Hiring Privacy Policy

Last updated: 10 October 2018

---

Reference in this policy to “Luno”, “we”, “us”, “our” or any similar term is to Luno Pte. Ltd, who is the data controller.

The purpose of this document

Luno is committed to complying with data protection laws, including, where applicable, the General Data Protection Regulation. This privacy notice applies to you if you apply to work with us as an employee, contractor or in any other capacity (an Application). It is intended to make you aware of how and why your personal data will be used as part of an Application process.

Data Protection Principles

Luno will comply with the following data protection principles:

• Your personal data will be used lawfully, fairly and in a transparent way;
• Luno will collect your personal data only for valid purposes, which we have clearly explained to you. Luno will not use your personal data in any way that is incompatible with those purposes;
• Luno will only collect personal data about you which is relevant and limited to the purposes we have told you about;
• Luno will ensure that your personal data is kept accurate and up to date;
• Your personal data will be kept only as long as necessary for the purposes we have told you about; and
• Luno will ensure that your personal data is kept securely.

The personal data we collect and where this is sourced

Standard Personal data

When you make an Application, we will collect, store, and use certain personal data about you. This will include the following types of personal data from the following sources:

• You may provide us with the following data when you complete our application form or when you agree to provide the data through a recruitment agency or platform: your name, email address, phone number, location (city), social media profiles and, where applicable, qualifications, statutory certifications, employment experience, training, current salary, desired salary, qualities which you have, motivating reasons for applying, any additional information in your curriculum vitae, covering letter, or any similar documents;
• You may provide us with certain personal information during an interview, test, assessment or other part of the Application process;
• We may obtain personal data about you from your listed references such as your previous employment dates, positions held, duties carried out, performance, your disciplinary record, personal qualities, skills, reasons for leaving previous roles and certain other information which may be volunteered about you; and
• We may obtain personal data about you from certain publicly accessible sources such as social media websites and other sites where you have a public online presence.

Background information and sensitive personal data

As part of your Application, we may also need to collect, store, and use the following types of personal data about you. This will only happen under the following circumstances and for the following limited purposes:

• We may ask you to disclose the existence of any fraud listings, criminal convictions and/or offences as part of the final stages of the application process. We may also independently check this information with external service providers together with information about your credit score. Given the nature of the services Luno offers its customers, any role requires a high degree of trust and integrity and so we use this information to satisfy ourselves that there is nothing which makes you unsuitable for the role. This is done as the last step of the application process and means that we will only process this information if we are considering offering you the relevant role.
• We may ask you to tell us your race for data capturing purposes, where this is required to meet our transformation obligations relevant to hiring.
• You may disclose your religious beliefs, disability status, health or any medical condition where it will assist us to make appropriate meal adjustments, access adjustments or other adjustments which you might need.

The purpose for which we use your personal data

We use your personal data (other than sensitive personal data, which is used exclusively for the reasons set out in the above section) to evaluate and hire candidates for the relevant role or services and, in particular, to decide whether to appoint you to the role or the services. This may include any of the following specific purposes:

• to assess your skills, qualifications and suitability for the relevant role or services;
• to notify you or your recruiter about the progress of your Application;
• to verify your identity and conduct a social media assessment, reference check and other assessments which are necessary for the performance of the role or the services;
• to otherwise manage and maintain your Application;
• to keep records related to our hiring and appointment process; and
• to comply with legal or regulatory requirements.

Consent to process your personal data

As part of your Application, you have consented to us using your personal data including, where necessary, your sensitive personal data for the purposes set out in the sections above. We acknowledge that your consent has been given for these purposes only. We will not use your personal data for any other purpose whatsoever without your approval.

You have the right to withdraw your consent for us to process your personal data for any of the aforementioned purposes at any time. To withdraw your consent, please send a written request to [email protected]. Upon receipt of such request, we will no longer process your Application and, subject to our retention policy, will dispose of your personal data securely.

Failure to provide personal data

If you fail to provide any personal data we have requested, we may not be able to process your Application. For example, if we require a credit check or references for this role and you fail to provide us with relevant details, we will not be able to take your Application further.

How we share personal data

For the purposes of processing your Application, we may share your personal data with:

• Any person that works for us who is involved in the hiring process;
• Any entity that forms part of the Luno group of companies, including (where relevant) the Luno operating entity in the country or region of the position to which you have applied;
• Third party providers of any recruitment management software that we use; and/or
• Companies and organisations that assist us with identity verification and employment checks.

All our third-party service providers and other entities in the Luno group are required to take appropriate security measures to protect your personal data in line with our policies. We do not allow third-party service providers to use your personal data for their own purposes and only permit the processing of your personal data for specified purposes and in accordance with our instructions.

Security of your personal data

Luno places great importance on data security and has put in place appropriate security measures to prevent your personal data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. We limit access to your personal data to those employees, agents, contractors and other third parties who have a business need-to-know in the hiring process. They will only process your personal data on our instructions and they are subject to a duty of confidentiality. We also have procedures in place to deal with any suspected data security breach and will notify you and any applicable regulator of a suspected breach where we are legally required to do so.

Data retention

We will retain your personal data for a period of 12 months after we have communicated to you our decision about whether to appoint you to the role, unless required by law to retain your personal data for a longer period of time. We retain your personal data for the purposes of recording and establishing that our appointment process is fair and transparent as well as for internal data analytics, internal auditing and talent mapping.

If we wish to retain your personal data for a further period of time, on the basis that a further opportunity may arise in future and we may wish to consider you for that, we will write to you separately, seeking your explicit consent to retain your personal data for a further period.

After the relevant retention period, we will securely destroy your personal data in accordance with applicable laws.

Global company

The personal data we collect may be transferred to, stored and processed outside of the jurisdiction in which you reside, and the laws of those countries may differ from the laws applicable in your own country. For example, data collected in the European Economic Area (EEA) may be transferred to, stored and processed at a destination(s) outside of the EEA. By providing us with your personal data in accordance with this Privacy Notice, you agree to the transfer, storing or processing of it outside of your jurisdiction.

Additional matters relating to personal data

Your right to access, update, or remove your personal data: Depending on the country in which you live, you may have certain rights under data protection law, including the right to object to the processing of your personal data or to request that we (i) provide you with a copy of your personal data; or (ii) correct, delete, or restrict the processing of your personal data. If you would like to exercise any of the above rights, please send a written request to [email protected].

Revisions to this Privacy Policy: We may amend this Privacy Notice from time to time. Where the amendment is material to your Application, we will do our best to notify you thereof.

Contacting Luno in relation to personal data: Should you have any query in relation to this Privacy Notice or how we handle your personal data, please contact us in writing at [email protected].