Privacy Notice

Regarding the processing of personal data of candidates for employment

 

This privacy notice applies to all the entities listed in Annex (hereinafter referred to as “YellowTree”,  “Us“, “We” or a similar ) is a company registered in the United Kingdom. We collect and process several categories of Personal Data from our candidates and potential trainees (hereinafter “You”) which, in accordance with UK and European Union data protection legislation, qualifies Us as the controller of this data.

This notification describes our policies and practices regarding collection and use of Your Personal Data when You apply for a position with Us, and describes your rights. More specifically, You will find below:

•        What data We collect about You;

•        How We use and how We generally process these data;

•        The grounds for our data processing;

•        To whom We communicate the data;

•        Data storage method.

 

Please carefully read this notification to understand how We process Your personal data.

 

1. HOW WE COLLECT AND USE (PROCESS) YOUR PERSONAL DATA

   1. At YellowTree, We collect and use the following data about You, and hereinafter We will refer to these as “Personal Data”.

      1. CV/biography information: information included in Your application and CV/biography or information otherwise provided to Us by You in this context, such as: full name, address, email address, phone number, previous employers, professional qualifications, referrals, professional development and skills appraisals, training, departmental changes, performance reviews.

We will use this data to act (at Your request) before signing the employment contract, such as contacting You for interviews.

1. Results of background and eligibility checks, such as corporate holdings database checks, possible personal bankruptcy checks, media and social media source checks, and public litigation information checks.

We use the above data in our legitimate interest to assess the candidate’s suitability, as well as to confirm information from CVs, biographies and cover letters, as well as to obtain letters of recommendation and to carry out background checks. We also have an interest in ensuring the good reputation of our future employees, so We may check a candidate’s image in the press and on social media to determine the tone and direction of public social media posts (for example, We do not tolerate hate speech, discrimination and racism), as well as to determine if a candidate is involved in any litigation that may harm our reputation or to determine if a candidate is involved in any competing business, etc. We do not process sensitive or special category data (such as health data) during these checks, but We may unintentionally find out information about criminal convictions if this information is public (such as listed on a court portal).

1. We may conduct tests and collect personality profiling information through dedicated employee and specialist consultants bound by confidentiality obligations. We do not use this data to automatically make decisions about You; any decision regarding your employment with YellowTree is made by our employees.

2. Images related to the video surveillance system within our premises - We use this data to carry out security checks, in our legitimate interest to ensure the security of the places, property and people on our premises.

3. Source of Personal Data.

Some of the processed Personal Data is provided directly by You, and other information is obtained indirectly from third parties, such as recruitment agencies and public sources (e.g. LinkedIn, Trade Register, court portal).

 

1. TO WHOM WE DISCLOSE PERSONAL DATA

   1. Sharing of data within YellowTree

Your Personal Data may be shared with any other company that is a member of our group if We consider this to be in our legitimate interest for internal administrative purposes (e.g. data storage, CRM) or for auditing and monitoring of our internal processes.

We may also share your Personal Data with companies in our group if they provide Us with products and services, such as IT systems, HR and employee monitoring services.

The access to your Personal Data is limited and permitted only to those employees who need to know that information for professional purposes, who may include your superiors and others as appointed by management to perform tasks, as well as employees in the HR, IT, security and financial departments.

1. Disclosure of data to third parties

We will disclose Your Personal Data only to the necessary extent and only to the following categories of third parties:

1. regulatory authorities, accountants, auditors, lawyers or other external experts, where their work requires this information;

2. companies that provide Us with products and services, such as:

   1. Human resources services such as pre-employment screening and employee monitoring services;

   2. Recruitment agencies;

   3. IT system providers and related support service providers, including email archiving, telecommunication service providers, backup and disaster recovery, IT security services and other outsourced service providers.

We may disclose Your Personal Data to third parties in the following situations:

1. Where you request Us or give Us Your consent to do so;

2. To persons who can demonstrate that they have the legal authority to act on Your behalf;

3. Where it is in our legitimate interest to do so in order to administer, expand or develop the business:

   1. in the event of a business transfer (e.g.We are selling part of the business or certain assets) related to the job You are applying for, We may disclose Your details to the potential buyer of those business activities or assets to ensure the business continuity;

   2. in the event that YellowTree (or a substantial part of its assets) is acquired by a third party, in which case Personal Data held by YellowTree will represent one of the transferred assets;

4. where We are required to disclose Your Personal Data to comply with a legal obligation, any legal request from government or executive authorities, and as may become necessary to meet certain national security or law enforcement or to prevent certain illegal activities.

5. to respond to any claims, to protect our rights or those of a third party, to protect the safety of any person, or to prevent any illegal activity; or

6. to protect the rights, property or safety of YellowTree , its employees, its customers, suppliers or other people.

Some of these data recipients (including our affiliates) may use Your data in countries outside the European Economic Area. Please see section 5 below for more details on this topic.

1. Restrictions on the use of Personal Data by the data recipients

Third parties to whom We provide your personal information under paragraphs (a), (b) and (e) above are limited (by law and by contract) in how they can use Your personal information for the specific purposes We had identified. We will always ensure that any third parties to whom We voluntarily disclose your personal information are subject to confidentiality and security obligations in accordance with this disclosure notice and applicable law (for the avoidance of any doubt, this may not apply where disclosure is not our decision, such as the situations mentioned in par. (c), (d), (f), (g) and (h) above.

Except as detailed above, We will never disclose or transfer any of Your Personal Data to any third party without notifying You or, where applicable, without obtaining Your prior consent.

 

1. RETENTION OF PERSONAL DATA

Your Personal Data is kept only as long as necessary to fulfil the purposes for which that information is processed. At the date of this document, Personal Data is kept for the following periods that We consider reasonably necessary:

1. Personal Data of candidates who do not become employees - for 2 years after the end of the recruitment stage;

2. Footage taken from surveillance cameras is kept for 30 days from the date of recording, unless an incident is recorded, in which case footage of those incidents is kept for 5 years. We do this in our legitimate interest to enable us to ascertain, exercise and defend our claims or those of a third party;

The Personal Data of candidates who become employees is held as part of employee data, and are subject to our policy on the processing of employee data.

If you require further information about how long your Personal Data is kept, please contact us (see section 8 below).

 

1. YOUR RIGHTS

   1. Your rights regarding your Personal Data:

      1. You can request access to the Personal Data We have about you. You can also request information about the following: the purpose of the processing; categories of Personal Data processed; who besides YellowTree could have received the data from Us; what was the source of the information (if you did not provide it to us directly); and how long the respective data will be kept.

      2. You have the right to correct (rectify) your data if it is inaccurate.

      3. You may also request the deletion of the data or the termination of the data processing activities, subject to certain exceptions.

      4. You may also request the cessation of data processing, subject to certain exceptions.

      5. You have the right to request Us to transfer the data we process about You, in a structured, commonly used and machine readable format, to you or, where technically feasible, directly to another controller.

      6. If you are not satisfied with the way We process your data or with the response received to a request in relation to Your Personal Data, You have the right to file a complaint with the competent data protection authority. This is the Information Commissioner’s Office (ICO) https://ico.org.uk  .

   2. Additional information requests

      1. If You would like further information about the above rights or if You wish to exercise any of these rights, please contact us (see section 8 below).

      2. We will consider all such requests and will provide You with a response within a reasonable time (no more than one month, which we may extend by a further two months if your request is complex). However, please note that there are exceptions to some of the rights mentioned. If Your request is denied, YellowTree will provide You with an explanation as to why Your request was denied.

      3. If any exception applies, We will notify You of this at the time We respond to your request. Before responding to any request from You, We may ask You for certain information necessary to confirm Your identity.

      4. If You have any further questions or intend to make a complaint, please contact Us (see section 8 below).

 

1. TRANSFER OF PERSONAL DATA OUTSIDE THE UNITED KINGDOM OR EUROPEAN UNION

   1. Personal Data may be processed by our staff operating outside the United Kingdom or European Economic Area (European Union, Iceland, Norway and Liechtenstein), as well as by other agents, members of our group or third parties, for the purposes mentioned in section 1.1. You can find further details about the recipients of your Personal Data at section 2 above.

   2. Where we provide any Personal Data about You to members of our group or proxy outside the United Kingdom or EEA, We will undertake appropriate measures and safeguards to ensure that the recipient adequately protects your personal information in accordance with the provisions of this notification. These measures include:

      1. in the case of US-based service providers, the use of the standard contractual clauses approved by the European Commission or the provider’s adherence to the EU-US Data Privacy Framework (details are available at https://www.dataprivacyframework.gov/ );

      2. in the case of service providers based in other countries outside the EEA, we will use the standard contractual clauses approved by the European Commission or the international data transfer addendum to the EU standard contractual clauses issued by the Information Commissioner.

   3. To request more details about the measures taken to protect Your Personal Data in the cases mentioned above, You can contact Us at any time (see section 8 below).

 

1. PROTECTION OF PERSONAL DATA

   1. YellowTree is committed to protecting personal information against any loss, misuse, disclosure, modification, inaccessible state, unauthorized access and destruction, and takes all reasonable measures to ensure the confidentiality of personal information, including by using appropriate organizational and technical measures. The organizational measures include physical access control to our headquarters, training of staff, and securing paper documents in locked rooms. Technical measures include encryption, password protection for access to our systems and the use of anti-virus software.

   2. When You provide Personal Data to Us, the data transfer may be carried out by Internet. Although We make every effort to protect the Personal Data You provide Us, the exchange of information between Us and You over an Internet connection is not 100% secure. Therefore, We cannot guarantee the security of Your personal information that You transmit to Us over the Internet, and therefore such transmission is at Your own risk. Once We have received your personal information, We will use strict procedures and security methods to prevent unauthorized access to this information.

 

1. CHANGES TO THE NOTIFICATION REGARDING THE PROCESSING OF PERSONAL DATA OF CANDIDATES FOR EMPLOYMENT

This notification may be amended whenever We deem it is necessary. Any changes made to this document will be displayed on the same web page, but will not be notified to you by e-mail.

 

1. ADDITIONAL QUESTIONS OR COMPLAINTS

   1. If You have any further questions or intend to make a complaint about how We collect, use or store your personal information or if You wish to exercise any of the rights You have regarding Your Personal Data, please contact:

YellowTree: compliance@yellowtree.com

1. We will try to resolve any such complaint or request regarding Your rights. If You are not satisfied with the response received, You may also submit a complaint to the Information Commissioner’s Office (ICO). You can find additional information regarding this topic on the web page:

https://ico.org.uk/make-a-complaint

01.01.2026