Data Protection Policy (Candidates for Employment)

1. ABOUT THIS POLICY

Data Protection Legislation provides rules which apply to the collection, use and processing of information concerning individuals. The Legislation sets out the principles that the Company must follow when processing personal data about individuals. It also gives individuals certain rights in relation to personal data that is held about them. For the purposes of this Policy, “Data Protection Legislation” means the Data Protection Acts 1988 and 2003 and any other applicable law or regulation governing the processing of personal data, including the General Data Protection Regulation (Regulation (EU) 2016/679).

This Policy sets out the basis on which we will process any personal data we collect from candidates for employment, or that is provided to us by individuals or other sources.

This Policy does not form part of any contractual agreement and may be amended at any time.

AdRoll Advertising Limited with an address of Level 6, 1 Burlington Plaza, Burlington Road, Dublin 4 (“the Company”) is the data controller for the purposes of this Policy.

The Data Protection Compliance Manager is responsible for ensuring compliance with the Legislation and with this Policy. Any questions about the operation of this Policy or any concerns that the Policy has not been followed should be referred in the first instance to the Data Protection Compliance Manager at in the first instance to your Talent Acquisition Partner and if you feel your issue hasn’t been appropriately addressed at that point, the issue may be emailed privacy@adroll.com. Finally, any outstanding concern or issue may be escalated to our Data Protection Officer: Lucid Privacy Group, at the following address:

Attn: AdRoll Data Protection Officer
Lucid Privacy Group
1556 Shrader Street
San Francisco, CA 94117
USA
Email: dpo@addrollgroup.com

2. INFORMATION IN RELATION TO THE PERSONAL DATA THAT WE MAY PROCESS ABOUT YOU

The Company needs to process personal data relating to you for the purposes of enabling the Company to consider your suitability for employment; without such processing, it would not be possible for the Company to consider your application for employment. Please see the Schedule to this Policy for information in relation to;

the categories of personal data that we will process about you;
the reasons for any such processing;
the legal basis for any such processing;
the recipients or categories of recipients of the personal data; and
the period of time for which the personal data will be stored.

Processing to meet the Company’s Legitimate Interests

In addition to the specific purposes set out in the Schedule to this Policy, we may need to process your personal data in order to meet the Company’s legitimate interests from time to time. We will only do so where such processing is not overridden by your interests or fundamental rights and freedoms. The legitimate interests in question will be dictated by business needs and will include (the following list is not exhaustive):
- General business management, including planning, forecasting, auditing and accounting exercises as well as analytical studies;
- Protection of the Company’s property, assets and infrastructure;
- Business continuity, including the backup of data and securing of intellectual property and confidential information;
- Recruitment related activities, including assessing suitability for a particular role, setting up and conducting interviews and tests for applicants, evaluating and assessing the results thereto, and as is otherwise needed in the recruitment and hiring processes.

3. YOUR RIGHTS IN RELATION TO THE PERSONAL DATA THAT WE MAY PROCESS ABOUT YOU

As a data subject, you are entitled to:

Obtain access to the personal data which is held about you, subject to limited exceptions;
Request the rectification or erasure of the personal data held about you;
Request the restriction of processing of any personal data concerning you;
Object to the processing of any personal data;
Exercise your right to data portability; and
Lodge a complaint with the Data Protection Commission.

4. PROCESSING BY THIRD PARTIES

We may, from time to time, engage the services of third parties (“data processors”) to assist us to perform our functions or obligations, for example, we may engage an external service provider to assist us to carry out reference checks, or perform functions in connection with the application/interview process. Where this occurs, any processing of personal data by the data processor will be in compliance with the requirements of the Legislation. Any such processing will be regulated by a contract between the Company and the relevant data processor. That contract will govern the conditions under which any personal data may be processed, the security conditions attaching to the processing of the data and will require the data processor to delete or return the data to the Company upon completion or termination of the contract.

We may, from time to time, need to seek advice from professional advisers such as lawyers, accountants and doctors in relation to your/the Company’s rights and entitlements and/or matters arising in connection with the application/interview process. It may be necessary to share certain records with those professional advisers in that context. Where those records contain personal data relating to you, we will rely on the following legal bases when sharing personal data with such professional advisers;

In the context of personal data, we will only share personal data with the Company's professional advisers where necessary for the purposes of compliance with a legal obligation to which the Company is subject; and
In the context of special category data, we will only share personal data with our professional advisers where necessary for the purposes of enabling the Company to carry out its obligations or exercise specific rights (or to enable you to carry out your obligations or exercise specific rights) in the field of employment, insofar as it is authorised by EU or Irish law.

In some cases, we may need to transfer your personal data to third parties overseas, which are outside the European Economic Area. However, we will ensure that adequate procedures and safeguards such as the European Commission Model Contract Clauses, as an example, are in place to protect your personal data at all times and that the third parties are contractually obligated to provide an adequate level of data protection in accordance with Data Protection Legislation.

5. CCTV IN THE WORKPLACE

The Company has installed a CCTV system for the purposes of;

protecting the safety and security of staff, visitors and other members of the public who attend at our offices;
protecting our buildings and assets from damage, disruption, vandalism and other such crime;
deterring anti-social activity in and around our offices;
supporting the day-to-day management of our operations, including ensuring the health and safety of staff and others;
enabling the investigation of suspicious activity, both inside and outside of our offices, including any issues that give rise to, or arise during the course of, disciplinary or grievance proceedings and/or investigations into criminal or potentially criminal matters by An Garda Síochána; and
ensuring that the Company is in a position to support/defend any litigation taken against it, whether in connection with any investigation carried out pursuant to Clause 5.1(e) above or otherwise.

The provisions of this Policy apply equally to images captured/recorded on the Company's CCTV system as to any other form of personal data. Information relating to the personal data that will be collected and processed by way of the CCTV system is detailed further in the Schedule.

How the system operates

CCTV cameras have been placed inside and outside of our offices at the front door, the doors at each end of the office and the door to the comms room. The system uses both fixed and domed cameras designed to capture and record images of individuals and property. The cameras do not pick up or record sound.

Signs are displayed at the entrance of each surveillance zone to alert individuals that their image may be recorded. The signs contain details of the organisation operating the system (where the system is not operated by the Company) together with information in relation to how individuals can contact that organisation or otherwise access further information in relation to how any captured images will be processed, accessed and stored. The camera locations have been chosen in such a way as to minimise the viewing of spaces not relevant to the purpose of the monitoring. Cameras have not been placed in areas in which individuals might have a reasonable expectation of privacy, e.g. locker areas, changing rooms and toilet facilities. CCTV monitoring operates 24 hours a day and data captured on cameras is continuously recorded.

Live Monitoring and Viewing of Recorded Images

Live feeds from CCTV cameras will only be monitored where this is reasonably necessary to achieve the purposes set out in Clause 5.1 above. Otherwise, recorded images may be spot checked or accessed where necessary to achieve the purposes set out in Clause 5.1.

Live feeds from cameras and recorded images are only viewed by approved members of staff whose role requires them to have access to such data. This may include The People Team or members of management involved with or supporting disciplinary or grievance matters. Recorded images will only be viewed in designated, secure offices.

Use and storage of recorded images

Images captured/recorded by the CCTV system will only be used for the purposes set out at Clause 5.1 above, or for any other purpose(s) specifically permitted by the Legislation. The periods of time for which any images or recordings will be processed by the Company are detailed in the Schedule.

Category of data	Purpose of processing	Legal basis of processing	Type of recipient to whom the data may be transferred	Retention period
Personal data collected during the course of the application/interview process (as recorded in any application form completed by you, your CV, correspondence between you and the Company, interview notes, reference checks, etc.)	To consider the data subject's suitability for employment	The processing is necessary for the purposes of carrying out the obligations and exercising specific rights of the controller or of the data subject in the field of employment (as authorised by law)	The People Team and, where appropriate, those members of management responsible for assessing the data subject’s suitability for recruitment to employment (and the Company’s occupational health provider, where required)	Duration of the assessment process plus 14 months, commencing on: the date on which the successful candidate is appointed to the role in issue, or the date on which a candidate is notified that he/she will not be appointed to the role in issue.
	In respect of retention only: to enable the support/defence of legal proceedings	In respect of retention only: the processing is necessary for the establishment, exercise or defence of legal claims	During the retention phase, personal data may only be accessed if required for the purposes of (i) complying with a legal obligation; (ii) responding to a request received from the data subject; or (iii) supporting/defending legal proceedings. In the case of the first two scenarios, the data may be accessed by authorised members of the IT and People Teams, as required to comply with the relevant request. In the case of the third scenario, the data may be shared with the Company’s nominated solicitors and any other parties, as may be directed by the Company's legal advisors.
Special category data collected during the course of the application/interview process (such data will not be sought by the Company during the interview/assessment process however we recognise the possibility that such data may be provided to the Company, either by you during the course of the interview/assessment process or as a result of a pre-employment medical). Where such data is provided to the Company, any processing will be for the purposes outlined in this Schedule.	To enable the Company to assess the working capacity of the data subject (noting the rights and obligations conferred on the Company pursuant to the Employment Equality Acts and the Safety, Health and Welfare at Work Act and caselaw deriving thereunder)	The processing is necessary for the purposes of carrying out the obligations and exercising specific rights of the controller or of the data subject in the field of employment (as authorised by law)	The People Team and, where appropriate, those members of management responsible for assessing the data subject’s suitability for recruitment to employment (and the Company’s occupational health provider, where required)	Duration of the assessment process plus 14 months, commencing on: the date on which the successful candidate is appointed to the role in issue, or the date on which a candidate is notified that he/she will not be appointed to the role in issue.
	In respect of retention only: to enable the support/defence of legal proceedings	In respect of retention only: the processing is necessary for the establishment, exercise or defence of legal claims	During the retention phase, personal data may only be accessed if required for the purposes of (i) complying with a legal obligation; (ii) responding to a request received from the data subject; or (iii) supporting/defending legal proceedings. In the case of the first two scenarios, the data may be accessed by authorised members of the IT and People Teams, as required to comply with the relevant request. In the case of the third scenario, the data may be shared with the Company’s nominated solicitors and any other parties, as may be directed by the Company's legal advisors.
Images captured/recorded by the Company’s CCTV system	For the purposes detailed in Clause 5.1(a) - (d) of this Policy	The processing is necessary for the purposes of the legitimate interests pursued by the data controller (as detailed in the “purpose of processing column”), taking into account the fundamental rights and freedoms of the data subject	Authorised members of the Company, including members of the IT and People Teams and members of management An Garda Síochána or other parties (when required by law) The Company’s nominated solicitors (where required for the purposes of seeking legal advice and/or supporting/defending legal proceedings)	Recorded images will be stored for a period of 2 months, following which they will be deleted, except in a case where the recording forms part of a report made to the Health and Safety Authority following the occurrence of a reportable accident or dangerous occurrence in the workplace, in which case the recording will be retained for a period of 10 years
Images captured/recorded by the Company’s CCTV system	For the purpose detailed in Clause 5.1(e) - (f) of this Policy	In respect of the sharing of recordings with An Garda Síochána: the processing is necessary for compliance with a legal obligation to which the controller is subject (including the reporting obligation set out in Section 19 of the Criminal Justice Act, 2011) In respect of retention and any processing carried out in the context of an investigation: the processing is necessary for the purposes of the legitimate interests pursued by the data controller (as detailed in the “purpose of processing" column), taking into account the fundamental rights and freedoms of the data subject	Authorised members of the Company, including members of the IT and People Teams and members of management An Garda Síochána or other parties (when required by law) The Company’s nominated solicitors (where required for the purposes of seeking legal advice and/or supporting/defending legal proceedings) During any retention phase, personal data may only be accessed if required for the purposes of (i) complying with a legal obligation; (ii) responding to a request received from the data subject; or (iii) supporting/defending legal proceedings. In the case of the first two scenarios, the data may be accessed by authorised members of the IT and People Teams, as required to comply with the relevant request. In the case of the third scenario, the data may be shared with the Company’s nominated solicitors and any other parties, as may be directed by the Company's legal advisors.	The recording will be retained for so long as is necessary to support/defend the legal proceedings in issue