Privacy Notice
Privacy Notice for the The Ardonagh Group - Employer Recruitment
Date of publication: 21-03-2025
The Ardonagh Group (‘We’ 'Us’) manages our employer recruitment process through our career site (the “Career Site”) and by using a related applicant tracking system.
In this Privacy Notice, we explain how we collect and process your personal data if:
- You visit our Career Site (you being a “Visitor”)
- You connect with us via our Career Site to create a profile with us with the intention of receiving information about current or future vacancies with us (you being a “Connecting Candidate”)
- You apply for a position with us, via our Career Site or a third party service (you being an ”Applying Candidate”)
- We collect information about you from other parties, sites and services, since we believe your profile is of interest for our current or future vacancies (you being a “Sourced Candidate”)
- Where you have been referred for potential employment by one of our employees or partners (you being a “Referred Candidate”).
This Privacy Notice also describes what data subject rights you have when we process your personal data and how you can exercise those rights.
When we use the term “Candidate” in this Privacy Notice we are referring to each of Connecting Candidates; Applying Candidates; Sourced Candidates; and Referred Candidates, unless it’s stated otherwise.
1. About processing of personal data
Personal Data is defined as all information that can be directly or indirectly linked to a ‘natural person’. Examples of Personal Data are: name, e-mail address, telephone number and IP address. Processing of Personal Data is any operation or set of operations performed on Personal Data - such as collecting, creating, analysing, sharing and deleting Personal Data.
There are laws and regulations on how companies may process Personal Data. We comply with all applicable data protections laws; including the EU / UK Data Protection Regulation (jointly referred to as “GDPR”).
Most obligations under the GDPR apply to the ‘data controller’. A data controller is the entity that decides the purpose and means for which Personal Data will be processed. A ‘data processor’ is an entity that is only allowed to process Personal Data as instructed by the data controller and may not use the Personal Data for its own purposes.
The applicable recruiting entity within the Ardonagh Group is the data controllers for your Personal Data processed under this Privacy Notice. For more information on the applicable recruiting entity please see the Ardonagh Group portfolio page https://www.ardonagh.com/business-portfolio/
2. What Personal Data do we process?
All individuals
-
Device information - If you visit our Career Site, and for the purposes of site performance, we will collect information about your device such as IP address, browser type and version, session behaviour, traffic source, screen resolution, preferred language, geographic location, operating system and device settings/usage.
-
Technical and statistical data - If you visit our Career Site, we will collect technical and statistical data about your use of the site for the purposes of site performance.
-
Communications data - We will collect and store your communication with us, including the information you provided in the communication. This may include the content of emails, the information you add to your account with us, anonymous surveys on how the recruitment process has been, etc.
-
Contact details - Such as your name, email address, telephone number and postal address.
Candidates
In addition to the information referenced above (under ‘All Individuals’), we will collect and process the following relating to candidates -
-
Information from interviews, recruitment assessments and other information from the recruitment process - Such as notes from interviews with you, salary requirements and other applicable recruitment information.
-
Information in your application - Such as your CV, covering letter, work samples, references, letters of recommendation and educational attainment.
-
Information from work related public resources - Meaning the information we collect about you from work related public sources and related to your professional experience (such as LinkedIn).
-
Information provided by references - Meaning the information we receive from our employees or partners who refer you to us, or by the persons you have listed as your references.
-
Special category personal data – we might collect information considered especially sensitive, such as health data. Where you have identified a need for reasonable adjustments during, or before, the recruitment process then we will ask your consent to retain such data to understand how we can accommodate any medical issues or disabilities identified. Such information will only be processed specifically for those purposes and not retained where no longer necessary. Additionally, information may be volunteered in relation to equal opportunities monitoring (such information will be anonymised accordingly).
3. Where do we receive your Personal Data from?
References
-
From the person for whom you are a reference. If a Candidate lists you as their reference, we will collect your contact details from the Candidate to be able to contact you.
Candidates
-
From the Career Site. If you visit our Career Site, we collect technical and statistical information about how you use the Career Site, and information from your device.
-
Directly from you. Most of the information we process about you, we receive directly from you, for example when you apply for a position with us or connect with us. You can always choose not to provide us with certain information. However, some Personal Data is necessary in order for us to process your application or provide you the information you request to get from us.
-
From work related public sources. We may collect Personal Data about you from work related public sources, such as LinkedIn or the website of your current employer.
-
From our references. We may receive information about you from our employees or partners (such as recruitment service providers), when they believe your profile is of interest for our current or future vacancies.
-
Data we create ourselves or in cooperation with you. Information about your application and profile is usually created by us, or by us in cooperation with you, during the recruitment process. This may for example include notes from interviews with you, assessments and test results.
4. For what purposes do we process your Personal Data?
Protect and enforce our rights, interests and the interests of others, for example in connection with legal claims.
We may collect or retain personal data (including any health data where applicable) about you for the purposes of defending any possible future legal claims or complaints.
Categories of Personal Data used: All the categories of Personal Data listed above can be used for this purpose.
Share your Personal Data with other recipients, for the purposes mentioned in Section 5 below.
Categories of Personal Data used: All the categories of Personal Data listed above may be used for this purpose.
Collect information about your use of the Career Site, using cookies and other tracking technologies, as described in our Cookie Policy.
Affected individuals: Visitors.
Categories of Personal Data used: Information set out above.
Maintain, develop, test, and otherwise ensure the security of the Career Site.
Affected individuals: Visitors.
Categories of Personal Data used: Device information; Technical and statistical data.
Analyse how the Career Site and its content is being used and is performing, to get statistics and to improve operational performance.
Affected individuals: Visitors.
Categories of Personal Data used: Device information; Technical and statistical data.
Provide you with updates about vacancies with us.
Affected individuals: Connecting Candidates.
Categories of Personal Data used: Contact details; Communications data.
Review profiles and applications sent to us. This also includes communicating with you about your application and profile.
Affected individuals: Connecting Candidates; Applying Candidates.
Categories of Personal Data used: All the categories of Personal Data listed above may be used for this purpose.
Collect and evaluate your professional profile on our own initiative. This also includes communicating with you regarding your profile.
Affected individuals: Sourced Candidates; Referred Candidates.
Categories of Personal Data used: All the categories of Personal Data listed above may be used for this purpose.
Contact you to ask for your participation in surveys
Affected individuals: Candidates.
Categories of Personal Data used: All the categories of Personal Data listed above may be used for this purpose.
5. Who do we share your Personal Data with?
Our service providers. We share your Personal Data with our suppliers who provide services and functionality in our recruitment process. For example, this includes recruitment service providers (recruitment agents & businesses) and the supplier of our Career Site and related applicant tracking system.
Our group companies. We share your Personal Data with our group companies when they provide us services and functionality to our recruitment process, such as access to particular systems and software. Additionally, your personal data is shared with the relevant group entity with the role vacancy for which you applied.
Companies providing cookies on the Career Site. If you consent to it, cookies are set by other companies than us, who will use the data collected by these cookies in accordance with their own Privacy Notice. You can find information about which cookies this applies to in our Cookie Policy.
To applicable authorities - when we are legally obligated to do so. We will share your Personal Data with authorities (e.g. regulators, law enforcement) when we have a legal obligation to do so.
To parties involved in legal proceedings. If needed to protect or defend legal proceedings or to take legal advice, we share your Personal Data with public authorities or with other parties involved in a potential or existing legal proceeding.
Mergers and acquisitions etc. In connection with a potential merger, sale of company assets, financing, or acquisition of all or part of our business to another company, we may share your Personal Data to other parties involved in the process.
6. On what legal bases do we process your Personal Data?
To be able to process your Personal Data, we need to have a legitimate reason (‘legal basis’).
When we process your Personal Data for the purposes described in this Privacy Notice, the legal basis we rely on is normally that the processing is necessary for our legitimate interest in being able to recruit talent. We have concluded that we have a legitimate interest in being able to perform the Personal Data processing for this purpose; that the processing is necessary to achieve that purpose and that our interest outweighs any associated risks.
You can contact us for more information about how this assessment was made. See Section 9 and 10 below for our contact information.
There may be specific circumstances when the processing is only performed if and when you provide your consent to the processing. This is for example the case if we propose to record an interview with you or in some cases where we process special category information. Please see Section 9 below for more information about your right to withdraw your consent.
7. When do we transfer your Personal Data outside of the EU/EEA, and how do we protect it then?
Some of our service providers process your Personal Data outside of the UK and EU/EEA.
In cases where another recipient of your Personal Data (as described in Section 5 above) is based outside the UK and EU/EEA, this will also mean that your Personal Data is transferred outside the UK and EU/EEA.
When we, or one of our suppliers, transfer your Personal Data outside the UK and EU/EEA, we will ensure that appropriate protection is put in place to maintain the security of your personal data. For example, we use the following safeguards:
- Where there is a decision by the EU Commission (or applicable regulatory authority for the jurisdiction where the data resides) that the country outside of the UK or EU/EEA to which your Personal Data is transferred has an adequate level of protection, which corresponds to the level of protection afforded by the GDPR.
- Entering into the EU Commissions standard contract clauses (or UK equivalent) with the recipient of the Personal Data outside the UK or EU/EEA. This means that the recipient provides contractually binding guarantees that the level of protection for your Personal Data afforded by the GDPR still applies and that your rights are still protected.
When your Personal Data is transferred outside the UK or EU/EEA, we also implement appropriate technical and organizational safeguards, to protect the Personal Data in case of a disclosure. Exactly which protective measures we implement depends on what is technically feasible, and sufficiently effective, for the particular transfer.
If you want more information about the cases in which your Personal Data is transferred outside the UK or EU/EEA you can contact us using the contact details in Section 9 and 10 below.
8. How long do we keep your Personal Data?
All individuals
If we process your Personal Data for the purpose of being able to protect and enforce our rights, we will keep your Personal Data until the relevant legal issue has been fully and finally resolved or until the expiry of any potential legal timeframes for submission of a claim.
Visitors
We keep your Personal Data for one (1) year for security purposes, for example to monitor any suspicious activity on the system. The retention periods for cookies are set out in our Cookie Policy. We keep your Personal Data to analyse the performance of the Career Site for as long as we keep Personal Data about you for other purposes. Where possible, any such information will be anonymised.
Candidates
If you are a Connecting Candidate (only), we keep your Personal Data for as long as you remain connected with us.
For other types of Candidates, we keep your Personal Data to decide if you are a suitable candidate for the relevant vacancy(ies) with us.
If you don’t succeed in the initial recruitment process, we keep your Personal Data for as long as needed to consider, and potentially contact you, for relevant future job openings.
If you are hired, we will keep your Personal Data during your employment, for other purposes than those stated above, which you will be informed of.
References
We keep your Personal Data for as long as we keep the Personal Data of the Candidate for whom you acted as a reference.
9. What rights do you have, and how can you exercise them?
In this section, you will find information about the rights you have when we process your Personal Data. As described below, some of the rights only apply when we process your Personal Data under a particular legal basis.
Please be aware that exercising some of the data subject rights below will impact Our ability to consider you for any open or future role vacancies.
If you want to exercise any of the rights listed here, you should:
- Visit the Data & Privacy page on our Career Site, where we offer features to let you exercise your rights;
-
Log in to your account with us, where you can use the settings in the account to exercise your rights; or
- Contact us directly at groupprivacy@ardonagh.com.
Right to be informed
You have the right to be informed about how we process your Personal Data. You also have the right to be informed if we plan to process your Personal Data for any purpose other than that for which it was originally collected.
We provide you with such information through this Privacy Notice and through updates on our Career Site (see also Section 11 below).
Right to access your Personal Data.
You have the right to know if we process Personal Data about you and to receive a copy of the data we process about you.
Right to access and to request a transfer of your Personal Data to another recipient (“data portability”) (subject to applicable laws).
You can request a copy of the Personal Data relating to you that we process for the performance of a contract with you, or based on your consent, in a structured, commonly used, machine-readable format. This will allow you to use this data somewhere else, for example to transfer it to another recipient. If technically feasible, you also have the right to request that we transfer your data directly to another recipient.
Right to have your Personal Data deleted (“right to be forgotten”).
In some cases, you have the right to have us delete or anonymise Personal Data about you. This is for example the case if you have objected to the processing and there are no legitimate, overriding justifications for the processing. (For the separate right to object, see below.)
Right to object against our processing of your Personal Data.
You have the right to object to processing of your Personal Data which is based on our legitimate interest, by referencing your personal circumstances.
Right to restrict processing.
If you believe that the Personal Data we process about you is inaccurate, that our processing is unlawful, or that we don’t need the information for a specific purpose, you have the right to request that we restrict the processing of such Personal Data. If you object to our processing, as described just above, you can also request us to restrict processing of that Personal Data while we make our assessment of your request.
When our processing of your Personal Data is restricted, we will (with the exception of storage) only process the data with your consent or for the establishment, exercise or defence of legal claims, to protect the rights of another natural or legal person, or for reasons relating to an important public interest.
Right to rectification.
You have the right to request that we rectify inaccurate information, and that we complete information about you that you consider incomplete.
Right to withdraw your consent.
When we process your Personal Data based on your consent, you have the right to withdraw that consent at any time. If you do so, we will stop processing your data for the purposes you’ve withdrawn your consent for. However, it doesn’t affect the lawfulness of processing that was based on your consent before it was withdrawn.
Right to raise a complaint.
If you have complaints about our processing of your Personal Data, you can raise a complaint with the data protection authority in United Kingdom. You can find their contact details here.
You can also lodge a complaint with your national data protection authority, which you can find listed here if you are based in the EU. If you are based in the UK, you can lodge a complaint with the Information Commissioner’s Office, here.
10. Where can you turn with comments or questions?
If you want to get in touch with us to exercise your rights, or if you have any questions, comments or concerns about how we handle your Personal Data, you can reach us by sending an email to groupprivacy@ardonagh.com.
11. Updates to this Privacy notice
We update this Privacy Notice when necessary - for example, because we start processing your Personal Data in a new way, because we want to make the information even clearer to you, or if it’s necessary to do so in order to comply with applicable data protection laws.
We encourage you to regularly check this page for any changes. You can always check the top of this page to see when this Privacy Notice was last updated.
