Candidate Privacy Notice

This Privacy Notice applies to all job applicants and is non-contractual.

1. Who are we?

Trolley Payments UK Ltd and its affiliates, including without limiting, Trolley CA Inc. (Canada), Trolley Operations CA Inc. (Canada), Trolley Operations US Inc. (US), Trolley US Inc. (US), Trolley SG Pte Ltd (Singapore) and Payment Rails HK Limited (Hong Kong) (hereinafter “Trolley”) respect your privacy and are committed to protecting your personal data.

2. Introduction

Trolley is a personal data controller, which means that it is responsible for collecting and processing your personal information or personal data. This Privacy Notice is aimed at informing you of how and why your personal data will be used, mainly for the recruitment process, and how long it will be retained for. Trolley is committed to being transparent and meeting its data protection obligations under the General Data Protection Regulation ((EU) 2016/679) (“GDPR”).

Trolley is required under the GDPR to notify you of the information contained in this Privacy Notice. This Privacy Notice applies to all job applicants and is non-contractual.

3. Data protection principles

Trolley will comply with data protection law and principles, which means that your data will be:

1. Processed lawfully, fairly and in a transparent way.
2. Collected only for legitimate purposes that have clearly been explained to you and not further processed in a way that is incompatible with those purposes.
3. Relevant and limited to what is necessary in relation to those purposes.
4. Accurate and kept up to date.
5. Maintained only for as long as necessary for the purposes explained to you, in relation to the recruitment process.
6. Kept securely and protected against unauthorised or unlawful processing and against loss or destruction using appropriate technical and organisational measures.

4. What kind of data is collected about you?

In connection with your application, Trolley will collect, use and store the following categories of personal data about you:

• The data you have provided to Trolley in your curriculum vitae (CV) and the personal data contained in your covering letter.
• The data you have provided on our application form, including name, address, telephone number, personal email address, date of birth, gender, education and employment history, qualifications, nationality, languages, diplomas and any data you provide Trolley during interviews.
• Any personal data related to the criminal background check.
• Any personal data provided to Trolley about you by your referees (if applicable).
• The data provided in your communications with Trolley, including emails, letters, messages, attachments.
• The data provided by your LinkedIn profile, GitHub profile and/or personal website.
• The information related to your assessment by a recruitment agency.
• The data provided by your recruitment tasks, such as presentations and tests.
• Any information non-required by Trolley but voluntarily submitted by you.

5. How will Trolley use your personal data?

Trolley will use the personal data it collects about you to:

• Assess your skills, qualifications and suitability for the role.
• Carry out background and reference checks, where applicable.
• Communicate with you about the recruitment process.
• Keep records related to Trolley’s hiring process and ensure effective HR and business administration.
• Comply with legal or regulatory requirements.

It is Trolley’s legitimate interest to decide whether to appoint you to the role since it would be beneficial to the business to appoint a suitable candidate. Trolley needs to process your personal data to decide whether to enter into a contract with you.

Having received your CV, cover letter and results from any tests completed (if applicable), Trolley will process that data to decide whether you meet the basic requirements to be shortlisted for the role. If you do, Trolley will decide whether your application is suitable to invite you for an interview. If Trolley decides to call you for an interview, it will use the data you provided at the interview to decide whether to offer you the role. If Trolley decides to offer you the role, it may then contact your references and/or perform any other checks before confirming your employment.

If you fail to provide personal data

If you fail to provide personal data when requested, which is necessary for Trolley to consider your application (such as evidence of qualifications or work history), Trolley may not be able to process your application further. For example, if Trolley requires references for this role and you fail to provide the relevant details, Trolley will not be able to take your application further and enter into a contract with you.

6. How Trolley uses particularly sensitive personal data?

Trolley will only use your sensitive personal data, which includes special categories of personal information and information about criminal convictions and offences, when the law allows it.

Some special categories of personal information, such as information about your health, and information about criminal convictions and offences, are processed so that Trolley can perform or exercise our obligations or rights under employment law and in line with our data protection policy.

Trolley may also process information about your health and information about any criminal convictions and offences when Trolley has your explicit written consent. In this case, Trolley will first provide you with full details of the personal information it would like and the reason it is needed, so that you can properly consider whether you wish to consent or not. It is entirely your choice whether to consent and you can withdraw your consent at any time.

7. Who has access to your personal information?

Your personal data may be shared internally within Trolley for the purposes of the recruitment process, including with members of the HR department, members of the recruitment team, members of training team, legal team, managers in the department which has the vacancy and IT staff if access to your personal information is necessary for the performance of their roles.

Trolley will not share your personal information with third parties during the recruitment process unless your job application is successful, and Trolley makes you an offer of employment or engagement. At that stage, Trolley may also share your personal information with third parties (and their designated agents), including:

• External organisations for the purposes of conducting pre-employment reference and employment background checks.
• Former employers, to obtain references.
• Professional advisors, such as lawyers, accountants.
• Governmental authorities, such as Revenue Quebec, Revenue Canada, CNESST.
• HR internal software, such as Wagepoint and Bob.

Trolley may also need to share your personal information with a regulator or to otherwise comply with the law. All of Trolley’s third-party service providers and other entities in the group are required to take appropriate security measures to protect your personal data in line with our policies. Trolley does not allow our third-party service providers to use your personal data for their own purposes. Trolley only permits them to process your personal data for specified purposes and in accordance with our instructions.

8. What are the security measures?

Trolley has put in place appropriate security measures to prevent your personal data from being accidentally lost, used or accessed in an unauthorized way, altered or disclosed. In addition, Trolley limits access to your personal data to those employees, agents, contractors and other third parties who have a business need-to-know. They will only process your personal data on our specific instructions, and they are subject to a duty of confidentiality.

9. How long does Trolley keep your personal information?

Trolley will only retain your personal information for as long as necessary to fulfil the purposes for which it was collected and processed.

If your application for employment is unsuccessful, Trolley will generally hold your personal information for a period up to (3) years after your last application date. It is retained for that period in the event of a legal claim, allegations for discrimination or to prove that Trolley conducted the recruitment exercise in a fair and transparent way.

If your application for employment is successful, personal information gathered during the recruitment process will be retained for the duration of your employment or engagement and in accordance with the privacy notice for employees, workers and contractors.

Please ensure that your data is always kept up to date. Personal information which is no longer to be retained will be securely and effectively destroyed or permanently erased from our IT systems.

10. What are your rights in connection with your personal information?

Under certain circumstances, by law you have the right to:

• Request access to your personal data (commonly known as a “data subject access request”). This enables you to receive a copy of the personal data Trolley holds about you and to check that Trolley is lawfully processing it.

• Request correction of the personal data that Trolley holds about you. This enables you to have any incomplete or inaccurate data corrected.

• Request erasure of your personal data. This enables you to ask Trolley to delete or remove personal data where there is no good reason for Trolley to continue processing it. You also have the right to ask Trolley to delete or remove your personal data where you have exercised your right to object to processing (see below).

• Object to processing of your personal data when Trolley is relying on a legitimate interest (or those of a third party) and there is something about your particular situation which makes you want to object to processing on this ground. You also have the right to object when Trolley is processing your personal data for direct marketing purposes.

• Request the restriction of processing of your personal data. This enables you to ask us to suspend the processing of personal data about you, for example if you want Trolley to establish its accuracy or the reason for processing it.

• Request the transfer of your personal data to another party.

If you wish to exercise any of these rights, please contact Trolley via e-mail to [email protected]. Trolley may need to request specific information from you in order to verify your identity and check your right to access the personal information or to exercise any of your other rights.

If you believe Trolley has not complied with your data protection rights, you have the right to make a complaint to the applicable supervisory authority or regulator.

11. Automated decision making

Automated decision making occurs when an electronic system uses your personal information to make a decision without human intervention.

Trolley does not envisage that any recruitment decisions will be made about you based solely on automated decision-making.

12. Changes to this privacy notice

Trolley reserves the right to update or amend this privacy notice at any time. Trolley will issue a new privacy notice when it makes significant updates or amendments.

Last Revised: June 15, 2022