Candidate Privacy Notice

About Tractable 

Tractable Ltd or its group companies (referred to as “Tractable” “we”, “us”, “our”) collects personal data to find and hire people who are a good fit for our company. You can reach us at Tractable Ltd, 5th Floor, Broadwalk House, 5 Appold Street, London, EC2A 2DA. 

About this notice 

The purpose of this notice is to provide you with information regarding the types of personal data and special categories of personal data that we hold and process about you and why when you apply for a role with us. We also aim to satisfy the obligation of transparency under the EU General Data Protection Regulation 2016/679 ("GDPR") and national laws implementing GDPR. For those candidates who are residents of California, the "Additional CCPA Disclosures" are annexed to this document.


What do ‘personal data’ and ‘special categories of personal data’ mean? 

“Personal data” under includes information relating to a living person, who can be identified directly or indirectly by such information (e.g. name, ID number, location data, an online identifier, one or more factors specific to the physical, physiological, genetic, mental, economic or social identity of that person). 

“Special categories of personal data” under the relates to personal information about you of a more private nature and means genetic data, biometric data, data concerning a person’s sex life or orientation, racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership and health.


Legal basis for processing 

In many of the countries where we operate, data protection law requires us to process personal data where we have an approved basis under the law. You have the right to understand what our legal bases are, so we explain them here. We use the following bases, depending on the activity we undertake:


Meeting our legitimate interests 

Like all companies, we have a legitimate interest in finding, choosing and hiring employees. 

When we use personal data as necessary to meet our legitimate business interests, we make sure we understand and work to minimise its privacy impact. For example, we limit the data to what is necessary, control access to the data, and where we can, aggregate or de-identify the data. 


What is legitimate interest? 

Under GDPR Article 6(1)(f), companies have the ability to engage in activities without consent under a balancing test. Do we have a legitimate interest in engaging in the activity that is not outweighed by the interests or fundamental rights and freedoms of the data subject? 


Performing a contract 

In some cases, the data we collect and the things we use it for are necessary for us to execute an agreement with you. 


Complying with law 

Some of the activities we undertake are necessary to comply with our legal and other obligations as your employer. For example, we may process personal data and special categories of personal data to: 

  • Report on our gender pay gap in countries where it is required

  • Comply with equal opportunity laws that apply to us in some countries 

  • Conduct background checks

How does Tractable use personal data for recruitment?

  • To find people who might be a good fit for our company: we collect applications online and from referrals, and we use recruitment agencies, specialist websites and tools, and public websites where people might share career information.
  • To assess candidates and evaluate results: we set up interviews and assess candidates for whether they meet the role requirements. We may talk to personal references and administer tasks or other tests to evaluate skills.
  • To sponsor visas and manage rights to work: We use personal data to sponsor visas and take other steps needed to make sure our international workforce has the right to work.
  • To analyse the diversity of our workplace: We monitor how we’re doing on diversity and inclusion, in some cases - like gender pay gap or equal opportunity requirements - because it’s required by law but mostly because it’s the right thing to do. We make sure to collect only the information we’re allowed to collect by law. We ask for some data about you that you can choose to willingly share, like gender identity, race, sexuality and disability. We anonymise this data so it isn’t linked to you. 


What personal data does Tractable use? 

The information we collect for our recruitment programmes may come directly from you (for example, when you fill out an application, send your CV/resume or complete a form). We may also collect it from recruitment agencies and platforms or from public sources like LinkedIn. The personal data we collect and use about candidates falls into the following categories: 

  • Contact information: first name, last name, personal email, home address, phone number, previous addresses, emergency contact information;

  • Recruitment information: References, job application form, salary/wage expectations, interview notes, feedback, previous work history and other information from a CV or resume; 

  • Background check results, including criminal history (subject to applicable law), sanctions watchlist results and legal proceedings history; 

  • Education & skills: degrees, training records, languages spoken, qualifications and certifications, professional membership;

  • Financial information: sort code, bank account numbers;  

  • Government identifiers: driving licence number, national identification number, passport number.

How does Tractable share and transfer recruitment data?

  • Tractable shares your data with service providers and other third parties who support our recruitment and payroll processes. 

  • Personal data may be shared with government authorities or law enforcement officials if required for the operation of our business, if mandated by law or if required for the protection of our legitimate interests in compliance with applicable laws. 

  • In the event that the business is sold or integrated with another business, your details will be disclosed to our advisers and any prospective purchaser’s adviser and will be passed to the new owners of the business. 

  • We may process personal data in one of our locations depending on where you are based: Japan, Thailand, Germany, France, Italy, Spain, Poland, Romania, Canada, Australia and Brazil and in our headquarters in the United Kingdom. It may also be processed on the servers of our service providers in other countries, who commit to processing it to UK and EU-level standards using approved transfer mechanisms.


How long will Tractable keep my data? 

So that we can keep accurate records, administer our business and meet legal reporting obligations, your personal data is stored for 18 months after a recruitment decision. If you become a Tractable employee, your personal data will be treated as employee data, and the privacy notice applicable to employee data will be communicated to you when you join.


Your rights and choices 

You may have rights under privacy and data protection law. Depending on where you live, these include the right to ask Tractable for a copy of your personal data, to correct, delete or restrict processing of it, and to obtain personal data in a format you can share with a new provider. You may have the right to object to processing. 

These rights may be limited in some situations – for example, where we can demonstrate that we have a legal requirement to process your data. You can contact our recruitment team to ask a question about our privacy practices or exercise your rights. If you have unresolved concerns, you have the right to complain to a data protection authority or other regulator where you live or work, or where you believe a breach may have occurred.

Please contact dpo@tractable.ai to ask a question or exercise your rights or choices about privacy practices. 

If we can’t resolve your concerns, you may have the right to complain to a data

protection authority or other regulator where you live or work, or where you believe a breach may have occurred. 


Additional CCPA Disclosures

Under the California Consumer Privacy Act ("CCPA"), if you are a resident of California, we are required to provide you with additional information about how we collect, use, and disclose personal information.

For purposes of this notice, the term "Personal Information" has the meaning given in the California Consumer Privacy Act of 2018 (the "CCPA") but excludes information exempted from the CCPA's scope. Please note that the terms of personal information and personal data are interchangeable for the purposes of this notice. 

The categories and sources of the Personal Information we collect are described above in “What personal data does Tractable use?” 

The purposes for which we use Personal Information are described under “How does Tractable use personal data for recruitment?” of this notice. 

The categories of third parties with whom we share personal information are described under “How does Tractable share and transfer recruitment data?” of this Notice. 

Your data rights 

You have the right to request that Tractable disclose certain information to you about our collection and use of your personal information over the past 12 months. Once we receive and confirm your verifiable request, we shall provide to you all the information we are required to provide.

You have the right to request that Tractable delete any of your personal information that we have collected from you, subject to certain exceptions e.g required by law to retain a copy.

The specific pieces of personal information we have collected about you can be requested at dpo@tractable.ai.