Candidate Privacy Notice

The BVNK entities listed in Schedule 1 provide this privacy notice (the “Privacy Notice”) to you because you are applying to work with one of said entities (“BVNK”, “we”, “our” or “us”) as an employee, worker or contractor (the “Application”). This Privacy Notice sets out the information that must be provided by us to you at the time your personal data is collected and processed by us and applies to all personal data we collect, use and process relating to your Application. 

BVNK is the “controller” of the personal data of prospective employees, workers or contractors, and is subject to applicable data protection laws. This means that we are responsible for how we collect, hold, use, store, and process your personal data for the purposes of your Application. 

If you have any questions about this Privacy Notice, how we process your personal data, or if you wish to exercise any of your rights as described in this Privacy Notice or under applicable data protection laws, you can contact BVNK’s privacy team (the “Privacy Team”) at dpo@bvnk.com.

Information about this Privacy Notice

This Privacy Notice outlines what data we collect from you, how we use this information, and how the situations in which we disclose such information, in compliance with the relevant data protection laws, including but not limited to the General Data Protection Regulation (EU 2016/679) (GDPR), the Spanish Data Protection Act (Organic Law 3/2018), the Singapore Personal Data Protection Act (SG PDPA) and the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA), (each a “Data Protection Law” and collectively, the “Data Protection Laws”).

By applying to work at BVNK, you acknowledge that you have accessed and read our Candidate Privacy Notice, and you acknowledge that you have been informed of BVNK’s collection, use, processing and disclosure of your personal data. 

Terms not otherwise defined in this Privacy Notice shall have the same meaning as is found in the applicable Data Protection Laws.

1. What is personal data?

Personal data means any information relating to you as an identified or identifiable natural person.

Special category data is information about you, relating to one of the following characteristics: racial or ethnic origin; political opinions; religious beliefs or other beliefs of a similar nature; trade union membership; genetic data; physical or mental health; and/or sexual orientation or sex life.

Legal Justification for Processing Personal Data

Unless otherwise indicated, the processing of personal data refers to the collection, use and disclosure of personal data under the relevant Data Protection Laws. Where there is any inconsistency and/or conflict between the Data Protection Laws, the GDPR shall prevail. 

Pursuant to Article 6 of the GDPR, BVNK shall only use or process your personal data if and to the extent that at least one of the following bases apply: 

• you have given your consent to the processing of your personal data for one or more specific purposes (Consent);
• processing is necessary for the performance of a contract to which you are a party to, or in order to take pre-contractual steps prior to entering into a contract (Contract Performance);
• processing is necessary for compliance with a legal obligation which we are subject to (Legal Obligations); and/or
• processing is necessary for the purposes of the legitimate interests pursued by BVNK or by a third party, except where such interests are overridden by your interests or your fundamental rights and freedoms which require the protection of personal data (Legitimate Interest). Examples include, but are not limited to: 
  • ensure the effective administration and management of the recruitment process; 
  • ensure we hire a suitable individual for a role; or
  • deal with disputes and accidents and take legal or other professional advice or ascertain your fitness to work.

Consent

Where we process your personal data as a result of consent, we ensure that consent is, where required, freely given, specific and informed, and established by a clear affirmative act. Where Consent is withdrawn, we have set out (below) how this may be undertaken by you.

Contract Performance

Where we engage third-party service providers or partners in relation to the recruitment process (e.g., background check providers, recruitment agencies, or HR software providers), the processing of your personal data may be necessary to take steps prior to entering into an employment contract with you or to facilitate the execution of such a contract.

Legal Obligations

Where there are legal obligations which apply to BVNK by virtue of any relevant Data Protection Law and/or an order of court, the processing of personal data may be required.

Legitimate Interest

Where BVNK has conducted an assessment as to whether the processing of personal data is in the legitimate interests of BVNK and that the legitimate interests of BVNK outweighed any adverse effect on the individual whose personal data processed, BVNK may rely on the Legitimate Interest exception (Article 6.1(f) of the GDPR) to process the personal data. Where a legitimate interest is involved, we will state what the legitimate interest is.

If the collection of any of your personal data is not mandatory (for example, where we collect information on a voluntary disclosure basis for equal opportunities monitoring), we will let you know this before we collect it, as well as the consequences of failing to provide us with this information (if any).

2. Data protection principles

We will comply with applicable data protection laws, which state that the personal data we hold about you must be:

• Used lawfully, fairly and in a transparent way;
• Collected only for valid purposes that we have clearly explained to you and not used in any way that is incompatible with those purposes;
• Adequate and relevant to the purposes we have told you about and limited only to those purposes;
• Accurate and kept up to date;
• Kept only as long as necessary for the purposes we have told you about; and
• Kept securely.

What personal data do we collect?

In connection with your Application, we will collect, store, and use the following categories of personal data about you:

If you fail to provide us with certain personal data when requested, we may not be able to progress your Application.

3. How do we collect your personal data?

Personal data is collected directly from you, third party sites (including, but not limited to, publicly available sources such as LinkedIn), employment agencies, job sites, your named references, the Disclosure and Barring Service or other background check providers. We may sometimes collect additional information from third parties including former employers or credit reference agencies. Such personal data is collected during our recruitment process.

4. How do we use your personal data?

We will process or use your personal data to:

• Assess your skills, qualifications, and suitability for the work or advertised role;
• Carry out background and reference checks, where applicable; 
• Assess your right to work in the relevant locations in compliance with immigration rules;
• Communicate with you about the recruitment process;
• Keep records related to our hiring or recruitment process; 
• Carry out data analytics including the profiles of those applying for roles with us;
• Comply with legal or regulatory requirements, for example the duty to make reasonable adjustments for applicants with disabilities and other disability non-discrimination obligations; 
• Comply with any specific regulatory requirements from our customers; 
• Manage the recruitment process, and ensure effective HR, personnel management and business administration; 
• Monitor equal opportunities; and 
• Enable us to establish, exercise or defend possible legal claims.

We will only  process personal data about you in compliance with the lawful bases for processing as set out above and/or where this is required or permitted by applicable law. Some of the above grounds for processing will overlap and there may be several grounds which justify our use of your personal data.

We will only use your personal data for the purpose for which it was collected, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purposes. If we need to use your personal data for an unrelated purpose, we will notify you and we will explain the legal basis which allows us to do so. We may also process your personal data without your knowledge or consent, in compliance with the above rules, where this is permitted or required by applicable law.

 

5. How do we use your special category persona data?

We may process your special categories of personal data to:

• Consider whether we need to provide appropriate adjustments during the recruitment process, for example, whether adjustments need to be made during a test or interview;
• Ensure meaningful equal opportunity monitoring and reporting; or 
• Comply with any legal or regulatory obligation. 

6. When do we use your special category personal data?

We may use special categories of personal data where: 

• You have provided your explicit consent; 
• We need to do so to carry out our legal obligations; 
• It is necessary for the establishment, exercise or defence of a legal claim;
• There is a substantial public interest; or
• It is needed to protect your vital interests (or someone else's vital interests) and you are not capable of giving your consent. 

7. Information about criminal convictions 

As part of the recruitment process, we may ask you for information in relation to unspent criminal convictions as we carry out criminal background checks. 

We will only collect information about criminal convictions if it is appropriate given the nature of the role and where we are legally able to do so. We use this information and these checks: 

• To assess your suitability for a regulated role; 
• To protect your interests, our interests and third-party interests; or
• Because it is necessary in relation to legal claims. 

We are allowed to use your personal data in this way where it is necessary to carry out our employment rights and obligations.

 

Retention of your personal data

The periods for which personal data will be stored and the criteria used to determine retention periods or whether personal data can be removed will depend on the information in question, its relevance or sensitivity. However, generally, personal data will be deleted if it has been superseded by other relevant or up to date personal data, if it is out of date, irrelevant or no longer necessary.

Generally, this means that your personal data will be retained until the end of your Application process or working relationship with us plus a reasonable period thereafter once we have communicated our decision to you about whether to appoint you to a role or offer you work. We retain your personal data for that period so that we can show, in the event of a legal claim, that we have not discriminated against candidates on prohibited grounds and that we have conducted the recruitment exercise in a fair and transparent way. 

For unsuccessful candidates, we will retain personal data for twelve months following our decision. If we wish to retain your data beyond this period for future opportunities, we will seek your explicit consent before doing so.

After this period, we will securely destroy your personal data in accordance with our data retention policy. In some circumstances we may anonymise your personal data so that it can no longer be associated with you, in which case we may use such information without further notice to you.

1.1 Change of purpose

We will only use your personal data for the purposes for which it was collected, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purposes. If we need to use your personal data for an unrelated purpose, we will notify you and we will explain the legal basis which allows us to do so. We may also process your personal data without your knowledge or consent, in compliance with the above rules, where this is permitted or required by law.

1.2 Who we may share your personal data with? 

We will only share your personal data with the following third parties for the purposes of processing your Application: 

• Recruitment agencies and platforms, such as LinkedIn and Otta; 
• Applicant tracking systems, such as Greenhouse
• Background check and online test providers, such as Zinc;
• Employee of record, global payroll solution providers or similar service providers (including Deel, Monday.com and Finance Crowd);
• Credit reference agencies; and/or
• Regulators and competent authorities.

All our third party service providers and BVNK group entities are required to take appropriate security measures to protect your personal data in line with our policies. We do not allow our third party service providers to use your personal data for their own purposes. We only permit them to process your personal data for specified purposes and in accordance with our instructions.

Your personal data may also be shared and processed by other BVNK group entities, for example where they provide services intra-group, for entering into a contract with you for the provision of our services or to perform obligations under such contract. 

1.3 Transfers of personal data

Your personal data will be stored on servers located in the EU. 

We may transfer the personal data we collect about you to countries outside the UK for the purposes of administering the recruitment process. For example, we use Greenhouse to receive and manage applications submitted through the website. This information is hosted by Greenhouse in the United States of America. 

Where required by applicable data protection laws, your consent to the transfer of your personal data outside your home country will be obtained as part of your Application.

As an international organisation, our authorised personnel may access your personal data in any country in which we operate (see Schedule 1). Therefore, it may be necessary to transfer your details to members of a BVNK group located in countries that may not have equivalent data protection or privacy laws to those which apply in your own country. We may also need to transfer your personal data to third-party service providers located in other countries. 

Regardless of where your personal data is transferred to, we make sure that your personal data is protected and that the transfer is subject to appropriate safeguards or is otherwise permitted under applicable data protection laws. Those may include: (i) adequacy decisions as issued by the UK Information Commissioner’s Office or the EU Commission (as applicable); and/or (ii) entering into the UK International Data Processing Agreement and/or Addendum to the EU Standard Contractual Clauses, as applicable.

If you would like further details of such safeguards, please notify BVNK’s Privacy Team at the email address above.

1.4 Data Security

We have put in place appropriate security measures to prevent your personal data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. Additionally, we limit access to your personal data to those employees, agents, contractors and other third parties who have a business need to know. They will only process your personal data on our instructions and they are subject to a duty of confidentiality.

We have put in place procedures to deal with any suspected data security breach and will notify you and any applicable regulator of a suspected breach where we are legally required to do so.

1.5 Your rights

Under certain circumstances, by law you have the right to:

• Right to Access: You have the right to request access to the personal data we hold about you and obtain a copy of it.
• Right to Rectification: You have the right to request the correction of inaccurate or incomplete personal data.
• Right to Erasure: Under certain conditions, you have the right to request the deletion of your personal data.
• Right to Restrict Processing: You have the right to request that we restrict the processing of your personal data under specific circumstances.
• Right to Object to Processing: Where we are relying on a legitimate interest and there is something about your particular situation which makes you want to object to processing on this ground you have the right to object to the processing of your personal data. 
• Right to Data Portability: You have the right to request that we provide your personal data to you in a structured, commonly used, and machine-readable format.

To exercise these rights, please contact the People & Talent Department or the Privacy Team at dpo@bvnk.com.

You will not have to pay a fee to access your personal information (or to exercise any of the other rights). However, we may charge a reasonable fee if your request for access is clearly unfounded or excessive. Alternatively, we may refuse to comply with the request in these circumstances.

1.6 Right to withdraw consent

You have the right to withdraw your consent for processing at any time. To withdraw your consent, please contact BVNK’s Privacy Team. Once we have received notification that you have withdrawn your consent, we will no longer process your Application and, subject to our data retention policy, we will dispose of your personal data securely.

You also have a right to complain to a supervisory authority, in particular:

• • A list of European Union data protection authorities can be found here;
  • The United Kingdom’s data protection authority’s contact details can be found here;
  • The South African data protection authority’s contact details can be found here;
  • The Singapore data protection authority’s contact details can be found here; and
  • The California Privacy Protection Agency contact details can be found here.

1.7 Changing this Privacy Notice

We may update this Candidate Privacy Notice from time to time to reflect changes in our practices, legal obligations, or other relevant factors, for which we reserve our right to do so. We may also notify you in other ways from time to time about the processing of your personal data.

 

Schedule 1

Malta

System Pay Services (Malta) Ltd

Company Number : C66961

Registered Address :

68 Northfields, Penthouse 9, Independence Avenue, Mosta MST9026, Malta

United Kingdom

BVNK Group Services (UK) Limited

Company Number : 13535657

Registered Address :

89 Charterhouse Street, Third Floor, London, England ,EC1M 6PE

Wiredirect Services Limited

Company Number : 13535657

Registered Address :

89 Charterhouse Street, Third Floor, London, England ,EC1M 6PE

System Pay Services Ltd

Company number : 11621763

Registered Address :

89 Charterhouse Street, Third Floor, London, England ,EC1M 6PE

Singapore

System Pay Services (Singapore) Pte. Ltd

Company number : 202313806H

Registered Address :

160 Robinson Road, #1404 Singapore Business Federation Center, 068914, Singapore

 

South Africa

System Pay Services SA (Pty) Ltd

Company number : 2019/222842/07

Registered Address :

Office 103, First Floor, North Wing, Granger Bay Court, V&A Waterfront, 8002

 

Spain

System Pay Services Solutions Spain S.L.

Company number : B16987679

Registered Address :

a. de Europa 19 , 3A, Parque Empresarial La Moraleja, Alcobendas, Madrid , Comunidad de Madrid, 28108, Spain

United States

System Pay Services US

101 W. Broadway

Suite 1975

San Diego , CA 92101