CREDIT KARMA GROUP JOB APPLICANT PRIVACY NOTICE
Date adopted: [12 November 2018]
This privacy notice provides information about how we collect and process the personal data that we obtain during the job application process. It covers the following topics:
- Who we are and how you can contact us
- What we use personal data for
- What kinds of personal data we use, and where we get it from
- Our legal grounds for processing personal data
- Where the personal data is stored and sent
- How long the personal data is kept for
- Your rights in respect of the personal data we hold about you
- Who you can complain to if you are unhappy about the use of your personal data
- Changes to the privacy notice
Personal data means information, or a combination or pieces of information, that could identify you.
1. WHO WE ARE AND HOW YOU CAN CONTACT US
We are Credit Karma (CK), a group of companies with headquarters at 760 Market Street, 2nd Floor, San Francisco, CA 94102, United States. The relevant entities of CK to which this privacy notice applies are Credit Karma, Inc. and Newcastle Ventures Ltd. whose contact details are listed in section 5 below. The particular CK entity in the list to whom you are applying is the controller of the personal data we hold about you for this process. For successful candidates employed by Newcastle Ventures Ltd, Credit Karma, Inc. and Newcastle Ventures Ltd. will be joint controllers of your personal data. This means that they are responsible for ensuring the personal data is used fairly and lawfully, and they are the legal persons against whom you can exercise the rights referred to in section 8 below. You can contact us about issues relating to your personal data, including the contents of this notice, by emailing us at UK-Recruiting@creditkarma.com.
2. WHAT WE USE PERSONAL DATA FOR
This section explains the purposes for which we collect and process personal data about you. More detail about the types of personal data that we might use for these purposes can be found in section 3 below. We are mindful of your privacy so we will only use personal data according to the appropriate stage of the application.
Managing the recruitment process
We might review your information on platforms such LinkedIn, for the purpose of identifying potential candidates for the job. We might also transfer your details from these platforms into our applications platform, to assess your skills, qualifications and interests, and to facilitate your application should you choose to apply.
Send you information about other positions within Credit Karma in accordance with your preferences.
To communicate with you and (on a strict need to know basis) relevant CK personnel involved in the recruitment process, and relevant third parties.
To record and demonstrate how we have conducted the application and recruitment process and arrived at our decision regarding your application.
Deal with your enquiries and requests.
Operate, evaluate, and improve the application platform and recruitment system.
Employment screening checks if we decide to make you an offer of employment
CK’s policy is to undertake identity verification checks and employment screening. These checks will only occur if they are necessary or required by law considering the position you are applying for and only if you are offered a position. Completion of these checks will require you to present certain documentation or provide additional details, and may require acknowledgement from you – further details will be provided with any offer of employment. We may engage a third party for this purpose, as outlined in section 5 below.
Checks might include identity verification, your employment and educational references, your qualifications, your credit file and fraud prevention.
Making reasonable disability adjustments (as applicable)
To ensure appropriate arrangements are in place throughout the recruitment process and, if your application is successful, to prepare for you commencing employment.
Legal and regulatory purposes
To respond to and defend any legal claims that may arise out the recruitment process. Also we may provide information to law enforcement agencies where they request this to comply with our legal obligations, or of our own choice where we consider there is a compelling reason to do so to protect our workers, visitors, customers or their consumers, or our general business interests.
3. WHAT KINDS OF PERSONAL DATA WE USE, AND WHERE WE GET IT FROM
We obtain and use information from various different sources. These are summarised in the following table.
Type of information we collect directly from you:
Name and contact details: This is basic personal data about you, and how to get in touch with you. It includes your current home address, email address and telephone number.
Date of birth: To ensure we attribute our records and any employee checks to the correct person, and where needed for any minimum qualifying age applicable to the position in question.
Driver information: We require proof of driving and vehicle insurance eligibility where driving is relevant to the role or involves a company vehicle.
Right to work in the UK: You will be asked to provide relevant documentation for us to check eligibility both at application stage, and if you commence employment with us, to repeat those checks at intervals throughout the employment relationship.
Other application details: Previous work history including work references, qualifications including educational details (e.g., educational history, certifications, skills), and where applicable, professional memberships, your reasons for applying and suitability for the position, and other details you provide in the application form and during interview(s).
Type of information we collect about you from other sources:
Background check information from employment screening agencies, publicly available registers, and the UK VISA and Immigration service (as allowed by law).
Publicly available professional profiles on websites or social media (e.g., LinkedIn).
Information about your performance or conduct from references or clients or service providers you worked with and who may provide feedback about you.
Information about your relationship with previous employers, including prior work experience.
Your CV from recruitment firms.
We may also collect sensitive information (also known as special category information) about you as permitted or required by law. This is a category of personal data that has special protection under data protection laws and includes:
Health or disability information (where applicable): For any facilities or practical arrangements to assist you in the recruitment process (and should any offer of employment be accepted, to prepare the workplace for your arrival).
Photograph used for identification purposes during the onsite interview process
Source of sensitive information: This information is typically obtained directly from you in the application form, from the checks described above, from interviews, or as otherwise notified to you within the application process.
In some circumstances we will use a third party service provider to verify the personal information you submit in the course of your application, including through reference checks and where applicable, background checks as described above.
The above information is mandatory to the application and recruitment process. We consider this appropriate having regard to the nature of our business and our legal and regulatory responsibilities as referred to above. If you wish to discuss these checks in further detail or raise a specific concern, please call your Human Resources contact at your earliest convenience, or email us at UK-Recruiting@creditkarma.com.
4. OUR LEGAL GROUNDS FOR PROCESSING PERSONAL DATA
This section explains the basis on which we process your personal data.
To take steps at your request prior to entering into or in order to enter into any contract of employment that may arise regarding your job application
To comply with our legal and regulatory obligations both generally as a business and in relation to your application for employment. For example proof of your right to work status or regarding disability adjustments
In other cases, CK has a legitimate interest in processing personal data during and after the end of the recruitment process, including:
administering and managing the recruitment process
assessing and confirming an applicant’s suitability for employment
deciding to whom to offer a job
keeping records of an applicant’s name and reasons for previous unsuccessful job applications to CK
When we process personal data to meet our legitimate interests, we put in place safeguards to ensure that your privacy is protected and to ensure that our legitimate interests are not overridden by your interests or fundamental rights and freedoms. For more information about the balancing test that we carry out to process your personal information to meet our legitimate interests, please contact us as the details below.
We may obtain your explicit consent to collect and use certain types of personal information when we are required to do so by law (for example, when we process some categories of sensitive personal data). If we ask for your consent to process your personal data, you
5. WHO WE SHARE THE PERSONAL DATA WITH
We may share your personal data with third parties:
where required to do so by law, including with public authorities to comply with legal and/or regulatory requirements;
with third parties to protect and defend our rights and property, where permitted by law.
We may also share your personal data in the following circumstances and with the following recipients and categories of recipients:
Our group companies
We may share your personal data among the relevant members of CK. If we do so, then use of the data by those companies will be governed by this privacy notice. A list of relevant CK companies is set out below although the list may change from time to time.
Credit Karma, Inc., ATTENTION: Legal Department, 760 Market Street, 2nd Floor, San Francisco, CA 94102, United States; UK-Recruiting@creditkarma.com.
Newcastle Ventures Ltd., ATTENTION: Legal Department, 760 Market Street, 2nd Floor, San Francisco, CA 94102; UK-Recruiting@creditkarma.com. Newcastle Ventures Ltd has a DPO that can be contacted by email at DPO@creditkarma.com or by phone at 415-852-7397.
We may provide your information to third parties who help us use it for the purposes described in section 2. For example:
Our database of personal data may be hosted by third parties on our behalf.
Our applications platform and other software used to process your application may be provided by third parties
Background checks may be carried out by third parties
These service providers, where they process your personal data under our instructions, will not be allowed to use your information for their own purposes or on behalf of other organisations.
If we sell our business to a third party, or go through a corporate reorganisation, this will involve the transfer of our corresponding human resources records (including recruitment records), to the new undertaking for them to use in the same way as set out in this privacy notice.
6. WHERE THE PERSONAL DATA IS STORED AND SENT
Our group company, Credit Karma, Inc., is based in the US. To the extent that we transfer your personal data to the US we will put in place a data sharing agreement based on the standard contractual clauses approved by the European Commission to legitimize international data transfers.
Other examples of situations where data might be transferred outside the EEA are where we may use cloud-based technology or a data centre or backup facility overseas. People in other countries may also need to access data for purposes such as technical support or system development and testing.
While countries within the European Union all ensure a high standard of data protection law, some parts of the world may not provide the same level of legal protection in relation to personal data. As a result, when we do send personal data overseas, we will make sure that suitable safeguards are in place to protect the information. These safeguards include the standard contractual clauses approved by the European Commission and Privacy Shield. If your information has been sent overseas like this, you can obtain further information about the safeguards used by emailing us at UK-Recruiting@creditkarma.com.
7. HOW LONG THE PERSONAL DATA IS KEPT FOR
To enable us to deal with any queries or issues that may arise from the job application process, we will, unless otherwise stated in this privacy notice, retain your personal details in our records for a period of six months from the date that we formally notify you of our decision. Certain details, such as name and disability adjustments might be retained for longer for regulatory reasons and potential litigation up to 3 years. In addition, we may also keep certain details, such as name and reasons for an unsuccessful application, in case you apply again in the future, for up to one year from the date that we formally notify you of our decision. If your application is successful, to ensure business continuity, we will transfer these records to your employee file upon commencement of employment.
8. YOUR RIGHTS IN RESPECT OF THE PERSONAL DATA THAT WE HOLD ABOUT YOU
You have several different rights in relation to the personal data that we hold about you. These are briefly described below. To discuss or exercise these rights, please use the contact details set out in section1.
Access: You have a right to find out what personal data we hold about you, and certain other information such as how we are using it.
Rectification: If the information that we hold about you is inaccurate or out of date, you have a right to ask us to correct it.
Objection to legitimate interests: If you disagree with us relying on the legitimate interests grounds for using your personal data (see section 4 above), you can object to us doing so. Subject to applicable law, we will then reassess the extent to which we can continue to use the data in light of your particular circumstances
Erasure: In certain circumstances you can ask us to delete your personal data from our systems.
Restriction: In some circumstances you can ask us to restrict the ways in which we use your personal data.
Portability: You have the right to receive some limited kinds of information in a useable electronic format and transmit it to a third party
9. WHO YOU CAN COMPLAIN TO IF YOU ARE UNHAPPY ABOUT THE USE OF YOUR PERSONAL DATA
If you are not happy with the way we use or handle your personal data you should contact us so that we can investigate your concerns. Please contact us by sending an email to UK-Recruiting@creditkarma.com. You also have the right to lodge a complaint with your local supervisory authority in the European country where you work, reside, or where the subject-matter of your complaint arises. The supervisory authority in the UK is the Information Commissioner’s Office (ICO).
10. CHANGES TO THE PRIVACY NOTICE
You may request a copy of this privacy notice using the contact details set out above. We may modify or update this privacy notice from time to time.
Where changes to this privacy notice will have a fundamental impact on the nature of the processing or otherwise have a substantial impact on you, we will give you sufficient notice so that you have the opportunity to exercise your rights (e.g., to object to the processing).