Uptree

This Job Candidate Privacy notice describes what personal information we, Uptree Limited, collect and process when you apply for a job with us. You are not legally required to provide any personal information, but without it we may not be able to process your application. If you do not agree to this notice, please avoid providing us with your data.

Contact details

Email: operations@uptree.co

Compliance and certification

We hold an IASME (Information Assurance for Small and Medium Enterprises) certification. IASME is a UK-based cybersecurity standard designed to help small and medium-sized enterprises (SMEs) improve their cybersecurity posture and demonstrate compliance with key best practices.

We are ICO registered and aware of our obligations under UK data protection laws, including how personal data should be collected, stored, processed, and disposed of.

What information we collect, use, and why

We collect or use the following personal information throughout the application and recruitment process, you may provide us (or we may otherwise generate or have access to):

• Biographical information: such as name, gender, date of birth, ethnicity, professional history, references, language proficiencies, professional qualifications and registrations, education details, social media profiles and activity, and your photos.
• Contact information: such as your work and home address, telephone number, email address, and social media handles and activity.
• Identification information: such as your national insurance number, government-issued identification (e.g. drivers licence, passport), photographs, or other similar identifiers.
• Performance information: such as candidate scoring information, metrics, interview notes, performance evaluations and feedback, and recommendations.
• Information about related persons, as relevant.
• Nationality and immigration status, and other information such as residency and work permit status, to allow us to verify your employment eligibility.
• Recordings and other content: such as video and voice recordings of calls and meetings you participate in, transcripts of such recordings, and any email correspondence, notes or communications captured or submitted to us via any communication methods.
• Information required to accommodate personal needs, potential disabilities or health-related conditions: to ensure compliance with our legal requirements under applicable law.
• Other information you provide to us; such as your feedback and survey responses where you choose to identify yourself.
• Consent to background checks including DBS checks for working with young people.

Lawful bases and data protection rights

Under UK data protection law, we must have a “lawful basis” for collecting and using your personal information. There is a list of possible lawful bases in the UK GDPR. You can find out more about lawful bases on the ICO’s website.

Which lawful basis we rely on may affect your data protection rights which are in brief set out below. You can find out more about your data protection rights and the exemptions which may apply on the ICO’s website:

• Your right of access - You have the right to ask us for copies of your personal information. You can request other information such as details about where we get personal information from and who we share personal information with. There are some exemptions which means you may not receive all the information you ask for. You can read more about this right here.
• Your right to rectification - You have the right to ask us to correct or delete personal information you think is inaccurate or incomplete. You can read more about this right here.
• Your right to erasure - You have the right to ask us to delete your personal information. You can read more about this right here.
• Your right to restriction of processing - You have the right to ask us to limit how we can use your personal information. You can read more about this right here.
• Your right to object to processing - You have the right to object to the processing of your personal data. You can read more about this right here.
• Your right to data portability - You have the right to ask that we transfer the personal information you gave us to another organisation, or to you. You can read more about this right here.
• Your right to withdraw consent – When we use consent as our lawful basis you have the right to withdraw your consent at any time. You can read more about this right here.

If you make a request, we must respond to you without undue delay and in any event within one month.

To make a data protection rights request, please contact us using the contact details at the top of this privacy notice.

Our lawful bases for the collection and use of your data

We will use and process your personal information for the following purposes and in reliance with the lawful bases noted below:

• Contract (pre-contractual measures) – we have to collect or use the information so we can enter into or carry out a contract with you. All of your data protection rights may apply except the right to object.
  • To evaluate your suitability for a role at Uptree Limited and progress your application
  • To create your employee personnel file, if hired.
• Legal obligation – we have to collect or use your information so we can comply with the law. All of your data protection rights may apply, except the right to erasure, the right to object and the right to data portability.
  • To comply with applicable legislation and industry codes.
• Legitimate interests – we’re collecting or using your information because it benefits you, our organisation or someone else, without causing an undue risk of harm to anyone. All of your data protection rights may apply, except the right to portability. Our legitimate interests are:
  • To contact you about other suitable roles within Uptree Limited in the future
  • To maintain our internal records of recruitment and employment applications
  • To comply with applicable legislation and industry codes
  • To create your employee personnel file, if hired
  • To manage risk and enhance our security measures
  • To create aggregated statistical or inferred data regarding our Candidates to further develop and improve our recruitment processes
  • To protect the rights and the interests of Uptree Limited, including for legal compliance purposes and to defend against claims.

Where we get personal information from

We collect your information from the following places:

• Directly from you
• Referees (external or internal)
• Security clearance providers
• Pension administrators or government departments (eg HMRC and DWP)
• Public sources (eg LinkedIn or other websites)
• External recruitment organisations (for some roles we may use external recruitment support to source candidates directly)

How long we keep information

We keep personal information on job candidates for 1 year in line with our Data Retention Schedule. When we no longer need personal data for the reason we collected it - we destroy it securely. Pseudonymised information about the number of applications received for any particular role is kept for an indefinite period to fulfil our reporting obligations.

Our justification for retaining personal information as part of candidate recruitment administration and management is so we can re-consider candidates for other positions and opportunities at Uptree Limited (subject to your consent, where required by Law), so we can use a candidate's personal data as a reference point for future applications submitted by them; and in case the candidate is hired, for additional employment and business purposes relating to their work; and as reasonably required to comply with our legal obligations and to defend against claims, to resolve disputes, prevent fraud and abuse, enforce our agreements or otherwise protect our legitimate interests, all in accordance with our data retention policy.

Who we share information with

In some circumstances, we may share information with the following organisations:

• External auditors
• Suppliers and service providers
• Professional consultants

Data processors

Some privacy and data protection laws, including the GDPR and CCPA, distinguish between two primary roles when it comes to collecting and processing personal data: data controllers and data processors.

A data controller (or business) determines the means and purposes for processing personal data, while a data processor (or service provider) is a party that processes data on behalf of the controller.

As part of our business, we use the following data processors for the processing of personal information on Job candidates:

• Google Workspace, which includes Google Drive, and Gmail
  • This data processor does the following activities for us: They manage our mail, calendar and documents.
• Slack
  • This data processor does the following activities for us: They store our non-asynchronous communication between team members.
• monday.com
  • This data processor does the following activities for us: They store our company workflows and project management tools.
• Dropbox
  • This data processor does the following activities for us: We use Dropbox to store and share our company documents.

To receive a complete list of our data processors used as part of our business across all areas, please contact us using the contact details at the top of this privacy notice.

Sharing information outside of the UK

Where necessary, we may transfer personal information outside of the UK. When doing so, we comply with the UK GDPR, making sure appropriate safeguards are in place. For further information or to obtain a copy of the appropriate safeguard for any of the transfers below, please contact us using the contact information provided above.

• Organisation name: Slack
  • Category of recipient: Internal discussion tool
  • Country the personal information is sent to: Australia, Canada, India, Japan, South Korea and the United States
  • How the transfer complies with UK data protection law: https://slack.com/intl/en-gb/privacy-policy-updated#international
• Organisation name: Google Workplace
  • Category of recipient: Storage provider, includes Google Drive, GMail and Google Analytics
  • Country the personal information is sent to: Multiple countries
  • How the transfer complies with UK data protection law: https://policies.google.com/privacy/frameworks?hl=en-US
• Organisation name: Dropbox
  • Category of recipient: Storage provider
  • Country the personal information is sent to: Multiple countries
  • How the transfer complies with UK data protection law: Addendum to the EU Standard Contractual Clauses (SCCs)
• Organisation name: monday.com
  • Category of recipient: project management tool
  • Country the personal information is sent to: Israel, the European Union, United States of America, Australia, Japan, Singapore, Brazil and additional locations in which they operate.
  • How the transfer complies with UK data protection law: https://monday.com/trustcenter/privacy

How to complain

If you have any concerns about our use of your personal data, you can make a complaint to us using the contact details at the top of this privacy notice.

If you remain unhappy with how we’ve used your data after raising a complaint with us, you can also complain to the ICO.

The ICO’s address:

Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

Helpline number: 0303 123 1113

Website: https://www.ico.org.uk/make-a-complaint

How to report a vulnerability

If you believe you found a security breach, please report it here.

Last updated

5 November 2024 - reviewed annually.