Privacy Policy for job candidates – OANDA Europe Limited
This „Privacy Policy for job candidates – OANDA Europe Limited” (hereinafter: the „Privacy Policy”) has been prepared by the company operating under the name OANDA Europe Limited (hereinafter: „Data controller” or „OEL”) and is directed to job candidates.
Based on Art. 13 sec. 1 and 2 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation; hereinafter: the „GDPR”) below we present you with information on the rules of processing and protection of your personal data.
- Who is responsible for your personal data?
The Data controller of personal data is OANDA Europe Limited with its seat in London, address: 18 St Swithin's Lane, London, United Kingdom, EC4N 8AD, a company entered in the register of entrepreneurs under the number 7110087.
- How to contact the Data controller?
A Data Protection Officer has been appointed at OEL. In matters relating to the processing of personal data by the Data controller, you can contact us using the following e-mail address: people@oanda.com and privacy@oanda.com. You can also make an appointment at the office of OEL or send information via post.
- On what legal basis and for what purpose are your personal data processed?
Your data will be processed in order to recruit for a position in the Data controller.
As part of recruitment processes, the Data controller expects the transfer of personal data (e.g. in curriculum vitae) only to the extent specified in the provisions of the applicable law. Consequently, the broader scope of information should not be provided. In the event that the submitted applications contain additional data, exceeding the scope indicated by the provisions of applicable law, their processing will be based on the candidate's consent (Article 6 para. 1 letter a of the GDPR), expressed through an unequivocal confirming action, which is sent by the candidate application documents. If the submitted applications contain information inadequate for the purpose of recruitment, they will not be used or taken into account in the recruitment process.
If voluntary and optional consent is given (Article 6 para. 1 letter a of the GDPR), the data will also be processed for the purposes of future recruitments conducted by the Data controller, in particular in order to present you with new job offers, invite you to take part in recruitments and check the possibilities of your participation in future recruitments carried out by the Data controller.
If the preferred form of employment is an employment agreement - in order to perform obligations resulting from legal provisions related to the employment process, including in particular the labor law - the legal basis for processing is the legal obligation incumbent on the Data controller (Article 6 para. 1 letter c of the GDPR in connection with the provisions of the labor law).
If the preferred form of employment is a civil law contract - in order to conduct the recruitment process - the legal basis for the processing of data contained in the application documents is taking action before concluding the contract at the request of the data subject (Article 6 para. 1 letter b of the GDPR).
In order to verify the qualifications and skills of the candidate and to establish the terms of cooperation - the legal basis for data processing is the legitimate interest of the Data controller (Article 6 para. 1 letter f of the GDPR). The legitimate interest of the Data controller is the verification of job candidates and determining the conditions of possible cooperation.
In order to establish or pursue possible claims by the OEL or to defend against claims made against the Data controller - the legal basis for data processing is the Data controller's legitimate interest (Article 6 para. 1 letter f of the GDPR).
If additional information is included in the documents provided by you - personal data referred to in art. 9 para. 1 of the GDPR, they will be processed with your consent (article 9 para. 2 letter a of the GDPR), which can be revoked at any time.
Data processing for purposes other than the above may take place: (i) based on obtaining additional consent, (ii) on the basis of applicable law, or (iii) when it is consistent with the purpose for which the personal data was originally collected (art. 6 para. 4 of the GDPR).
To the extent that personal data are processed based on the consent given, it can be withdrawn at any time, without affecting the lawfulness of the processing carried out before its withdrawal. If consent is given for the purposes of future recruitment processes, personal data will be deleted no later than after two years - unless the consent has been withdrawn earlier.
Providing data in the scope specified in applicable law is required - if the candidate prefers employment based on an agreement of employment - by law, including in particular the labor law, and in the case of preferring employment based on a civil law contract - by the Data controller. The consequence of not providing this data is the inability to consider a given candidacy in the recruitment process. Providing other data is voluntary.
- What are your rights in the scope covered by the Privacy Policy?
You have certain rights in relation to your personal data, but please be aware that certain exceptions apply to the exercise of these rights and so you will not be able to exercise these in all situations. The Data controller exercises your rights without undue delay, generally, within one month of receiving the request.
- Subject access: You have a right to be provided with access to your personal data processed by the Data controller.
- Rectification: You have the right to request the Data Controller to correct your personal data that is incorrect, as well as to request supplementing incomplete personal data.
- Erasure: You have the right to request the Data controller to erase your personal data in any of the following cases: (i) when personal data are no longer necessary for the purposes for which they were collected or otherwise processed, (ii) when personal data is processed unlawfully, (iii) when personal data must be removed in order to fulfil the legal obligation provided for in generally applicable regulations.
However, the Data controller will not be able to erase personal data to the extent that their processing will be necessary for: (i) exercising the right to freedom of expression and information, (ii) compliance with a legal obligation that requires processing on the basis of universally applicable regulations, (iii) statistical purposes on the terms set out in the GDPR, (iv) establishing, investigating or defending claims.
- Restriction: You have the right to request the Data controller to limit the processing of personal data in cases where: (i) you question the correctness of personal data - for a period allowing the Data controller to check the correctness of this data, (ii) the processing is unlawful, and you oppose the deletion of personal data and request the restriction of their use instead, (iii) the Data controller no longer needs personal data for the purposes of processing, but you need them to establish, assert or defend claims.
- Portability: To the extent that personal data is processed in order to conclude and perform a contract or processed on the basis of consent, and data processing is carried out in an automated manner - you have the right to receive your personal data from the Data Controller in a structured, commonly used and machine-readable format. You also have the right to send this personal data to another entity or request it from us.
- Object: You have the right to object to the processing of your personal data if the Data controller processes this data in a legitimate interest. We may disregard the objection if we demonstrate the existence of valid, legitimate grounds for processing, overriding your interests, rights and freedoms, or grounds for establishing, pursuing or defending claims.
- You also have the following additional rights:
- Withdrawal of consent: In the circumstances where you may have provided your consent to the processing of your personal data, you have the right to withdraw any consents to processing that you have given us and prevent further processing if there is no other ground under which we can process your personal data.
- Raise a complaint: You can raise a complaint about our processing with the data protection regulator in your jurisdiction (for example in the UK – „Information Commissioner’s Office (ICO)”.
- Providing personal data
Providing your personal data to the extent resulting from generally applicable law, in particular national labor law is necessary to participate in the recruitment procedure. Providing other data by you is voluntary.
- Automated decision making
You will not be subject to a decision which is based solely on automated processing, including profiling, and produces legal effects for you or similarly significantly affects it.
- Who is your personal data shared with?
The Data Controller may transfer your data to the following categories of recipients if it is necessary to carry out the process: a company from the capital group to which the OEL belongs, legal advisers, associates, entities providing servers and data storage, software suppliers for the recruitment process (such as Greenhouse Software Inc.) and verification of candidates.
- Transfer of personal data to third countries
In order to handle the recruitment process and use the necessary software, the Data controller transfers your personal data to recipients outside the EEA, i.e. to third countries. In the case of transfer of personal data to third countries, i.e. to recipients based outside the European Economic Area, the OEL transfers them using mechanisms consistent with applicable law, which include, inter alia, the use of standard data protection clauses adopted by the Commission or adequacy decisions. You can get more information in this regard each time by contacting the Data controller in accordance with point 2 of the Privacy Policy.
- How long is your personal data kept?
Personal data will be processed until the end of the recruitment process. In the event of separate consent to the processing of data for the purposes of future recruitment, the personal data will be processed until the end of these recruitment, but no longer than until the consent to data processing is withdrawn.
- Change in the Privacy Policy
This Privacy Policy may change, in particular if the need or obligation to introduce such changes results from changes in applicable law, including changes in the recipients of the data.