Quick links
Please read this Privacy Notice in full to ensure that you are fully informed. If you only want to access a particular section of this Privacy Notice then you can click on the relevant link below to jump to that section:
1. What is the purpose of this document?
1.1 dunnhumby Limited (referred to in this Privacy Notice as "we", "our" or "us") is a "data controller". This means that we are responsible for deciding how we hold and use data relating to you ("personal data"). You are being provided with a copy of this Privacy Notice because you are applying for work with us (whether as an employee, worker or contractor). It makes you aware of how and why your personal data will be used, namely for the purposes of the recruitment exercise, and how long it will usually be retained for. It provides you with certain information that must be provided under the General Data Protection Regulation ((EU) 2016/679) ("GDPR") and other relevant privacy laws.
1.2 This Privacy Notice supplements our dunnhumby Privacy Notice, which includes information about how we collect personal data through our website and in our business, including how we use cookies and similar tracking technology.
1.3 In some of the more detailed sections below you will see a small summary box which will give you an overview of what that section contains. We do encourage you to read each section in detail.
1.4 Our recruitment processes are not intended for children, and we do not knowingly collect data relating to children. When we refer to children we are referring to persons under the age of 16.
1.5 Please note that where you are successful in your application, personal data gathered during the recruitment process will be transferred to your personnel file and retained during your employment. How we use such information during your employment will be provided to you in a separate employment privacy notice.
2. When do we collect personal data?
This section explains the various ways in which we collect information about you as you proceed through our recruitment process. It also sets out what other potential sources we may use to gather information about you. |
2.1 We collect personal data about our candidates from the following sources:
2.1.1 you, the candidate;
2.1.2 your recruitment agent;
2.1.3 our background check provider;
2.1.4 in respect of criminal convictions:
2.1.4.1 for all US applications, through our service provider;
2.1.4.2 for applications for finance positions in the UK, through the Disclosure and Barring Service;
2.1.5 our recruitment system providers involved in the recruitment process (e.g. Greenhouse which is our applicant tracking system),
2.1.6 KPMG (our IR35 assessment providers);
2.1.7 for Brazilian applicants we will receive personal data about you from our medical and drugs screening services provider;
2.1.8 for US applicants we will receive personal data about you from our drug screening services provider and our employment reference check services provider;
2.1.9 for German applicants we will receive personal data about you from our Works Council based in Berlin who have a statutory right to review your application;
2.1.10 your named referees; and
2.1.11 providers of publicly accessible sources such as LinkedIn.
3. What personal data do we collect?
This section covers what types of personal data we collect. Most of the personal data we collect will either be provided by you voluntarily or will be collected from parties you recommend to us such as your referees/references, our service providers or professional social media channels such as LinkedIn. |
3.1 In connection with your application, we will collect, store, and use the following categories of personal data about you:
3.1.1 Identity Data: your name, title, date of birth, passport/visa details and gender;
3.1.2 Contact Data: your address, email address and phone number;
3.1.3 Application Data: the information you have provided on our online application form, including education and employment history, qualifications, a copy of your CV, information about your current level of remuneration (including benefit entitlements);
3.1.4 Interview Data: any information you provide to us during an interview, including where such interview takes place via our virtual platform provided by Cubiks through which you record and submit your interview videos;
3.1.5 Assessment Data: any information you provide in the course of or resulting from any assessment (including psychometric assessments) which is part of our recruitment process, including the assessments carried out by our service provider Cubiks or Korn Ferry. Assessment Data includes, for example, your answers to a questionnaire or a score or result rating your performance in an assessment.
3.1.6 Background Data: any information we may obtain about your background including information obtained from your references/referees, information obtained from public sources such as LinkedIn and any checks we undertake to confirm your academic qualifications;
3.1.7 Corporate Data: if you are applying for a role with us through a corporate entity or through an agency, information relating to those corporate entities or agencies.
3.2 We may also collect, store and use the following special categories of personal data ("Sensitive Data"):
3.2.1 Information about your race or ethnicity or religious beliefs;
3.2.2 Information about your health, including any medical or disability information;
3.2.3 Information regarding your performance against our drugs screening test (where appropriate for US and Brazilian applicants);
3.2.4 Information about criminal convictions and offences.
3.3 If you undertake part of the recruitment assessments via our talent assessment provider Cubiks, Cubiks may ask you to provide some non-mandatory personal data or Sensitive Data upon registering to use its online platform. You do not have to provide this data if you do not wish to, as this data is not necessary for our recruitment purposes.
3.4 If you fail to provide information when requested, which is necessary for us to consider your application (such as evidence of qualifications or work history), we will not be able to process your application successfully. For example, if we require a CV or references for this role and you fail to provide us with relevant details, we will not be able to take your application further.
4. How we use personal data and our legal bases for processing it
This section sets out how we use your personal data and our legal bases for such usage. |
4.1 We will use personal data about you during the application and recruitment process (and perhaps after such process has been completed) in different ways. Most commonly, we will use your personal data in the following circumstances:
Purpose/Activity | Categories of personal data used (as described at section 3) | Lawful basis for use |
|---|---|---|
To make reasonable adjustments to our recruitment process to accommodate any disability that you may have. | • Identity Data | • To promote equality and fairness in our recruitment process, we may need to process your Sensitive Data relating to any disabilities which you disclose to us in order to make reasonable adjustments to the recruitment process. For this purpose, we may also need to share Sensitive Data with our talent assessment provider Cubiks. We will do so only where it is necessary to facilitate or enable your participation in the Cubiks' assessments. |
To assess your suitability for the role which you applied for. | • Identity Data | • We will need to review and assess the information you provide to us or which we obtain about you for the purposes of determining whether you are the right person for the role for which you have applied. We believe that such use is within our legitimate business interest. |
To establish your right to work in a particular country. | • Identity Data | • In order to offer you a role we will need to establish whether you are legally permitted to work in the jurisdiction in which the role is situated. We believe that such use us within in compliance with our legal obligation as an employer to employ only those persons who are eligible to work within the relevant jurisdiction. |
To undertake work or education related background checks by contacting your referees/references. | • Identity Data | • In order to ensure that the information relating to your education, qualification or previous work experience is correct and to potentially obtain information relating to your character, we will contact those persons who you nominate as your reference/referee. We believe that such use is within our legitimate business interest. |
To undertake background checks relating to criminal activity. | • Identity Data | • To check your suitability for a particular role we may need to perform criminal records checks against you. However, we will only do this where we believe we have a legitimate interest to do so, or where it is a legal requirement for us to do so based on the role for which you have applied. |
To comply with our legal obligation to promote equal opportunities in the workplace in respect of ethnicity, race, religion and health conditions. | • Identity Data | • To ensure that our business remains an equal opportunities employer, we may need to record your information relating to ethnicity, race, religion and health conditions. |
If you are unsuccessful in the application process, to contact you with future vacancies that we believe may be of interest to you. | • Identity Data | • To contact you about future vacancies for roles we believe you are suitable for if you are unsuccessful in your current application process. We believe that such use is necessary for our legitimate business interests. |
If you are unsuccessful in the application process and you apply for a new role with us within 14 months, to assess your suitability for such new role. | • Assessment Data | • We will re-use the results of the assessments you undertook with Cubiks in the previous 12 months, if we consider such assessments relevant for the new role you have applied for. We believe that such use is within our legitimate business interest. |
If you are successful in the application process, to "onboard" you onto our systems and to have an understanding of the roles that are filled. | • Identity Data | • To collect the details you provide and to ensure that your details are “onboarded” into our central HR systems. We believe that such use is necessary both for our contract with you (e.g. payment details in order to pay you in the future, and to set you up within our systems in order to allow you to start your new role), and for our legitimate business interest. |
To assess whether your appointment would constitute holding a position as a contractor or an employee for tax purposes. | • Identity Data | • In order to ensure we are complying with relevant tax laws it is necessary to determine whether your proposed working arrangements would classify you as a contractor or an employee of the company for the purposes of such tax laws. We believe that such use is necessary for the purpose of complying with our tax related legal obligations. |
5. Use of Artificial Intelligence (AI) in Recruitment
5.1 As part of our recruitment process, we may use artificial intelligence ("AI") tools to support activities such as preparing job advertisements, identifying potentially fraudulent or spam applications, verifying applicant identity and identifying potentially fraudulent identity documents, generating interview questions and evaluation criteria, matching candidates to relevant opportunities based on their skills and experience, and recording and producing summaries of screening and interview conversations.
5.2 Our Talent Acquisition Partners, hiring managers and other members of the recruitment team remain responsible for recruitment decisions and candidate communications.
5.3 We take our use of AI seriously and seek to ensure that it is carried out in accordance with applicable laws and our internal standards relating to fairness, accountability and transparency.
5.4 We do not use individual candidate information to train or improve AI models unless that information has been anonymised or converted into aggregate data.
5.5 If you have any questions about our use of AI in recruitment, please contact us using the contact details set out in Section 12 of this Privacy Notice. For further information about how AI may be used during the recruitment process, please refer to our AI Recruitment Guidelines.
6. Who does dunnhumby share my personal data with?
From time to time, we might need to share your personal data. We only do this when we are legally permitted to do so. A list of those parties who may be granted access to your personal data are as set out below, along with the reason(s) for such access. |
6.1 During the recruitment process, we may be required to share your personal data with the following persons/parties:
6.1.1 your personal data will be shared internally for the purposes of the recruitment exercise. This includes members of our HR and recruitment team and the interviewers involved in the recruitment process (as necessary);
6.1.2 if you are applying for a role within our Berlin office, we have a statutory obligation to share certain personal data with our Works Council established in Germany;
6.1.3 if you are successful, we may be required to share this news with our recruitment agents to comply with our contract with them;
6.1.4 if you are successful, we will share your Identity Data, Contact Data and Application Data with our tax advisors who, through their software system, will make a determination as to whether your proposed working arrangements would classify you as a contractor or an employee under the relevant tax laws;
6.1.5 if you are successful, your personal data will be "onboarded" onto our internal HR systems using recruitment software which is provided and hosted by software providers such as "Enboarder". The personal data shared with Enboarder will include your Identity Data, Contact Data, Application Data, Financial Data and Corporate Data;
6.1.6 your Identity Data, Contact Data, Application Data may also be shared with our recruitment software providers (including our Applicant Tracking System providers, Greenhouse) for the purpose of facilitating and completing the recruitment process;
6.1.7 as stated in section 4, we may need to share some of your personal data with our criminal records check partners for the purpose of undertaking the relevant background checks. This will include the sharing of your Identity Data, Contact Data. You may then be asked to provide directly to the criminal records check partner certain Sensitive Data related to any past offences; and
6.1.8 we will contact your nominated individuals to follow up on any references we require.
7. How does dunnhumby keep my personal data secure?
7.1 We use appropriate technical and organisational measures to protect the information that we collect and process about you. The measures we use are designed to provide a level of security appropriate to risk of processing your personal data.
7.2 Specific measures we may use include:
7.2.1 applying encryption methods to your personal data when we store it on our internal database and/or when we need to transfer it;
7.2.2 ensuring we have appropriate firewalls in place;
7.2.3 providing data protection training to our staff;
7.2.4 regularly monitoring our systems for possible vulnerabilities and attacks, and carrying out penetration testing to identify ways to further strengthen security;
7.2.5 asking for proof of identity (where appropriate) before we share your personal data with you;
7.2.6 requiring staff to comply with data protection policies; and
7.2.7 restricting access to personal data on a need-to-know basis.
8. International data transfers
To achieve the purposes set out in section 4 above, it may be necessary for us to provide your personal data to parties which may be located outside of your jurisdiction (i.e. the country in which you live). This section identifies those countries in which the recipients of your personal data may be located, and explains how we comply with our relevant legal obligations. |
8.1 The servers (either as standalone storage, or as a result of the software tools/services we use) we use to store personal data during the recruitment process and afterwards will be based in the UK, EU, Australia, Singapore and the US.
8.2 In particular, the servers of our Applicant Tracking System (Greenhouse) are, as at the date of drafting, based in the US.
8.3 As part of the recruitment process, we may need to transfer your personal data to our colleagues whose relevant group company is based in a country outside of that in which you originally submitted your information. These countries may have data protection and privacy laws that are different to the laws of your country and, in some cases, may not be as protective.
8.4 However, we take appropriate safeguards to require that personal data will remain protected in accordance with this Privacy Notice. These include implementing the European Commission's Standard Contractual Clauses for transfers of personal data between our group companies, which require all group companies to protect personal data they process from the EEA in accordance with European Union data protection and privacy law.
8.5 Our Standard Contractual Clauses can be provided on request. We have implemented similar appropriate safeguards with our service providers and partners and further details can be provided upon request by contacting [email protected].
9. Data retention
We have a legal obligation not to retain personal data for longer than is necessary. The period of such retention may vary depending on the purposes for which we collected personal data. This section explains the length of time we will retain your personal data for, or where it is not possible, the considerations we will take into account when determining the relevant retention period. |
9.1 If you are unsuccessful in the application process, we will retain your personal data for a period of 14 months from the date of your job application. We retain your personal data for that period:
so that we can show, in the event of a legal claim, that we have not discriminated against candidates on prohibited grounds and that we have conducted the recruitment exercise in a fair and transparent way; and
to write to you with details of any other vacancies which may arise in the future which we feel you might be interested in.
9.2 We will write to you every 14 months to confirm whether you wish to continue to hear from us about future job opportunities. If you decline to receive such further information or fail to respond to our request for consent, we will securely destroy your personal data in accordance with applicable laws and regulations.
9.3 Please note that you can opt-out of hearing from us about future job opportunities at any time by clicking the unsubscribe link in our emails or by contacting us at [email protected].
9.4 If you are successful in the application process and you start working with us, we will retain your personal data in accordance with section 1.4 and section 4.1(i) of this Privacy Notice.
10. Rights of access, correction, erasure, and restriction
Depending on the circumstances in which your personal data was collected and/or is being used, the law grants you certain rights which you can exercise. This section explains what those rights may be and how you can exercise them. |
10.1 Under certain circumstances, by law you have the right to:
10.1.1 You have the right to access, correct, update or request deletion of your personal data, object to our processing of your personal data, restrict our processing of your personal data, or request portability of your personal data. If the UK data protection laws apply to you, you also have the right to complain to us if you have any concerns about our processing of your personal data. If you wish to do any of those things, please contact us at [email protected].
10.1.2 Similarly, if we have collected and process personal data with your consent (see the table set out in section 4 about when we rely on your consent), you can withdraw your consent at any time by contacting us at [email protected]. Withdrawing your consent will not affect the lawfulness of any processing we conducted prior to your withdrawal. It also will not prevent us from continuing to process the personal data we have collected from you without consent (e.g. where we collected it in accordance with our legitimate business interest). See section 4 for further information.
10.1.3 You have the right to complain to a data protection authority about our collection and use of your personal data. For more information, please contact your local authority. (Contact details for authorities in the UK, European Economic Area, Switzerland and certain non-European countries (including the US and Canada) can be found by clicking these links).
10.2 You may may also have certain rights in relation to the use of AI, where it is used by dunnhumby to make a solely automated decision regarding your application:
10.2.1 Due to the number of applications we receive for each role, we use AI to help analyse and group applications based on the suitability of the application to the role. If you would prefer your application to be reviewed by a member of our recruitment team rather than being assessed solely through this AI-enabled process, please contact [email protected] . For more details please see your application pack.
10.2.2 if you believe that our use of AI has resulted in an incorrect outcome, or that relevant skills, experience or qualifications were not properly taken into account, you may ask us to review the decision. A member of our recruitment team will review your application. To request a review, please contact [email protected]
10.3 We respond to all requests we receive from individuals wishing to exercise their rights in accordance with the law. When making a request, we may ask you to verify your identity (e.g. by providing a copy of suitable identification). Please provide any reference number for the job application you applied for, and describe your request with sufficient detail that allows us to properly understand, evaluate and respond to it.
10.3.1 You can also exercise your rights above by calling our head office at +44 20 8832 9222.
10.3.2 You will not receive discriminatory treatment if you choose to exercise any of your rights.
11. Updates to this Privacy Notice
11.1 We may update this Privacy Notice from time to time in response to changing legal, technical or business developments. When we update our Privacy Notice, we will take appropriate measures to inform you, consistent with the significance of the changes we make. We will obtain your consent to any material Privacy Notice changes if and where this is required by law.
11.2 You can see when this Privacy Notice was last updated by checking the "last updated" date displayed at the top of this Privacy Notice.
12. How to contact us
12.1 If you have any questions or concerns about our use of your information, please contact our Data Protection Officer using the following details: [email protected]. The data controller of your information is dunnhumby Limited.
12.2 You also have the right to lodge any complaints or concerns with your local data protection authority (DPA). Contact details for authorities in the UK, European Economic Area, Switzerland and certain non-European countries (including the US and Canada) can be found by clicking these links.
13. California Privacy Notice
13.1 This California Privacy Notice (“California Notice”) describes how we Collect, use, and disclose the Personal Information of California candidates, as well as the rights provided to California candidates by the California Consumer Privacy Act (“CCPA”).
13.2 “Personal Information” means information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with you. Personal Information does not include information that is publicly available, de-identified, or aggregated.
13.3 Capitalized terms defined in the CCPA that are used in this California Notice shall have the same meaning as in the CCPA. Unless otherwise noted, the disclosures contained within this California Notice describe our activities for the 12 months preceding the date of this Privacy Notice and our current practices.
13.4 In the event of a conflict between any other policy, statement, or notice and this California Notice, this California Notice will prevail as to California candidates.
13.5 How we Collect, use, and disclose your Personal Information
13.5.1 We Collect your Personal Information as described in Section 2 of the Recruitment Privacy Notice.
13.5.2 We Collect, use, and disclose the following categories of Personal Information about California candidates. Note that the specific pieces of Personal Information may vary depending on the nature of your interactions with us and may not include all of the examples listed.
Personal Information we Collect | Purposes for Collection, use, and disclosure |
|---|---|
Identifiers, including real name, alias, postal address, email address, passport number, or other similar identifiers | • To assess your suitability for the role which you applied for. |
Personal Information described in Cal. Civ. Code § 1798.80(e), including name, address, telephone number, passport number, education, employment, employment history, , or medical information | • To assess your suitability for the role which you applied for. |
Characteristics of protected classifications under California or federal law, including date of birth, race, ancestry, ethnic origin, sex, gender, religion or creed, medical condition, or disability | • To make reasonable adjustments to our recruitment process to accommodate any disability that you may have. |
Audio, electronic, visual, or similar information, including virtual interview recordings and CCTV footage | To assess your suitability for the role which you applied for. |
Professional or employment-related information, including your education and employment history, qualifications, a copy of your CV or resume, your current level of remuneration (including benefit entitlements); information provided by your references; and information you provide in the course of or resulting from any assessment | • To assess your suitability for the role which you applied for. |
Inferences used to create a profile reflecting the candidate’s characteristics, behavior, attitudes, intelligence, abilities, and aptitudes | • To assess your suitability for the role which you applied for. |
Sensitive Personal Information, including: | • To make reasonable adjustments to our recruitment process to accommodate any disability that you may have. |
Additional Categories of Personal Information that do not directly fit within one of the categories defined by the CCPA, including drug screening information and information about criminal convictions and offenses | • To assess your suitability for the role which you applied for. |
13.5.3 We disclose the categories of Personal Information above as described in Section 4 of the Recruitment Privacy Notice.
13.5.4 For information on our retention practices, please see Section 9 of this Privacy Notice.
13.5.5 We do not use or disclose Sensitive Personal Information for purposes to which the right to limit use and disclosure applies under the CCPA.
13.6 How we Sell and Share your Personal Information
13.6.1 Under California law, we do not Sell or Share the Personal Information of California candidates.
13.6.2 We do not have actual knowledge that we Sell or Share the Personal Information of candidates under 16 years of age.
13.7 Your California Privacy Rights
- 13.7.1 Right to Know. You have the right to request that we inform you what Personal Information we have Collected, used, stored, and disclosed about you in the 12 month period prior to the date you submitted your request, including:
13.7.1.1 the categories of Personal Information we have Collected about you;
13.7.1.2 the categories of sources from which the Personal Information was Collected;
13.7.1.3 our Business Purposes for Collecting or disclosing your Personal Information;
13.7.1.4 the categories of Personal Information that we disclosed about you for a Business Purpose and the categories of recipients to which each category of Personal Information was disclosed; and
13.7.1.5 the specific pieces of Personal Information we have Collected about you. 13.7.2 Right to Delete Your Personal Information. You have the right to request that we delete Personal Information we Collected from you, subject to certain exceptions.
13.7.3 Right to Correct Inaccurate Information. You have the right to request that we correct Personal Information that we maintain about you if you believe such Personal Information is inaccurate.
13.7.4 Right to Opt Out of Sales and Sharing of Personal Information. We do not Sell or Share the Personal Information of California candidates, as defined by the CCPA. For this reason, this right is not applicable.
13.7.5 Right to Limit Use and Disclosure of Sensitive Personal Information. We do not use or disclose Sensitive Personal Information for purposes to which the right to limit use and disclosure applies under the CCPA. For this reason, this right is not applicable.
13.7.6 Rights Related to Automated Decision-Making. You have the right to opt out of automated decision-making, including profiling, used to evaluate certain personal aspects relating to your performance at work, economic situation, health, personal preferences, interests, reliability, behavior, location, or movements. Because we do not use automated decision-making to evaluate candidates, this right is not applicable.
13.7.7 Right to Non-Discrimination for the Exercise of Your Privacy Rights. We will not discriminate against you if you choose to exercise any of your privacy rights described above.
13.8 How to exercise your California Privacy Rights
13.8.1 You may submit requests relating to your Personal Information as described above. To exercise any of these rights, please submit a request by emailing [email protected] or calling us at +44 020 3986 5499
13.8.2 You may be asked to provide additional Personal Information to verify your identity before we can respond to your request. You may authorize an agent to make a request on your behalf. However, the agent must provide enough information to verify the authority of the agent and your identity.
13.8.3 You can contact us using the information provided in Section 12 of this Privacy Notice.