Privacy policy for the Pentland Brands employer branding and recruitment
Date of publication: 19th May 2025
- Introduction
- About processing of personal data
- What personal data do we process?
- Where do we receive personal data from?
- For what purposes do we process your personal data?
- Whom do we share you personal data with?
- On what legal bases do we process your personal data?
- Transfers of your personal data outside of your country
- For ho wlong do we keep your personal data?
- What rights do you have and how can you exercise them?
- Where can you turn with comments or questions?
- Updates to this Privacy Policy
- U.S. Residents Privacy Supplement
- Canadian Residents Privacy Supplement
- India Residents Privacy Supplement
1. Introduction
We at Pentland manage our employer branding and recruitment process through our career site (the “Career Site”), and by using a related applicant tracking system.
In this privacy policy, we explain how we process your personal data if:
- You visit our Career Site (you being a “Visitor”
- You connect with us via our Career Site, to create a profile with us and receive information about current or future vacancies with us (you being a “Connecting Candidate”
- You apply for a position with us, via our Career Site or a third party service (you being an “Applying Candidate”)
- We collect information about you from other parties, sites and services, since we believe your profile is of interest for our current or future vacancies (you being a “Sourced Candidate”)
- We receive information about you from our employees or partners, since they believe your profile is of interest for our current or future vacancies (you being a “Referred Candidate”)
- We receive information about you from a Candidate, who lists you as their reference (you being a “Reference”).
This privacy policy also describes what rights you have when we process your personal data, and how you can exercise these rights.
When we use the term “Candidate” in this privacy policy, we are referring to each of Connecting Candidates; Applying Candidates; Sourced Candidates; and Referred Candidates, unless it’s stated otherwise.
2. About processing of personal data
Personal data is all information that can be directly or indirectly linked to a living, physical person. Examples of personal data are: name, e-mail address, telephone number and IP address. Processing of personal data is any automated use of personal data - such as collecting, creating, analyzing, sharing, and deleting personal data.
There are laws and regulations on how companies may process personal data, so-called data protection laws. Different data protection laws apply to different types of use of personal data, and in different parts of the world. Pentland will comply with applicable data protection and privacy laws worldwide.
Most obligations under data protection and privacy laws apply to the data controller. A data controller is the entity that decides for which purposes personal data will be processed, and how the processing will be executed. The data controller can use a data processor. A data processor is an entity that is only allowed to process personal data as instructed by the data controller, and may not use the personal data for its own purposes.
For the purposes of EU and UK data protection law, Pentland Brands Limited, 8 Manchester Square, London, W1U 3PH is the data controller when we process your personal data as described in this Privacy policy.
3. What personal data do we process?
All individuals
- Device information - If you visit our Career Site, we will collect information about your device, such as IP address, browser type and version, session behaviour, traffic source, screen resolution, preferred language, geographic location, operating system and device settings/usage.
- Technical and statistical data - If you visit our Career Site, we will collect technical and statistical data about your use of the site, such as information about which URLs you visit, and your activity on the site.
- Communications data - We will collect and store your communication with us, including the information you provided in the communication. This may include the content of emails, video recordings, messages on social media, the information you add to your account with us, surveys, etc.
- Contact details - Such as your name, email address, telephone number and physical address.
Candidates
- Data from interviews, assessments and other information from the recruitment process - Such as notes from interviews with you, assessments and tests made, salary requirements.
- Information in your application - Such as your CV, cover letter, work samples, references, letters of recommendation and education.
- Information in your public profile - Meaning the information we collect about you from public sources related to your professional experience, such as LinkedIn or the website of your current employer.
- Information provided by references - Meaning the information we receive from our employees or partners who refer you to us, or by the persons you have listed as your references.
- National Identification Information - Meaning your country of birth or the country where you are a registered national or citizen, and any visa or other right to work.
- Results of background checks and screening - Such as education verification and criminal records and driver’s license checks.
- Sensitive personal data (including special categories of personal data) - Insofar as necessary and legally permitted, such as Social Security, driver’s license, state identification, or passport number; your race, ethnicity, and gender.
Such sensitive data is only processed in limited circumstances, e.g. where we need to carry out our legal obligations or exercise rights in connection with employment, where it is needed in the public interest in line with country-specific laws, or with your explicit written consent.
4. Where do we receive your personal data from?
All individuals
- From the Career Site. If you visit our Career Site, we collect technical and statistical information about how you use the Career Site, and information from your device.
- Directly from you. Most of the information we process about you, we receive directly from you, for example when you apply for a position with us or connect with us. You can always choose not to provide us with certain information. However, some personal data is necessary in order for us to process your application or provide you the information you request to get from us.
References
- From the person for whom you are a reference. If a Candidate lists you as their reference, we will collect your contact details from the candidate to be able to contact you.
Candidates
- From public sources. We may collect personal data about you from public sources, such as LinkedIn or the website of your current employer.
- From our references. We may receive information about you from our employees or partners (such as recruitment service providers), when they believe your profile is of interest for our current or future vacancies.
- From your references. If you provide us with references, we may collect information about you from them.
- Data we create ourselves or in cooperation with you. Information about your application and profile is usually created by us, or by us in cooperation with you, during the recruitment process. This may for example include notes from interviews with you, assessments and tests made.
5. For what purposes do we process your personal data?
Protect and enforce our rights, interests and the interests of others, for example in connection with legal claims.
Affected individuals: The individual(s) affected by the legal issue - this may include persons from all categories of individuals listed above.
Categories of personal data used: All the categories of personal data listed above can be used for this purpose.
Share your personal data with other recipients, for the purposes mentioned in Section 6 below.
Affected individuals: Varies depending on the purpose of the sharing, see Section 6 below.
Categories of personal data used: All the categories of personal data listed above may be used for this purpose.
Collect information about your use of the career site, using cookies and other tracking technologies, as described in our Cookie Policy.
Affected individuals: Visitors.
Categories of personal data used: Device information.
Maintain, develop, test, and otherwise ensure the security of the career site.
Affected individuals: Visitors.
Categories of personal data used: Device information; Technical and statistical data.
Analyse how the career site and its content is being used and is performing, to get statistics and to improve operational performance.
Affected individuals: Visitors.
Categories of personal data used: Device information; Technical and statistical data.
Provide you with updates about vacancies with us.
Affected individuals: Connecting Candidates.
Categories of personal data used: Contact details; Communications data.
Review profiles and applications sent to us. This also includes communicating with you about your application and profile.
Affected individuals: Connecting Candidates; Applying Candidates.
Categories of personal data used: All the categories of personal data listed above may be used for this purpose.
Collect and evaluate your professional profile on our own initiative. This also includes communicating with you regarding your profile.
Affected individuals: Sourced Candidates; Referred Candidates.
Categories of personal data used: All the categories of personal data listed above may be used for this purpose.
To determine your eligibility and suitability for certain job roles, to the extent permitted by law.
Affected individuals: Candidates.
Categories of personal data used: All the categories of personal data listed above may be used for this purpose.
Contact you directly about specific, future vacancies with us.
Affected individuals: Candidates.
Categories of personal data used: All the categories of personal data listed above may be used for this purpose.
Record the interview(s) with you.
Affected individuals: Candidates.
Categories of personal data used: Communications data.
Contact you to ask for your participation in surveys
Affected individuals: Candidates.
Categories of personal data used: All the categories of personal data listed above may be used for this purpose.
Contact you to ask you to provide information about a candidate and evaluate the information you provide.
Affected individuals: References.
Categories of personal data used: Contact details; Communications data.
Your sensitive personal data will not be used for any additional purposes that are incompatible with the purposes listed above unless we provide you with notice of those additional purposes.
6. Whom do we share your personal data with?
Our service providers. We share your personal data with our suppliers who provide services and functionality in our employer branding- and recruitment process. For example, this includes recruitment service providers and the supplier of our Career Site and related applicant tracking system.
Our group companies. We share your personal data with our group companies, when they provide us services and functionality to our employer branding- and recruitment process, such as access to particular systems and software.
Companies providing cookies on the Career Site. If you consent to it, cookies are set by other companies than us, who will use the data collected by these cookies in accordance with their own privacy policy. You can find information about which cookies this applies to in our Cookie Policy.
To authorities and other public actors - when we are ordered to do so. We will share your personal data with authorities and other public actors when we have a legal obligation to do so.
To parties involved in legal proceedings. If needed to protect or defend our rights, we share your personal data with public authorities or with other parties involved in a potential or existing legal proceeding. This can for example be in case of discrimination claims.
Mergers and acquisitions etc. In connection with a potential merger, sale of company assets, financing, or acquisition of all or part of our business to another company, we may share your personal data to other parties involved in the process.
We do not sell your personal data or your sensitive personal data, nor do we share it with third parties for cross-context behavioral advertising.
7. On what legal bases do we process your personal data?
To be able to process your personal data, we need to have a so-called legal basis. A legal basis is a reason for processing the personal data that is justified under data protection laws.
When we process your personal data for the purposes described in this Privacy Policy, the legal basis we rely on is normally that the processing is necessary for our legitimate interest in being able to recruit talent with the relevant competence for us. We have concluded that we have a legitimate interest in being able to perform the personal data processing for this purpose; that the processing is necessary to achieve that purpose; and that our interest outweighs your right not to have your data processed for this purpose.
You can contact us for more information about how this assessment was made. See Section 10 and 11 below for our contact information.
There may be specific circumstances when the processing is only performed if and when you provide your consent to the processing. This is for example the case if we propose to record an interview with you, or if we request your permission to contact you for future opportunities. Please see Section 10 below for more information about your right to withdraw your consent.
There may also be specific cases where it is necessary to process your personal data in order to comply with a legal obligation. Please note that we may process your personal data without your knowledge or consent where this is required by law.
8. When do we transfer your personal data outside of your country, and how do we protect it then?
We always strive to process your personal data within the country you are in.
However, some of our service providers process your personal data outside of this. We also use suppliers whose parent company, or whose subcontractor’s parent company, is based outside the EU/EEA. In these cases, we have taken into account the risk that the personal data may be disclosed to countries outside of your country, for example because of an authority request.
In cases where another recipient of your personal data (as described in Section 5 above) is based outside of your country, this will also mean that your personal data is transferred outside of your country.
When we, or one of our suppliers, transfer your personal data outside of your country, we will ensure that a safeguard recognized by your data protection authority is used to enable the transfer.
For data transfers outside of the EU/EEA, we use the following safeguards:
When your personal data is transferred outside of your country, we also implement appropriate technical and organizational safeguards, to protect the personal data in case of a disclosure. Exactly which protective measures we implement depends on what is technically feasible, and sufficiently effective, for the particular transfer.
If you want more information about the cases in which your personal data is transferred outside of your country you can contact us using the contact details in Section 9 and 10 below.
9. For how long do we keep your personal data?
All individuals
We may retain personal data for the period necessary to establish, exercise or defend legal claims. If we process your personal data for the purpose of being able to protect and enforce our rights, we will keep your personal data until the relevant legal issue has been fully and finally resolved.
When retention of your data is no longer necessary, we will delete or anonymise your personal data in accordance with applicable law.
Visitors
We keep your personal data for up to one (1) year for security purposes. The retention periods for cookies are set out in our Cookie Policy. We keep your personal data to analyse the performance of the Career Site for as long as we keep personal data about you for other purposes.
Candidates
If you are a Connecting Candidate (only), we keep your personal data for as long as you remain connected with us.
For other types of Candidates, we keep your personal data to decide if you are a suitable candidate for the relevant vacancy(ies) with us.
If you don’t succeed in the initial recruitment process, we keep your personal data for as long as needed to consider, and potentially contact you, for relevant future job openings.
If you are hired, we will keep your personal data during your employment, for other purposes than those stated above, which you will be informed of.
References
We keep your personal data for as long as we keep the personal data of the Candidate for whom you acted as a reference.
10. What rights do you have, and how can you exercise them?
In this section, you will find information about the rights you have when we process your personal data, depending on the jurisdiction. As described below, some of the rights only come into play when we process your personal data under a particular legal basis.
If you want to exercise any of the rights listed here, we suggest that you:
- Visit the Data & Privacy page on our Career Site, where we offer features to let you exercise your rights;
- Log in to your account with us, where you can use the settings in the account to exercise your rights; or
- Contact us directly at dataprotection@pentland.com.
EEA and UK Candidates
Candidates in the EEA and UK have the following rights:
Right to be informed
You have the right to be informed about how we process your personal data. You also have the right to be informed if we plan to process your personal data for any purpose other than that for which it was originally collected.
We provide you with such information through this privacy policy, through updates on our Career Site (see also Section 12 below), and by answering any questions you may have for us.
Right to access your personal data.
You have the right to know if we process personal data about you, and to receive a copy of the data we process about you. In connection with receiving the copy of your data, you will also receive information about how we process your personal data.
Right to access and to request a transfer of your personal data to another recipient (“data portability”).
You can request a copy of the personal data relating to you that we process for the performance of a contract with you, or based on your consent, in a structured, commonly used, machine-readable format. This will allow you to use this data somewhere else, for example to transfer it to another recipient. If technically feasible, you also have the right to request that we transfer your data directly to another recipient.
Right to have your personal data deleted (“right to be forgotten”).
In some cases, you have the right to have us delete personal data about you. This is for example the case if it’s no longer necessary for us to process the data for the purpose for which we collected it; if you withdraw your consent; if you have objected to the processing and there are no legitimate, overriding justifications for the processing. (For the separate right to object, see below.)
Right to object against our processing of your personal data.
You have the right to object to processing of your personal data which is based on our legitimate interest, by referencing your personal circumstances.
Right to restrict processing.
If you believe that the personal data we process about you is inaccurate, that our processing is unlawful, or that we don’t need the information for a specific purpose, you have the right to request that we restrict the processing of such personal data. If you object to our processing, as described just above, you can also request us to restrict processing of that personal data while we make our assessment of your request.
When our processing of your personal data is restricted, we will (with the exception of storage) only process the data with your consent or for the establishment, exercise or defence of legal claims, to protect the rights of another natural or legal person, or for reasons relating to an important public interest.
Right to rectification.
You have the right to request that we rectify inaccurate information, and that we complete information about you that you consider incomplete.
Right to withdraw your consent.
When we process your personal data based on your consent, you have the right to withdraw that consent at any time. If you do so, we will stop processing your data for the purposes you’ve withdrawn your consent for. However, it doesn’t affect the lawfulness of processing that was based on your consent before it was withdrawn.
Rights relating to automated decision-making, including profiling.
In cases where decisions are being made about you based solely on automated processing and producing legal or significant impacts, you may have the right to request human intervention, express a point of view, or contest the decision.
These rights may not apply though where you have provided explicit consent for the automated decision-making, it is necessary for a contract, or authorised by law.
Right to raise a complaint.
If you have complaints about our processing of your personal data, you can raise a complaint with the data protection authority in your country.
You can also lodge a complaint with your national data protection authority, which you can find listed here if you are based in the EU. If you are based in the UK, you can lodge a complaint with the Information Commissioner’s Office, here.
Residents based in the U.S., Canada or India should refer to their relevant SUPPLEMENT below for more details on rights available to them.
11. Where can you turn with comments or questions?
If you want to get in touch with us to exercise your rights, or if you have any questions, comments or concerns about how we handle your personal data, you can reach us by sending an email to dataprotection@pentland.com.
12. Updates to this Privacy policy
We update this privacy policy when necessary - for example, because we start processing your personal data in a new way, because we want to make the information even clearer to you, or if it’s necessary to do so in order to comply with applicable data protection laws.
We encourage you to regularly check this page for any changes. You can always check the top of this page to see when this privacy policy was last updated.
13. U.S. Residents Privacy Supplement
If you are a resident of California, Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island Tennessee, Texas, Utah, and Virginia, the law in your state provides you certain rights with respect to your personal data.
Depending on your state of residence, you may have the following rights regarding your personal information:
Right to Know.
You may have the right to be informed about the categories and specific pieces of personal data we have collected, the sources from which we collected it, the purposes for collecting it, and the third parties with whom we have shared it.
Right to Access.
You may request access to the personal data we hold about you.
Right to Correct.
You may request that we correct any inaccurate personal data relating to you without undue delay. In this context, taking into account the purposes of the processing, you may also have the right to request the completion of incomplete personal data - also by means of a supplementary declaration.
Right to Delete.
You may request the deletion of your personal data, subject to certain exceptions. In certain circumstances, it may not be possible for us to accept your request, for example, when the processing is necessary to comply with a legal obligation, or if the processing is necessary for the performance of a contract.
Right to Portability.
You may request that we provide you with a copy of your personal data in a structured, commonly used, and machine-readable format. You also have the right to request that we transfer this information to another data controller, where technically feasible.
Right to Opt Out of Sale.
You may direct us not to sell or share your personal data with third parties.
Right to Opt Out of Targeted Advertising.
You may request that we not disclose, disseminate, or transfer your personal data to a third party for targeted advertising (also known as “cross-context behavioural advertising”).
Right to Restriction of Processing.
You may request that we restrict processing of your personal data. In certain circumstances, it may not be possible for us to accept your request, for example, when the processing is necessary to comply with a legal obligation.
Right to Opt Out of Certain Data Processing.
You may withdraw your consent that you have previously provided for our collection, use or disclosure of your personal data, subject to reasonable notice and any contractual or legal exceptions. Note that this will not affect the lawfulness of our processing of your personal data based on consent before its withdrawal.
Right to Opt Out of Automated Individual Decision-Making.
You may have the right to not be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you. Note that this right shall not apply if such a decision is necessary as part of a contract we have with or want to conclude with you, we have your consent, or we are permitted by law to engage in such automated decision making. In these cases, we will implement measures to safeguard your rights and freedoms and legitimate interests, and you may contest the decision by contacting us as set forth below.
Right to limit use of Sensitive Data
You may have the right to restrict or limit how we use sensitive personal information
Right Against Discrimination.
You have the right not to be discriminated against for exercising any of your data protection rights. This means that we will not deny you goods or services, charge you different prices or rates, or provide you with a different level or quality of goods or services based solely on your exercise of these rights.
Right to Appeal.
Depending on your residency, you may have the right to appeal if we decline to act regarding your privacy request. To do so, please follow the instructions for exercising your privacy rights below, or use the contact information provided in this Policy.
How to exercise your privacy rights:
- Visit the Data & Privacy page on our Career Site, where we offer features to let you exercise your rights;
- Log in to your account with us, where you can use the settings in the account to exercise your rights; or
- Contact us directly at dataprotection@pentland.com.
Identity verification: We will take steps to verify your request by matching the information provided in your request with the information we have in our records. You must provide us with this information via the above email address and verify your access to the registered email address.
Authorized agents: You may designate someone as an authorized agent to submit privacy requests on your behalf. For security purposes, authorized agents will be required to provide proof of their authorization with us, and we may also require that the relevant individual, whose data is subject to the request, directly verify their identity and the authority of the authorized agent with us.
Selling and Sharing of Personal Data: We do not sell personal information as that term is defined under the CCPA/CPRA, nor do we “share” personal information for cross-context behavioural advertising unless otherwise stated.
If we engage in such activities in the future, we will update this notice and provide a “Do Not Sell or Share My Personal Information” link.
Shine the Light Disclosure: California Civil Code Section § 1798.83, also known as the “Shine the Light” law, permits California residents to request and obtain from us once a year, free of charge, a list of the third parties to whom we have disclosed their personal data (if any) for direct marketing purposes in the preceding calendar year, as well as the type of personal data disclosed. To make such a request, please send an email with the subject “Shine the Light Request” to the email address in our Contact Us section.
14. Canadian Residents Privacy Supplement
Subject to certain limitations and depending on applicable law, Candidates in Canada may have the following rights:
Right to access and know.
You have the right to obtain confirmation whether your personal data is being processed, obtain access to your personal data being processed and know: the categories of information we are processing, the purposes of information processing, the categories of third parties to whom the information may be disclosed, and how long the information will be stored (or the criteria used to determine that period).
Right to Correct.
You may request we correct or remove inaccurate personal data and the right to have incomplete personal data completed.
Right to Withdraw Consent.
For personal data you have provided to us on a consensual basis, you can withdraw your consent for future processing.
Right to Lodge a Complaint.
You have the right to lodge a complaint regarding our use of your data. If your request or concern is not satisfactorily resolved, you may approach your provincial or the federal privacy commissioner’s office.
You may exercise these rights by contacting Pentland as described above. All requests regarding your personal data will be subject to verification of the identity of the requesting individual.
15. India Residents Privacy Supplement
Terminology
For individuals in India:
“personal data” means any data about an individual who is identifiable by or in relation to such data;
“Data Principal” means the individual to whom the personal data relates;
“Data Fiduciary” means the entity determining the purpose and means of processing personal data.
For the purposes of this Section, Pentland Brands Limited acts as the Data Fiduciary.
Lawful basis for processing
For individuals in India, we process your personal data only where permitted under the DPDP Act, including:
Consent: where you have provided your free, specific, informed, unconditional and unambiguous consent for one or more specified purposes (for example, creating a profile, receiving job alerts, or being considered for future roles);
Certain legitimate uses: where processing is permitted under applicable law without consent, including where necessary for compliance with legal obligations, responding to medical or employment-related emergencies, recruitment-related activities where permitted by law, or other purposes recognised under the DPDP Act.
Where we rely on your consent, you have the right to withdraw that consent at any time.
Notice and consent
We provide you with a notice at or before the time of collecting your personal data, which includes:
- the personal data being processed;
- the purposes of processing;
- how you can exercise your rights; and
- how you can make a complaint.
Where processing is based on consent:
- you may provide consent through our Career Site or other interactions with us;
- you may withdraw your consent at any time using the methods described in this Privacy Policy; and
- withdrawal of consent will not affect the lawfulness of processing carried out before withdrawal.
Processing of children’s personal data
Our Career Site and recruitment processes are intended for individuals aged 18 and above. We do not knowingly process personal data of individuals under the age of 18 in India without verifiable consent from a parent or lawful guardian, where required.
We do not undertake tracking, behavioural monitoring, or targeted advertising directed at children in connection with our recruitment activities.
Your rights as a Data Principal
Under the DPDP Act, you have the following rights:
- Right to access information about your personal data and its processing;
- Right to correction, completion, updating and erasure of personal data;
- Right to withdraw consent at any time;
- Right to grievance redressal;
- Right to nominate another individual to exercise your rights in the event of your death or incapacity.
You may exercise these rights using the methods described in Section 10 of this Privacy Notice.
Grievance redressal
If you have any concerns or complaints regarding the processing of your personal data, you may contact us at dataprotection@pentland.com.
We will acknowledge and address your grievance within a reasonable time.
If you are not satisfied with our response, you may escalate your complaint to the Data Protection Board of India in accordance with applicable law.
