Depop Limited is a company established in England (company number 08316342) with its registered offices at 1 Bartholomew Lane, London, United Kingdom, EC2N 2AX (“Depop”, “we”, “our”, or “us”). We are committed to protecting and respecting your privacy.
This Privacy Notice (together with any other documents referred to in it) sets out the basis on which the personal data collected from you, or that you provide to us, will be processed by us in connection with our recruitment and hiring processes. Please read the following carefully to understand our views and practices regarding your personal data and how we will treat it. You may also wish to read our full Privacy Policy on our website.
We have appointed a Data Protection Officer who is responsible for overseeing questions in relation to data privacy. If you have any questions about this Privacy Notice, including any requests to exercise your legal rights please contact our Data Protection Officer using the details set out below:
Title: Aphaia Ltd
Email address: dpo@aphaia.co.uk
Postal address: Eagle House163 City Road, London, EC1V 1NR.
Type of personal data we may hold and process
- The sort of information we will collect at different points of the recruitment process may include your name, private and professional addresses, date and place of birth, gender, marital status and dependents, nationalities, passport, national insurance number, identification number, photographs, telephone numbers, email addresses, bank account details, academic and professional qualifications, professional admissions, references, type and duration of residence and work permits and emergency contact details.
- If you contact us, we may keep a record of that correspondence.
- We will keep a record of your progress through any hiring process that we may conduct.
- If you are hired, we will process personal data about you in accordance with our internal Privacy Standard (a copy of which will be provided to you) for payroll, benefits and expenses purposes and to keep track of your holiday, sickness and other absence using third party software services developed for the purpose.
- Most of the information we hold about you will have been provided by you, (this includes information provided through an online job site, via email, in person at interviews and/or by any other method) but some may come from other external sources, such as tax authorities, recruitment agencies with whom we work and your referees.
- We may use third party software and online recruitment applications to assist with the recruitment process. Such software service providers will process personal data on our behalf and in accordance with our instructions.
- If you fail to provide certain information when requested, we may not be able to perform or enter into a contract with you (such as paying you or providing a benefit), or we may be prevented from complying with our legal obligations (e.g. to ensure you have the right to work and with respect to the health and safety of our workers).
- In addition, as part of our commitment to equality of opportunity and to monitor compliance with our equal opportunity policy, we may ask you to complete an equality monitoring form. Where you are asked to complete an equality monitoring form, information is provided voluntarily and on an anonymous basis for statistical analysis. It is not stored with your other personal
Information collected from other sources
- We may collect information about you through publicly available sources such as LinkedIn and other social media profiles.
- Third party recruitment software may also provide us with the facility to link the data you provide to us, with other publicly available information about you that you have published on the Internet.
- Where this technology allows us to search various databases – some publicly available and others not -such programmes are given parameters on the requirements of a role and search through publicly available sources, where there is a reasonable expectation that such information may be collected and processed by potential employers, to find candidates in appropriate industries for a particular job role.
- We may receive your personal data from a third party who recommends you as a candidate for a specific job opening or for our business more generally.
Lawful basis for processing
- We rely on legitimate interest as the lawful basis on which we collect and use your personal data. Our legitimate interests are the recruitment of staff for our business.
- Where you apply for a job opening through a job portal (such as Indeed) we rely on your consent, which is freely given by you during the application process, to disclose your personal data on the basis described in their privacy notice.
Purposes of processing
We use information held about you in the following ways:
- To consider your application in respect of a role for which you have applied.
- To consider your application in respect of other roles.
- To communicate with you in respect of the recruitment process.
- To enter into a contract of employment or engagement with you.
- To enhance any information that we receive from you with information obtained from third party data providers.
- To find appropriate candidates to fill our job openings.
- To verify information provided or to prevent fraud.
- To help our third party service providers (such as third party recruitment software providers and their processors and data providers) and partners (such as the job sites through which you may have applied) improve their services.
Automated decision making/profiling
- We may use third party application technology to select appropriate candidates for us to consider based on criteria expressly identified by us, or typical in relation to the role for which you have applied. The process of finding suitable candidates is automatic, however, any decision as to who we will engage to fill the job opening will be made by Depop staff.
Disclosure of your information
- As set out above, we may pass your information to our third party service providers, who use it only in accordance with our instructions and as otherwise required by law.
How we store your personal data
- We take appropriate measures to ensure that all personal data is kept secure including security measures to prevent personal data from being accidentally lost, or used or accessed in an unauthorised way. We limit access to your personal data to those who have a genuine business need to know it. Those processing your information will do so only in an authorised manner and are subject to a duty of confidentiality.
- We also have procedures in place to deal with any suspected data security breach. We will notify you and any applicable regulator of a suspected data security breach where we are legally required to do so.
- Unfortunately, the transmission of information via the internet is not completely secure. Although we will do our best to protect your personal data, we cannot guarantee the security of your data transmitted through any online means, therefore any transmission remains at your own risk.
Where we store your personal data
- Where we store your personal data in our own systems, it is stored on our secure servers within the EEA. It may be transferred outside the EEA (for example to our affiliate in the US for internal administrative purposes) and to third party service providers outside the EEA to perform our contract with you and comply with our legal or contractual requirements.
- To ensure that your personal data receives an adequate level of protection we put in place measures to ensure that your personal information is treated by third parties outside the EEA in a way that is consistent with and which respects the EU laws on data protection: e.g. such parties must be US Privacy Shield certified or enter into appropriate data processing agreements containing the model contract clauses (where necessary). If you require further information about these protective measures, you can request them from the Data Protection Officer.
How long we keep your personal data
- We will keep the personal data we hold about you accurate and up to date and for no longer than is necessary for the purpose. This means that data will be destroyed or erased from our systems when it is no longer required. To determine the appropriate retention period for personal data, we consider the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal requirements.
- Your assistance with keeping data we hold about you up to date is critical and you must immediately notify us if your personal details change or if you become aware of any inaccuracies in the personal data we hold about you.
- We will normally retain employment application data for 24 months following conclusion of the recruitment process. If you are successful in your application for employment, information provided during the recruitment process will be retained to perform the contract with you.
Your rights
Under the data protection legislation you have a number of important rights to:
- Right to access your information: You are entitled to see the information held about you and to check that we are lawfully processing it. We will comply with our obligations under applicable data protection legislation in relation to any request by you. We may charge you a reasonable fee or refuse to comply with your request if it is clearly unfounded, repetitive or excessive. We try to respond to all legitimate requests within one month (once we have been able to verify your identity). Occasionally it may take us longer than this if your request is particularly complex or you have made a number of requests.
- Request correction of the personal information that we hold about you. This enables you to have any incomplete or inaccurate information we hold about you corrected.
- Request erasure of your personal information. This enables you to ask us to delete or remove personal information where there is no good reason for us continuing to process it. You also have the right to ask us to delete or remove your personal information where you have exercised your right to object to processing (see below).
- Object to processing of your personal information where we are relying on a legitimate interest (or those of a third party) and there is something about your particular situation which makes you want to object to processing on this ground. You also have the right to object where we are processing your personal information for direct marketing purposes.
- Request the restriction of processing of your personal information. This enables you to ask us to suspend the processing of personal information about you, for example if you want us to establish its accuracy or the reason for processing it.
- Request the transfer of your personal information to another party in certain formats, if practicable.
- Withdraw consent to processing at any time where we are relying on consent to process your personal data. However, this will not affect the lawfulness of any processing carried out before you withdraw your consent. If you withdraw your consent, we may not be able to provide certain products or services to you. We will advise you if this is the case at the time you withdraw your consent.
- Make a complaint to a supervisory body which in the United Kingdom is the Information Commissioner’s Office. The ICO can be contacted through this link: https://ico.org.uk/concerns/
If you wish to exercise any of the rights set out above, please contact the Data Protection Officer: dpo@aphaia.co.uk.
We reserve the right to update this privacy notice at any time, and any modifications will be posted in the job section of our website.