Privacy Notice for Job Candidates in Europe

What types about personal data do we process?

Basic personal and contact details that you share with us in relation to your application - name, date of birth, address, phone number, e-mail address, photo.

Specific data relevant for the recruitment process: Skills and experience, test results (when applicable), qualifications, references, CV, cover letter and application details, interview (including video interview when applicable), assessment data and any other data that you may voluntarily share with us. Personal data for the accommodation of reasonable accessibility adjustments (when relevant): information concerning your health (disability) that you may voluntarily share with us.

Data provided to us by your referees (if applicable). These are reference points that you have given us to contact.

Details of any job offer made to you (when relevant): function, work location, holiday entitlement, working hours, payroll data (salary), social benefits. 

Applicable documents and data required by Law for concluding contracts, if you are selected for the position you apply – described in detail in our privacy notice for employees (such as names, national ID number, Tax number, Social security number, address, date of birth, nationality, city and country of birth, VISA details, details from medical certificates when required by law).

Where do we collect your personal data from? 

Typically, during your recruitment process with us, most of your data is likely to come directly from you: for example, names, contact details, CV details, information about your previous employment, education and skills etc.

 However, in some cases we receive information not directly from you but from third parties such as recruitment agencies or referees/reference points; information can encompass names, contact details, skills, previous employment history summary, performance.

We can also obtain information from professional social networks, such as LinkedIn, job boards and from other publicly accessible sources related to your professional life for the purposes of approaching you with job offers. 

For a very limited number of management positions and where it is strictly necessary and/or required by law, we may perform relevant background checks. 

What are the purposes of processing your data? 

We process your information: 

• To consider your application for a role in SumUp and manage our recruitment processes.

• To communicate with you in respect of the recruitment process.

• To ensure equal opportunities for all candidates and offer reasonable adjustments in the hiring process.

• To find appropriate candidates to fill our job openings.

• To prepare an offer and conclude your employment contract with us. 

• Based on your consent to ask you about your experience within the recruitment process so that we can improve it. 

Collection of data of job applicants for the purposes described above is necessary for us - to assess your application and potentially conclude an employment contract with you. If we cannot collect enough relevant information, we would not be able to proceed with your application.

What is the lawful basis for processing your data? 

We collect your personal data to assess your skills and suitability for a particular position within SumUp. In this regard, the recruitment process is a necessary condition for us to enter into an employment contract with you. Please note that if you apply for a job position in Berlin your personal data will be processed by the SumUp Works Council for the purposes of performance of its legal rights and obligations under the applicable local legislation.

We also rely on legitimate interest as the lawful basis on which we collect and use your personal data. Our legitimate interests are the recruitment of suitable, talented and reliable staff for our business. When we obtain information from your public profile on professional social networks, such as LinkedIn, we base this processing on our legitimate interest to build a decision base in order to establish an employment relationship with you.

If you agree to retain your personal data to offer you future open job positions at SumUp after the expiration of the initial retention periods as per Annex 1, we rely on your consent.

If you provide us with special categories of personal data, such as information concerning disabilities you may have, we rely on your prior explicit consent to process this data so that we can offer you reasonable accessibility adjustments in the hiring process.

When we invite you to participate in a survey on your satisfaction with the application process at SumUp the relevant legal basis is your consent. 

Furthermore, we may process your personal data where this is necessary to defend ourselves against legal claims arising from the application process that are brought against us. The legal basis for this are performance of a contract, in some cases legal requirement and our legitimate interest to defend our interests - for example, a burden of proof in proceedings under applicable national anti-discrimination laws. 

Once you have passed the recruitment stage, we might also be obliged to collect some additional data about you, as required by law to enter into an employment contract.

Do we share your data with third parties? 

Your information may be shared internally within the SumUp Group for the purposes of the recruitment process. This includes members of the HR team, interviewers involved in the recruitment process, managers in the business area with a vacancy. If you apply for a job position in Berlin, your personal data will also be shared with the Works Council.

Your personal data may be shared with and/or processed by third parties that are acting on our behalf for specific recruitment related processes like job boards, recruitment software, recruitment agencies. 

In some cases, for management or key functions positions, we may be required to share your personal information with a regulator to comply with the law. 

Do we transfer data outside the sea?

Since SumUp is a global Group of companies, Group-internal transfers of employee data are possible for human resource management and administration purposes.

In the course of our activities, in some cases your information may be transferred to third parties outside of the EEA. We have in place safeguards including security standards as used within SumUp for all data, using only reputable third parties and ensuring adequate agreements are in place with them to ensure the security of your data.

How do we protect your personal data? 

You can be assured that we take the security of personal data we process very seriously. We take appropriate measures to ensure that all personal data is kept secure including security measures to prevent personal data from being accidentally lost, altered, used or accessed in an unauthorised way. We limit access to your personal data to those who have a genuine business need to view it. Those processing your information will do so only in an authorised manner and are subject to a duty of confidentiality. 

We have put in place procedures to deal with any suspected data security breach and will notify you and any applicable regulator of a suspected breach where we are legally required to do so. 

Is there automated decision-making and profiling? 

In our current processing activities relating to job candidates, we do not use automatic decision making or profiling. If we intend to do so in the future, we will amend this Privacy Notice accordingly and make it available to our job candidates.

How long do we keep your personal data? 

Please find all retention periods related to job applicants’ documents and data depending on the country where the hiring SumUp entity is in the table in Annex 1 at the end of this Privacy Notice.

If your application for employment is successful, personal data gathered during the recruitment process will be transferred to your employee file and retained during your employment. The periods for which employee data is held will be provided to you in a separate privacy notice dedicated to employees. 

What are your rights? 

Under the applicable data protection legislation, including the GDPR you have a number of rights with regard to your personal data. You have the right to:

• Access to Your Data: You can ask us what data we process for you and/or for a copy of your personal data.

• Amend (Rectify) your Data: You can request the correction or update of personal data that we hold about you when you believe that it is incorrect or incomplete. 

• Delete (Erase) Data: You can ask us to erase or delete all or some of your personal data, to the extent permitted by law under certain circumstances. 

• Object to, or Restrict the processing of your Data: You can ask us to stop using all or some of your personal data or to limit our use of it, to the extent permitted by law under certain circumstances.

• Data Portability: You have the right to request us to transmit our data to another organisation in a structured, commonly used and machine-readable format. 

If you have provided consent for the processing of your data, you have the right to withdraw that consent at any time which will not affect the lawfulness of the processing before your consent was withdrawn.

You can exercise your rights by contacting us at [email protected]. 

If you have any question or want to express dissatisfaction with the way SumUp processes your personal data, you can always contact our Data Protection Officer at email address: [email protected]. 

You can also lodge a complaint to the relevant data protection authority. SumUp will cooperate fully with any such investigation and endeavour to satisfy all queries as fully as possible. The relevant authority for each country can be found on the European Commission website. 

Updates of this privacy notice 

We may change this job candidates Privacy Notice in the future. The latest version and its effective date will be always made available to job candidates.

Annex 1 – Retention Periods