First Mode Applicant Privacy Notice

Updated October 10, 2023

We treat people with care and respect – that includes respecting the privacy of individuals. We comply with all applicable laws on the collection, storage, use, retention, transfer and deletion (collectively referred to as “processing”) of personal data. We want to ensure you know how we’ll be handling the personal data you provide us with.

What is personal data? Personal data typically includes any information relating to an individual person who can be identified from that information (also known as an identifiable individual). This includes anything ranging from an individual’s name or passport details, through to their opinions or other people’s feedback on them.

Key takeaways you must be aware of:

We only process personal data lawfully and fairly, and will only keep that data for as long as it is necessary in light of the purpose for which the data was collected.
We only share personal data with others when there is a legitimate business or legal need to do so. We ensure that the transfer of that data complies with applicable data privacy laws and that anyone receiving personal data from us understands the importance of protecting that data.
We respect the rights you have to review, update and correct our personal information.
We respect your right to not be subjected to automated decision making

Questions? If you have any questions about this Privacy Notice or would like to access the information it contains in a different format please contact our Data Privacy Team at privacy@firstmode.com

Applicant Privacy Notice Details

When you apply to a role at First Mode, are referred to a role by a current employee or are presented to First Mode via a 3^rd party, you will be required to share some of your personal data with First Mode in order for us to review your suitability. This notice outlines the data we process, the legal basis for which we have authority to process your personal data) as per GDPR) and your rights with regard to the processing of your personal data.

Does this apply to me?
This policy applies to all people applying to work at First Mode.

What’s the scope of this notice?
The notice applies applications to First Mode globally. Contact privacy@firstmode.com if you have any questions about regional specific considerations.

What do I need to know?

Data privacy laws and regulations are in place to protect the privacy rights of the individuals whose data we collect and hold. These laws and regulations typically impose obligations on us to ensure that we only process personal data lawfully and fairly and take extra precautions when we process particularly sensitive information about people (for example information about health conditions).

What data do we process?
Where permitted by applicable laws and regulations (and with your consent, where this is required by law) we collect various types of personal data about you for the purposes described in this Privacy Notice including:

Personal details:

your name
gender
nationality
civil/marital status
date of birth
age
personal contact details (e.g., address, telephone or mobile number, e mail)
national ID number
immigration and eligibility to work information
driving license
passport
languages spoken
details of any disability and any reasonable adjustments required as a result

Recruitment and selection data:

skills and experience
qualifications
references
CV and application
interview and assessment data (including results of psychometric tests, if appropriate)
information related to the outcome of your application
interview notes and records
details of any offer made to you

Financial information:

your bank details
tax information
social security information
student loan information (if applicable)
previous employment details (where relevant)

Vetting and verification data:

vetting and verification information (e.g., results of right to work verification, Identity verification)

Role information:

job title
start date
salary

Equality and diversity data, where permitted by law and provided voluntarily, data:

gender
age
race
nationality
religious belief
sexuality (stored anonymously for equal opportunities monitoring purposes)

Any other personal data which you choose to disclose to us during your application and onboarding, whether verbally or in written form.

Certain additional information may be collected where this is necessary and permitted by local applicable laws.

Special categories

To the extent permitted by applicable laws we may, during the job application process, collect and process a limited amount of personal data within the above data which falls into special categories, sometimes called “sensitive personal data”. Where the EU General Data Protection Regulation applies, this term means information relating to:

racial or ethnic origin
political opinions
religious or philosophical beliefs
physical or mental health (including details of accommodations or adjustments)
trade union membership
sex life or sexual orientation
biometric and genetic data
criminal records and information regarding criminal offences or proceedings.

Where other data protection laws apply, “sensitive personal data” or “special categories of personal data” shall have the meaning (if any) defined in such laws (as amended from time to time).

How does First Mode collect data?

We collect and record your personal data from a variety of sources, but mainly directly from you. You will provide this information directly to us, enter it into our systems (for example, our job application portal) or the individuals with whom you interact during the job application process. In addition, further information about you will come from the individuals with whom you interact during the job application process.

We also obtain some information from third parties: for example, via recruitment agencies and search agencies, references from a previous employer, information from tax authorities, referrals from existing employees, or where we employ a third party to carry out a background check (where permitted by applicable law) or occasionally from clients.

Where we ask you to provide personal data to us on a mandatory basis, and we will inform you of this at the time of collection and in the event that particular information is required by the contract or statute this will be indicated. Failure to provide any mandatory information will mean that we cannot carry out certain processes. For example, we will be unable to verify your eligibility to work in certain jurisdictions if you do not provide us with your qualifications, nationality or immigration information. In some cases, it may mean that we are unable to continue with your application as we will not have the personal data, we believe to be necessary in determining whether to proceed with your application.

Apart from personal data relating to you, you may also provide us with personal data of third parties, notably your referees, for purposes of administration and management of your application. Before you provide such third-party personal data to us, you must first:

inform these third parties of any such data which you intend to provide
inform these third parties of the processing to be carried out, and;
obtain the requisite consent from these third parties (where required by applicable laws), as detailed in this Privacy Notice

What are the purposes for which data is processed and what is our legal basis (if applicable) for carrying out the processing?

Your personal data is collected and processed for various business purposes, in accordance with applicable laws and any applicable collective bargaining agreements. We have set out in this Privacy Notice the purposes for which we may use your personal data. Personal data may occasionally be used for purposes not obvious to you where the circumstances warrant such use. We may, where we think it is necessary and required by applicable laws, provide you with additional information to ensure that you understand how your personal data may be used.

The legal basis on which we process your personal data

Whenever First Mode processes your personal data, we do so by using a legal basis or justification for that processing. Processing of special categories of data is always justified on the basis of an additional lawful condition detailed below.

First Mode considers that it has a legitimate interest in processing data for the purposes set out above. This is necessary to ensure fair and effective recruitment of suitable personnel and the effective reward, administration, support, development and management of applicants. This is important to ensure that First Mode continues to meet its business objectives and goals both in the short and long term; maintains its reputation; and continues to attract and retain high caliber applicants.

We may occasionally work with third parties to process your personal data, for example when we need to meet security requirements for our clients.

In exceptional circumstances, where we have no legitimate interest in processing, but you ask us to process data for a particular purpose, we may carry out the processing on the basis of your consent. If we need your consent, we will ask you for it.

If the data processing activity falls within the jurisdiction of Chile, we may process your personal data where the processing is carried out by us for the exclusive use of us, our associates and the entities to which we are affiliated, for statistical, pricing or other purposes of general benefit of us or our associated or affiliated entities.

We have set out below the purposes we may use your personal data for and the legal basis we rely on in each case.

If applicable privacy law(s) does not enable collection, use and disclosure of personal data upon such legal bases, we will obtain your consent to such processing in accordance with those law(s).

The purposes we use personal data for and the legal basis that applies

We have identified several purposes for collecting and processing your personal data. These are set out below. Where required under applicable laws, we will seek your consent to these purposes in accordance with those laws. Where we are not required to seek consent for the processing of your personal data, the purposes, together with the legal basis we rely on in each case are as follows:

Purpose for processing	The lawful basis we rely on
Recruitment and selection Considering your suitability to work for us in the role you have applied for, comparing you to other candidates and making recruitment decisions	If the personal data processing activity falls under the jurisdiction of the UK, EEA or South Africa, the following applies: This processing is necessary for the compliance with legal obligations to which First Mode is subject including the requirement to ensure we do not unlawfully discriminate in our recruitment decision. Processing beyond legal compliance is necessary for takings steps at your request to enter a contract with you. Where you have applied to work for us we need to use your personal data to ensure that you are suitable for the role you have applied for and to make an offer of employment to you where appropriate. Additional processing is necessary for the purpose of the legitimate interests pursued by First Mode. First Mode has a legitimate interest in holding information on potential candidates, fully assessing applicants to ensure that only suitable and appropriate candidates are selected, to compare candidates and make a fair decision on the most appropriate candidate for the position. If the personal data processing activity falls under any other jurisdiction where your consent is required, the legal grounds for processing your personal data is your Consent.
Pre-employment verification and screening Appropriate pre-employment screening.	If the personal data processing activity falls under the jurisdiction of the UK, EEA or South Africa, the following applies: This processing is necessary for compliance with legal obligations to which First Mode is subject including establishment of the right to work in the country in which you are employed. Screening which is not legally required is necessary for the purpose of the legitimate interests pursued by First Mode. First Mode has a legitimate interest in ensuring that candidates for employment or engagement do not pose an unacceptable risk to the business or its customers and considers the verification carried out necessary to prevent crime and other unlawful acts and to protect the business and customers from fraud, dishonesty or incompetence. If the personal data processing activity falls under any other jurisdiction where your consent is required, the legal grounds for processing your data is your Consent.
Offers of employment and on-boarding Making job offers, providing contracts of employment or engagement and preparing to commence your employment or engagement where you accept an offer from us	If the personal data processing activity falls under the jurisdiction of the UK, EEA or South Africa, the following applies: This processing is necessary for compliance with legal obligations to which First Mode is subject including the requirement to issue written particulars of the terms of employment and the requirement not to unlawfully discriminate in the terms of any offer to you. Additional processing is necessary to take steps to enter into the contract between you and First Mode and to perform that contract because we will need information to make an appropriate offer to you and administer your employment contract if you join us. The remainder of the processing is necessary for the purpose of the legitimate interests pursued by First Mode. First Mode has a legitimate interest in ensuring the effective engagement of applicants on appropriate terms and conditions of employment and that there is a smooth transition into employment for successful candidates and that information supplied in the recruitment process which is relevant to ongoing employment is maintained. If the personal data processing activity falls under any other jurisdiction where your consent is required, the legal grounds for processing your data is your Consent.
Future job opportunities To contact you if you are not successful in your initial application should another potentially suitable vacancy arise	The legal grounds for processing your data is Consent.
Recruitment feedback and complaints To deal with any query, challenge or request for feedback received in relation to our recruitment decisions	If the personal data processing activity falls under the jurisdiction of the UK, EEA or South Africa, the following applies: This processing is necessary for the compliance with legal obligations to which First Mode is subject including ensuring that First Mode is able to demonstrate its compliance with data protection laws and anti-discrimination laws Beyond legal compliance processing is necessary for the purpose of the legitimate interests pursued by First Mode. First Mode has a legitimate interest in being able to provide feedback to candidates and to be able to defend any challenge or claim made in connection with our recruitment decision. This will assist First Mode to avoid the risk of financial exposure or costs incurred through challenges to recruitment decisions and to maintain its reputation. If the personal data processing activity falls under any other jurisdiction where your consent is required, the legal grounds for processing your data is your Consent.
Legal compliance Complying with laws and regulation applicable to First Mode (for example maternity or parental leave legislation, working time, health and safety legislation, taxation rules, worker consultation requirements, other employment laws, and regulation to which First Mode is subject in the conduct of its business)	This processing is necessary for the compliance with legal obligations to which First Mode is subject including those laws set out.
Ensuring equality of opportunity Monitoring programs to ensure equality of opportunity and diversity with regard to personal characteristics protected under applicable anti-discrimination laws	If the personal data processing activity falls under the jurisdiction of the UK, EEA or South Africa, the following applies: This processing is necessary for the compliance with legal obligations to which First Mode is subject including anti-discrimination laws. Beyond the above processing it is also necessary for the purpose of the legitimate interests pursued by First Mode. First Mode has a legitimate interest in ensuring that it takes action to prevent discrimination and promote an inclusive and diverse workplace. If the personal data processing activity falls under any other jurisdiction, the legal grounds for processing your data is your Consent.
Search and Succession Planning Monitoring the availability of possible candidates for future roles and maintaining contact with appropriate candidates.	If the personal data processing activity falls under the jurisdiction of the UK, EEA or South Africa, the following applies: The processing is necessary for the purpose of the legitimate interests pursued by First Mode. First Mode has a legitimate interest in ensuring that it will be able to fill future vacancies. If the personal data processing activity falls under any other jurisdiction, the legal grounds for processing your data is your Consent.

Additional legal basis we rely on where we process special category data (if the personal data processing activity falls within the jurisdiction of the UK, EEA, or South Africa)

The special categories of personal data that are processed by First Mode are set out above.

Where we process special categories of personal data it will be justified by a condition set out above and also by one of the following additional conditions:

The processing is necessary for the purposes of carrying out the obligations and exercising the rights of you or First Mode in the field of employment law, social security and social protection law, to the extent permissible under applicable laws;
The processing is necessary to protect your vital interests or of another person where you are physically or legally incapable of giving consent (for example in exceptional emergency situations, such as a medical emergency)
The processing is necessary for reasons of substantial public interest
The processing is necessary for the establishment, exercise or defense of legal claims
In exceptional circumstances the processing is carried out subject to your explicit consent.

Additional legal basis we rely on where we process special category data (if the personal data processing activity falls within the jurisdiction of Australia)

The special categories of personal data that are processed by First Mode are set out above. Where we process special categories of data in Australia, it will be justified by:

A condition set out above, provided applicants have also consented to the collection of the information
One of the following conditions is met:
- The collection of the information is required or authorized by, or under, an Australian law or a court / tribunal order;
- A ‘permitted general situation’ (within the meaning of that term in section 16A of the Privacy Act 1988 (Cth)) exists in relation to the collection of the information; or
- A ‘permitted health situation’ (within the meaning of that term in section 16B of the Privacy Act 1988 (Cht)) exists in relation to the collection of the information.

The purposes we use special category personal data for and the additional legal basis that applies

We have identified several purposes for collecting and processing your special category personal data. These are set out below. Where required by applicable laws, we will seek your consent to such processing for these purposes. Otherwise, the purposes together with (where applicable) the additional legal basis we rely on in each case are as follows:

Purpose for processing	Additional lawful basis for special category data processing
Physical or mental health data, for making adjustments to the recruitment and selection process, as needed	If the personal data processing activity falls under the jurisdiction of the UK or EEA, this processing is necessary for the purposes of carrying out the obligations and exercising the rights of you or First Mode in the field of employment law, social security and social protection law, to the extent permissible under applicable laws. In particular compliance with anti-discrimination legislation. If the personal data processing activity falls under any other jurisdiction where your consent is required, the legal grounds for processing your data is your Consent.
Biometric data for identification purposes (where permitted), and criminal records and information regarding criminal offences and other proceedings (where permitted), for pre-employment verification and screening	If the personal data processing activity falls under the jurisdiction of the UK or EEA, we process this personal data on the basis of substantial public interest. If the personal data processing activity falls under any other jurisdiction where your consent is required, the legal grounds for processing your data is your Consent.
Ensuring equality of opportunity	If the personal data processing activity falls under the jurisdiction of the UK or EEA, this processing is necessary for the public interest of ensuring equality of opportunity or treatment between people of different racial or ethnic origins, holding different religious or philosophical beliefs, people with different states of physical or mental health or people of different sexual orientation with a view to enabling such equality to be promoted or maintained. If the personal data processing activity falls under any other jurisdiction where your consent is required, the legal grounds for processing your data is your Consent.

Consent

We may seek your consent to certain processing of your personal data which is not otherwise justified under one of the above basis or where (for example, under the privacy laws of Chile) applicable privacy laws require us to obtain your consent.

If you are in the EEA or United Kingdom, if consent is required for the processing in question;

such consent will be sought from you separately to ensure that it is freely given, informed and explicit;
information regarding such processing will be provided to you at the time that consent is requested, along with the impact of not providing any such consent; and
you should be aware that it is not a condition or requirement of your employment to agree to any request for consent from First Mode.

Processing data relating to criminal convictions and offences

Personal data relating to criminal convictions and offences will only be processed where authorized by applicable laws, (and where required by applicable laws with your consent). For example, a criminal record check may be carried out as part of your recruitment.

Automated decision making

Automated decision-making takes place when an electronic system uses personal data to make a decision without human intervention. We do this only where we have your consent (if required by applicable laws), or where it is necessary to perform the contract with you and appropriate measures are in place to safeguard your rights.

When recruiting for certain roles, we may automatically reject applicants based on their answers to some screening questions. This will happen where there are legal requirements pertaining to the role (e.g. right to work or minimum qualifications or certifications). If this applies, the candidate will be unsuccessful in their job application. All requirements of the role will be clearly articulated in the job description.

For certain roles, we may use artificial intelligence to scan job applications and CVs to assess their alignment with the requirements of the role, as described in the job description. This will result in applicants being ranked based on the outcome of the scanning. Hiring decisions will then be made by a human being.

In a limited number of cases, we may also automatically reject applicants if they do not achieve a pass score in an assessment test that they take as part of the application process. If this applies, the applicant will be unsuccessful in their job application.

In any specific situation described above and subject to local laws, you have 21 days to request a reconsideration of any decision taken by automated means.

Retention of personal data

First Mode endeavors to ensure that personal data are kept as current as possible, and that irrelevant or excessive data are deleted or made anonymous as soon as reasonably practicable.

First Mode generally retains personal data for as long as is required to satisfy the purpose for which it was collected. This will usually be the period of your application, plus the time in which you can make an appeal or take other legal action. If successful, your personal data will be retained for the period of your employment/contract with us plus the length of any applicable statutory limitation period following your departure, although some data, such as pension information, may need to be kept for longer. First Mode may keep some specific types of data, for example, tax records, for different periods of time, as required by applicable law. However, some personal data may be retained for varying time periods in order to comply with legal and regulatory obligations and for other legitimate business reasons.

Disclosures of personal data

Your personal data (with your consent, where required by applicable law) can be accessed by or may be disclosed internally on a need-to-know basis within First Mode to:

Members of local, regional and global Human Resources teams, including managers and team members
local, regional and executive management responsible for managing or making decisions in connection with your application to First Mode or when involved in a process concerning your application to First Mode
system administrators
where necessary for the performance of specific tasks or system maintenance by members of Company teams such as the Finance and IT Departments and the People team.

Your personal data is also accessed by third parties who provide us with services. For example:

Screening and referencing providers.
External software / data hosting providers

Where the third parties described above act as a “data processor” they carry out their tasks on our behalf and upon our instructions for the above-mentioned purposes. In this case your personal data will only be disclosed to these parties to the extent necessary to provide the required services.

In addition, we may share personal data with national authorities in order to comply with a legal obligation to which we are subject. This is, for example the case in the framework of imminent or pending legal proceedings or a statutory audit.

Security of data

First Mode is committed to protecting the confidentiality and security of the personal data you share with us. First Mode uses a variety of technical and organizational methods to secure your personal data in accordance with applicable laws.

International transfer of personal data

From time to time your personal data (including special categories of personal data) will be transferred to associated companies of First Mode to process for the purposes described in this Privacy Notice. This will be applicable for example where the relevant company or a manager from that company is responsible for conducting or approving the relevant process.

These associated companies or managers may be located within the European Union and elsewhere in the world (including but not limited to, Australia, Chile, South Africa, UK and USA).

Personal data may also be transferred to third parties (e.g. service providers or regulators as set out above), who may have systems or suppliers located outside the country or jurisdiction where you are located.

As a result, your personal data may be transferred to countries outside of the country or jurisdiction in which you are located or outside of the European Union to countries whose data protection laws may be less stringent than yours.

First Mode will ensure that appropriate or suitable safeguards are in place to protect your personal data and that transfer of your personal data is in compliance with applicable data protection laws.

In addition:

Where required by applicable data protection laws, First Mode has ensured that service providers (including other Company associated companies) sign standard contractual clauses as approved by the European Commission or such other contractual or other measures as approved or indicated by other supervisory authority with jurisdiction over the relevant Company exporter. You can obtain a copy of any standard contractual clauses in place which relate to transfers of your personal data by contacting privacy@firstmode.com.

If you are located in the European Union or the United Kingdom, you have a right to request a copy of any data transfer agreement under which your personal data is transferred, or to otherwise have access to the safeguards used. Any data transfer agreement made available to you may be redacted for reasons of commercial sensitivity. To request sight of these contact contacting privacy@firstmode.com.

Your rights as a data subject

Whether these rights apply to you will depend on the nature of the personal data processing activity, and the jurisdiction in which the processing takes place.

Right to access, correct and delete your personal data

First Mode aims to ensure that all personal data is correct. You also have a responsibility to ensure that changes in personal circumstances are notified to First Mode so that we can ensure that your data is up to date.

You have the right to request confirmation and/or access to any of your personal data that First Mode may hold, and to request correction of any inaccurate data relating to you.

If you are located in the European Union, the United Kingdom or Chile, you furthermore have the right to request deletion of any irrelevant data we hold about you.

You can see and update some of this data yourself via the HR Information system once you become an employee. To amend data in relation to a job application, please log into our recruitment system, Greenhouse, via First Mode’s careers page, or by contacting the recruitment team you have been liaising with.

Data portability

Where we are relying upon your consent or the fact that the processing is necessary for the performance of a contract to which you are party as the legal basis for processing, and that personal data is processed by automatic means, you have the right, if you are located in the European Union or the United Kingdom, to receive all such personal data which you have provided to First Mode in a structured, commonly used and machine readable format, and also to require us to transmit it to another controller where this is technically feasible.

Right to restriction of processing

If you are located in the European Union or the United Kingdom, you have the right to restrict our processing of your personal data where:

you contest the accuracy of the personal data until we have taken sufficient steps to correct or verify its accuracy
where the processing is unlawful, but you do not want us to erase the data
where we no longer need the personal data for the purposes of the processing, but you require them for the establishment, exercise or defense of legal claims
where you have objected to processing justified on legitimate interest grounds (see below) pending verification as to whether First Mode has compelling legitimate grounds to continue processing.
Where personal data is subjected to restriction in this way we will only process it with your consent or for the establishment, exercise or defense of legal claims.

Right to withdraw consent

Where we have obtained your consent or relied on your consent to process information and you have provided us with your consent to process data, you have the right to withdraw such consent at any time. You can do this by contacting privacy@firstmode.com.

Right to object to processing justified on legitimate interest grounds

If you are located in the European Union or the United Kingdom, and we are relying upon legitimate interest to process data, then you have the right to object to that processing. If you object, we must stop that processing unless we can either demonstrate compelling legitimate grounds for the processing that override your interests, rights and freedoms or where we need to process the data for the establishment, exercise or defense of legal claims. Where we rely upon legitimate interest as a basis for processing, we believe that we can demonstrate such compelling legitimate grounds, but we will consider each case on an individual basis.

If you are located in Chile, you have the right to object to the use of your personal data for the purposes of advertising, market research or opinion polls.

Right to object to automated decision making

If you are located in the European Union or the United Kingdom, you have the right to object to any decision that significantly affects you being taken solely by a computer or other automated process. In such a case, you have the right to obtain human intervention, to express your point of view, and to contest the automated decision.

Right to complain

For further information regarding your rights, or to exercise any of your rights, please contact:

Our Data Privacy Team at privacy@firstmode.com.

You also have the right to lodge a complaint with us or with a supervisory authority if you consider that the processing of your personal data infringes applicable law.

Jurisdiction	Supervisory Authority Contact Information
United Kingdom	Information Commissioner’s Office T +44 303 123 1113 www.ico.org.uk
Elsewhere in the EEA (European Economic Area)	Data Protection Commission 21 Fitzwilliam Square South Dublin 2, D02 RD28, Ireland T +353 578 684 800 F +353 761 104 800 https://www.dataprotection.ie/en/contact/how-contact-us
South Africa	The Information Regulator (South Africa) SALU Building, 316 Thabo Sehume Street, Pretoria T +27 12 406 4818 F +27 86 500 3351 inforeg@justice.gov.za https://www.justice.gov.za/inforeg/
Australia	The Privacy Commissioner, under the Office of the Australian Information Commissioner (OAIC) GPO Box 5218 Sydney NSW 2001 T +61 1300 363 992 F +61 2 9284 9666 enquiries@oaic.gov.au https://www.oaic.gov.au/

We ask that you please attempt to resolve any issues with us before contacting any supervisory authority.

Additional Privacy Notices

We may undertake certain processing of personal data which are subject to additional Privacy Notices and we shall bring these to your attention, and (where required to do so) obtain your consent, where relevant.

Notice of changes

First Mode may change or update this Privacy Notice at any time.

Should we change our approach to data protection, you will be informed of these changes or made aware that we have updated the Privacy Notice so that you know which information we process and how we use this information. Where required under applicable laws, we will obtain your consent to these changes.