Recruitment Privacy Notice
Relevant Text
This is an online application service provided by Greenhouse, which collects and processes data on behalf of CloudRock Holdings Ltd and its associated entities (the “Company”, “we”). When you create an account, we will collect certain details about you (personal data) to enable you to apply for a career opportunity with us or to set up job alerts for future roles. We may store your account details and any draft applications for a period of time, to enable you to easily complete a saved application. For more information about how your personal data is processed when you register for an account with Greenhouse, please refer to the CloudRock Recruitment Privacy notice here
CloudRock Recruitment Privacy Notice
1. Scope
This Notice describes how CloudRock Holdings Ltd and our related entities (collectively, “CloudRock, “company”, “us”, “we”) process personal data when you apply for a position with us, including traineeships, work experience or recruitment events and during any subsequent selection and onboarding process.
As a company with a global presence, we are subject to the varying requirements of Applicable Data Protection Laws within the jurisdictions where we operate. Although our approach to data protection and privacy across our business aims to be as consistent as possible and to accord with Applicable Data Protection Laws, the specific requirements, rights and obligations relating to personal data can be different.
In this Recruitment Privacy Notice, the descriptions of any rights and obligations will only apply where the processing is within the scope of the GDPR. Where we operate in jurisdictions with Applicable Data Protection Laws which are substantially different from the GDPR, the information below (in particular the rights and obligations described and limitations on processing) do not necessarily apply.
For candidates applying for roles in locations outside of the EU and UK, please also refer to our regional supplements below which provide further relevant information including office contact details and how to exercise your rights under Applicable Data Protection Laws. Where there is any inconsistency between a regional supplement and this Recruitment Privacy Notice, the regional supplement shall prevail.
2. Definitions
Where we use terms such as “processing”, “personal data”, “processor”, “controller”, “data subject”, these will take their meaning given in the GDPR and where applicable, the UK GDPR. Where other Applicable Data Protection Laws apply, the above expressions shall bear their respective meanings given under the relevant law or where no equivalent expression exists, be interpreted in a manner which is consistent withs such laws.
CloudRock refers to the international consulting practice operating through CloudRock Holdings Ltd, a limited liability company incorporated in England and associated entities and undertakings incorporated or formed in the USA (CloudRock Partners LLC), in Portugal (CloudRock Partners, Unipessoal, LDA, in India (CloudRock Partners India Pvt. Ltd), in Australia (CloudRock Asia Pacific Pty Ltd) and by means of a number of other associated entities and undertakings (each a “CloudRock Entity”).
Applicable Data Protection Laws means any laws, regulations, requirements relating to the processing of personal data applying to CloudRock Entities including, where applicable within the U.K and Central Europe: the General Data Protection Regulation (Regulation (EU) 2016/679)(“GDPR”) and as it applies within the U.K, the UK GDPR, within India, the Digital Personal Data Protection Act, 2023, within Australia, the Privacy Act 1988 within our United States offices, various federal and local privacy statements.
3. Types of Personal Data We Process
We may process personal data when you register for an account with us and where you submit an application for a role with CloudRock. The type of personal data we process will depend on the type of role you apply for, the location of your role and whether you are successful with your application. We may process some limited personal data when you register an account but do not proceed with submitting your application. We may process the following types of data:
3.1. Identity data such as your name, address, email address, telephone number, and date of birth and other direct identifiers such as ID documentation, where this is permitted by Applicable Data Protection Laws;
3.2. Application data such as your professional experience and education including where relevant: university degrees, academic records, certifications, awards and achievements, employment history including details of current and previous employer, referees, date of admission, jurisdiction of qualification, professional regulatory history, language skills, your references and right to work information and any other information that you provide in support of your application;
3.3. Technical data such as your login information, your IP address, operating system or other meta-data which is automatically collected when you access the Greenhouse application portal or our websites.
3.4. Sensitive data such as your health, disability and age, criminal offence information;
3.5. Other information that you may provide to us voluntarily in the course of the recruitment process.
4. Sources of Personal Data
Most of the personal data we process is provided directly by you when you submit this information to us with your application or when you participate in the interview process.
We may also receive personal data about you indirectly. For example, when you have been referred for a position at CloudRock or when we receive additional information from third parties such as your nominated referees or previous employers. We may also collect information about you from publicly available information in the course of pre-employment checks (as described in Section 5 (“Why do we process your personal data?”).
5. Why Do We Process Your Personal Data?
We may process your personal data to:
· assess your suitability and eligibility for a position or opportunity you have applied for;
· comply with immigration, employment or any other laws or regulations that apply to us;
· take steps prior to entry into an employment agreement with you if your application is successful;
· pursue our legitimate interests where permitted under Applicable Data Protection Laws, which are not overridden by your rights and freedoms, having regard to the safeguards we put in place such as those described in Section 10 (“International Transfers”);
· protect CloudRock’s systems, business information and employees, including where necessary for the exercise or defence of legal claims or other professional reporting requirements;
· we may contact you to ask for your consent as to whether you want to be contacted about future career opportunities with us;
· conduct pre-employment checks where permitted, which may include verification of information contained within your application, criminal history, financial history or other information that may be required to establish your education and/or qualifications.
6. What Are the Lawful Bases for Our Processing?
We may process your personal data because this is necessary for us to review your application or offer you future job opportunities with your consent.
By checking the box against the statement “I have read the CloudRock Recruitment Privacy Notice and I am happy to proceed”, you will indicate your consent to our processing of personal data for these purposes. You may withdraw your application and your consent at any time in the manner described below. However, if you do withdraw your consent, we may not be able to progress your application or make you an offer of employment, where we are considering this.
Where we are considering your application with a view to offering you a position, we may process your personal data at your request prior to entry into a contract with you.
We may also process your personal data in order for us to:
· comply with any Applicable Data Protection Laws including in respect of immigration, tax, professional or employment law obligations; and/or
· protect the security and integrity of our systems, assets, information, or colleagues and where permitted, we will rely on these as legitimate interests.
We may process sensitive data about you such as information concerning your physical or mental health to assess whether there are any reasonable adjustments that we may need to make in the recruitment process. If you are successful in your role, we may request further information concerning your health in order to provide you with any benefits to which you are entitled. In our UK and European offices, the legal basis on which we rely is to perform our legal obligations, to exercise or defend legal claims, where processing is necessary to carry out rights or obligations in the field of employment, social security, social protection law or in the case of discretionary benefits, with your explicit consent.
7. Diversity and Inclusion Data (Applicable to UK only)
We are very careful about how we use diversity and inclusion data and always, in an ethical, confidential and lawful manner, which is our top priority. Where you have opted to share diversity and inclusion data with us such as your nationality, racial and ethnic origin, gender, sexual orientation or religion, your personal data will be accessible to only a small number select individuals within the Global HR Team.
We collect this data in order to identify and keep under review the existence or absence of equality of opportunity between specified groups of people in order to promote such equality.
Personal data which is collected from your responses to the “Voluntary Disclosure” section of the application may be used by CloudRock to comply with our regulatory reporting obligation in respect of diversity and gender pay gap reporting. In each case, your information will be aggregated with other colleagues’ data and will be shared with the regulatory authorities anonymously.
We may also process your personal data to create aggregated and anonymous statistics to inform our diversity and inclusion strategy and to track our progress against CloudRock targets. In some cases, we may share anonymised statistics on our diversity levels externally, such as on our website or with our clients.
If you opt in to provide responses in the “Voluntary Disclosure” section of the application, we may process any personal data in order to perform our legal obligations in respect of employment or for statistical purposes in the public interest where use such personal data to create aggregated and anonymous statistics for equal opportunities monitoring.
8. Who Will Receive My Personal Data?
We take great care to ensure your personal data is only processed where this is strictly necessary and for the purposes described above. Your personal data may be shared internally with certain members of the HR team, hiring managers and other individuals who have a need to know the information or who are actively participating in the recruitment process you are taking part in.
A number of CloudRock Entities may need to process your personal data. Ordinarily, the CloudRock Entity where you apply for a role will process your personal data as an independent data controller.
Where different CloudRock Entities act as joint controllers, CloudRock Holdings Ltd is designated as sole point of contact to respond to any questions you may have about how we process your personal data and to exercise your rights. For more information or if you would like to contact us, please find the relevant contact details below or in the event you apply for a role outside the UK and EU, within the relevant Regional Supplement.
We may share your personal data with third parties who process data on our behalf, including where we engage external recruitment agencies to assist us with the recruitment process or data processors such as IT service providers that store data on our behalf. We use Greenhouse as our provider for all recruitment activities, which securely stores your personal data for us once you have created an account with them.
We may also share your personal data with our third-party provider, Credence in order to carry out necessary pre-employment checks, in the event that you accept an offer of employment from us.
We may also share your personal data to the extent that we are required by law, with certain public authorities such as law enforcement or professional or regulatory authorities. If this is necessary for our exercise or defence of legal claims, we may also share your personal data with our insurers or professional advisors.
9. Retention
We will not retain your personal data for longer than is necessary to fulfil the purposes described above. If we no longer have a legal ground to retain your personal data, we will erase the information securely, or in some cases anonymise it.
If your application is successful, your personal data may be further processed in relation to your future employment with us, and to allow us to comply with any legal requirements required of us as employer (Please see Section 12 (“Processing at Offer Stage”)).
If you are unsuccessful, we will retain your data for a period of 6 months after the completion of the application process and the last communication relating to the outcome of your application has been sent.
Where you have consented for us to contact you about future career opportunities at CloudRock, we may retain your personal data for an additional period of 24 months. We may contact you again from time to time, to check if you would like to continue to be contacted by us about future career opportunities.
10. International Transfers
As a global consultancy, we may need to share your personal data to other CloudRock Entities or third parties in other locations. Adequate safeguards for personal data transfers within CloudRock (and where necessary with other third parties working with or for us in respect of your application) will be ensured through standard contractual clauses; with your consent; or on the basis that the transfer is otherwise compliant with Applicable Data Protection Laws. Additionally, within CloudRock we have in place binding company-wide data protection and information security policies which govern our internal data processing activities.
Any personal data you provide to us through Greenhouse will be securely stored within the Greenhouse cloud servers located in the UK.
11. Possible Consequences
There are no negative consequences if you do not wish to provide us your personal data in the context of submitting an application. However, without providing your personal data it will not be possible to progress your application and your application will be closed. Incomplete or incorrectly completed applications cannot be considered.
12. Processing at Offer Stage
If you accept an offer from us, we will process further personal data preparatory to our contract with you.
Where you have been successful with an application, it will be necessary for us to verify certain details you have submitted. We will also conduct pre-employment background checking. Depending on the nature of your role and where local law requires and/or permits this (for example where it is required to meet certain professional regulatory standards), we may request our third-party screening provider to undertake criminal and/or financial history checks as a part of the final screening process. Where such checks are conducted, we will ensure that appropriate safeguards are in place to protect your personal data, including minimising access to such data.
Our Staff Privacy Notice which will be provided with you prior to your employment, will apply to any processing of personal data we conduct whilst you are an employee.
13. Automated Decision Making
We do not currently use any automatic decision making as part of our recruitment processes.
14. Your Rights
If you wish to exercise your rights, you can get in touch with us by contacting dpo@cloudrockpartners.com.
Regional Supplements
USA
Information We Collect
We may collect and process the following personal data:
· Identification Information: Name, address, email, phone number.
· Professional Information: Resume/CV, cover letter, work history, education details, qualifications.
· Additional Information: Any other information you provide during the application process.
Purpose of Data Collection
Your personal data is collected and processed for the following purposes:
· To evaluate your qualifications for employment.
· To communicate with you during the recruitment process.
· To comply with legal and regulatory requirements.
Legal Basis for Processing
Our legal basis for processing your personal data includes:
· Consent: By submitting your application, you consent to the processing of your personal data.
· Legitimate Interest: To assess your suitability for the role and manage our recruitment process.
· Legal Obligation: To comply with applicable laws and regulations.
Data Storage and Security
Your personal data is stored on secure servers located in the UK. We implement appropriate technical and organizational measures to protect your data against unauthorized access, alteration, disclosure, or destruction.
Data Sharing and Transfers
We may share your personal data with:
· Internal Personnel: Relevant staff involved in the recruitment process.
· Third-Party Service Providers: Vendors who assist us in managing our recruitment processes.
Given that you are a candidate from North America, your data may be transferred outside the UK. We ensure that any such transfers are conducted in accordance with applicable data protection laws and that appropriate safeguards are in place.
Your Rights
You have the following rights regarding your personal data:
· Access: Request access to your personal data.
· Rectification: Request correction of inaccurate or incomplete data.
· Erasure: Request deletion of your personal data, subject to legal limitations.
· Restriction: Request restriction of processing under certain circumstances.
· Objection: Object to processing based on legitimate interests.
· Portability: Request the transfer of your data to another organization.
Contact Us
If you have any questions about this Data Privacy Statement or wish to exercise your rights, please contact us at:
Email: dpo@cloudrockpartners.com
Updates to This Statement
We may update this Data Privacy Statement periodically. Any changes will be posted on this page with an updated effective date.
By submitting your application, you acknowledge that you have read, understood, and agree to the terms of this Data Privacy Statement.
INDIA
This Data Privacy Statement outlines how we collect, use, and safeguard the personal information you provide when applying through Greenhouse which is hosted in the UK. This statement is applicable to candidates applying from India.
Personal Data We Collect
When you apply for a position at [Company Name], we collect the following personal data:
· Name
· Contact details (email address, phone number, physical address)
· Educational background
· Employment history
· CV/Resume
· References
· Any other information you provide during the application process
Purpose of Data Collection
Your personal data is collected and processed for the following purposes:
· Evaluating your qualifications and suitability for employment
· Communicating with you about your application
· Conducting reference checks
· Complying with legal and regulatory requirements
Legal Basis for Processing
We process your personal data based on the following legal grounds:
· Your consent, given by agreeing to this Privacy Notice
· The necessity of processing for the performance of a contract or in order to take steps prior to entering into a contract
· Compliance with legal obligations
· Legitimate interests pursued by [Company Name], such as improving our recruitment process and ensuring data security
· Data Sharing and Transfers
Your personal data may be shared with:
· Internal HR and recruitment teams
· Third-party service providers involved in the recruitment process
· Regulatory or legal authorities where required by law
· Given that your data will be processed in the UK, it will be subject to UK data protection laws, which provide a high level of protection for personal data.
Data Security
We implement appropriate technical and organizational measures to protect your personal data against unauthorized access, disclosure, alteration, and destruction.
Data Retention
Your personal data will be retained for as long as necessary to fulfil the purposes for which it was collected, or as required by applicable laws and regulations. If your application is unsuccessful, we may retain your data for a period to consider you for future opportunities, unless you request otherwise.
Your Rights
You have the following rights regarding your personal data:
· The right to access your personal data
· The right to correct or update your personal data
· The right to request the deletion of your personal data
· The right to withdraw your consent at any time
· The right to object to or restrict the processing of your personal data
To exercise these rights or if you have any questions about this Privacy Notice, please contact us at Email: dpo@cloudrockpartners.com
Changes to This Privacy Notice
We may update this Privacy Notice from time to time. Any changes will be posted on this page with an updated effective date.
By submitting your application, you acknowledge that you have read, understood, and agree to this Data Privacy Statement.
AUSTRALIA
Information We Collect
We collect and process the following types of personal data:
· Identification Data: Name, address, email, phone number, and other contact details.
· Professional Data: Employment history, education, qualifications, and skills.
· Application Data: CV, cover letter, and any other information you provide during the application process.
Purpose of Processing
Your personal data will be used for the following purposes:
· To process and manage your application for employment.
· To assess your suitability for the role you have applied for.
· To communicate with you about your application and recruitment process.
Legal Basis for Processing
We process your personal data based on the following legal grounds:
· Consent: By submitting your application, you consent to the processing of your personal data as described in this statement.
· Legitimate Interest: For the purpose of evaluating your application and managing our recruitment processes.
Data Transfer and Storage
Your personal data will be stored securely on our systems, which are hosted in the United Kingdom. If you are an applicant from Australia, please be aware that your data will be transferred internationally. We ensure that appropriate safeguards are in place to protect your personal data during such transfers, in compliance with applicable data protection laws.
Data Retention
We will retain your personal data for as long as necessary to complete the recruitment process. If your application is unsuccessful, we may retain your data for a period of [specify duration] to consider you for future opportunities, unless you request us to delete your information.
Your Rights
You have the following rights regarding your personal data:
· Access: You can request access to your personal data.
· Rectification: You can request corrections to any inaccurate or incomplete data.
· Deletion: You can request the deletion of your personal data under certain circumstances.
· Objection: You can object to the processing of your personal data.
· Data Portability: You can request a copy of your personal data in a structured, commonly used, and machine-readable format.
Contact Information
If you have any questions about this Data Privacy Statement or wish to exercise your rights, please contact our Data Protection Officer at:
Email: dpo@cloudrockpartners.com.
Consent
By submitting your application, you acknowledge that you have read, understood, and agree to the terms of this Data Privacy Statement.
