Candidate privacy notice

01Who we are

KUZUB LTD is the controller of the personal data described in this notice.

KUZUB LTD is a private limited company registered in Scotland with company number SC890997. Its registered office is at Suite 2/3, 48 West George Street, Glasgow G2 1BP, United Kingdom.

KUZUB LTD is registered with the Information Commission, the UK data protection regulator, under registration number ZC249004.

Anything about this notice or your personal data can be sent to privacy@kuzub.co.uk, or by post to our registered office.

02What this notice covers

This notice is for people who join our talent network on the Careers page at kuzub.co.uk/careers, who send us their details because they want to work with us, or who take part in our recruitment for a role. The privacy notice at kuzub.co.uk/privacy covers the rest of this website.

UK data protection law applies to the personal data this notice describes, wherever you live. If you are in the European Union, you have the same rights under the EU General Data Protection Regulation. Our representative in the European Union under Article 27 GDPR and Article 13 of the Digital Services Act is being appointed and will be named on this page. Until then, residents of the European Union can reach us at privacy@kuzub.co.uk.

03What we collect

From the talent-network form: your name, your email address, the area of work you choose, a link to your portfolio or profile if you give one, your message, and a record of your consent, which is the wording you agreed to and the time you agreed to it.

When you send the form, our server also uses your IP address, held only in working memory, to stop automated abuse, as the privacy notice explains.

If you send us your details by email instead, we receive what you send, such as your name, your email address, your CV and your message.

If we consider you for a role, we also hold what that process produces: notes of our conversations with you, the practical task you complete and our assessment of it, and our decision with its reasons. Work you do for a practical task remains yours. We use it only to assess you, and we delete it with the record of the process.

If we offer you a role, we check your right to work at that stage and not before, where the law of the country you will work in requires it. In the United Kingdom, this is the right-to-work check that UK law sets for employers. We tell you then which documents we need, and we keep a record of the check, including copies of the documents you show us.

From the date of this notice, before we take anyone on, as an employee or as a contractor, we check their name against the sanctions lists of the United Kingdom, the European Union, the United States, the United Nations and Ukraine. For a contractor, we also confirm their identity and that the person who will do the work is the person we contract with, or is employed by the business we contract with.

When you give us a link to your work, we look at what it shows. Apart from the checks described above, we do not collect information about you from anyone else, such as a referee, without telling you first.

We do not ask for information about your health, ethnic origin, religion or beliefs, any other special category of personal data, or criminal convictions, and we ask you not to send it. If you need anything arranged differently to take part in any step, tell us what would help; you do not need to tell us why.

If what you tell us about an adjustment reveals a disability or a health condition, we use it only to make the adjustment, keep it apart from our assessment and delete it with the rest of your recruitment record. We rely on our obligations under the Equality Act 2010 (UK GDPR Article 9(2)(b) and paragraph 1 of Schedule 1 to the Data Protection Act 2018).

04Why we use it and on what basis

Talent network. We use your details only to consider you for roles at KUZUB LTD and to contact you about them. Our lawful basis is your consent, which you give by ticking the box on the form; without that tick the form is not sent. If you joined the talent network before this notice was published, we use your details only to contact you about roles until you tell us, in reply to our email, that we may also consider you for roles.

You can withdraw your consent at any time by writing to privacy@kuzub.co.uk or by replying to any email we send you about roles. We then delete your talent-network details. Withdrawing consent does not affect anything we did with your details before you withdrew it.

Details you send by email. We use them to answer you and to consider you for roles. Our lawful basis is legitimate interests, being our interest in hearing from people who want to work with us and yours in being considered. You can object at any time, and we then delete them.

Recruitment for a role. When you take part in our recruitment for a role, we use your details to assess you and to decide. The basis is taking steps at your request before entering into a contract of employment or engagement, together with our legitimate interest in choosing fairly. We keep a record of the process so that we can answer questions about our decision and defend it if it is challenged, which is also a legitimate interest.

Right-to-work check. We carry out the check that the law sets before anyone starts work. The basis is our legal obligation.

Checks before we engage you. The sanctions, identity and work-identity checks described above rest on our legal obligations under sanctions law and on our legitimate interest in preventing fraud and exploitation. If a check suggests a match with a listed person, we use the result only to decide whether we can lawfully engage that person, relying on paragraph 10 of Schedule 1 to the Data Protection Act 2018.

You do not have to give us any personal data, and no law or contract requires you to. Without the details the form asks for, we cannot keep you in the talent network or consider you for a role. If we offer you a role, the offer depends on the right-to-work check, and without it we cannot engage you.

A person reads every form and every application, and people make every decision about you. Apart from automatic checks that stop spam and automated abuse, no decision about you is made by automated means alone.

05Who sees it

Your details are seen only by the people at KUZUB LTD who run the talent network or take part in hiring for the role.

Resend delivers the form to our mailbox, which Zoho hosts, and emails you send us arrive in the same mailbox. Cloudflare hosts the website and its forms. Resend, Zoho and Cloudflare act as our processors, under data processing terms that allow them to use personal data only on our instructions.

We do not pass your details to recruitment agencies, to other employers or to anyone else for their own use, and we do not sell them.

Apart from our processors, we disclose personal data only in three cases. The first is where the law requires it, for example to a court or to a public authority with the power to demand it. The second is to our professional advisers, such as lawyers and accountants, when we need their advice on a matter that concerns you. The third is if the part of our business that holds it passes to another organisation, in which case we require that organisation to handle it as this notice describes.

06Transfers outside the United Kingdom

Resend and Cloudflare process data outside the UK, including in the United States. Those transfers rely on the UK International Data Transfer Addendum to the EU Standard Contractual Clauses, which each provider incorporates in its data processing terms. Zoho keeps our mailbox in its data centre in the European Union, to which UK law allows transfers under regulations made under Article 45A of the UK GDPR.

You can ask for a copy of these safeguards at privacy@kuzub.co.uk.

07How long we keep it

Talent-network details are kept for 12 months from the day you send them, then deleted. If you withdraw your consent sooner, we delete them when you ask. To stay in the network after 12 months, send the form again.

Details you send by email are kept for 12 months from your last message, then deleted, unless you take part in our recruitment for a role.

If you take part in our recruitment for a role and do not join us, we keep the record of the process for 12 months from the day we tell you our decision, then delete it, together with the record of the checks before engagement. If you join us, it becomes part of your employment or engagement record, and we tell you how we handle that record when you start; the record of the checks before engagement is kept with it for as long as sanctions, tax and employment law require.

If you join us, the record of your right-to-work check is kept with your employment or engagement record for as long as the law requires. If you do not, we delete it as soon as the offer is declined or withdrawn.

08Your rights

Under UK data protection law you can ask for a copy of your personal data, ask us to correct it or delete it, ask us to restrict our use of it, object to our use of it, and ask for it in a portable form. Where we rely on your consent, you can withdraw it at any time.

If you object to a use that rests on legitimate interests, we stop it, unless we have compelling legitimate grounds that override your interests, such as protecting the website and its forms against attack and automated abuse, or we need the data to establish, exercise or defend a legal claim.

Write to privacy@kuzub.co.uk. We answer within one month, free of charge. We may ask for information that confirms who you are before we act on a request.

09Complaints

If you are unhappy with how we have handled your personal data, please tell us: write to privacy@kuzub.co.uk, or send the contact form at kuzub.co.uk/contact with the interest Other. We acknowledge your complaint within two working days of receiving it, and always within the 30 days that section 164A of the Data Protection Act 2018 allows. We then look into it, keep you informed of progress, and tell you the outcome without undue delay. A working day is Monday to Friday, except public holidays in Scotland.

You can also complain to the Information Commission (ico.org.uk), the UK data protection regulator. If you live or work in the European Union, you can also complain to the data protection authority of the member state where you live or work or where you believe the infringement took place.

10Changes to this notice

If we change this notice, we update this page and the date at the top of it. If a change affects details you have already given us, we tell you by email before it applies. This is version 1, the first version published by KUZUB LTD.