1. Introduction

This Privacy Notice explains how the Reconomy Group ("we", "us", "our", "company'') collects, uses, stores, and shares personal data submitted by job applicants ("you", "your").

We use Pinpoint, a recruitment platform provided by The Infuse Group Limited (trading as Pinpoint), to manage our recruitment process. Further details for Pinpoint’s data privacy can be found here: https://www.pinpointhq.com/security-privacy

As part of our recruitment process, we may use artificial intelligence (AI) and automated tools to help manage applications for open roles. We explain how those tools use your personal information and what that means for you in Appendix 1: Use of AI and Automation in Recruitment.

This notice supplements and should be read alongside our general privacy notices available on Reconomy group websites, including: https://www.reconomy.com/privacy-policy/.

We are committed to protecting your privacy and complying with the Data Protection Laws.

2. Who we are

Recruitment activities may be managed by the Reconomy company to which you have applied, or on a centralised basis by recruitment teams operating across the Reconomy group. In carrying out recruitment, workforce planning, internal mobility and talent management activities, your personal data may be accessed and shared between relevant Reconomy group companies where necessary. Reconomy group companies work together for such purposes in accordance with applicable data protection laws.

Data processing roles are outlined below:

The Reconomy group company advertising the role or otherwise engaging with you as a candidate will generally act as the controller of your personal data.
Where recruitment services are provided centrally on behalf of a group company, the entity providing those services may act as a processor acting on the controller's instructions.
Where two or more Reconomy group companies jointly determine why and how your personal data is processed, for example in relation to shared recruitment processes, internal mobility programmes or group-wide talent pools, those companies will act as joint controllers. A summary of the joint controllers' respective responsibilities is available by contacting us using the details set out below, and you may exercise your rights under data protection law against any of the joint controllers.

Where your information is shared with another group company, we will do so only where there is a lawful basis for the sharing. Where a group company or service provider is located outside the UK or EEA, the transfer will be made under one of the following safeguards: an adequacy decision, the UK International Data Transfer Agreement, or the UK Addendum to the EU Standard Contractual Clauses. Additional information regarding the specific processing activities undertaken by each entity can be obtained by contacting gdpr@reconomy.com.

3. Definitions

“Data Protection Laws” means applicable law and regulatory requirements relating to the processing, privacy and use of personal data and protection of individuals, including, but not limited to:

(i) Regulation (EU) 2016/679 (“GDPR”)

(ii) Regulation (EU) 2016/679 (“GDPR”) as incorporated into domestic UK law by the European Union (Withdrawal Agreement) Act 2020 and amended by The Data Protection, Privacy and Electronic Communications (Amendments etc.) (EU Exit) Regulations 2020 (together the “UK GDPR”).

(iii) any legislation enacted in the country of establishment of the data controller in respect of the protection of personal data or any corresponding or equivalent national laws or regulations.

all as amended, updated, or replaced from time to time;

“Relevant Guidance” means:

(i) guidance and codes of practice issued from time to time by a data protection regulator and/or the European Data Protection Board (previously known as the Article 29 Working Party); and

(ii) any relevant case law, court order, judgment or decree under applicable law and regulatory requirements.

“Domestic Law” means the laws of the country of establishment of the data controller

“Personal Data” means any information relating to an identified or identifiable natural person, who can be identified, directly or indirectly, such as a name, identification number, location, online identifier.

4. What Personal Data We Collect

During the application process, we may collect the following categories of personal data:

Full name and contact details (email, phone, address)
CV/resume, cover letter, employment history, education
Job preferences and application details
Interview notes and assessments
IP address and usage data (for platform security and analytics)

We may collect the following categories of personal data for employment and onboarding documentation, which may vary depending on the country of employment and applicable legal requirements, including for the EU and the UK, such as:

Full name and contact details (email, phone, address);
Employment details (start date, job title, contract type);
Proof of identity and right to work (passport, national ID card, residence permit, visa, biometric residence permit);
Identification and statutory information, such as national identification numbers or ID card details, date of birth, sex, marital status, number of dependents or children (where required for tax or benefits registration) to fulfil legal, payroll, tax, or social security obligations;
Social security or national insurance information;
Tax-related forms and declarations (e.g. tax identification numbers, tax residency declarations);
Employment eligibility and statutory declarations;
Bank account details for salary payments;
Signed employment agreements, policies, and acknowledgements;
Reference and/or qualification check documentation.

In certain jurisdictions, we may also collect and process special category personal data and criminal conviction data where permitted and required by law, for employment and onboarding purposes. This may include:

Medical or health-related information, such as fitness-to-work assessments or mandatory occupational health checks;
Criminal conviction or background check information, where required by law or permitted for the role.
Equal opportunity data (e.g., gender, ethnicity, disability status) – optional

Such data is processed strictly in accordance with applicable Data Protection Laws and only where appropriate legal safeguards are in place.

The specific documents requested depend on local legal, regulatory, and employment requirements applicable in the relevant country or state.

5. Legal Basis for Processing

We process your data under the following lawful bases:

Compliance with a legal obligation

We process certain personal data where necessary to comply with our legal obligations under employment, tax, social security, health and safety, and identity‑verification laws. This may include processing information such as identification documents, national insurance or social security numbers, right to work information, statutory declarations, and information required for required medical examination scheduling (when required by law).

Processing of special category data and criminal conviction data is carried out where necessary to comply with employment, health and safety, occupational health, or legal screening obligations, and in accordance with Articles 9(2) and 10 GDPR, as applicable.

Performance of a contract

We process personal data where necessary to take steps at your request prior to entering into an employment contract and to perform our contractual obligations once the employment relationship begins. This includes activities such as preparing employment documents, creating user accounts, and granting system access.

Legitimate interests

We process personal data where necessary for our legitimate interests in managing and administering our recruitment processes, assessing your suitability for available roles, communicating with candidates, maintaining talent pipelines, and supporting workforce planning and internal mobility across the Reconomy group. We only do so where our interests are not overridden by your rights and freedoms.

Consent

We rely on your consent where it is required by law, including for the collection of optional information such as equal opportunities monitoring data and for sending marketing communications. You may withdraw your consent at any time.

6. How We Use Your Data

We use your personal data to:

Manage your job application(s)
Communicate with you during the recruitment process
Evaluate your qualifications and suitability
Organise pre-employment on onboarding checks, such as identity verification, where required by law or internal policies
Manage mandatory administrative steps, including creating your employee profile, generating your employee ID, and setting up your access permissions
Ensure legal and HR compliance, such as employment, tax, and social security obligations
Conduct background checks (where applicable, based on local legislation).
Verifying your eligibility to work in the relevant jurisdiction and complying with EU and UK employment, immigration, tax, and social security laws
Prepare and issue your employment documentation

We may use information collected throughout the recruitment process, including application, assessment, interview, and hiring data, to monitor and improve the way we recruit candidates. This may include analysing recruitment outcomes, evaluating the effectiveness of hiring tools and technologies (including AI-enabled features), identifying opportunities to improve efficiency and consistency, and enhancing the experience of candidates, recruiters, and hiring managers. Any such activity will be undertaken in accordance with applicable data protection laws and, where appropriate, using aggregated or anonymised data wherever possible.

We explain how AI tools utilised during our recruitment process use your personal information and what that means for you in Appendix 1: Use of AI and Automation in Recruitment.

You have the right to object to this AI-assisted evaluation, including any profiling involved. To object, contact gdpr@reconomy.com

If you object, we will stop any further AI-assisted processing unless we have compelling legitimate grounds that override your interests, or need to continue for the establishment, exercise or defence of legal claims.
Please note that any objection will apply to future processing. Where AI-assisted evaluation has already taken place before we receive your objection, we may not be able to reverse processing that has occurred. However, once your objection is received, any further assessment of your application will be carried out by human reviewers without the use of AI tools.

7. Data Sharing

We may share your data with:

Payroll and benefits providers

Third‑party service providers who support payroll processing, tax administration, pension schemes, medical or other insurance, wellbeing platforms or other employment‑related benefits. Occupational health, medical service providers and health and safety

Where required for mandatory pre‑employment or onboarding medical checks, workplace health and safety assessments, risk evaluations, or statutory compliance.

IT and system service providers

Vendors who provide tools used for onboarding, identity verification, access management, or internal communication platforms.

Regulatory and governmental authorities

When required to comply with legal obligations related to employment, tax, social security, immigration, health and safety, or other statutory requirements

Background screening and verification providers

Third-party providers performing background, reference, or right-to-work checks, where permitted by applicable law.

Professional advisors

Legal, tax, audit, or HR advisors, where necessary for compliance with legal or regulatory obligations.

Regulatory and governmental authorities

When required to comply with legal obligations related to employment, tax, social security, immigration, health and safety, or other statutory requirements.

Other companies within the Reconomy Group

Who utilise the Pinpoint platform and where necessary for internal HR administration or group-wide compliance purposes.

All third parties are bound by data protection agreements and must comply with applicable Data Protection Laws.

8. Data Retention

We retain personal data collected during the recruitment and onboarding process only for as long as necessary for employment and legal purposes, including:

During your employment: Onboarding personal data becomes part of your employee file and is kept for the duration of your employment.
Unsuccessful applicants: We may retain your personal data for a limited period following conclusion of recruitment process to consider you for future opportunities where appropriate, and manage potential legal claims, unless a longer retention period is required or permitted by applicable law.
After employment ends: Certain information may be retained for mandatory legal, tax, social security, audit, or employment law retention periods, depending on local regulatory requirements.
Local regulatory requirements: Retention periods may vary by country, and we apply all applicable local statutory retention.
Where no specific legal period applies: Data is retained only for as long as necessary for the purpose for which it was collected, and then securely deleted or anonymised.

You may request earlier deletion (see Your Rights).

9. Where Your Information Is Processed

Pinpoint stores data within data centres locating in the EU and UK. Through Pinpoint’s hosting infrastructure., your information may be processed in the United Kingdom (UK), the European Economic Area (EEA) and the United States.

Due to the international nature of the Reconomy’s operations, personal data may be disclosed to countries outside of the UK and/or the EEA. If a controller transfers personal data to a third country i.e., outside the European Economic Area for an EU Controller or, outside the United Kingdom for a UK Controller, we will seek to put in place appropriate safeguards to ensure that personal data remains adequately protected. We will ensure that all legal requirements in respect to international data transfers will be followed.

10. Your Rights

Under GDPR, you have the right to:

Access your data
Rectify inaccurate data
Erase your data ("right to be forgotten")
Restrict or object to processing
Data portability
Withdraw consent at any time

To exercise your rights, contact us at gdpr@reconomy.com

11. Complaints

If you believe your data rights have been violated or you are unhappy with how we have used your data, you can contact your local supervisory authority.

For UK:

Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
Tel: 0303 123 1113

ICO website: https://www.ico.org.uk

For EEA:

A list of European Supervisory authorities is maintained by the European Data Protection Board (EDPB) and can be accessed here: https://www.edpb.europa.eu/about-edpb/our-members_en

12. Changes to our Notice

Any changes we make to our Privacy Notice in the future will be posted on this page and, where appropriate, notified to you by email. Please check back frequently to see any updates or changes to our Privacy Notice.

Appendix 1: Use of AI and Automation in Recruitment

1. Purpose

As part of our recruitment process, the Reconomy Group, uses artificial intelligence (AI) and automated tools to help manage applications for advertised roles. This notice explains how those tools use your personal information and what that means for you.

2. The AI Tools We Use

We use Pinpoint, a recruitment platform provided by The Infuse Group Limited (trading as Pinpoint), to manage this recruitment process. For this vacancy, we have enabled the following AI-assisted features:

AI Candidate Match Score: gives our recruiters an indicative score of how closely your application matches the criteria for the role. This score is a guide only and does not determine the outcome of your application.
AI Notetaker: produces an automated summary of interview conversations to support our recruiter’s own notes.
AI Hiring Copilot: an internal tool that helps our recruiters and hiring managers prepare for interviews and record their own decisions; it is used by our staff and does not process your application independently of them.

3. What Personal Information the AI Processes, and For How Long

The tools listed above process the personal information you provide as part of your application, such as your name, contact details, CV, application form answers, and career and qualification history, together with interview transcripts, and assessment results.

We do not use AI to estimate or infer your gender, ethnicity, age, disability, or other characteristics protected under the Equality Act 2010 from your name or application, and we do not permit AI Candidate Filters to be configured to filter candidates in or out based on those characteristics.

If we ask you to voluntarily provide diversity information for equal opportunities monitoring, this is collected separately, on an optional basis, and is not used by the AI tools described in this notice to score or filter your application.

AI-derived outputs, match scores, interview summaries and transcripts, and chatbot logs, are retained on the same schedule as the rest of your application unless stated otherwise . Please refer to Data Retention.

4. Whether AI Makes a Decision Affecting You

AI supports, but does not replace, a human decision

The AI features described in this notice help our recruiters and hiring managers work through applications; they do not decide the outcome of your application. A member of our recruitment team reviews the AI’s filtering, match score, or summary before any decision is made about whether you progress and can depart from what the tool suggests. No decision about your application is taken solely by AI.

You can raise a concern about how a decision was made at any time by contacting gdpr@reconomy.com.

5. Our Purpose and Lawful Basis

We use these tools to support our recruitment process and to help us assess applications role consistently, fairly, and efficiently. These tools assist us in reviewing candidate information, managing applications, identifying relevant skills and experience and progressing candidates through the recruitment process within a reasonable timeframe.

Our lawful basis for this processing is our legitimate interests in recruiting suitable candidates, operating an effective and consistent recruitment process, and making informed hiring decisions. We have considered the impact of this processing on candidates and are satisfied that our legitimate interests are not overridden by your rights and freedoms.

We use consent for the lawful basis for the use of AI notetaking during interviews. Candidates are asked to agree in advance of the use of the tool. If consent is not provided, the AI note-taking tool is not enabled, and the interview will be conducted without AI-assisted notetaking.

Where required by applicable law, or where particular processing activities involve special category personal data, we will rely on an alternative lawful basis and/or meet any additional legal requirements that apply.

6. Fairness, Accuracy and Human Oversight

We and Pinpoint take steps to check that these AI features work fairly and accurately, including periodic testing for bias across groups sharing protected characteristics, and review of a sample of AI-assisted outcomes by our recruitment team. If you believe an AI-assisted feature has treated your application inaccurately or unfairly, you can ask us to investigate this, see Contact us.

7. Who Is Responsible For Your Information

The Reconomy group company advertising the role or otherwise engaging with you as a candidate will generally act as the controller of your personal data throughout our recruitment process.

The Infuse Group Limited (Pinpoint) processes your information on our instructions, as our processor, to provide the recruitment platform and its AI features. Further details for Pinpoint’s responsible AI approach can be found here: https://www.pinpointhq.com/security-privacy/pinpoint-ai-approach [DS8] [EM9] [EM10]

8. Your Rights and How To Contact Us

You have the right to access, correct, or ask us to delete your personal information, to restrict or object to our processing, and to complain to the Information Commissioner's Office (ICO) or, if you are based in the EEA, your local supervisory authority.

To exercise any of these rights, or to ask a question about our use of AI in this recruitment process, contact gdpr@reconomy.com.