to the processing on grounds relating to your particular situation. In the same way, usage data is collected directly when you use our system, but you can object to this processing.
5. Categories of Data Recipients
We can communicate the data to our service providers or other group companies which carry out some services on our behalf (such as software and hardware providers, website providers, and other IT services providers) as data processors in accordance with a data processing agreement.
We will communicate your data in the final phase of the recruiting process to our client which is your potential employer to promote your application; this latter will process your data as an autonomous controller and will provide you with their privacy policy.
We can communicate the data to other public or private bodies whenever we are obliged to do so, in response to orders or requests from a court, regulators, government agencies or public authorities, or to comply with law or regulatory requirements.
6. Transfer of Data
We are based in UK, and we rely on an IT infrastructure located in the European Union. However, some of our suppliers (IT services) when provide some services can operate outside of the European Economic Area (“EEA”) and Switzerland, such as in the US, and have access to the data from outside the EEA.
In these cases, data is transferred only in the presence of the safeguards indicated in the applicable data protection legislation. In particular, the transfer will take place:
- To destination countries for which the UK Government and the European Commission have issued an adequacy decision (art. 45 GDPR and UK GDPR) or
- On the basis of the International Data Transfer Addendum to the EU Commission Standard contractual clauses (“SCCs”) (art. 46 GDPR and UK GDPR), provided that supplementary security measures are also in place.
For further information about the data transfers, you can contact our DPO at privacy@wexecutive.uk
7. Rights of Data Subjects
Under the GDPR and the UK GDPR:
You have the right to access your data and to modify or correct your data.
You can obtain the erasure of personal data and the restriction of the processing when certain conditions are met.
You have the right to receive a copy of your personal data in a structured, commonly used and machine-readable format or ask Us to transmit that data to another controller, where technically feasible, if the processing is based on consent or on a contract and is carried out by automated means.
You have the right to withdraw the consent you have given at any time, without affecting the lawfulness of the processing carried out before the withdrawal.
You can always object to the processing of your personal data for direct marketing purposes and, on grounds relating to your particular situation, you can also object to the processing of your personal data based on the legitimate interest of the controller.
If you wish to exercise one of these rights, you can contact our DPO at privacy@wexecutive.uk
You can lodge a complaint with the data protection authority of your country if you believe that your rights have been breached. For the UK you can contact the Information Commissioner’s Office at https://ico.org.uk.