Applicant and Candidate Privacy Notice and Artificial Intelligence (AI) Notice
Last updated: 07/07/2025
Purpose
The purpose of this privacy notice is to document the basis for processing your information and to inform job candidates of Kraken Technologies Limited and its subsidiaries (together, “Kraken”) about why, when and how we process information provided to us by them and others.
By continuing with your job application with Kraken, you consent (where required by applicable law) to both the processing for this application and other appropriate positions, and understand that this may result in your data being involved in automated decision making and/ or assessment by AI in support of these processes. You can opt-out at any time for being considered for other appropriate positions by contacting us as set out in this privacy notice.
Scope
This privacy notice applies to the processing of personal data collected in connection with career opportunities at Kraken, including during the recruitment and hiring process. It explains how and why we collect, use, store, and share your personal data, and outlines the rights and choices you have regarding your information.
The data controller for the processing of your personal data is the Kraken entity in the country from which you would work if you were offered a job at Kraken. If you are unsure which country or entity this would be, please contact us dpo@kraken.tech. You can find out more about our Kraken group here.
Kraken has appointed a Data Protection Officer (DPO), who is responsible for overseeing questions in relation to this privacy notice. If you have any questions, or any requests to exercise your legal rights, please contact us by email at dpo@kraken.tech.
How your personal data is collected
We use different methods to collect personal data from and about you including through:
Your Interactions With Us. We collect most of this personal data directly from you, for example by filling in online forms, contacting us, completing your application and/or assessments, your CV, and any other documents or communications you provide. We may also collect data during interviews, assessments, or other interactions, including notes and recordings where applicable.
Third-Party Sources. We may receive your personal information from a variety of third-party sources, including employment screening agencies, background check agencies, recruiting agencies, service providers, former employers, educational institutions, and publicly available information on websites or social media (e.g., LinkedIn, when relevant for recruitment purposes and allowed by law). For example, if you register to be contacted by prospective employers on another website, that website may share your personal information with us.
Publicly Available Sources. We may review publicly accessible information to support the recruitment process. This includes professional networking sites such as LinkedIn, personal websites, portfolios, or other online platforms where you have made your professional information available.
Third-Party Login Mechanisms: If you choose to connect your job application via a third-party login mechanism (e.g., Facebook, Google, or LinkedIn login), we will collect information from those third parties according to your privacy settings on their services. This information could include your name, language preference, birth date, profile picture, and similar details.
Internal Sources. If you have previously applied for a role with us or another member of the Kraken group or have been referred by a current employee, we may use data from those earlier interactions or referrals to inform our decision-making.
Technical and Security Systems. If you attend an interview or office tour at one of our premises, we may collect data from our technical systems, such as visitor access logs or CCTV footage, to ensure the safety and security of our staff and visitors.
Automated technologies. We use standard automated data collection tools, such as cookies, web beacons, tracking pixels, tags, and similar tools, to collect Internet and device activity information about how people use our websites and interact with our emails. We may also use the information we collect automatically (for example, IP address, and unique device identifiers) to identify the same unique person across our various services to provide a more seamless and personalized experience to you. The types of data collection tools we use may change over time as technology evolves. You can learn more about our use of cookies and similar tools, as well as how to opt out of certain data collection, by reading our Cookies Notice.
Types of information we collect and process
The table below sets out the categories of personal data we collect and use.
| Category | Category under the CCPA | Description |
|---|---|---|
| Application Data | Identifiers. Professional or employment-related information. Education information, and other data you provide us. | Personal data provided by you or the person who referred you. This includes: Contact information, such as your full name, email address, mobile phone number, home address, and any other contact information; Details related to your work experience, such as your CV or resume, cover letter, academic qualifications, transcripts; Information about the type of employment you are looking for or may be interested in, including targeted compensation, benefits and other job preferences; Publicly available information from publicly available sources relevant for the hiring process, e.g. your LinkedIn or GitHub profile, other social media profiles; and Other information provided by you in the hiring process. |
| Interview Data | Professional or employment-related information. Education information. Other data taken down during the recruitment process | Personal data collected from interviews and outcomes of any recruiting exercises you complete, including personality/reasoning ability tests and, for certain roles, recordings of presentational based interviews. |
| Background Check Data | Identifiers. And other data about you provided via background checks and other similar records. | Information received from internal and external reference and background checks, including screening, and criminal records at offer stage only (if applicable for the position you have applied for, and as permitted by applicable laws). |
| Travel Data | Identifiers. | Personal data we process if Kraken is arranging travel for on-site interviews, such as passport information. |
| Immigration and Visa Data | Identifiers. | Information related to your immigration status and visa requirements, including evidence of how you meet nationality and right to work rules, including passports and other identity documents. |
| Premises Data | Identifiers. Sensory Data. Internet or Other Electronic Network Activity Information. Geolocation Data. | We may process personal data relating to access logs to Kraken physical premises, and images recorded from CCTV systems in use in and around Kraken premises, where a job interview or office tour takes place onsite. |
| Voluntary Demographic Data | Characteristics and other data you provided us. | On a voluntary basis, we ask you to provide us with demographic information such as gender identity and, as permitted by applicable laws in some countries, race, ethnicity, and veteran status. This information will only be used to help us to evaluate and improve our diversity and belonging efforts on an aggregate level. This information will be processed separately from your application and whether you choose to answer will not affect your job application. |
How and why we use your personal data
We only collect and process data about you where we have a reason for doing so and only where that reason is permitted under data protection law.
Certain applicable data protection laws require us to have a legal basis for everything that we do with your personal data falling under one of the following categories:
Performance of a contract with you: Where we need to perform a contract we are about to enter into or have entered into with you.
Legitimate interests: We may use your personal information where it is necessary to conduct our business and pursue our legitimate interests, for example to prevent fraud and/or enable us to give you the best user experience. We make sure we consider and balance any potential impact on you and your rights (both positive and negative) before we process your personal data for our legitimate interests. We do not use your personal data for activities where our interests are overridden by the impact on you (unless we have your consent or are otherwise required or permitted to by law).
Legal obligation: We may use your personal data where it is necessary for compliance with a legal obligation that we are subject to.
Consent: We rely on consent only where we have obtained your active agreement to use your personal data for a specified purpose.
Vital Interests: We may process your personal data where we believe it is necessary to protect your vital interests or the vital interests of a third party, such as situations involving potential threats to the safety of any person.
We use your personal data in a number of different ways and for different reasons – the tables below set out what we do and why.
Where we have indicated that we rely on legitimate interests for the processing of your personal data, we carry out a ‘balancing’ test to ensure that our processing is necessary and that your fundamental rights of privacy are not outweighed by our legitimate interests before we proceed with such processing.
| Purpose/Use | Relevant categories of personal data | Our reasons (Legal basis) |
|---|---|---|
| To communicate with you throughout the hiring process. | Application Data | Pre-contractual necessity; Necessary for our legitimate interests (to manage and administer the recruitment process, including communicating with candidates about their applications, interviews, and outcomes.). |
| To assess your qualifications, skills, and suitability for the considered job. | Application Data Interview Data | Necessary for our legitimate interest (to evaluate a candidate’s suitability for employment, ensuring we hire individuals with the appropriate qualifications, experience, and skills necessary for the role. |
| To verify your provided information and carry out background checks. | Application Data Background Check Data | Necessary for our legitimate interest (to ensure the accuracy of information provided by candidates and to assess their integrity, trustworthiness, and suitability for the role, particularly where the position involves access to sensitive data, financial responsibilities, or security-sensitive environments); Consent (for certain background checks in certain countries); and Compliance with legal obligations (for legally required background checks in certain countries) |
| To book travel for on-site interviews, if applicable. | Travel Data | Necessary for our legitimate interest (to facilitate the recruitment process by arranging necessary travel logistics for candidates attending in-person interviews, ensuring a smooth and efficient experience for both the candidate and Kraken). |
| To consider you for, and inform you about future job opportunities. | Application Data Interview Data | Consent |
| To prepare your employment agreement if you are offered a job at Kraken. | Application Data Immigration and Visa Data | Performance of a Contract. |
| To assist you with obtaining an immigration visa or work permit (if requested by you). | Application Data | Necessary for our legitimate interest (to support the recruitment process by assisting candidates with immigration or work authorization requirements, where such assistance is necessary to enable lawful employment and has been requested by the candidate); and Compliance with legal obligations. |
| To capture footage to help prevent and detect crime and for security purposes. | Premises Data | Necessary for our legitimate interest (to ensure the security of our and our premises and for purposes of detecting and preventing crime). |
| To comply with applicable laws, regulations, legal processes or enforceable governmental requests, e.g. immigration and visa laws and requirements. | Application Data Interview Data Background Check Data Immigration and Visa Data | Compliance with legal obligations. |
| To evaluate and improve our diversity and belonging efforts on an aggregate level. | Voluntary Demographic Data | Consent |
Automated decision-making in our recruitment practices
Kraken may use an automated decision-making tool (“Tool”) that increases the robustness of our recruitment practices in certain cases when (i) you apply for a new position; and (ii) your personal information is included in our talent pipeline. We do not make recruiting or hiring decisions based solely on automated decision-making or profiling (as those terms are defined under applicable local laws).
The Tool considers your suitability for a specific position based on three areas set by the hiring manager: skills, location and job titles. The better the fit with the requirements for the open position, the higher your profile will rank for these criteria. It is important to note that our internal recruiters do not solely rely on the Tool, but it may assist to prioritize applications. They are trained and empowered to use their personal judgment and experience, and do not have to follow the pre-ranking suggested by the Tool.
The Tool does not consider other factors such as (if applicable) visa requirements, relocation willingness and salary expectations. These are still manually evaluated by our recruiters. Apart from your personal information relating to these three criteria, your other personal information is not processed by the Tool. The Tool is used solely by the internal HR recruiters of Kraken. Your personal information is not used to train AI models.
We may aggregate or de-identify the information we collect to limit or prevent the identification of any specific individual. This helps us achieve goals such as research and recruiting. For example, we might analyze trends in job applications and candidate life cycles, generating reports in an aggregated and de-identified or anonymized format. Once information is anonymized and no longer considered personal information under applicable data protection laws, this notice no longer applies.
Sharing your personal data
We may disclose some or all of your personal data with:
Our Kraken Group companies, where necessary for the provision of our services;
Internal business units such as HR, IT, Finance/Payroll, Managers, Legal;
System administrators and support staff who have advertised a vacancy or who will interview you;
Your previous employers where you have provided them as a reference;
Recruitment agencies;
Service providers who assist the Kraken Group with recruitment initiatives and campaigns or with their underlying tools or services;
Professional advisors such as legal advisors, consultants and accountants;
Law enforcement agencies or regulatory bodies, where we are under a duty to disclose or share it to comply with a legal obligation.
Third parties in the event of a reorganization, sale, merger, consolidation, joint venture, assignment, transfer, or other disposition of all or part of our business, assets, or stock (including during bankruptcy proceedings).
We may disclose your personal information in other ways if you have given us consent to do so.
Kraken Technologies Limited and certain of its subsidiaries are based in the UK, but we may sometimes share your personal data with third parties outside of the United Kingdom (UK) or European Economic Area (EEA). Whenever we transfer your personal data outside of the UK/EEA, we will always ensure it is protected by reasonable safeguards, including (but not limited to) only transferring personal data to countries that have been deemed by the Information Commissioner or European Commission to provide an adequate level of protection, or by using specific contractual protections. You can contact dpo@kraken.tech for details.
How long do we retain your personal data for
We will only retain your personal data for as long as necessary to fulfil the purpose(s) for which we have collected, including for the purposes of satisfying any legal, regulatory, accounting, or administrative requirements.
To determine the appropriate retention period for the personal data we hold, we consider the amount, nature and sensitivity of the personal data, the risk of harm from unauthorised use or disclosure of your personal data, the reasons why we handle your personal data, the applicable legal requirements and whether we can achieve those purposes through other means.
In some circumstances, we may anonymise your personal data (so that it can no longer be associated with you) for research or statistical analysis. In these cases, we may use this information indefinitely without further notice to you.
What are my rights under data protection laws?
You have various rights under data protection laws which you can exercise by contacting us. The easiest way to do this is by email to dpo@kraken.tech. We have set these out below.
When Kraken has obtained your consent to process your personal information, you have the right, under applicable law, to withdraw that consent at any time with future effect. If you choose to withdraw your consent, it will not affect (1) the lawfulness of any processing conducted by Kraken prior to the withdrawal, or (2) Kraken’s continued processing of some or all of your personal information under other legal bases, where applicable.
Please note that we may need to verify your identity before facilitating or enabling you to exercise your personal information rights. This may require you to provide certain information when submitting such requests. Under applicable law, you may also submit personal information requests through an authorized agent. In such cases, we may request additional information to verify the authenticity of the request and the agent’s authorization to act on your behalf.
Right to object
You have the right to object to us handling your personal data on the basis of our legitimate interests. If you ask us to stop handling your personal data in this way, we will stop unless we can show you that we have compelling grounds as to why we should continue to use your personal data.
Right of access
You have the right to access your personal data which we are handling, and you are entitled to receive confirmation and details about whether your personal data is being processed by us.
Right to rectification
You have the right to require us to rectify any inaccurate personal data we hold about you. You also have the right to ask us to complete personal data which you think is incomplete.
Right to restriction
You can restrict our processing of your personal data in certain circumstances.
Right to data portability
This right only applies to your personal data we are handling because you consented to us using it or because there is a contract in place between us. You have the right to receive your personal data in a structured, standard machine-readable format, and the right to ask us to send your personal data to another organisation or to give it to you.
Right to erasure
You have the right to require us to erase your personal data in certain circumstances.
Right to complain
You have the right to lodge a complaint with your supervisory authority. We would always rather you speak to us first if you have any questions about our handling of your personal data, so we can resolve any problems as quickly as possible. If you have any queries, issues or complaints regarding the processing of your personal data, you can contact us via email at dpo@kraken.tech.
The Information Commissioner's Office is the supervisory authority for data protection issues in the United Kingdom.
If you are located in the UK or the EEA, and you are not happy with the way we have handled your data, or would like more information about your rights, you can contact the Information Commissioner’s Office at https://ico.org.uk