JOB APPLICANT PRIVACY/FAIR PROCESSING NOTICE
1. Introduction
1.1 In this Data Privacy Notice the terms the "Company", "we", "us" and "our" are references to Addepar UK Ltd., company number 13162730, having a registered address at Clifton House, Bunnian Place, Basingstoke, Hampshire, United Kingdom, RG21 7JE. Addepar UK Ltd. is part of the Addepar group of companies of which the ultimate parent is Addepar, Inc.
1.2 Addepar UK Ltd. will be the data controller of your personal data. In addition, where processing of personal data is undertaken by other associated companies of the Company for their own independent purposes, these associated companies may be co-controllers of your personal data.
1.3 We hold and process data on all current and former applicants and interview candidates ("applicants" or "you" or "your"), and third parties whose information you provide to us in connection with your application (e.g., next‑of‑kin, emergency contact information).
1.4 We take your data protection rights and our legal obligations seriously. Your personal data will be treated in a secure and confidential manner and only as set out below or otherwise notified to you in writing.
1.5 Please read the following carefully to understand our views and practices regarding your personal data and how we treat it. The following Data Privacy Notice describes the categories of personal data we may process, how your personal data may be processed, for what purposes we process your data and how your privacy is safeguarded in the course of our relationship with you. It is intended to comply with our obligations to provide you with information about the Company's processing of your personal data under privacy laws. It does not form part of a contract of employment or engagement.
1.6 If you have any questions about this Data Privacy Notice please contact privacy@addepar.com.
2. Responsibility for data privacy
2.1 The contact details of each of the Company's data controllers and, where applicable their representatives and relevant data protection contact, are Addepar UK Ltd. & Addepar, Inc., each of which can be reached at privacy@addepar.com.
2.2 If you have any questions regarding the processing of your personal data or if you believe your privacy rights have been violated, please contact Addepar’s People Team at people@addepar.com or privacy@addepar.com.
3. What data do we process?
3.1 We collect various types of personal data about you for the purposes described in this Data Privacy Notice including:
(a) personal details: your title and name, birth name, preferred name, any additional names, gender, home contact details (e.g., address, telephone or mobile number, e‑mail), immigration and eligibility to work information, languages spoken, details of any disability and any reasonable adjustments required as a result;
(b) recruitment and selection data: skills and experience, qualifications, references, CV and application, record of interview, interview notes and assessment, vetting and verification information (e.g. results of credit reference check, financial sanction check and a basic disclosure criminal record check relating to unspent convictions where carried out and permitted by applicable law), right to work verification, information related to the outcome of your application, details of any offer made to you;
(c) equality and diversity data: where permitted by law and provided voluntarily, data regarding gender, race, nationality, and sexuality (stored anonymously for equal opportunities monitoring purposes); and
(d) any other personal data which you choose to disclose to Company personnel during the course of the application process whether verbally or in written form (for example in work emails).
3.2 Certain additional information will sometimes be collected where this is necessary and permitted by local applicable laws.
3.3 Some of the information collected by the Company and described above constitutes special category personal data. Special category personal data includes information relating to racial or ethnic origin, political opinions, religious or philosophical beliefs, health, trade union membership, sex life or sexual orientation, biometric or genetic information, and information relating to criminal records, offences or proceedings. The Company only collects personal data when permitted or required to do so by law, in circumstances described below.
4. How does the Company collect data?
4.1 The Company collects and records your personal data from a variety of sources, but mainly directly from you or from our service providers that handle applications on our behalf, such as Greenhouse. You will usually provide this information directly to us through your participation in the recruitment process, or you will provide it to our service providers, such as Greenhouse.
4.2 We also obtain some information from third parties: for example, references from a previous employer, recruitment agencies or where we employ a third party to carry out a background check (where permitted by applicable law).
4.3 Where we ask you to provide personal data to us on a mandatory basis, we will inform you of this at the time of collection. Failure to provide any mandatory information may mean that we cannot carry out our recruitment process.
4.4 Apart from personal data relating to you, you may also provide the Company with personal data of third parties, such as contact information of individuals listed as referees in your application. Before you provide such third party personal data to the Company you must first inform these third parties of any such data which you intend to provide to the Company and of the processing to be carried out by the Company, as detailed in this Data Privacy Notice.
5. What are the purposes for which data are processed?
5.1 Your personal data are collected and processed for business purposes in accordance with applicable laws.
5.2 We collect and process your personal data for purposes including:
(a) recruitment and selection including:
(i) to assess your suitability to work for us including short listing, agreements and interviews;
(ii) to conduct pre‑employment checks including verification of your identity, checking your legal right to work and checking references;
(iii) to conduct a pre‑employment reference check, financial sanction check and a check in relation to suspect criminal activities in order to prevent crime and other unlawful acts and to protect the business and clients in the financial services industry from the risk of dishonesty, malpractice or improper conduct;
(iv) to compare you with other applicants and make a decision whether to offer you employment;
(v) to consider any reasonable adjustments either for the recruitment process or if you were to commence employment with us in the event you have a disability;
(vi) to make a job offer and provide a contract of employment;
(vii) to prepare to bring you on board as an employee where you accept an offer of employment from us. In this case we will customise to make sense of the information gathered during recruitment for the purpose of your employment and will transfer some of this to our employment systems and files;
(viii) to contact you if you are not successful should another potentially suitable vacancy arise during the six months following the completion of the recruitment process for the role you applied for; and
(ix) to deal with any query, challenge or request for feedback received in relation to our recruitment decision;
(b) protecting the private, confidential and proprietary information of the Company, its employees, its clients and third parties;
(c) monitoring programmes to ensure equality of opportunity and diversity with regard to personal characteristics protected under applicable anti‑discrimination laws;
(d) to enforce our legal rights and obligations, and for any purposes in connection with any legal claims made by, against or otherwise involving you;
(e) to comply with lawful requests by public authorities (including without limitation to meet national security or law enforcement requirements), discovery requests, or where otherwise required or permitted by applicable laws, court orders, government regulations, or regulatory authorities (including without limitation data protection, tax and employment), whether within or outside your country; and
(f) for other purposes permitted by applicable laws, including legitimate interests pursued by the Company where these are not overridden by the interests or fundamental rights and freedoms of applicants and where these have been explained to you before the relevant data is collected or the processing is carried out.
5.3 Special categories of data may be collected and processed by the Company for the following purposes:
(a) documentation such as work permits, details of residency, proof of citizenship will be processed to assess and review eligibility to work for the Company in the jurisdiction in which you work; and
(b) your racial or ethnic origin, sexual orientation or disability status may be used for the collection of statistical data subject to local laws, or where required to record such characteristics to comply with equality and diversity requirements of applicable local legislation or to keep the Company's commitment to equal opportunity under review.
5.4 Additional information regarding specific processing of personal data may be notified to you.
6. Legal bases for processing
6.1 Personal data
(a) Whenever the Company processes your personal data we do so on the basis of a lawful condition for processing. Processing of special categories of data is always justified on the basis of an additional lawful condition as described in section 6.2 below.
(b) In the majority of cases, the processing of your personal data will be justified on one of the following bases:
(i) we will process your data where the processing is necessary for the performance of a contract to which you are a party or in order to take steps at your request prior to entering into such a contract; or
(ii) where the above grounds do not apply we may process your personal data where the processing is necessary for the legitimate interests pursued by the Company (being those purposes described in the section above), except where such interests are overridden by your interests or fundamental rights and freedoms which require protection of personal data.
6.2 Special categories of data
(a) The special categories of personal data that may be processed by the Company are set out in this Data Privacy Notice. Where we process special categories of data it will be justified by a condition set out at paragraph 6.1(b) above and also by one of the following additional conditions:
(i) the processing is necessary for the purposes of carrying out the obligations and exercising the rights of you or the Company in the field of employment law, social security and social protection law, to the extent permissible under applicable laws;
(ii) the processing is necessary for the purposes of preventive or occupational medicine, for the assessment of your working capacity, medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems and services, to the extent permitted by applicable laws;
(iii) the processing is necessary to protect your vital interests or of another person where you are physically or legally incapable of giving consent (for example in exceptional emergency situations, such as a medical emergency);
(iv) the processing is necessary for purposes authorised by applicable law. This includes:
(A) where the processing is necessary for the purposes of identifying or keeping under review the existence or absence of equality of opportunity or treatment; and
(B) where the processing is necessary for complying with regulatory requirements that involve taking steps to determine whether an individual has committed an unlawful act or has been involved in dishonesty, malpractice or other serious misconduct.
(v) the processing is necessary for the establishment, exercise or defence of legal claims.
6.3 Processing data relating to criminal convictions and offences
7. Retention of personal data
7.1 The Company retains personal data for as long as is required to satisfy the purpose for which it was collected by us or provided by you. This will usually be the period of the application process. We may keep some specific types of data, for example, your CV, for longer where we have a legitimate business reason to do so, such as to contact you for future opportunities.
8. Disclosures of personal data
8.1 We share your personal data with Addepar, Inc., its affiliates and any of their employees where it is necessary to do so for any of the purposes described in this Privacy Notice.
8.2 The Company also shares personal data with service providers that perform services on our behalf, such as our recruitment platform provider, Greenhouse; background and education verification agencies; HR and recruitment service providers; accounting, payment and expense reimbursement providers; travel providers; and electronic signature providers. In accordance with applicable law, we have entered into legally binding agreements requiring our service providers to use and disclose personal data only as necessary to perform services on our behalf or to comply with applicable legal requirements.
8.3 In addition, we may disclose personal data about you (a) if we are required or permitted to do so by law or legal process, for example due to a court order or a request from a law enforcement agency, (b) when we believe disclosure is necessary or appropriate to prevent physical harm or financial loss, (c) in connection with an investigation of suspected or actual fraudulent or other illegal activity, and (d) in the event we sell or transfer all or a portion of our business or assets (including in the event of a reorganization, dissolution, or liquidation).
9. Security of data
9.1 The Company is committed to protecting the security of the personal data you share with us. In support of this commitment, we have implemented appropriate technical, physical and organisational measures to ensure a level of security appropriate to the risk. The Company uses a variety of technical and organisational methods to secure your personal data in accordance with applicable laws.
10. INTERNATIONAL Transfer of Personal Data
10.1 From time to time your personal data (including special categories of personal data) will be transferred to associated companies of the Company to process for the purposes described in this Data Privacy Notice. This will be applicable for example where the relevant company or a manager from that company is responsible for conducting or approving the relevant process or the data is part of a global directory where other individuals need to have access. These associated companies or managers are located elsewhere in the world (for example, Addepar, Inc. located in the United States or Addepar Canada, Inc. located in Canada).
10.2 Personal data may also be transferred to third parties (e.g. service providers, such as Greenhouse, as set out above), who may have systems or suppliers located outside the European Union.
10.3 As a result, in some circumstances your personal data will be transferred to countries outside of the UK whose data protection laws may be less stringent than in the UK.
10.4 In such, cases, the Company will comply with applicable legal requirements and will only transfer your personal data if:
(a) The country to which the personal data will be transferred has been recognised as providing an adequate level of protection for personal data; or
(b) We have put in place appropriate safeguards in respect of the transfer, for example the controller to controller or controller to processor Standard Contractual Clauses.
10.5 You may request a copy of the safeguards that we have put in place in respect of transfer of personal data by contacting privacy@addepar.com.
11. Your rights as a data subject
11.1 Subject to applicable law, you may have the right to request:
(a) confirmation of whether we process personal data relating to you and, if so, to request a copy of that personal data;
(b) that we rectify or update your personal data that is inaccurate, incomplete or outdated;
(c) that we cease to process certain personal data where you object to its use and we do not have an overriding legitimate interest in carrying out the processing and it is not necessary for the establishment, exercise or defence of legal claims;
(d) that we erase your personal data in certain circumstances, such as where we collected personal data on the basis of your consent and you withdraw that consent, or when you object to use of your personal data;
(e) that we restrict the use of your personal data in certain circumstances, such as while we consider another request that you have submitted, for example a request that we update your personal data;
(f) withdrawal of your consent where you have given us consent to process your personal data; and
(g) that we provide a copy of your personal data to you in a structured, commonly used and machine readable format in certain circumstances.
11.2 If you wish to exercise any of your data protection rights or if you consider that we have processed your personal data in violation of applicable law, please contact Addepar’s People or Legal team at people@addepar.com or legal@addepar.com.
11.3 If you consider that we have processed your personal data in violation of applicable law and failed to remedy such violation to your reasonable satisfaction, you may also lodge a complaint with the Information Commissioner’s Office.
12. Notice of changes
12.1 The Company may change or update this Data Privacy Notice at any time.
12.2 Should we change our approach to data protection, you will be informed of these changes or made aware that we have updated the Data Privacy Notice so that you know which information we process and how we use this information.
12.3 This Data Privacy Notice was last updated and reviewed on September 25, 2023.