Candidate Privacy Notice

Triple Point Group Candidate Privacy Notice

1. Introduction

Your privacy is important to us, so we have developed this Candidate Privacy Notice (“Notice”) to explain how we collect, use, manage and look after your personal data during the recruitment and engagement process.

Triple Point is committed to protecting the personal data of all applicants. We comply with applicable data privacy legislation including the UK General Data Protection Regulation (“UK GDPR”) and the Data Protection Act 2018 (“Data Protection Legislation”).

2. Scope

This Notice applies:

(a) To anyone applying for a role with Triple Point to whom the Triple Point hiring process applies, and will include prospective employees, partners, directors, contractors, consultants, NEDs, interns and secondees

(b) To engagements that are for permanent positions as well as fixed term contracts secondments, internships or other engagements of a non permanent nature

(c) Regardless of whether the engagement is direct or through a third party (such as a recruiter)

It is separate from our Employee Privacy Notice, which applies once your employment/engagement begins.
We may update this Notice at any time to reflect changes in internal processes or updates to the Data Protection Legislation.

Throughout this Notice, when we say, “you” or “your”, this refers to you or any authorised person who engages with us on your behalf, such as any recruitment agencies you have authorised to liaise with us on your behalf.

3. Who we are

Throughout this Notice, when we say “we” or “Triple Point”, this refers to Triple Point ServCo which acts as a data controller in respect of the processing described in this Notice. Registered office: 1 King William Street, London, EC4N 7AF. Please contact your Talent Acquisition Partner and/or People Business Partner, if you have any queries relating to this Notice, or the processing of your personal data.

4. Legal grounds for processing your personal data

‘Personal data’ is defined under the UK GDPR as any information relating to an identified or identifiable natural person. An identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person. We process your personal data in order to manage your interest in a role or contract with us. We process your personal data only where lawful to do so. The UK GDPR requires us to have a lawful reason to process your personal data, referred to as a ‘lawful basis’ and they include:

(a) Contractual necessity: processing your personal data to take steps before entering into a contract with you

(b) Legal obligation: to check your eligibility to work in the UK and comply with other regulatory requirements

(c) Legitimate interests: to assess your skills, qualifications, and suitability for roles at Triple Point, and to maintain efficient recruitment processes

(d) Consent: where you provide special category data (e.g. diversity monitoring information) or agree to us retaining your data for longer periods. You can withdraw your consent at any time

(e) Recognised legitimate interests: this may allow us to process your personal data in certain pre-defined circumstances set out in the Data Protection Legislation (for example, we are able to process your personal data where the processing is necessary for the purposes of safeguarding a vulnerable individual)

We will not share or use your data for marketing purposes without your consent.

5. What personal data do we process?

We collect personal data that you provide to us, e.g. as part of the recruitment process or to progress your interest in a position with us. This data is available to, and may be processed by, the Triple Point People team. Some of this information will also be made available to our hiring
managers. Third party providers may also collect or receive personal data (e.g. for vetting purposes) conducted on our behalf.

We collect personal data as outlined in this Notice to confirm your identity, employment/engagement history and relevant qualifications with respect to a role, to comply with the law, and for our legitimate interests to be able to assess and manage our risk.

If you choose not to provide information that we reasonably require, we may be unable to progress your application, complete pre-employment/engagement checks, or make/maintain an offer of employment/engagement. Where a particular check is required by law, regulation, a client requirement or our internal risk management, we will explain what information is needed and why. If we cannot complete that check, we may decide not to proceed with your application. Any optional information you choose not to provide (for example, equality, diversity and inclusion information) will not affect the outcome of your application.

During the recruitment/engagement process we may collect the following (non-exhaustive) categories of personal data:

Type	Examples of personal data processed
Identification and contact information	Name, title, address, email, telephone number, date of birth, right-to-work documentation, national insurance, and proof of identity.
Application materials	CV, cover letter, employment history, prior experience, education, skills, competencies, qualifications, professional memberships, and references.
Employment/engagement records	Location of employment, job titles, work history, training records etc.
Assessment and interview data	Notes from interviews, responses to questions or queries, a record of your progress through our hiring process, test or assessment results, background check results (if applicable).
Diversity and equal opportunities data	Information you voluntarily provide at any stage of the process about gender, ethnicity, health, or disability status. Collection of this information is optional and will not affect your application.
Correspondence and other information	Correspondence and any personal data you choose to provide to us in connection with your application, in correspondence or otherwise.
Third party information	Information we receive about you from third parties in connection with your application such as vetting & screening partners, referees, educational institutions, publicly available sources etc.
Compensation data	Current and desired compensation data.

As a business that conducts regulated activities, thorough vetting is important to us. We have set out in detail below the personal data that is collected in connection with our vetting.

6. Vetting

Providing certain personal data is necessary for us to progress your application and to carry out appropriate vetting. Depending on the nature of the role, the vetting checks we perform may include:

(a) A right to work in the United Kingdom check, which includes documents to prove identity or address, and your immigration status

(b) Verification of identity, which includes your personal details such as your name (current and former), date and place of birth, gender or sex, address history, contact information, nationality, photograph, documents to prove identity or address, government-issued identity numbers

(c) A credit reference check, which may include an Adverse Financial Check. For roles with financial or regulatory responsibilities, we may conduct proportionate credit checks. Financial history checks may include credit reports, bankruptcy, court records, tax information, salary and income, real estate ownership, shareholding, financial sanctions. We will conduct credit reference checks with Credit Reference Agencies (“CRAs”) in any country where you have resided for a period of six months or more within the last five years. To do this, we will supply your personal data to CRAs, and they will give us information about you. This will include information from your credit applications and about your financial situation and financial history. CRAs will supply us with both public (including the electoral register) and shared credit information, financial situation, history and fraud prevention information. We may use this information to: (i) prevent criminal activity, i.e. fraud; and (ii) manage your employment, engagement and/or assignment. If you are appointed, further screening/monitoring may occur subject to our Employee Privacy Notice

(d) Criminal conviction check – we may also collect information about criminal convictions to meet our legal obligations in respect of your employment or engagement with us. We may collect information about criminal convictions in any country where you have resided for a period of six months or more within the last five years, where we are legally able to do so. We undertake Basic DBS vetting for non-Certified employees and Standard DBS vetting on our Certified employees, which details spent and unspent convictions, cautions, reprimands and final warnings held on police records. You will receive a copy of the disclosure information we receive

(e) A conduct check, which may include a Criminal Records Check, court, and police records, including barred, and watch lists

(f) Media coverage checks, including social media, politically exposed persons, press articles, press releases, internet activity (e.g. blogs, forums etc. used to express opinions) are conducted for Certified employees. Note that we do not intentionally collect special category data when conducting this check

(g) Professional credentials, designations, licenses, memberships, associations, awards, sanctions or reprimands

(h) Education history, including institution’s name, period, status, location, performance, exam results, qualifications awarded, disciplinary or sanctions, supervisor, conduct, opinions about you

(i) Employment/occupational history check (including volunteering) and self-employment history, including employer’s name, period, job title, status, location, duties, performance, compensation, disciplinary or sanctions, supervisor, conduct, reason for leaving, opinions about you. Note that for Certified individuals, this will include a 6-year employment history check with regulated FCA references

(j) Investigative directorship searches are conducted for Certified individuals

(k) Gap history, including activities you have undertaken, period, documents to prove these, character referees, opinions about you

(l) Regulatory references obtained from prior employers pursuant to the Financial Conduct Authority (FCA) Senior Manager and Certification Regime (SM&CR)

(m) Conflict of interest checks

7. Where we collect your personal data from

We may obtain your personal data from a range of sources, which may relate to any roles you
apply for:

(a) Directly (via our Applicant Tracking System (ATS), email, or in person)

(b) Recruitment agencies or referrers

(c) Previous employers including companies associated with Triple Point or sources from whom you have asked us to obtain information

(d) Publicly available sources such as LinkedIn or professional networking sites

(e) Referees and background check providers

(f) Recruitment tools and platforms in addition to the ATS that are used in our hiring process

(g) Academic institutions and professional bodies (e.g. The Law Society)

8. How we use your information

We will only use your information where we have lawful basis to do so under Data Protection Legislation (see section 4). We use your data to:

(a) Process and manage your application/engagement

(b) Communicate with you during the recruitment/engagement process

(c) Assess your suitability for employment/engagement and make hiring decisions

(d) Comply with regulatory requirements

(e) Conduct verification, vetting and background checks as described in section 6 above

(f) Maintain our records

9. How we make decisions about you

Your personal data is not subject to automated decision-making, including profiling and we do not make recruitment decisions based solely on automated processing. If this changes, we will inform you and provide additional information.

10. Sharing your data

Your personal data may be shared with:

(a) Internal Triple Point staff involved in the recruitment process

(b) Triple Point Group Companies

(c) Third-party service providers (e.g. Applicant Tracking System, background screening providers, video screening tools, IT service providers (including Microsoft and third party voice and video tools such as Microsoft Teams and Zoom), recruitment agencies/partners and psychometric providers) acting under our instructions

(d) Regulators, law enforcement, or government bodies where required by law

(e) Referees and other professional contacts you nominate

We require all third parties to respect the security of your data and to process it in accordance with applicable law.

11. International transfers

In some cases, your personal data may be transferred outside the UK/EEA. Where this happens, we will ensure appropriate transfer safeguards (such as standard contractual clauses) are in place in line with Data Protection Legislation. We will not share your personal
data with a third-party organisation without a valid business reason, a contract or Data Sharing Agreement in place, or without your consent.

Where we need to process your personal data outside of the UK/EEA (e.g. to carry out our contract with you, to fulfil a legal or regulatory obligation, to protect the public interest and/or for our legitimate interests) we will ensure that this is done in accordance with applicable law and the Data Protection Legislation.

12. How we protect your personal data

We are committed to implementing technical and organisational measures that meet the requirements of the Data Protection Legislation and the appropriate level of security.

We use a range of measures to keep your information safe and secure which may include encryption and other forms of security. We require our personnel to comply with written confidentiality obligations and to process personal data in line with applicable data governance policies and procedures. Third parties with whom we contract for services may only process your personal data on our instructions, and they are subject to written confidentiality obligations.

We require third parties (including Triple Point entities) working on our behalf to process and transfer any personal data made available to them securely and in accordance with Data Protection Legislation.

We have security measures in place to prevent your personal data from being accidentally lost, used or accessed in an unauthorised way, or inappropriately altered or disclosed. In addition, we limit access to your personal data to those who need to process that information for
business reasons. We have put in place procedures to deal with any suspected information security breach and will notify you and any applicable regulator of a suspected breach as appropriate and in accordance with our legal obligations.

13. How long will we keep your personal data?

We retain your personal data for as long as reasonably necessary having regard to the purpose(s) for which we collected it, including in connection with our statutory and regulatory obligations.

If you are appointed, relevant data (including personal data) will form part of our records (e.g. your personnel file) and will be processed under our Employee Privacy Notice. Subject to any regulatory or legal requirements, if your application/interest is unsuccessful, we
will retain your personal data for 12 months after the recruitment process ends, unless you request deletion sooner or request that we hold your information for longer.

We may need to retain your information for a longer period where we need the information to comply with regulatory or legal requirements (such as regulations under SMCR in which we would retain for the period requirement), or where we may need it for our legitimate purposes, e.g. to help us respond to queries or complaints, fighting fraud and financial crime, responding to requests from regulators, etc.

Data Protection Legislation gives you a number of rights regarding the personal data we hold about you:

14. Your rights

Data Protection Legislation gives you a number of rights regarding the personal data we hold about you:

(a) The right to be informed. This relates to our obligation to provide fair processing information to individuals whose personal data we are processing

(b) The right of access to the information we hold about you, and to obtain information about how we process it

(c) The right to rectification allows you to request that we rectify your information if is inaccurate or incomplete

(d) The right to erasure allows you to request the deletion or removal of your personal data where there is no compelling reason for its continued processing. We may continue to process your information if we have another legitimate reason or legal obligation for doing so

(e) The right to restrict processing allows you to ‘block’ or suppress processing of personal data in certain circumstances

(f) The right to data portability – in some circumstances, the right to receive certain information you have provided to us in an electronic format and/or request that we transmit it to a third party

(g) The right to object to, and to request that we restrict, our processing of your information in some circumstances