Job Applicant Privacy Notice

1. Who is this Privacy Policy for?

This Privacy Policy applies to individuals engaged in working for or on behalf of Ideagen, including:

Job applicants and candidates applying for roles at Ideagen
Current and former employees
Contractors, agency staff, and consultants
Placement students and interns
Any other individuals whose personal data is processed in the context of employment or work-related activities with Ideagen

2. What is this Privacy Policy about?

This Privacy Policy explains what personal data we collect from you, how and why we collect it, how we use it, and who we share it with. It outlines your rights and Ideagen’s role as the data controller of your personal data. The nature of the data we collect and how we process it depends on your relationship with us and how you interact with Ideagen in the context of employment or work-related activities.

3. Who is the controller or processor of your data?

Ideagen acts as the data controller when we determine how and why your personal data is processed in the context of recruitment, employment, or other work-related activities. As the controller, we are responsible for compliance with data protection laws an d for ensuring your personal data is handled appropriately.

In limited and exceptional circumstances, Ideagen may act as a data processor. In such cases, we will only process your personal data as instructed and authorised by a third-party data controller. When this applies, the third party is responsible for compliance with data protection obligations. For any concerns relating to the processing of your data in such cases, we refer you to the relevant controller’s privacy policy.

4. How can you contact us?

Ideagen is a limited company incorporated in England and Wales (company number 02805019), with its registered address at One Mere Way, Ruddington, Nottingham, England, NG11 6JS.

Ideagen has appointed a Data Protection Officer (DPO) and a dedicated privacy team to oversee our privacy program, ensuring compliance with applicable data protection laws and the integration of best practices across the organisation.

If you have any comments, complaints, or questions regarding this Privacy Policy or the way your personal data is handled, you can contact us at:

Email: dataprotection@ideagen.com

Phone:
UK: +44 (0) 1629 699 100
US toll-free: +1 888 882 2082

Further contact details, including office locations, can be found on our website: https://www.ideagen.com/company/contact-us

5. How do we collect your personal data?

We collect personal data about you in a variety of ways, depending on your relationship with Ideagen and the stage of your engagement with us. This includes:

Directly from you, such as information you provide during the recruitment process or throughout your employment (e.g., via application forms, CVs, interviews, assessment centres, or staff surveys)
From third parties, including:
- Employment agencies or recruitment partners
- Your university or college (if you are a student or placement candidate)
- Referees (internal or external)
- Security clearance providers (where applicable)
- Government agencies such as HMRC
- Healthcare providers and staff benefit providers
From systems and technology, such as:
- CCTV footage when attending an Ideagen site
- Internal systems used during your employment
From your interactions with us, such as responses to diversity and inclusion questionnaires or feedback forms

For job applicants, we will only contact third parties (e.g., referees or background check providers) once an offer of employment has been made. You will be informed before this occurs.

6. What personal data do we collect from you?

The personal data we collect depends on your interaction with Ideagen, such as whether you are applying for a role or are currently employed. We have grouped the types of data we collect to provide transparency:

6.1 - Relating to Job applicants

When you apply for a role at Ideagen, we may collect the following personal data directly from you or from third parties involved in the recruitment process:

Contact details, such as your name, address, email address, and telephone number
Information about your qualifications, skills, experience, and employment history
Current remuneration details, including salary and benefit entitlements
Information about any disability requiring reasonable adjustments during the recruitment process
Proof of your right to work in the UK or other relevant jurisdictions
Equal opportunities monitoring data, such as ethnic origin, sexual orientation, health, and religion or belief (this is optional and not required for your application)
Information from recruitment agencies, universities or colleges (if applicable), and referees
Security clearance data (where relevant)
CCTV footage if you attend an Ideagen site during the recruitment process

6.2 Relating to your employment

Once employed, we collect and process personal data necessary to fulfil our contractual obligations, manage HR processes, comply with legal requirements, and support internal operations. This includes:

Contact information: name, job title, personal email address, and phone numbers
Identification and legal data: date of birth, gender, National Insurance number (or equivalent), passport, driving licence, proof of address, and right to work documents
Emergency contact details: marital status, next of kin, and emergency contacts
Employment and education history: CVs, previous roles, schools attended, qualifications and grades
Device and browser information: IP address, browser type and version, operating system, language settings, and other technical identifiers
Account and security data: usernames, passwords, and authentication methods
Usage and activity data: log files, content interactions, browsing history, and user journey data
Organisational information: trade union membership (if disclosed), work location, and role within the organisation
Any other information you, your previous employers, or other organisations choose to disclose

We may also collect aggregated, anonymised data for analytics purposes. If such data is ever combined with identifiable personal data, it will be treated as personal data and handled in accordance with this policy.

6.3 - Relating to your salary, pension and loans

We collect and process the following personal data to administer your salary, pension, statutory and contractual leave entitlements, and other employment-related benefits:

Details of your job role and employment contract, including start and end dates, salary, grade, salary band, and working pattern (e.g., flexible working requests)
Records of time worked, overtime, expenses, and other payments, including employment-related loans (e.g., travel season tickets)
Leave records, including sick leave, annual leave, and special leave
Pension information, including membership in state and occupational pension schemes
Bank account details, payroll records, and tax status
Trade union membership (where relevant for salary deductions)
Information related to maternity, paternity, shared parental, and adoption leave, including application forms, MATB1 forms, matching certificates, and documentation related to the Ideagen Voluntary Leave Scheme

We may also collect aggregated, anonymised data for statistical or analytical purposes. If such data is combined with identifiable personal data, it will be treated as personal data and handled in accordance with this policy.

We collect personal data through direct interactions, automated systems, and third-party sources such as analytics providers, search information services, social media platforms (e.g., LinkedIn), or other individuals within third-party organisations.

6.4 - Relating to your performance and training

We collect the following data to assess your performance, support training and development, and manage employment-related matters:

Performance-related data, including probation reviews, objectives (e.g., GPS), internal job moves, and promotions
Records of grievances, dignity at work matters, and related investigations
Disciplinary records, including documentation of hearings and outcomes
Whistleblowing concerns raised by or involving you
Training history and development needs

6.5 - Relating to monitoring

We collect monitoring data to ensure compliance with corporate policies, protect our systems and premises, and safeguard employees:

Access logs and data related to criminal enforcement (where applicable to your role)
Information from monitoring IT usage in line with acceptable use policies

6.6 - Relating to your health, wellbeing and other Special Category Data

We collect and process health and special category data to meet our legal obligations, support equal opportunities, and ensure employee wellbeing:

Health and wellbeing data, including information from health checks, occupational health reports, fit notes, and sick leave forms
Accident records for incidents occurring at work
Details of desk audits, access needs, and reasonable adjustments
Information related to protected characteristics under the Equality Act and Section 75 of the Northern Ireland Act, such as racial or ethnic origin, religious beliefs, disability status, and gender identity

7. How do we use your personal data?

We will process your personal data for one or more of the following lawful bases:

Performance of a Contract – where processing your personal data is necessary for the performance of your employment contract or to take steps at your request prior to entering into a contract with Ideagen.
Legitimate Interests – where processing is necessary for the legitimate interests of Ideagen or a third party, provided those interests are not overridden by your fundamental rights and freedoms.
Compliance with Law – where processing is necessary for us to comply with a legal obligation.
Your Consent – where you have given us your informed consent to process your personal data for a specific purpose, such as during the recruitment process. You may withdraw your consent at any time by submitting a written request.

Specifically, your personal data may be used by us for the following reasons:

Use	Legal Basis
To manage and administer the recruitment process, including background checks and pre-employment screening.	Consent. Performance of a Contract. Legitimate interest
To assess and decide on your suitability for employment and appointment	Consent. Performance of a Contract. Legitimate interest
To contact you and/or your next of kin (in an emergency situation)	Performance of a Contract. Legitimate interest
For internal record keeping, including entitlement to work, fitness to work, identity verification, references, and legally required records	Performance of a Contract. Legitimate interest
To understand the demographics of Ideagen’s employees in order to make improvements for greater diversity and inclusivity	Legitimate interest
To detect and prevent fraud and abuse to ensure the security and protection of all employees and others, as well as to identify and authenticate your access to the applications and our systems or to identify and authenticate you before we provide you with certain information	Performance of a Contract. Legitimate interest
To comply with the law and our legal obligations, including to respond to a request or order from a court, regulator, or authority, as well as to fulfil our contractual obligations with our customers when they have access to our services	Compliance with Law. Performance of a Contract
To exercise Ideagen’s legal rights, including to take action against those in breach of the terms and conditions applicable to them	Compliance with Law. Performance of a Contract
To effect the sale, merger, acquisition or other transfer of control of all or part of Ideagen or its business	Legitimate Interests

We will only use your personal data for the purposes for which it was collected. We do not process or share your personal data unless required by law or with your consent.

8. Do we sell or share your personal data?

We will never sell or share your data to external parties for marketing or other purposes not related to the performance of your duties.

9. Where do we keep your data?

Data may be hosted in systems including (but not limited to):

Cloud service providers
Customer relationship management (CRM) platforms
Enterprise resource planning (ERP) systems
Marketing automation tools
Various business applications (e.g., learning platforms, billing/subscription services, HR software)

For EU/UK residents, data is hosted in the EU/UK. For U.S. residents, it is primarily hosted in the U.S. Other geographies may apply for non-EU/UK/US users.

Please refer to our Schedule of Sub-processors for full details.

10. How do we control and secure your personal data?

We employ technical and organisational measures to protect your data. We are certified to the ISO 27001:2022 standard which is an international standard for Information Security. Certification requires an extensive suite of policies to be maintained covering information security standards and practices. In addition to these policies Ideagen has a comprehensive approach with measures and controls in place to ensure personal data are secure. These include (but are not limited to) staff training, internal working groups, continuous monitoring and improvement, relevant background checks (where required), physical measures at our office locations, data segregation within our environments and network access controls. Where required, we offer opt-in and opt-out options for data use in marketing and data sharing.

11.Your rights in relation to your personal data

Under data protection law you have the following rights (these are not all absolute rights such as the right to be forgotten);

Right to be informed
Right of access
Right to rectification
Right to erasure (also known as the right to be forgotten)
Right to restriction of processing
Right to object to processing
Right to data portability
Right not to be subject to automated decision making, (please note Ideagen recruitment processes are not solely based on automated decision making)

In order to review any request in line with your rights it may be necessary to verify the identity of the person exercising their rights. There is no charge for exercising your rights. If you make a request you will receive a response within one month of making the request. Should you wish to exercise any of these rights, please contact dataprotection@Ideagen.com.

In addition to the above rights you have the right to make a complaint. If you have any concerns about our use of your personal information you can make a complaint to us at dataprotection@ideagen.com.

You also have the right to complain to the ICO for any matters involving how your data may have been processed by us. The contact details are set out below ;

ICO address:

                Information Commissioner’s Office
                Wycliffe House
                Water Lane
                Wilmslow
                Cheshire
                SK9 5AF

Helpline Number 0303 123 1113

ICO website: www.ico.org.uk

In compliance with the EU-U.S. DPF, the UK Extension to the EU-U.S. DPF and the Swiss-U.S. DPF, Ideagen commits to cooperate and comply with the advice of the EU Data Protection Authorities, UK Information Commissioner’s Office (ICO) and the Swiss Federal Data Protection and Information Commissioner (FDPIC) with regard to unresolved complaints concerning our handling of personal data received in reliance on the EU-U.S. DPF, the UK Extension to the EU-U.S. DPF and the Swiss-U.S. DPF.

12. Do we share your personal data with any third parties?

We may employ the services of other parties for dealing with matters that may include payroll processing, delivery of items, search engine facilities, provision of employee benfits, data hosting and data analytics. We may provide these service providers with access to certain personal data provided by employees.

Such personal data will, however, only be provided to such parties in accordance with this privacy policy and only to the extent required by them to perform the services that we request.

13. What would happen if there are changes to the business ownership and control?

Our business is a growing one which means we are expanding. As part of this growth it may also involve changes. As we expand and change our business this may involve the sale, merger, acquisition and/or the transfer of control of all or part of Ideagen or our business (including as the result of corporate re-structuring). Personal data provided by employees will, where it is relevant to any part of our business so transferred, be transferred along with that part and the new owner or newly controlling party will, under the terms of this privacy policy, be permitted to use the personal data for the purposes for which it was originally supplied to us.

14. Do you make any International Transfers of my personal data?

We may transfer personal data that we collect from you to other companies within the Ideagen group which are outside of the European Economic Area (including but not limited to the United States, Australia, Malaysia and India). In these cases, we ensure your personal data is protected by requiring all our group companies to follow the same rules when processing your personal data.

We may also transfer personal data that we collect from you to third party data processors located in countries that are outside of the European Economic Area. In these circumstances, we will always take measures to ensure we have adequate legal safeguards in place. For example, we have entered into written agreements with all relevant third party processors that ensure your data receives the same protection as if it were being processed inside the European Economic Area.

A list of the third parties with whom we may share your personal data for the purposes set out in clause 7 above, can be provided upon request.

15. How long do we keep Personal Data?

Any personal data you submit will be retained by us for no longer than is necessary to fulfil the stated/contractual purposes, or as reasonably necessary for us to retain such information in order for Ideagen to comply with laws and regulations (including satisfying any legal, regulatory, tax, accounting or reporting requirements). After the retention period is over, Ideagen securely disposes or anonymises your personal information in order to prevent loss, theft, misuse, or unauthorized access. If you withdraw your consent (where applicable) or request removal of your personal data, such data will be destroyed.

15.1 - Job Applicant

If your application for employemnt is unseuccesful we will hold your data on file for upto 12 months after the end of the recruitment process. After that period or if you withdraw your consent your data will be deleted or destroyed.

15.2 - Employee

If your application for employment is succesful the personnel data held about you will be transferred to your personnel file and retained during your employment. The periods for retention of your data as employee is in line with the Ideagen Data Retention Policy.

15. Changes to this Privacy Policy

We reserve the right to change this privacy policy as we may deem necessary from time to time or as may be required by law. Any changes will be posted promptly on the website and the application and you are deemed to have accepted the terms of this privacy policy on your first use of the website or application following any alterations.