Recruitment Privacy Notice

1. Personal Data

This privacy notice describes how Flyttr Ltd and Flyttr Inc. collects and uses personal information about you during the recruitment relationship with us, in accordance with Applicable Data Protection Laws.

Applicable Data Protection Laws means the Data Protection Act 2018 (DPA 2018), United Kingdom General Data Protection Regulation (UK GDPR), the Privacy and Electronic Communications (EC Directive) Regulations 2003, and any legislation implemented in connection with the aforementioned legislation. Where data is processed by a controller or processor established in the European Union or comprises the data of people in the European Union, it also includes the EU General Data Protection Regulation (EU GDPR). Where you are applying for a role based in the United States, it also includes the California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA/CPRA) and other applicable US federal and state law. This includes any replacement legislation coming into effect from time to time.

We collect information about you to facilitate the recruitment process and assess if you are an appropriate candidate. We need to keep some details on file as per the examples below.

We only disclose your information to the parties described in Section 8 (Data Sharing) below, for the purposes set out in this notice. Your information will not be used for marketing purposes outside of Flyttr. We do not sell your data and Flyttr promise to keep your details safe and secure.

Our data protection representatives can be contacted directly here:

The type of personal data we may collect:

  • Personal contact information: Name, address, telephone numbers, email addresses
  • CV and application information: employment and education history and referee details
  • Interview notes and references
  • Payroll and salary information: National Insurance number or equivalent (e.g. Social Security Number in the United States), bank details, wage and benefit information
  • Health information in relation to disability adaptations
  • Documentation relating to your right to work status in the jurisdiction of the role.

How we collect this data: We collect data about you through our recruitment portal provided by BambooHR. This may be uploaded by yourself or a recruitment agent in the format of a CV/resume and cover letter. We will also collect information via notes made by our recruiting officers during a recruitment interview and any right-to-work documentation you provide. Further information will be collected directly from you if you are offered employment — for example, your bank and next-of-kin details (please see the Employee Privacy Notice applicable to your jurisdiction, which will be provided when you start work).

In some cases, we will collect data about you from third parties, such as employment agencies or former employers when gathering references. This data is stored in your personnel file.

2. How We Will Use Information About You

We will use the personal information we collect about you to:

  • Assess your skills, qualifications, and suitability for the vacancy and make hiring decisions
  • Carry out reference and pre-employment checks
  • Communicate with you about the recruitment process
  • Keep records related to our hiring processes
  • Comply with legal or regulatory requirements

It is in our legitimate interests to make decisions on whom to offer employment to and also wage and salary decisions. For candidates applying to roles in California, the equivalent basis is our business purpose of evaluating candidates for employment — see the California Candidates section below for the specific CCPA/CPRA disclosures this requires.

We also need to collect your data to ensure we are complying with legal requirements, such as:

  • carrying out right-to-work checks required in the jurisdiction of the role, for example, right-to-work checks in the UK or Form I-9 employment eligibility verification in the United States and
  • making reasonable adjustments or accommodations for disabled candidates and employees

Having received your CV or resume and application form, we will process that information to decide whether you meet the basic requirements to be shortlisted for the role. If you do, we will decide whether your application is strong enough to invite you for an interview. If we decide to call you for an interview, we will use the information you provide to us at the interview to decide whether to offer you the role. If we decide to offer you the role, we will then take up references and carry out pre-employment checks before confirming your appointment.

If we require background checks for a role in the United States, these are carried out with your prior written authorisation and in accordance with the Fair Credit Reporting Act (FCRA) and applicable state law, using a separate authorisation and disclosure document required by that law. This notice does not replace that document.

If you are unsuccessful in obtaining employment, your data will not be used for any reason other than in relation to the specific application you have made.

If you fail to provide personal information:

If you fail to provide information when requested, which is necessary for us to consider your application (such as evidence of qualifications or work history), we will not be able to process your application successfully. For example, if we require a background or credit check or references for this role and you fail to provide us with relevant details or authorisation, we will not be able to take your application further.

3. How We Use Particularly Sensitive Personal Information

Some personal data is regarded as more sensitive; under UK GDPR this is classified as "special category data", and under the CCPA/CPRA as "sensitive personal information". We do not commonly ask for much of this in the recruitment process. However, we will use your particularly sensitive personal information in the following ways:

  • We will use information about your health/disability status to consider whether we need to provide appropriate adjustments during the recruitment process for example, whether adjustments need to be made for an interview.

For candidates in California, the specific categories of sensitive personal information we collect and our purposes for doing so are set out in the California Candidates section below, as required by the CPRA.

4. Automated Decision-Making

We do not use automated decision-making, including profiling, to make decisions that produce legal effects or similarly significantly affect you. We may use AI tools to support or inform certain processing activities, e.g. translating CVs or application documents, but these outputs are not used to make automated decisions about you and any relevant outcome is reviewed by a person before it affects your application or employment. Any AI tools we use are subject to our security and data protection due diligence, and we do not use your personal data to train publicly available AI models.

We are monitoring the California Privacy Protection Agency's regulations on automated decision-making technology (ADMT) under the CPRA, which introduce pre-use notice and opt-out rights for certain automated decisions in employment, phasing in from 2027, and will update this notice ahead of any change in how we use such tools.

5. Data Security

We have put in place appropriate security measures to prevent your personal information from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. In addition, we limit access to your personal information to those employees, agents, contractors and other third parties who have a business need-to-know. They will only process your personal information on our instructions, and they are subject to a duty of confidentiality.

We have put in place procedures to deal with any suspected data security breach and will notify you and any applicable regulator of a suspected breach where we are legally required to do so.

6. Data Retention

How long will you use my information for?

If your application is unsuccessful, we will retain your personal information for a period of 12 months. We retain your personal information for that period so that we can show, in the event of a legal claim, that we have not discriminated against candidates on prohibited grounds and that we have conducted the recruitment exercise in a fair and transparent way. This period is also consistent with US recordkeeping practice for unsuccessful applicants. After this period, we will securely destroy your personal information in accordance with applicable laws and regulations.

If your application is successful, your data will be kept and transferred to the systems we administer for employees. We have separate privacy notices for employees, which will be provided to you.

If we wish to retain your personal information on file, on the basis that a further opportunity may arise in future and we may wish to consider you for that, we will write to you separately, seeking your consent to retain your personal information for a fixed period on that basis.

7. Rights of Access, Correction, Erasure, and Restriction

Your rights in connection with personal information

Under certain circumstances in UK/EU, by law you have the right to:

  • Request access to your personal information (commonly known as a "data subject access request"). This enables you to receive a copy of the personal information we hold about you and to check that we are lawfully processing it.
  • Request correction of the personal information that we hold about you. This enables you to have any incomplete or inaccurate information we hold about you corrected.
  • Request erasure of your personal information. This enables you to ask us to delete or remove personal information where there is no good reason for us continuing to process it. You also have the right to ask us to delete or remove your personal information where you have exercised your right to object to processing (see below).
  • Object to processing of your personal information where we are relying on a legitimate interest (or those of a third party) and there is something about your particular situation which makes you want to object to processing on this ground. You also have the right to object where we are processing your personal information for direct marketing purposes.
  • Request the restriction of processing of your personal information. This enables you to ask us to suspend the processing of personal information about you — for example, if you want us to establish its accuracy or the reason for processing it.
  • Request the transfer of your personal information to another party.

If you want to review, verify, correct or request erasure of your personal information, object to the processing of your personal data, or request that we transfer a copy of your personal information to another party, please contact info@flyttr.com.

California Candidates — CCPA/CPRA Rights

California is currently the only US state whose comprehensive privacy law applies fully to job applicant personal information. If you are applying for a role based in California, you have the following additional rights, in place of, not in addition to duplicating, the general rights above:

  • Right to Know — you have the right to request disclosure of the categories and specific pieces of personal information we have collected about you, the sources of collection, our business purposes, and the categories of third parties with whom we have shared it.
  • Right to Delete — you have the right to request deletion of personal information we hold about you, subject to exceptions where retention is required by law or necessary for our legitimate recruitment purposes.
  • Right to Correct — you have the right to request correction of inaccurate personal information we hold about you.
  • Right to Limit Use of Sensitive Personal Information — you have the right to direct us to limit the use and disclosure of your sensitive personal information to purposes necessary to evaluate your application, as described in this notice.
  • Right to Non-Discrimination — we will not discriminate against you for exercising any of your CCPA/CPRA rights.
  • Right to Opt Out of Sale or Sharing — we do not sell or share your personal information for cross-context behavioural advertising. This right is not applicable in the recruitment context.

To exercise your rights in California please contact the People Team at people_global@flyttr.com stating the right you wish to exercise. We will acknowledge your request within 10 business days and respond in full within 45 calendar days (extendable by a further 45 days with notice). We will verify your identity before processing your request.

If you are not satisfied with our response, you may appeal by replying to our response. You also have the right to file a complaint with the California Privacy Protection Agency at cppa.ca.gov.

California — Sensitive Personal Information Collected

The CPRA requires us to disclose the categories of sensitive personal information we collect from candidates and the purposes for which we use it:

Category Examples / Purpose
Immigration / citizenship status Collected as required by federal law for I-9 employment eligibility verification, where you are offered a role.
Health / disability information Collected only where you disclose it to request adjustments during the recruitment process.
Racial or ethnic origin (voluntary) Collected only if you choose to complete a voluntary EEO self-identification form; not used in hiring decisions.

Texas Candidates — Note

Texas does not currently extend consumer privacy rights (under the Texas Data Privacy and Security Act) to individuals in the recruitment or employment context, so no additional statutory rights apply beyond the general rights set out above. The general position in this notice applies to Texas candidates.

8. Data Sharing

Your data will be shared with colleagues within the Company where it is necessary for them to undertake their duties with regard to recruitment. This includes, for example, the People Team, those in the department where the vacancy is who are responsible for screening your application and interviewing you, and the IT department if you require access to our systems to undertake any assessments.

We may share your personal data with other companies within our corporate group where this is necessary for recruitment or compliance purposes. All group companies are required to protect your information in a manner consistent with this notice and in accordance with applicable data protection laws. Access to your data is limited only to individuals who have a legitimate business need to review it and is covered by an intra-group data sharing agreement. As some of our colleagues work internationally, this transfer and processing may take place outside the country where you applied. Where we transfer your data internationally, we ensure appropriate safeguards are in place to protect it.

We will share your personal information with third parties where required by law, where it is necessary to administer the relationship with you, or where we have another legitimate interest or business purpose in doing so.

We do not sell your personal information. We do not share your personal information with third parties for their own marketing purposes.

All of our third-party service providers and other entities in the group are required to take appropriate security measures to protect your personal information in line with our policies.

We do not allow our third-party service providers to use your personal data for their own purposes. We only permit them to process your personal data for specified purposes and in accordance with our instructions.

9. Complaints

If you wish to make a complaint about how your personal data is being processed by Flyttr (or third parties as described in Section 8 above), or how your complaint has been handled, you have the right to lodge a complaint directly with us at Flyttr (details in Section 1 above) or with the relevant regulator for your jurisdiction.

UK candidates — Information Commissioner's Office:

California candidates — California Privacy Protection Agency: