Applicant Privacy and Data Protection Notice
Wildlife Studios Limited (the Company, we, us, our) is committed to protecting the privacy and security of your personal information.
The Company is a “data controller” within the meaning of the GDPR. This means that we are responsible for deciding how we hold and use personal information about you. This Applicant Privacy and Data Protection Notice (the Notice) is intended to ensure that you are aware of what personal data we hold in relation to you and how we use that data, in accordance with the GDPR.
For the purposes of this Notice:
GDPR means the General Data Protection Regulation (EU 2016/679) and any national implementing laws, as amended or updated from time to time;
Group Company means a company which is a Subsidiary or Holding Company of the Company or any Subsidiary of such Holding Company from time to time (and for this purpose Subsidiary and Holding Company have the meanings given to them respectively in sections 7 and 8 of the Companies Act 2014).
Please read the following carefully to understand how and why we are using such information and what your rights are under the applicable data protection legislation.
This Notice applies to you because either (i) we have identified you as a potential candidate for future recruitment; and/or (ii) you have applied to work with us (whether as an employee, agency worker, consultant, individual contractor or director); and/or (iii) you have been referred to us for potential employment; and/or (iv) you have reached us or was reached by us through an event sponsored or organized by us. This Notice also applies to third parties whose information you provide to us in connection with our relationship with you (for example, in respect of references). Please ensure that you provide a copy of this Notice to any third parties whose personal data you provide to us.
This Notice does not form part of any offer of employment or contract of employment and does not confer any contractual right on you, or place any contractual obligation on us.
This Notice applies to all personal data collected, maintained, transmitted, stored, retained, or otherwise used (i.e. processed) by us regardless of the media on which that personal data is stored. We may update this Notice at any time and will notify you, where appropriate, in writing of any material changes.
Data Protection Principles
The Company is committed to complying with the GDPR. Any personal information that we hold about you must be:
- Used lawfully, fairly and in a transparent way;
- Collected only for valid purposes that we have clearly explained to you and not used in any way that is incompatible with those purposes;
- Relevant to the purposes that we have told you about and limited only to those purposes;
- Accurate and kept up to date;
- Kept only as long as necessary for the purposes we have told you about; and
- Kept securely.
What is Personal Data?
‘Personal Data’ is defined as any information relating to a living individual from whom that individual can be identified directly from that data or indirectly in conjunction with other information. It does not include data where the identity has been removed (anonymous data). We will collect, hold and use the following categories of Personal Data about you as set out in Appendix 1 of this Notice.
Purpose and Basis for Processing
We will only use your personal information when the law allows us to. Most commonly, we will use your personal information for the following purposes:
- In order to take steps at your request prior to entering into a contract;
- To comply with a legal obligation;
- Where it is necessary for our legitimate interests (or those of a third party) and your interests and fundamental rights do not override those interests. In this instance a legitimate interest assessment (LIA) will have been conducted to (i) identify a legitimate interest; (ii) show that the processing is necessary to achieve it; and (iii) balance it against your interests, rights and freedoms. You may request a copy of this LIA by contacting email@example.com.
In particular, we will hold, process and may disclose personal data provided by you for the following purposes:
Future recruitment to identify potential suitable candidates for particular roles.
Recruitment/appointment including assessing your job application;
Managing health and safety at work and incident reporting;
Exercising our right to defend, respond or conduct legal proceedings.
We will only use your personal information for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose. If we need to use your personal information for an unrelated purpose, we will notify you and we will explain the legal basis which allows us to do so.
Special Categories of Personal Data
Certain categories of your personal data are regarded as ‘special’ including information relating to an individual’s:
- Physical or mental health;
- Religious, philosophical or political beliefs;
- Trade union membership;
- Ethnic or racial origin;
- Biometric or genetic data; and
- Sexual orientation.
None of this data is processed during our Recruitment Process.
We only process such data where necessary for the purpose of carrying out the obligations, and exercising specific rights of the Company or of a prospective employee under employment law or for the assessment of your working capacity. See Appendix 1.
Information about Criminal Convictions
Information about criminal convictions also warrants a higher level of protection. We will only process data relating to your criminal convictions or involvement in criminal proceedings when permitted by law, or where provided voluntarily by you.
Consent / Vital Interests
In principle, we do not rely on your consent for data use. We may, however, from time to time, (i) ask for your consent to use your personal data for a specific purpose; and/or (ii) process your personal data (including “special data”) in order to protect your vital interests or the interests of another. If we do so, we will provide you with full details of the data that we would like and the reason we need it. We will also inform you about the fact that you can revoke your consent at any time and how you should do that. Once we have received notification that you have withdrawn your consent, we will no longer process your personal data and, subject to our data retention policy, we will dispose of your personal data securely.
Where you do not provide us with your Personal Data
If you do not provide us with your personal data we may not be able to process your job application or assess your suitability for a particular role, comply with our legal obligations or manage our business. We will tell you when we ask for information which is a statutory or contractual requirement or needed to comply with our legal obligations.
Security and Storage of Personal Data
We have put in place appropriate security measures to prevent your personal information from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed.
We securely store your personal data, with controlled access to it. Access to personal data (including special data) in both electronic and paper form is restricted to the Greenhouse three site administrators (two based in√ä Brazil and one in the United States), and the Recruiting Lead in Ireland, all of which have a legitimate and justifiable reason to view such data.
Third parties to whom we have provided your personal data will only process your personal information on our instructions and where they have agreed to treat the information confidentially and to keep it secure.
We have put in place procedures to deal with any suspected data security breach and will notify you and any applicable regulator of a suspected breach where we are legally required to do so.
Recipients of Your Personal Data
We may disclose your personal data to a Group Company including, without limitation, for the following reasons: in order to run global processes; carry out group wide reporting; or take decisions about hiring or promotion.
It may be necessary from time to time for us to disclose personal data to third parties or agents, including without limitation to the following:
- Third parties to assist in the administration, processing and management of certain activities pertaining to prospective employees, for example Zoom (to set up online job interviews), Greenhouse (our recruitment platform), Tableau (our business intelligence platform), HackerRank (used for assessment tests of prospective candidates), and DocuSign (for electronic signatures of job offers);
- Individuals or companies employed by the Company to carry out specific services, functions or consultancy work including external reference agencies and other financial institutions;
- Relatives or legal representatives of prospective employees;
- Regulatory bodies to whom we are obliged or required to disclose information including Workplace Relations Commission, Courts and Court-appointed persons;
- Legal and medical practitioners;
- Potential purchasers or bidders;
- Relevant Government departments and agencies; and
- Other support service providers necessary to assist the Company with the above.
We will inform you, where appropriate, in advance if we intend to further process or disclose your personal data for a purpose other than the purposes set out above. We take all reasonable steps, as required by law, to ensure the safety, privacy and integrity of such data and information and, where appropriate, enter into contracts with such third parties to protect the privacy and integrity of such data and any information supplied.
Transfer of Personal Data outside the EEA
The personal data that we collect in relation to you may be transferred to, and stored at a destination outside the European Economic Area (EEA), for the purposes described above. Due to the global nature of our business, your personal data may be disclosed to Group Companies outside the EEA, including, in particular, Brazil and United States of America. It may also be processed by personnel operating outside the EEA who work for us or for one of our suppliers who act on our behalf. We will ensure suitable safeguards are in place to protect the privacy and integrity of your personal data in such circumstances including standard contractual clauses under Article 46.2 or adequacy decision under Article 45 of the GDPR. You can obtain information and a copy of documentation pertaining to these safeguards from the Country Manager where applicable.
Data will be stored for as long as required to satisfy the purpose for which the data was collected and used, unless a longer period is necessary for our legal, accounting or reporting obligations or for the exercise or defence of legal claims. In circumstances where we have collected your personal data for future potential roles, we generally retain your data for a period of 1 year. After this period, the data is anonymized.
The Company may retain your name and email address on a cool off list after the initial retention period, for 1 more year, in situations where your recruiting process ended because either you have reached the interview or testing phase, but has not been hired, or the position you have applied to is not being offered anymore; in both cases the Company might find your profile of interest for future opportunities and may retain your data in a cool off list.
The Company may also retain your name and email address in a suppression list, after the 1 year period, in order not to contact you again for a period of 1 more year. The suppression list does not prevent you from applying again to the recruiting process, as it is just used to avoid further recruiting approach from the Company afterwards. Your data will be anonymized at the end of this period.
Your Data Rights
You have several rights in relation to your personal data under applicable privacy and data protection law, which may be subject to certain limitations and restrictions such as when the processing of your data is necessary to comply with a legal obligation or for the exercise or defence of legal claims.
Under certain circumstances, by law you have the following rights:
|Your Right||What this Means|
|Right to Withdraw Consent||
If we are processing your personal data on the legal basis of consent, you are entitled to withdraw your consent at any time (see Contact Us below). However, the withdrawal of your consent will not invalidate any processing we carried out prior to your withdrawal and based on your consent.
|Right of Access||
You can request a copy of the personal data we hold about you (a data subject access request).
|Right to Rectification||
You have the right to request that we correct any inaccuracies in the personal data we hold about you and complete any personal data where this is incomplete.
|Right to Erasure (Right to be Forgotten)||
You have the right to request that your personal data be deleted in certain circumstances including:
However, this right does not apply where, for example, the processing is necessary:
|Right to Restriction of Processing||
You can ask that we restrict your personal data (i.e. keep but not use) where:
We can continue to use your personal data:
|Right to Data Portability||
Where you have provided personal data to us, you have a right to receive such personal data back in a structured, commonly-used and machine-readable format, and to have those data transmitted to a third-party data controller without hindrance but in each case only where:
|Right to Object||
You have a right to object to the processing of your personal data in those cases where we are processing your personal data in reliance on our legitimate interests. In such a case we will stop processing your personal data unless we can demonstrate compelling legitimate interests which override your interests and you have a right to request information on the balancing test we have carried out. You also have the right to object where we are processing your personal data for direct marketing purposes.
|Right to Complain||
You have the right to lodge a complaint with your local supervisory authority, the Data Protection Commission, Canal House, Station Road, Portarlington, Co. Laois, R32 AP23, if you consider that the processing of your personal data infringes the GDPR.√ä
The Irish Office of the Data Protection Commissioner can also be contacted at firstname.lastname@example.org
If you wish to exercise any of your rights in this regard please contact the Legal team. We will respond to your request as soon as practicable. We may request proof of identification to verify your request.
We will respond to any valid requests within one month, unless it is particularly complicated or you have made repeated requests in which case we will respond, at the latest, within three months. We will inform you of any such extension within one month of receipt of your request, together with the reasons for the delay. You will not be charged a fee to exercise any of your rights.
If you require any further clarification regarding this Notice, please contact:
General Personal Data
- Personal – contact/identifying details including name, address, email address, date of birth, photograph, civil status, gender, nationality, domestic partners, dependents;
- Professional – including social media (for example, LinkedIn, StackOverflow, GitHub, Facebook, Instagram), Curriculum Vitae and/or application form, previous employment background, references from previous employers, record of interview/interview notes, selection and verification records, educational details, professional and/or academic transcripts, professional certifications, special skills including (driver) licenses, language skills, memberships of committees or other bodies;
- General correspondence/meetings – relating to the recruitment process;
- Incapacity – any accommodations or adjustments required for interview or application purposes in connection with any incapacity.
Special Categories of Personal Data
Physical or mental health data – such as information about your physical or mental health or condition; for example, we will use information about disability status to consider whether we need to provide for appropriate adjustments during the recruitment process.
Other special categories of personal data – such as racial or ethnic origin; religious or similar beliefs; membership of a trade union; the commission or alleged commission of any offence; and any proceedings for any offence committed or alleged to have been committed, the disposal of those proceedings or the sentence of any court in those proceedings.
Special categories of personal data will only be collected and used in so far as such is necessary for the purposes of carrying out an obligation in the field of employment law, or exercising specific rights or when the use is authorized by law or for the assessment of working capacity.