1. General Information
iiPay is committed to protecting the privacy of the job applicants’ personal data. In accordance with the provisions of the data privacy rules (including Regulation (EU) 2016/678 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC, hereinafter referred as “GDPR””) and other applicable legislation, this statement explains how iiPay processes the personal data that you submit when you apply for a position and we assess your application, and that we process. When processing personal data our policy is to only process personal data that is strictly necessary for assessing your application.
Please note that sections 1, 2, 3, 15 of our iiPay Privacy & Terms apply to this privacy statement as well as to the data processing detailed below.
iiPay acts as a data controller with respect to the information you provide when you apply for a position.
“iiPay”, “we”, and “us” refers to the IiPay member firm that has posted the position for which you are applying.
It is a prerequisite for assessing your application that you read this privacy statement and confirm to us that you have received appropriate and intelligible information about the processing of your personal data.
2. Collecting your personal data
It would be impossible to complete the recruitment process without processing certain personal data about you. We use your personal data to match your skills, experience and education with specific roles offered by iiPay.
In frame of this, you may be asked to provide information about you (including your name, email address, telephone number, address, your academic and professional qualifications and experience, availability, desired compensation etc.). You may choose to provide these directly to iiPay (which using Bamboo) or import information about yourself into iiPay systems from other websites (for example, from LinkedIn, or email address). To the extent the terms of use of other websites (including Bamboo) may require consent to import their data, you agree you will obtain such consent prior to importing any information into iiPay’s systems (irrespective of the requirement we encourage individuals using our recruitment tools and websites to refer to the privacy notices available on those tools and websites). iiPay accepts no liability for the lawfulness of any data import.
One may also choose to provide us with other information, such as a photograph or additional biographical information. We will use and process all personal data provided in the course of the application process in the manner described in this Privacy Statement.
We may also collect information through recruitment agencies for example, when a recruitment agency with your details contacts us to suggest you as a potential candidate. We advise to candidates to refer to the privacy notices available at those agencies.
The provided information is passed to the relevant hiring managers and persons (including iiPay People and Culture team who manage the recruitment processes) involved in the recruitment process to decide whether to invite you for an interview. iiPay will collect further information if you are invited to the interview (or equivalent) stage and onward. Such information includes interview notes, assessment results, feedback and offer details.
iiPay may obtain information about your professional background by contacting the organisations or individuals you have referenced, the organisation or individual referring you, or other third parties, as part of processing your personal data for the purposes set out in this Privacy Statement. To the extent permitted by applicable legislation, iiPay may also collect information about you from publicly available sources (e.g. online databases), in accordance with the principles of purpose limitation and data minimization. In no event will we collect or store information about you that is irrelevant to the assessment of your application.
3. Special categories of personal data include data concerning the following:
Under no circumstances will iiPay ask you to provide special categories of personal data (e.g. political opinion, trade union membership, racial origin, sexual orientation) during the recruitment process.
Nevertheless, if you choose to provide data falling into special categories of personal data, we will only be able to process such data if you explicitly consent to such processing. Accordingly, in such cases please indicate your explicit consent to such processing in a documented manner.
However, during the offer phase or onboarding, we may collect special category data from candidates where we have an employment law obligation or we are permitted (according to the said legislation) to do so. This information is relevant to their future working environment at iiPay or the future provision of employment benefits, or with the individual’s explicit consent, where collecting such information is permitted by law. For example, we may also need to conduct criminal background checks for certain candidates to assess their eligibility to work at iiPay or for clients.
4. Updating and accessing your personal data
Please inform us immediately if there is a change in the personal data that you have previously provided. You can access your data at any time to review or update your personal data.
5. Purpose and legal basis of processing
iiPay and other IiPay member firms with which your personal data is shared in the course of applying for a position may use your personal information for any or all of the following purposes:
- assessing your application(s) for employment, evaluating you for open positions throughout our network, and managing your candidate profile
- evaluating your suitability for employment (including for example providing your personal information to third parties to conduct background checks);
- liaising in connection with your application;
- if no employment is established, notifying you if a position relevant to you subsequently opens at iiPay (provided that you explicitly consent to receiving such notifications, see below).
The legal basis for processing the personal data in the course of submitting your application is iiPay’s legitimate interest in being able to decide on assessing your application and to select the most suitable candidate for the position.
If no employment relationship is established, iiPay may, subject to your explicit consent, continue to process your personal data after the recruitment process has been completed so that we can notify you of other positions that may be relevant to you.
If an employment contract is signed but no relationship is established (as the candidate decides not to join) the data may be stored and processed based on iiPay’s legitimate interest to support possible legal claims.
The legal grounds for processing personal data during the offer phase or onboarding process are:
- the compliance with a legal or regulatory obligation
- our legitimate interest to hire and onboard candidates by making an offer to successful candidates,
- our legitimate interest to hire and onboard candidates by carrying out pre-employment screening checks.
6. Data retention
We will retain your personal data for as long as is considered strictly necessary for the purpose(s) for which it was collected. Data retention periods were determined, on the one hand, with regard to the relevant mandatory retention periods required by law and or the statute of limitations applicable to pursuing legal claims, if any.
If no employment relationship is established between IiPay and you, but you agree to further processing of your personal data for the purposes of receiving notifications about future job offers, we may process the data you provide for up to two years calculated from the date of assessment of your application.
If you have not consented to further processing of your personal data as referred to above, iiPay will, following assessment of your application,
- if no employment relationship is established, immediately we erase your data;
- If an employment contract is signed but no relationship is established (as the candidate decides not to join) the data may be kept by iiPay to support possible legal claims within the statute of limitation.
- if an employment relationship is being established, the data may be processed under the internal employee privacy notice. Copy of criminal records is not retained.
7. When and how we share personal data
We will only share your personal data with third parties if we are legally permitted to do so. When we share personal data with third parties, we put in place appropriate contractual arrangements and other security mechanisms set out in the General Data Protection Regulation to protect personal data. To that end, we also have strict data protection, confidentiality and security standards and policies of our own.
iiPay is part of a global network with member firms around the world. Accordingly, in certain cases it may be necessary to transfer and disclose your personal data provided in the course of your application to other iiPay member firms (including with our entity located in the UK, as some members of our People and Culture team who manage the recruitment reside in the UK).
Your personal data will only be transferred outside the European Economic Area (EEA) to the following recipients and in the following cases:
- recipients in a jurisdiction which, on the basis of an adequacy decision of the European Commission, offers an adequate level of protection for personal data as required by the European Union;
- recipients with whom IiPay has an agreement that covers the EU requirements and safeguards for the transfer of personal data to recipients outside the EEA.
To help provide, run and manage our internal IT systems we use services provided by third parties, who typically act as our data processors. (Such services include, for example: information technology services, including the services of cloud-based software as service providers, identity management, website hosting and management, data analysis, data backup, security, and storage services). Among others, your data may be also shared with our recruitment system called Bamboo. We encourage individuals using our recruitment tools and websites to refer to the privacy notices available on those tools and websites.
In addition to the above, IiPay may, to the extent required by applicable law, also disclose your personal data to law enforcement, regulatory and other government agencies, and to professional bodies and other third parties, as required by and/or in accordance with applicable law or regulation.
8. Changes to this privacy statement
This privacy statement was last updated in January 2025. We may update this privacy statement at any time by publishing an updated version. The new updated or amended privacy statement will apply from that revision date.
9. Your rights
You have certain rights under the General Data Protection Regulation and other applicable legislation in relation to the personal data we process about you.
In this context, you have the right to:
- request a copy of personal data we hold about you;
- ask that we update the personal data we hold about you, or correct such personal data that you think is incorrect or incomplete;
- ask that we delete personal data that we hold about you, or restrict the way in which we process such personal data;
- request a copy of your data in a machine-readable format (e.g. as an email attachment or on a data carrier) or request that it be transferred to a third party (right to data portability);
- withdraw your consent to processing of your personal data (to the extent such processing is based on consent), or object to the processing of your personal data (if such processing is carried out on grounds of a legitimate interest of iiPay or a third party);
- make a complaint, initiate official proceedings, and seek judicial remedy in relation to data processing.
To exercise any of the abovementioned rights, you can contact us by writing to:
Integrated International Payroll Limited
2nd Floor, Festival House
Jessop Avenue
Cheltenham
GL50 3SH
United Kingdom
or sending an email to TheDataController@iiPay.com.
You also have the right to object to the processing of your personal data in accordance with Art. 21 of the GDPR. When you object, iiPay must stop processing your data, unless iiPay can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves to assert, exercise or defend legal claims. Exercising this right will not incur any additional costs. However, this right may only exist if the data processing is based on the legitimate interests of the controller or a third party.
The rights above are not of absolute nature, and they may be limited due to reasons determined in the GDPR.
If the data processing is based on your consent, you have the right to withdraw their consent at any time, free of charge, without giving any reason. The withdrawal of consent will not affect the lawfulness of processing based on consent before its withdrawal.
In accordance with Article 77 of the General Data Protection Regulation, you also have the right to lodge a complaint with a supervisory authority, in particular the Member State of your habitual residence, place of work or of an alleged infringement of the General Data Protection Regulation.
For the purpose of the UK, the supervisory authority is the Information Commissioner’s Office (ICO), the contact details of which are available here: https://ico.org.uk/global/contact-us/.
10. How we secure your information
We take appropriate technical and organisational measures to secure your information and to protect it against unauthorised or unlawful use and accidental loss or destruction, including:
- only sharing and providing access to your information to the minimum extent necessary, subject to confidentiality restrictions where appropriate, and on an anonymised basis wherever possible;
- using secure servers to store your information;
- verifying the identity of any individual who requests access to information prior to granting them access to information;
- using Secure Sockets Layer (SSL) software to encrypt any information you submit to us via any forms on our website; and
- only transferring your information via closed system or encrypted data transfers.