Analysis Group Privacy Notice for EU and UK Job Applicants
(Last updated August 2022)
About this document
Welcome to Analysis Group and thank you for your interest in our organization! Analysis Group is committed to protecting and respecting your privacy. This Privacy Notice for Job Applicants (“Notice”) sets out how personal data of job applicants and individuals attending recruiting events in the European Union and the United Kingdom (“you”, “your”) are collected, used, shared and otherwise processed, and your rights in relation to the personal data we hold.
This privacy notice is not a contract and does not create any legal rights or obligations. This privacy notice also is not intended to replace other notices or disclosures we may provide to you in connection with your role in our organization, which will supersede any conflicting disclosures contained in this privacy notice.
What is personal data?
When we use the term “personal data” in this Notice, we mean information that identifies, relates to, describes, uniquely individualizes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, to an individual. It does not include aggregated or anonymized information that is maintained in a form that is not capable of being associated with or reasonably linked to an individual person.
Controller
For the purposes of UK, EU and member state data protection laws, in particular the General Data Protection Regulation (“GDPR”), and the UK Data Protection Act 2018 (“DPA”), as applicable, the Analysis Group entity that offers a job for which you apply is the controller of your personal data. The terms “Analysis Group,” “we” or “us” in this Notice reference that entity.
The Analysis Group entities located in Europe are:
- Analysis Group Ltd., 1 Angel Court, London EC2R 7HJ, United Kingdom
- Analysis Group srl, Rue Belliard 40, 1040 Brussels, Belgium
- Analysis Group SAS, 35 boulevard des Capucines, 75002 Paris, France
Due to Analysis Group’s ownership and management structures (with HR functions typically based in the United States), Analysis Group, Inc., an American company registered in Massachusetts, acts as joint controller of your personal data and is subject to the GDPR, the DPA, and other member state data protections laws in respect of its processing of personal data relating to EU and UK job applicants. Analysis Group, Inc. is located at 111 Huntington Avenue, Boston, MA 02199, USA.
How we collect your personal data
We most often collect the personal data described below directly from you, for example when you submit personal data in application forms and cover letters or come for an interview. We may also collect certain personal data from previous employers, references, recruiters, and our LinkedIn Recruiter account that enables us to view and contact you as a prospective candidate. In addition, we may also collect personal data through service providers and other third parties that collect it on our behalf, such as communications providers, scheduling providers and application providers (e.g., iCIMS).
When we collect personal data directly from you for the purpose of the application process, you provide the personal data voluntarily. You are not obliged to provide the information to us. The consequences of not providing the personal data are that we may not be able to assess your professional qualifications or otherwise make a fully informed assessment of your ability to fulfil the position for which you have applied.
The types of personal data we collect
We may collect the following types of personal data about you:
- contact information, including name, email address(es), telephone numbers and postal address(es);
- records of communications and interactions we have had with you;
- biographical, educational and social information, including:
- your name, title, gender, nationality, date of birth, and place of birth;
- your government identification numbers;
- information needed to establish your eligibility to work for us, including details of your visa and work permit;
- details of your education, including the schools you attended and when you were in attendance, degrees, licenses, certificates or other educational qualifications you earned, your transcripts or training records, references from your institutions of study and, where applicable, expected graduation date;
- results of background checks and screening as follows:
- for France and Belgium: education verification, information on former jobs and employers, and ID verification;
- for UK: education verification, information on former jobs and employers, ID verification, and, where necessary due to the position for which you have applied, criminal records;
- details of your work history and references from your previous employer(s);
- For UK only: where necessary due to the position for which you have applied, we may ask you whether you have a criminal record and, if applicable, details of criminal convictions and offences;
- to the extent you provide this information to us, we may also process special categories of information (“sensitive personal data”) as follows:
- for France and Belgium: information on disabilities and other health-related information or information you provide in connection with an accommodation request;
- for UK: information on disabilities and other health-related information, information you provide in connection with an accommodation request, or information on your race/ethnicity and religion;
- web-related information, such as technical details about your visit to our online services contained in log files or analytics data relating to your usage and activity on our online services. For more information, please refer to the Website Privacy Statement on the Analysis Group website; and
- any other personal data you chose to share with us in your interview or application, CV, resume, or other supporting documentation.
We may also create and maintain internal records which may contain personal data about you, such as interview evaluation notes.
How we use your personal data
The purposes for which we may use your personal data include:
- providing you with information about Analysis Group and what it is like to work for us (where you have asked for this, which can occur before you have made a formal application to work for us);
- identifying you as a potential candidate and reviewing your application for a position with us;
- verifying the information provided to us in connection with your application or received from other sources;
- determining your eligibility and suitability for the potential position or other opportunities with us, and offering you a job with us;
- facilitating the recruiting and interview process;
- communicating with you about the status of your application or other opportunities with us that may be of interest to you;
- assessing and improving the performance and success of our recruiting and hiring process;
- conducting internal investigations, audits, compliance, risk management, problem resolution and security operations;
- fulfilling contractual obligations to you and other third parties;
- exercising or protecting our rights and property and the rights, property and personal safety of our staff or others; and
- complying with applicable law, rule, regulation, legal proceeding and government investigations, including relating to tax reporting and immigration.
We may process sensitive personal data for the purposes of:
- determining an individual’s suitability to undertake tasks required by a particular job role;
- addressing legal obligations in relation to health and safety in the workplace;
- protecting and defending our rights or property, and/or the rights or property and personal safety of our staff or others;
- for UK only: recording an applicant’s racial or ethnic origin in order to monitor Analysis Group’s compliance with equal opportunities and/or anti-discrimination legislation; and
- where applicable, complying with legal requirements.
Please note that if you accept an offer from us, we may transfer the personal data we collected about you during the recruiting and job application process to your personnel file with us. Our processing of such personal data will then be subject to the Privacy Notice for EU and UK Staff that will be provided to you in an adequate manner.
The basis for processing your personal data
We may process your personal data for the above purposes because:
- it is necessary for our or a third party’s legitimate interests, which include our commercial interests in operating Analysis Group in a professional, sustainable manner, in accordance with all relevant legal requirements, exercising or defending legal claims, and other legitimate interests as set out in the section “How we use your personal data”;
- it is necessary for the performance of a contract with you (such as an employment contract) or in order to take steps at your request prior to entering into such a contract;
- we have your freely given, specific and explicit consent; and
- it is necessary to comply with our legal obligations.
To the extent we process sensitive personal data, we may rely on your explicit consent, or we may process your personal data for the purpose of carrying out the obligations and exercising specific rights in the field of employment, or for establishing, exercising or defending legal claims, or for another reason in the public interest.
Sharing your personal data with others
For the purposes referred to in this Notice and relying on the legal bases for processing as set out above, we may share your personal data with certain third parties as set out below:
- As our company group acts globally, we may share your personal data with Analysis Group, Inc. This in particular holds true with respect to the provision of centralized recruiting and human resources functions. In that case we will be acting as joint controllers with Analysis Group, Inc. If you would like to obtain further information regarding our joint responsibility regarding the processing of your personal data, please contact us using the contact details set out in section “Contact us”.
- In many cases, the possible future manager in line to you is employed by another Analysis Group entity, including Analysis Group, Inc. (located in the United States) and Groupe D’Analyse Ltée (located in Canada). Thus, if the hiring decision is also dependent on the participation of a manager in line that is employed by another Analysis Group entity, we may share your personal data with that entity.
- Agents, contractors and other service providers may receive your personal data where there is a legitimate reason for their receiving your personal data, including third parties where we have engaged them to support us in connection with our recruitment activities (such as external recruiter and background-check providers). As we store your personal data on our system and may communicate with you electronically, service providers that provide hosting services and communication services may have access to your personal data as well. To the extent such service providers act on our behalf, we will ensure that (i) we have entered into sufficient data processing agreements, and (ii) they only act according to our instructions;
- Internal and external auditors and other independent third parties such as lawyers;
- Analysis Group may disclose personal data to third parties where we are legally required to do so (by a court, government body, law enforcement agency or other authority of competent jurisdiction) or if we reasonably believe that such action is necessary to (i) comply with the law and the reasonable requests of authorities; (ii) detect and investigate illegal activities and breaches of agreements or internal policies; and/or (iii) exercise or protect our rights and property and the rights, property and personal safety of our staff, visitors or others.
In each case, we will ensure that personal data will only be disclosed on a need-to-know basis.
International data transfers
Some of the personal data we process about you are transferred to, and stored at, a destination outside of the UK and/or the European Economic Area (“EEA”), including in the United States. Additional transfers could happen, for example, where your personal data is processed by staff operating outside the UK/EEA who work for us or another Analysis Group entity, or where personal data is processed by one of our suppliers or vendors who is based outside the UK/EEA or who uses data storage facilities outside the UK/EEA.
In the cases where a transfer of data to a location outside the UK/EEA takes place, this could mean that the data is transferred to a country with a lower level of protection of your personal data. Thus, we will only transfer your personal data on one of the following bases to ensure that your personal data is sufficiently protected:
- where the transfer is subject to “appropriate safeguards” for international transfers prescribed by applicable law (for example, standard contractual clauses adopted by the European Commission and/or the UK Secretary of State (as applicable)). In particular, we have standard contractual clauses in place between Analysis Group entities located in France, Belgium, and the UK and the Analysis Group entity located in the United States;
- a European Commission and/or UK Secretary of State decision provides that the country or territory to which the transfer is made ensures an adequate level of protection. In particular, data transfers from us to Groupe d'Analyse Ltée in Canada are covered by the European Commission's adequacy finding on the Canadian Personal Information Protection and Electronic Documents Act (which has also been adopted by the UK); or
- there exist specific situations where the transfer is permitted under applicable law (for example, where we have your explicit consent or where the transfer is necessary for the performance of a contract concluded in your interest).
If you would like to obtain further information on the transfer of your personal data to countries located outside the EEA which are not acknowledged by the European Commission and/or the UK Secretary of State to provide for an adequate level of protection, please contact us using the contact details set out in the section “Contact us”.
How long your personal data is kept
If you accept an offer from us, the personal data we collect during the application process may be transferred to your personnel file and retained in accordance with our Privacy Notice for EU and UK Staff.
If you are not hired by Analysis Group and if you do not request that your personal data be deleted by us, we will retain your application and personal data for a maximum period of two years subject to prior agreement to benefit from additional job opportunities from Analysis Group.
In the case where you attended one of our recruiting events and agreed to receive promotional information about Analysis Group, we will continue to process your personal data unless it is no longer needed for the purposes for which we collected your personal data or unless you unsubscribe from receiving such promotional information. Note that if you unsubscribe from receiving such promotional information, we will continue to store your email address in a suppression list to ensure that you will not receive any further promotional communications.
However, some personal data will be retained for longer, for example for compliance with legal or regulatory obligations, or to establish, exercise or defend legal claims. Such personal data will be deleted after the applicable retention period has expired. The typical retention period is ten (10) years.
How we protect your personal data
We implement a variety of security measures to maintain the safety of your personal data. This includes various technical and organizational measures. We assess the effectiveness and appropriateness of the implemented measures on a regular basis to ensure a sufficient level of data protection considering new threats and standards as well as the varying likelihood and severity of incidents affecting your personal data and your rights and freedoms. When engaging third parties to provide services to us, we ensure that these third parties also have appropriate security measures in place.
However, no security system is impenetrable, and we cannot guarantee the security of our systems 100%. In the event that any personal data under our control is compromised as a result of a breach of security, we will take reasonable steps to investigate the situation and notify you (if your personal data has been compromised) and/or the competent data protection authorities as appropriate.
Your rights
You have the following legal rights regarding your personal data:
- to obtain access to the personal data that we hold about you (right to access), which in particular means that you may obtain:
- confirmation on whether or not we are processing your personal data and where that is the case:
- information about the categories of personal data we are processing, the purposes for which we process your personal data and information as to how we determine applicable retention periods;
- information about the categories of recipients with whom we may share your personal data;
- information on the source of the personal data if we have not obtained that data from you;
- information on the existence of automated decision-making and – if applicable – the logic involved; and
- a copy of the personal data we hold about you;
- to require us to correct and complete the personal data we hold about you if the data are incorrect or incomplete without undue delay (right to rectification);
- to require us to erase your personal data without undue delay under certain circumstances, such as where you have withdrawn your consent, if applicable, or where the personal data are no longer necessary in relation to the purposes for which they were collected or processed (right to erasure);
- to require us to restrict our data processing activities, such as where the accuracy of the personal data is contested by you (right to restrict the processing);
- to receive from us the personal data we hold about you which you have provided to us in a structured, commonly used, machine-readable format that supports re-use and enables you to transmit that personal data to another controller or to request the transfer of such personal data to a third party (right to data portability);
- to object, on grounds relating to your particular situation, to any processing based on our legitimate interests; however, where there are compelling reasons for us to continue to process your personal data, we will assess and inform you if that is the case (right to object).
Please note that the above rights are not absolute, and we may be entitled to refuse requests where exceptions apply or where the requirements to exercise these rights have not been met.
If you wish to exercise one of these rights, please contact us using the details set out in the section “Contact us”.
We encourage you to contact us in cases of questions and concerns in relation to privacy matters to find a solution together. However, you also have a right to lodge a complaint with a supervisory authority (data protection authority) (right to lodge a complaint).
For certain processing activities, we may rely on your consent (such as where we would like to send promotional communication to you). If we need your consent, we will notify you and explain what kind of personal data we intend to use and how we intend to use it. You do not have to give us your consent. Where you have given us consent to process your personal data in a certain way, you may withdraw your consent at any time with effect for the future. Please note that if you refuse to consent or withdraw your consent to our sending promotional communications to you, this will not have any negative consequences in relation to your application for employment with us. If you have given your consent and you wish to withdraw it, please contact the Privacy Compliance Team at AGPrivacy@analysisgroup.com.
If you no longer wish to receive promotional communications, you can use the unsubscribe link contained in each such communication to unsubscribe from receiving further promotional emails. You can also contact us using the details set out in the section “Contact us”.
Changes to this Notice
We may update this Notice from time to time. When we change this Notice in a material way, we will update the “last updated” date at the beginning of this Notice and will inform you thereof in an adequate manner to the extent this is relevant for your application. Changes to this Notice are effective when they are posted in an adequate manner.
Contact us
If you have any queries about this Notice or how we process your personal data, or if you wish to exercise any of your rights under applicable law, you may contact the Privacy Compliance Team at AGPrivacy@analysisgroup.com.