Candidate Privacy Notice

About this notice

This notice explains how Yonda Tax collects, uses, stores and shares personal data about you when you apply for a role with us, whether as an employee, worker or contractor.

It applies to all candidates, including those based outside the UK.

This notice applies until you start working for us or receive our Employee Privacy Notice, whichever is earlier. After that, our Employee Privacy Notice explains how we use your data.

We may update this notice at any time. The latest version will always be available on our website.

Who we are

Yonda Tax Limited is the data controller for your personal data.

If you have any questions about this notice or how we handle your data, contact privacy@yondatax.com.

What data we collect

We collect and process the following personal data about you:

• Personal details: name, address, personal email and phone number
• Application details: CV, cover letter, application form answers, qualifications, employment history and skills
• Assessment information: interview notes, assessment or task results, and feedback from interviewers
• Interview recordings: we record interviews, and will tell you before the interview starts
• Salary and availability: current or expected salary, notice period and start date

If we make you an offer, we will also collect:

• Contract details: your full legal name, home address, job title, reporting line, salary, bonus and share option details, start date, place of work and other terms of your employment contract
• Signature information: your signature and the signing record created by our e-signature provider, including your email address, the name you enter when signing and the date and time you signed
• Witness details: the name, address, occupation, email address and signature of the person you choose to witness your signature, and the signing record for their signature
• Right to work: passport, visa, share code or other right to work documents
• References and background checks: references and background check results

We do not carry out criminal record checks.

Special category data

We do not ask for equality and diversity information.

We only ask for health information if you tell us about a disability or need, so we can make adjustments to the recruitment process.

Some sensitive information may still reach us, for example if you include it in your CV, mention it during an interview, or it is visible in an interview recording. We do not use this information to make decisions about your application.

Information about your witness

Our employment contracts are signed as a deed, which means your signature must be witnessed. We will collect your witness's name, address, occupation, email address and signature. We use this only to make sure your contract is validly signed, and we keep it with your signed contract.

Your witness will be sent the contract to sign, so they will be able to see its contents, including your salary and other terms. Please choose your witness with this in mind.

Please let your witness know that we will hold their details. Your witness has the same rights over their data as set out in the Your rights section, and can contact privacy@yondatax.com with any questions.

Where we get your data from

Most of the data we hold comes from you. We may also receive data from:

• LinkedIn, where you have applied through it or made your profile public
• recruitment agencies, if you applied through one
• people who refer you to us
• referees and previous employers
• background check providers
• our interviewers
• your witness
• our e-signature provider

Do you have to provide your data?

You do not have to apply, but if you do not provide the information we ask for, we may not be able to consider your application. If we make you an offer, we must check your right to work, and cannot employ you without this.

Why we use your data and our lawful basis

We only use your data where the law allows us to. The table below sets out why we use your data and the legal basis for each.

Where we rely on legitimate interests, we have considered whether our interests are outweighed by your rights and freedoms.

How we use special category data

Special category data needs an additional legal condition on top of the lawful basis above.

Health information: We use this only to make adjustments to the recruitment process. We rely on Article 9(2)(b) UK GDPR (obligations in employment, social security and social protection law) and Schedule 1, Part 1, paragraph 1 of the Data Protection Act 2018.

Where we rely on this Schedule 1 condition, we keep an Appropriate Policy Document, as required by the Data Protection Act 2018. You can request a copy from privacy@yondatax.com.

Use of AI tools

We use third-party AI tools to help with recruitment tasks, such as:

• drafting job descriptions, emails and interview notes
• preparing interview questions and assessments
• scheduling interviews
• transcribing and summarising interview recordings
• summarising CVs and applications for interviewers
• drafting and reviewing offer letters and employment contracts

When we use these tools:

• we use business accounts only, under contracts that prevent the provider from using our data to train their models
• we only include the personal data needed for the task. Where possible, we remove names, addresses and other identifying details, including your witness's details, before using AI tools, for example when reviewing contracts, and avoid including health or other special category data
• summaries are there to support interviewers, who still review your full application and interview

We do not use AI tools to make decisions about you, such as shortlisting, interview outcomes, offers or the terms we offer you. These decisions are always made by people.

Automated decision-making

We do not make decisions about you based solely on automated processing.

Who we share your data with

We share your data with the following third parties, who process it on our behalf and under contract:

• Ashby, our applicant tracking system
• reference and background check provider
• video interviewing and meeting recording providers
• AI tool providers
• Adobe Acrobat Sign, our e-signature provider
• HR advisers, and legal advisers who help us draft or review contracts and share option terms
• IT, communication and document storage providers

A list of our current providers is available on request from privacy@yondatax.com.

If you applied through a recruitment agency, we will share information about your application with them.

We also share data where the law requires us to, for example with the Home Office, courts and tribunals, or the police.

We do not sell your personal data.

International transfers

Some of our providers store or access data outside the UK, for example in the United States. Where this happens, we make sure appropriate safeguards are in place, such as the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, or the UK Extension to the EU-US Data Privacy Framework.

If you are based outside the UK

If you are applying from outside the UK, this notice applies to you too. Your data is transferred to and held in the UK, where we are based, and with the providers listed above.

Local data protection law may give you additional rights. As well as the ICO, you can complain to the data protection authority in the country where you are based. In South Africa, this is the Information Regulator.

How long we keep your data

Your rights

You have the right to:

• access the personal data we hold about you
• ask us to correct inaccurate or incomplete data
• ask us to delete your data, where there is no good reason for us to keep it
• ask us to restrict how we use your data
• object to us using your data where we rely on legitimate interests, including recording your interview
• ask us to transfer your data to another organisation, in some circumstances

To use any of these rights, contact privacy@yondatax.com. We will normally respond within one month.

Complaints

You have the right to complain to us if you think we have not handled your personal data in line with data protection law. You can do this by contacting privacy@yondatax.com. We will acknowledge your complaint within 30 days, investigate it, keep you updated and tell you the outcome.

You also have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk or on 0303 123 1113.