Job Application Privacy Notice

KDDI Europe Limited ("KDDI") is committed to protecting the privacy and security of the personal information of its job applicants.

This privacy notice describes how your personal data will be collected and used during the recruitment and selection process, in accordance with the United Kingdom’s enactment of the General Data Protection Regulation "GDPR" as may be amended or updated from time to time. KDDI will refer to the United Kingdom’s enactment as the "GDPR" in this policy.

It applies to all Job Applicants.

For the purposes of the GDPR, KDDI is a "data controller". This means that we are responsible for deciding how we hold and use personal data about you and ensuring that such use is in compliance with the GDPR. We are required under the GDPR to notify you of the information contained in this privacy notice. Further, the recruitment agency we receive your CV from is also a data controller.

This means that we, and the recruitment agencies, are responsible for deciding how to hold and use personal data about you and ensuring that such use is in compliance with the GDPR. We are required under the GDPR to notify you of the information contained in this privacy notice.

This notice applies to job applicants. This notice does not form part of any contract of employment or other contract to provide services. KDDI may update this notice at any time.

It is important that you read this notice, together with any other privacy notice KDDI may provide on specific occasions when we are collecting or processing personal data about you, so that you are aware of how and why KDDI are using such information.

KDDI will comply with data protection law. The law under the GDPR states that the personal data we hold about you must be:

• Used lawfully, fairly and in a transparent way.
• Collected only for valid purposes that we have clearly explained to you and not used in any way that is incompatible with those purposes.
• Relevant to the purposes we have told you about and limited only to those purposes.
• Accurate and kept up to date.
• Kept only as long as necessary for the purposes we have told you about.
• Kept securely.

Personal data means any information relating to an identified or identifiable living individual. It does not include data where the identity of the individual has been removed (anonymous data).

There are “special categories” of sensitive personal data which require a higher level of protection.

KDDI may collect, store, and use the following categories of personal data about you in relation to the recruitment and selection process:

• Personal contact details such as name, title, addresses, telephone numbers, and personal email addresses.
• Date of birth.
• Gender.
• Nationality.
• Education and qualification details
• Recruitment information (including copies of right to work documentation, references and other information included in a CV or cover letter or as part of the application process).
• Employment records (including job titles, work history, working hours, training records, professional memberships and a copy of your employment contract).
• Professional contact details.
• Passport details.
• Reference from former employers/educational establishments (once the job offer has been made to you). This may include performance and conduct information, absences, disciplinary and grievance information, last salary and any other related information provided by your former employer or educational establishment.
• CCTV footage and other electronic data obtained, such as security card records.
• Personal data that we collect through your use of our website (including email) such as your full name, email address and the content, date and time of your email correspondence.
• Photographs.
• Notes from face to face and phone interviews
• Current salary and benefit information

It may also be necessary to collect, store and use the following “special categories” of sensitive personal data:

• Information about your race or ethnicity, religious beliefs, sexual orientation and political opinions.
• Information about your health, including any medical condition or disability, so we can make reasonable adjustments for candidates who have a disability.
• Information about criminal convictions and offences (only relevant to certain secondments and will be required at the final interview stage).

Personal data about Job Applicants may be collected through the application and recruitment process, either directly from Job Applicants (speculative applications or queries received via the KDDI Europe website) or from an employment agency or background check provider. We may sometimes collect additional information from third parties including former employers, educational establishments, credit reference agencies or other background check agencies, clients, immigration services providers, insurance providers, medical services providers and HMRC.

The personal data about Job Applicants will only be processed when the GDPR allows this to occur. Most commonly, Job Applicants personal data will be used in the following circumstances:

• Where it is needed to comply with a legal obligation.
• Where it is necessary for the legitimate interests of KDDI (or those of a third party, including the client to whom your CV may be sent and who may interview you) and your interests and fundamental rights do not override those interests.

Job Applicants personal data may also be used in the following situations, which are likely to be rare:

• To protect the Job Applicant’s interests (or someone else's interests). For example, in the event of having to provide sensitive personal data in the event of illness or injury where a Job Applicant is unable to provide that information themselves.
• Where it is needed in the public interest or for official purposes.

All the categories of data in the list above are primarily needed to allow KDDI and/or the Client to whom your CV may be submitted to enable KDDI and/or the client to comply with legal obligations [*].

In some cases KDDI and/or the client to whom your CV may be submitted may use your personal data to pursue legitimate interests of our own or those of third parties [**], provided your interests and fundamental rights do not override those interests. The situations in which Job Applicant personal data will be processed in relation to recruitment process are listed below. KDDI have indicated by asterisks the purpose or purposes for which processing has or will take place in relation to Job Applicant personal data, as well as indicating which categories of data are involved.

• Manage recruitment process and assess job applicant’s suitability (including the job offer)**
• Checking you are legally entitled to work in the UK.*
• Business management and planning, including accounting and auditing.**
• Dealing with legal disputes involving job applicant (including accidents/incidents occurring during interviews with KDDI or the client).*
• Complying with health and safety obligations.*
• Equal opportunities monitoring. **

Some of the above grounds for processing will overlap and there may be several grounds which justify our use of your personal information.

If you fail to provide certain information when requested, KDDI may not be able to assess your suitability for vacancies you applied for.

KDDI and/or the client to whom your CV may be submitted could be prevented from complying with the legal obligations owed to you (such as to ensure the health and safety of visitors). Depending upon the particular failure, KDDI might not be able to employ/engage you.

If you do not agree to our processing of your data in the manner outlined in this privacy notice, please do not submit any personal data to KDDI Europe directly or via an employment agency.

Job Applicant personal data will only be used for the purposes for which it is collected, unless it is reasonably considered that KDDI and/or the client who received your CV, or conducted an interview with you, need to use the data for another reason and that reason is compatible with the original purpose. If your personal data is needed for an unrelated purpose, KDDI and/or the client will notify you and will explain the legal basis which allows us to do so.

Please note that KDDI and/or the client may process your personal data without your knowledge or consent, in compliance with the above rules, where this is required or permitted by law.

“Special categories” of sensitive personal data (“Sensitive Personal Data”) require higher levels of protection. We need to have further justification for collecting, storing and using Sensitive Personal Data. KDDI have in place an appropriate policy document and safeguards which we are required by law to maintain when processing Sensitive Personal Data. Clients with whom you may interview, as data controllers, are also obliged to comply with these requirements in relation to any such processing of that data.

Job Applicant Sensitive Personal Data may be processed in the following circumstances:

• In limited circumstances, with your explicit written consent.
• Where it is needed to carry out our legal obligations or exercise rights in connection with your engagement (including in relation to providing the same to any client with whom you may interview where it is necessary for the client to have that information for the purposes of a lawful reason under the GDPR for processing your data).
• Where it is needed in the public interest, such as for equal opportunities monitoring.

Less commonly, sensitive personal data may be processed where it is needed in relation to legal claims or where it is needed to protect your interests (or someone else's interests, including that of any client to which you are sent on secondment) and you are not capable of giving your consent, or where you have already made the information public.

Processing of such data about Job Applicants or former Job Applicants may also be undertaken in the course of legitimate business activities with the appropriate safeguards.

KDDI and/or the client with whom you may interview could use your sensitive personal data in the following ways:

• using information about your physical or mental health, or disability status, to ensure your health and safety (make reasonable adjustments at the interview) with KDDI and/or the client.
• using information about your race or national or ethnic origin, religious, philosophical or moral beliefs, or your sexual life or sexual orientation, to ensure meaningful equal opportunity monitoring and reporting.
• using information provided from pre-employment screening which may include criminal record checks and credit checks, to assess whether you are suitable to perform certain jobs given the contractual obligations which KDDI owes to third parties, such as clients to whom you may be seconded if your application was successful (and it may be necessary for confirmation in relation to such records to be provided to those clients in order that any necessary legal obligations are complied with).
• using evidence relating to your national origin to determine whether you are entitled to enter and work in the United Kingdom.

Your consent is not needed if KDDI or the client with whom you may interview use your Sensitive Personal Data in accordance with their respective Data Protection Policy to carry out legal obligations or exercise specific rights in the field of employment law. In limited circumstances, you may be approached for your written consent to allow the processing of your Sensitive Personal Data. If so, you will be provided with full details of the information that is needed and the reason it is needed, so that you can carefully consider whether you wish to consent. You should be aware that that you do not need to agree to any request for consent from us; where consent is not provided, the consequences of failing to supply consent (if any) will be made clear to you.

KDDI and/or any client with whom you interviewed, and you were confirmed to be a suitable Job Applicant, may only use Sensitive Personal Data relating to criminal convictions where the law allows it. This will usually be where such processing is necessary to carry out our obligations and provided it is done so in line with the Data Protection Policy and Data Retention, Archiving and Deletion Policy of KDDI or the client to whom, following the successful interview, you may be seconded (as appropriate).

Less commonly, Sensitive Personal Data of a Job Applicant relating to criminal convictions may be used where it is necessary in relation to legal claims, where it is necessary to protect the Job Applicant’s interests (or someone else's interests, including any client to whom the successful Job Applicant may be seconded) and the Job Applicant is not capable of giving consent, or where the Job Applicant has already made the information public.

KDDI envisages that it will hold Sensitive Personal Data about criminal convictions

KDDI will only collect Sensitive Personal Data about criminal convictions if it is appropriate given the nature of the role which you are required to perform for a client, if you are successful, and where we are legally able to do so. Where appropriate, we will collect Sensitive Personal Data about criminal convictions as part of the recruitment process (after the final interview stage) or KDDI may be notified of such information directly by you, or by the police or other authorities, in the course of you interviewing with us. KDDI will use Sensitive Personal Data about criminal convictions and offences to determine whether you are able to perform the role for which you are to be recruited given the contractual obligations which KDDI owe to third parties, including the client to whom you may be seconded. You will be specifically notified by the client to whom you may be sent on secondment if they require sensitive personal data relating to your criminal convictions.

KDDI are allowed to use your personal data in this way to carry out our obligations owed to clients (in respect of not having KDDI staff working at customer premises where those staff have criminal convictions). KDDI have in place an appropriate policy (the Data Retention, Archiving and Deletion Policy) and safeguards which we are required by law to maintain when processing such data. This will also apply in the case of a client to whom you may be sent on secondment given that they will be data controllers and bound to comply with the GDPR as such.

KDDI may have to share your data internally for the purpose of the recruitment and selection process (this includes HR team members and recruiting managers) and with clients to whom your CV may be submitted.

KDDI will require such clients to respect the security of your data and to treat it in accordance with the law.

KDDI may transfer your personal data outside the EU where necessary for the purposes of your engagement (this only relates to Job Applicants who apply for Senior Management roles with Global Grading 5 and above (Director, Executive Vice President, Senior Director, Area Block CEO and Managing Director)), monitoring and management. If KDDI do, you can expect a similar degree of protection in respect of your personal information.

KDDI will share your personal data with third parties where required by law, where it is necessary to administer the interview process that you may have with the client or where we have another legitimate interest in doing so.

All our clients are data controllers in their own right, and they are themselves required to comply with the GDPR and take appropriate security measures to protect personal data. Further, KDDI has in place a contract by which the client to whom your CV may be submitted, confirms to KDDI that the client is required to comply with the GDPR. All of your rights under the GDPR in relation to any client with whom you may interview should therefore be preserved.

KDDI have put in place measures to protect the security of your information. Details of these measures are available on the intranet in the KDDI UK Data Protection Policy.

Clients with whom you may interview will only process your personal data in accordance with their legal obligations as data controllers under the GDPR. Any client with whom you interview and who processes your personal data will be bound by the provisions of the GDPR (as they will be contractually bound to KDDI to comply with the GDPR).

Since any client to whom your CV may be submitted will be bound to comply with the GDPR, such clients are bound to have in place appropriate security measures to prevent your personal data which they may need in in relation to recruitment and selection process pursuant to the agreement between both parties from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. They will also be required to limit access of your personal data to those employees, agents, contractors and other third parties who have a business need to know.

Any client to whom your CV may be submitted, who is required to comply with the GDPR, will have in place procedures to deal with any suspected data security breach and will notify you and any applicable regulator of a suspected breach where we are legally required to do so.

KDDI will hold you data on file for six months from the date your application of employment was unsuccessful (this includes speculative CVs). KDDI’s clients with whom you may interview, who are bound by the GDPR, may only retain your personal data for as long as necessary to fulfil the purpose for which the data was collected in relation to your interview.

At the end of this period your data is deleted (e.g. soft copies of your CV) or destroyed (hard copies of your CV, copy of your passport and visa, interview notes) unless we need to retain it for loner in order to exercise or defend any claims.

In case of successful Job Applicants, personal and sensitive personal data obtained during the recruitment and selection process will form a part of your personal file and will be retained for the duration of your employment and six years after your employment ceases unless stated otherwise in KDDI’s Data Retention, Archiving and Deletion Policy.

It is important that the personal data that KDDI and clients of KDDI with whom you may interview hold about you is accurate and current. Please keep KDDI and the client informed if your personal data changes during the recruitment and selection process.

Under certain circumstances, by law you have the right to:

• Request access - to your personal data (commonly known as a data subject access request (“DSAR”)). A DSAR enables you to receive a copy of the personal data KDDI and the client hold about you and to check that we are lawfully processing it.
• Request correction - of the personal data that held about you. This enables you to have any incomplete or inaccurate information KDDI and the client to whom you CV was submitted or you interviewed with holds about you corrected
• Request erasure - of your personal data in certain circumstances. This enables you to ask KDDI and the client to whom your CV was submitted or you interviewed with to delete or remove personal data where there is no good reason for continuing to process it. You also have the right to ask KDDI or the client to whom your CV was submitted or you interviewed with to delete or remove your personal data where you have exercised your right to object to processing (see below). Please note that there may be circumstances where you ask KDDI or the client to erase your personal data but KDDI or the client with whom you interviewed are legally entitled to retain it.
• Object to processing - of your personal data in certain circumstances. You would also have the right to object if KDDI or the client to whom your CV was submitted to or you interviewed with were processing your personal data for direct marketing purposes. Again, there may be circumstances where you object to KDDI or the client processing your personal data but it is legally entitled to continue processing your personal data and/or to refuse that request.
• Request the restriction of processing - of your personal data in certain circumstances. This enables you to ask KDDI or the client to whom your CV was submitted to or you interviewed with to suspend the processing of personal data about you, for example if you want KDDI or the client to establish its accuracy or the reason for processing it. There may be circumstances where you ask KDDI or the client to restrict our processing of your personal data but it is legally entitled to continue processing your personal data and/or to refuse that request.
• Request the transfer - of your personal data to another party.
• Right to withdraw consent - In the limited circumstances where you may have provided your consent to the collection, processing and transfer of your personal data for a specific purpose, you have the right to withdraw your consent for that specific processing at any time. To withdraw your consent, please refer to the KDDI Privacy Policy or the client Privacy Policy with whom you interviewed. Once KDDI or the client has received notification that you have withdrawn your consent, we are required to no longer process your data for the purpose or purposes you originally agreed to, unless we/they have another legitimate basis (other than consent) for doing so in law.

If you have any questions about this privacy notice, please contact KDDI’s Business Process Director (GDPR@eu.kddi.com ). You have the right to make a complaint at any time to the Information Commissioner's Office (ICO), the UK supervisory authority for data protection issues.

KDDI reserve the right to update this Job Applicant Privacy Notice at any time, and KDDI will provide you with a new Job Applicant Privacy Notice when we make any substantial updates. KDDI may also notify you in other ways from time to time about the processing of your personal information. If you have any questions about this Job Applicant Privacy Notice, please contact the Business Process Director (GDPR@eu.kddi.com ).