Candidate Privacy Notice

Published on RBQ website for employment applicants

1. Purpose

The Robiquity group of companies is a "controller" in relation to personal data. This means that we are responsible for deciding how we hold and use personal information about you. You are being sent a copy of this privacy notice because you are applying for work with us (whether as an employee, worker or contractor). It makes you aware of how and why your personal data will be used, namely for the purposes of the recruitment exercise, and how long it will usually be retained for.

It provides you with certain information that must be provided under the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 (DPA 2018), and the Data (Use and Access) Act 2025 (DUAA 2025), which amends and supplements the UK GDPR framework. References in this notice to "data protection law" should be read as encompassing all three instruments.

2. Data Protection Principles

Robiquity will comply with data protection law and principles, which means that your data will be:

• Used lawfully, fairly and in a transparent way.  
• Collected only for valid purposes that we have clearly explained to you and not used in any way that is incompatible with those purposes.  
• Relevant to the purposes we have told you about and limited only to those purposes.  
• Accurate and kept up to date.
• Kept only as long as necessary for the purposes we have told you about.  
• Kept securely.

These principles are set out in Article 5 of the UK GDPR, as retained and amended by the DUAA 2025.

3. Information Which We Hold

In connection with your application for work with us, we will collect, store, and use the following categories of personal information about you:

• The information you have provided to us in your curriculum vitae and covering letter.
• The information you have provided on our online application form, including name, title, address, telephone number, personal email address, date of birth, gender, employment history, and qualifications.
• Any information you provide to us during an interview either via Teams or in-person.
• Any information provided during any testing or presentation process.

We may also collect, store and use the following types of more sensitive personal information:

• Information about your race or ethnicity, religious beliefs, sexual orientation and political opinions.
• Information about your health, including any medical condition, health and sickness records.

4. How is Your Personal Information Collected?

We collect personal information about candidates from the following sources:

• You, the candidate directly.
• You, the candidate via LinkedIn or the Robiquity website.
• A Robiquity colleague who may be referring via our Candidate Referral Policy.
• Recruitment agencies, from which we collect the following categories of data: name, CV, salary expectations and any notes forwarded to us by the recruitment agency as part of the recruitment process.
• The following data from third parties is from a publicly accessible source: name, qualifications, previous work experience.

5. How We Will Use Information About You

We will use the personal information we collect about you to:

• Assess your skills, qualifications, and suitability for the work or role.
• Carry out background and reference checks, where applicable.
• Assess suitability for Security Clearance.
• Communicate with you about the recruitment process.
• Keep records related to our hiring processes.
• Comply with legal or regulatory requirements.

Lawful Basis for Processing

It is in our legitimate interests to decide whether to appoint you to the role or the work since it would be beneficial to our business to appoint someone to that role or work. We also need to process your personal information to decide whether to enter into a contract or a contract of employment with you.

Our primary lawful bases for processing your personal data during recruitment are therefore:

• ‍Article 6(1)(b) UK GDPR — processing necessary for the performance of a contract to which you are party, or to take steps at your request prior to entering a contract;‍
• Article 6(1)(c) UK GDPR — processing necessary for compliance with a legal obligation; and‍
• Article 6(1)(f) UK GDPR — processing necessary for our legitimate interests, including the efficient and fair assessment of candidates.

Having received your CV and covering letter or your application form and the results from any testing which you undertook, we will then process that information to decide whether you meet the basic requirements to be shortlisted for the role. If you do, we will decide whether your application is strong enough to invite you for an interview. If we decide to call you for an interview, we will use the information you provide to us at the interview to decide whether to offer you the role or work. If we decide to offer you the role or work, we will then take up references, verify previous work experience and carry out a right to work, criminal record and credit check before confirming your appointment.

6. If You Fail to Provide Personal Information

If you fail to provide information when requested, which is necessary for us to consider your application (such as evidence of qualifications or work history), we will not be able to process your application successfully. For example, we require a BPSS for all roles (which includes employment verification and Credit Checks) and if you fail to provide us with relevant details, we will not be able to further consider or continue with your application.

7. How We Use Particularly Sensitive Personal Information

We will use your particularly sensitive personal information in the following ways:

• We will use information about your disability status to consider whether we need to provide appropriate adjustments during the recruitment process, for example whether adjustments need to be made during a test or interview.
• We will use information about your race or national or ethnic origin, religious, philosophical or moral beliefs, or your sexual life or sexual orientation, to ensure meaningful equal opportunity monitoring and reporting.

The lawful basis for processing special category data is Article 9(2)(b) of the UK GDPR (processing necessary for the purposes of carrying out obligations and exercising rights in the field of employment), read together with Schedule 1 of the DPA 2018, as amended by the DUAA 2025.

8. Information About Criminal Convictions

We will request to check and process information about criminal convictions. We will collect information about your criminal convictions history if we would like to offer you the work or role (conditional on checks and any other conditions, such as references, being satisfactory). We have in place an appropriate policy document and safeguards which we are required by law to maintain when processing such data.

9. Automated Decision-Making

We may use automated tools and systems at certain stages of the recruitment process, for example to screen applications or schedule assessments. However, no decision that produces a legal or similarly significant effect on you will be made solely by automated means without meaningful human involvement.

Where automated processing tools are used to assist our decisions (for example, applicant tracking systems or scoring tools), a member of our recruitment or People team will always review and take responsibility for the final decision.

Your rights in relation to automated processing

Under the DUAA 2025 (amending the UK GDPR), you have the right to:

• Be informed when automated processing has been used in a decision that affects you;
• Request a meaningful explanation of the logic involved in any such automated processing, to the extent that it influenced a decision about you;
• Request that a qualified human being reviews any decision that has been taken with automated assistance, where that decision has a significant effect on you; and
• Contest any decision that is based solely on automated processing.

If you wish to exercise any of these rights, please contact us at dpo@robiquity.com.

10. Why Might You Share My Personal Information With Third Parties?

We will only share your personal information with the following third parties for the purposes of processing your application: VeroScreen, ADS Group, HiBob, Microsoft Office 365 and external recruitment agencies.

All our third-party service providers and other entities in the group are required to take appropriate security measures to protect your personal information in line with our policies. We do not allow our third-party service providers to use your personal data for their own purposes. We only permit them to process your personal data for specified purposes and in accordance with our instructions.

11. Data Security

We have put in place appropriate security measures to prevent your personal information from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. In addition, we limit access to your personal information to those employees, agents, contractors and other third parties who have a business need-to-know. They will only process your personal information on our instructions and they are subject to a duty of confidentiality.

We have put in place procedures to deal with any suspected data security breach and will notify you and any applicable regulator of a suspected breach where we are legally required to do so. Under the DUAA 2025, the timeframes and requirements for breach notification to the Information Commissioner's Office (ICO) remain consistent with the UK GDPR (72 hours where feasible), but the ICO has enhanced powers to issue guidance on what constitutes an adequate security response. We will comply with any such guidance as issued.

12. Data Retention — How Long Will You Use My Information For?

We will retain your personal information for a period of twelve months after we have communicated to you our decision about whether to appoint you to the role or the work. We retain your personal information for that period so that we can show, in the event of a legal claim, that we have not discriminated against candidates on prohibited grounds and that we have conducted the recruitment exercise in a fair and transparent way. After this period, we will securely destroy your personal information in accordance with our data retention policy.

13. Your Rights

Under the UK GDPR, as amended and supplemented by the DUAA 2025, you have the following rights:

• Right of access: You may request access to your personal information (commonly known as a "data subject access request"). This enables you to receive a copy of the personal information we hold about you and to check that we are lawfully processing it.
• Right to rectification: You may request correction of the personal information that we hold about you. This enables you to have any incomplete or inaccurate information we hold about you corrected.
• Right to erasure: You may request erasure of your personal information. This enables you to ask us to delete or remove personal information where there is no good reason for us continuing to process it. You also have the right to ask us to delete or remove your personal information where you have exercised your right to object to processing.
• Right to object: You may object to processing of your personal information where we are relying on a legitimate interest (or those of a third party) and there is something about your particular situation which makes you want to object to processing on this ground.
• Right to restriction: You may request the restriction of processing of your personal information. This enables you to ask us to suspend the processing of personal information about you, for example if you want us to establish its accuracy or the reason for processing it.
• Right to data portability: You may request the transfer of your personal information to another party.
• Right to explanation of automated decisions: Where automated processing has been used in making a decision about you that has a significant effect, you have the right to receive a meaningful explanation of the logic involved and to request human review of that decision. See Section 9 above for further detail.
• Right not to be subject to solely automated decisions: You have the right not to be subject to a decision based solely on automated processing which produces legal or similarly significant effects concerning you, except in limited circumstances defined by law.

If you want to review, verify, correct or request erasure of your personal information, object to the processing of your personal data, or request that we transfer a copy of your personal information to another party, please contact dpo@robiquity.com in writing. We will respond to your request within one calendar month of receipt. In complex cases, this period may be extended by a further two months, in which case we will notify you.

14. Right to Withdraw Consent / Objection to Processing

Our primary lawful bases for processing your personal data during the recruitment process are legitimate interests and steps prior to contract (see Section 5). We do not rely on consent as the primary lawful basis for processing your application.

Where we do rely on your consent for any specific, limited processing activity (for example, where we ask you to consent to us retaining your details for future opportunities), you have the right to withdraw that consent at any time by contacting dpo@robiquity.com. Withdrawal of consent will not affect the lawfulness of any processing carried out before the withdrawal.

If you wish to object to our processing of your personal data on legitimate interests grounds, please contact us at dpo@robiquity.com, setting out the particular circumstances that make you wish to object. We will consider your objection and cease processing unless we have compelling legitimate grounds to continue.

15. Data Protection Officer

Robiquity have appointed a data protection officer (DPO) to oversee compliance with this privacy notice. If you have any questions about this privacy notice or how we handle your personal information, please contact our DPO at dpo@robiquity.com.

16. How to Make a Complaint

You have the right to make a complaint at any time to the relevant Supervisory Authority.

In the United Kingdom, the supervisory authority is the Information Commissioner's Office (ICO). You can contact the ICO as follows:

• ‍Website: www.ico.org.uk‍
• Telephone: 0303 123 1113‍
• Address: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

Under the DUAA 2025, the ICO's powers have been extended, including new powers to conduct audits, issue information notices, and impose penalties. If you believe your data protection rights have been infringed, you are entitled to lodge a complaint with the ICO.

We would, however, appreciate the chance to address your concerns before you approach the ICO. Please contact dpo@robiquity.com in the first instance.

17. Review Process

This policy is reflective of our internal data processing standards and is owned by the Head of Legal in conjunction with the People team. The policy can be amended to reflect changes at any time.  The notification will be reviewed annually as part of the corporate policy review procedure.