Privacy policy for the watchTowr employer branding and recruitment

Date of publication: 12-09-2025

We at watchTowr manage our employer branding and recruitment process through our career site (the “Career Site”), and by using a related applicant tracking system.

In this privacy policy, we explain how we process your personal data if:

1. You visit our Career Site (you being a “Visitor”)
2. You connect with us via our Career Site, to create a profile with us and receive information about current or future vacancies with us (you being a “Connecting Candidate”)
3. You apply for a position with us, via our Career Site or a third party service (you being an ”Applying Candidate”)
4. We collect information about you from other parties, sites and services, since we believe your profile is of interest for our current or future vacancies (you being a “Sourced Candidate”)
5. We receive information about you from our employees or partners, since they believe your profile is of interest for our current or future vacancies (you being a “Referred Candidate”)
6. We receive information about you from a Candidate, who lists you as their reference (you being a “Reference”).

This privacy policy also describes what rights you have when we process your personal data, and how you can exercise these rights.

When we use the term “Candidate” in this privacy policy, we are referring to each of Connecting Candidates; Applying Candidates; Sourced Candidates; and Referred Candidates, unless it’s stated otherwise.

1. About processing of personal data

Personal data is all information that can be directly or indirectly linked to a living, physical person. Examples include name, e-mail address, telephone number and IP address. Processing covers any use of personal data - collecting, creating, analysing, sharing and deleting.

Different data protection laws apply in different places. For the processing described in this privacy policy, the main laws are the UK GDPR and Data Protection Act 2018 (for the UK), the EU GDPR (for the EEA), the Singapore Personal Data Protection Act 2012 (PDPA), and applicable US state privacy laws (including the California CCPA/CPRA).

Most obligations apply to the data controller - the entity that decides the purposes and means of processing. A processoronly processes personal data on the controller’s instructions.

We are the data controller when we process your personal data as described in this privacy policy.

Special category data (UK/EEA): where we process special category data (for example equal opportunities data or health information for interview accommodations), we identify both an Article 6 legal basis and an Article 9 condition (for example substantial public interest for equality of opportunity, or obligations in employment law) and apply required safeguards under the UK GDPR / GDPR and, in the UK, Schedule 1 of the Data Protection Act 2018.

2. What personal data do we process?

All individuals

• Device information - If you visit our Career Site, we will collect information about your device, such as IP address, browser type and version, session behaviour, traffic source, screen resolution, preferred language, geographic location, operating system and device settings/usage.
• Technical and statistical data - If you visit our Career Site, we will collect technical and statistical data about your use of the site, such as information about which URLs you visit, and your activity on the site.
• Communications data - We will collect and store your communication with us, including the information you provided in the communication. This may include the content of emails, video recordings, messages on social media, the information you add to your account with us, surveys, etc.
• Contact details - Such as your name, email address, telephone number and physical address.

Candidates

• Data from interviews, assessments and other information from the recruitment process - Such as notes from interviews with you, assessments and tests made, salary requirements.
• Information in your application - Such as your CV, cover letter, work samples, references, letters of recommendation and education.
• Information in your public profile - Meaning the information we collect about you from public sources related to your professional experience, such as LinkedIn or the website of your current employer.
• Information provided by references - Meaning the information we receive from our employees or partners who refer you to us, or by the persons you have listed as your references.

3. Where do we receive your personal data from?

All individuals

• From the Career Site. If you visit our Career Site, we collect technical and statistical information about how you use the Career Site, and information from your device.
• Directly from you. Most of the information we process about you, we receive directly from you, for example when you apply for a position with us or connect with us. You can always choose not to provide us with certain information. However, some personal data is necessary in order for us to process your application or provide you the information you request to get from us.

References

• From the person for whom you are a reference. If a Candidate lists you as their reference, we will collect your contact details from the candidate to be able to contact you.

Candidates

• From public sources. We may collect personal data about you from public sources, such as LinkedIn or the website of your current employer.
• From our references. We may receive information about you from our employees or partners (such as recruitment service providers), when they believe your profile is of interest for our current or future vacancies.
• From your references. If you provide us with references, we may collect information about you from them.
• Data we create ourselves or in cooperation with you. Information about your application and profile is usually created by us, or by us in cooperation with you, during the recruitment process. This may for example include notes from interviews with you, assessments and tests made.

4. For what purposes do we process your personal data?

Protect and enforce our rights, interests and the interests of others, for example in connection with legal claims.

Affected individuals: The individual(s) affected by the legal issue - this may include persons from all categories of individuals listed above.

Categories of personal data used: All the categories of personal data listed above can be used for this purpose.

Share your personal data with other recipients, for the purposes mentioned in Section 5 below.

Affected individuals: Varies depending on the purpose of the sharing, see Section 5 below.

Categories of personal data used: All the categories of personal data listed above may be used for this purpose.

Collect information about your use of the career site, using cookies and other tracking technologies, as described in our Cookie Policy.

Affected individuals: Visitors.

Categories of personal data used: Device information.

Maintain, develop, test, and otherwise ensure the security of the career site.

Affected individuals: Visitors.

Categories of personal data used: Device information; Technical and statistical data.

Analyse how the career site and its content is being used and is performing, to get statistics and to improve operational performance.

Affected individuals: Visitors.

Categories of personal data used: Device information; Technical and statistical data.

Provide you with updates about vacancies with us.

Affected individuals: Connecting Candidates.

Categories of personal data used: Contact details; Communications data.

Review profiles and applications sent to us. This also includes communicating with you about your application and profile.

Affected individuals: Connecting Candidates; Applying Candidates.

Categories of personal data used: All the categories of personal data listed above may be used for this purpose.

Collect and evaluate your professional profile on our own initiative. This also includes communicating with you regarding your profile.

Affected individuals: Sourced Candidates; Referred Candidates.

Categories of personal data used: All the categories of personal data listed above may be used for this purpose.

Contact you directly about specific, future vacancies with us.

Affected individuals: Candidates.

Categories of personal data used: All the categories of personal data listed above may be used for this purpose.

Record the interview(s) with you.

Affected individuals: Candidates.

Categories of personal data used: Communications data.

Contact you to ask for your participation in surveys

Affected individuals: Candidates.

Categories of personal data used: All the categories of personal data listed above may be used for this purpose.

Contact you to ask you to provide information about a candidate, and evaluate the information you provide.

Affected individuals: References.

Categories of personal data used: Contact details; Communications data.

5. Whom do we share your personal data with?

Our service providers. We share your personal data with our suppliers who provide services and functionality in our employer branding- and recruitment process. For example, this includes recruitment service providers and the supplier of our Career Site and related applicant tracking system.

Our group companies. We share your personal data with our group companies, when they provide us services and functionality to our employer branding- and recruitment process, such as access to particular systems and software.

Companies providing cookies on the Career Site. If you consent to it, cookies are set by other companies than us, who will use the data collected by these cookies in accordance with their own privacy policy. You can find information about which cookies this applies to in our Cookie Policy.

To authorities and other public actors - when we are ordered to do so. We will share your personal data with authorities and other public actors when we have a legal obligation to do so.

To parties involved in legal proceedings. If needed to protect or defend our rights, we share your personal data with public authorities or with other parties involved in a potential or existing legal proceeding. This can for example be in case of discrimination claims.

Mergers and acquisitions etc. In connection with a potential merger, sale of company assets, financing, or acquisition of all or part of our business to another company, we may share your personal data to other parties involved in the process.

We do not sell candidate personal information. If we use cross-context behavioural advertising or similar technologies on the Career Site, you can manage your choices via our Cookie Policy and any regional links we provide (for example, “Do Not Sell or Share My Personal Information” for California).

6. On what legal bases do we process your personal data?

To process your personal data we need a legal basis.

UK / EEA: we primarily rely on legitimate interests to recruit talent and operate a secure, effective Career Site. Depending on the activity, we may also rely on contract (steps at your request prior to entering into a contract), legal obligation, and consent where required (for example, recording an interview). For any special category data, we identify an Article 6 basis and an Article 9 condition (for example substantial public interest for equality of opportunity or obligations in employment and social protection law) and apply appropriate safeguards.

Singapore (PDPA): we rely on consent or applicable PDPA exceptions (including the Legitimate Interests Exception) where we have assessed benefits vs. adverse effects and implemented safeguards. You may withdraw consent at any time, and we will inform you of consequences where relevant.

United States: for California and other applicable states, we process applicant personal information for business purposes such as recruiting, security and compliance. We do not sell applicant personal information.

You can contact us for more details about our assessments. See Sections 9 and 10 for contact details.

7. When do we transfer your personal data outside of the EU/EEA, and how do we protect it then?

We aim to process personal data within the UK or EEA where possible. Some of our service providers or group companies are located - or access data - outside these regions.

When we or our suppliers transfer personal data internationally, we use safeguards recognised by the relevant law:

• EEA → US: where the US recipient is certified, we rely on the EU Commission’s adequacy decision for the US via the so-called EU-US Data Privacy Framework, and the adequacy decision for the UK.Otherwise we use the EU Commission’s standard clauses with transfer risk assessments and additional safeguards where appropriate.
• UK → US: where the US recipient is certified, we rely on the UK-US Data Bridge (the UK extension to the DPF). Otherwise we use the UK IDTA or the EU SCCs with UK Addendum, with assessments and safeguards.
• EEA → UK: we rely on the EU’s adequacy decision for the UK.
• Other destinations: we rely on applicable adequacy regulations/decisions or appropriate safeguards (for example contractual clauses) recognised by the sending jurisdiction.

If you would like more information about specific transfers and safeguards, contact us using the details in Sections 9 and 10.

8. For how long do we keep your personal data?

All individuals

If we process your personal data for the purpose of being able to protect and enforce our rights, we will keep your personal data until the relevant legal issue has been fully and finally resolved.

Visitors

We keep your personal data for one (1) year for security purposes. The retention periods for cookies are set out in our Cookie Policy. We keep your personal data to analyse the performance of the Career Site for as long as we keep personal data about you for other purposes.

Candidates

If you are a Connecting Candidate (only), we keep your personal data for as long as you remain connected with us.

For other types of Candidates, we keep your personal data to decide if you are a suitable candidate for the relevant vacancy(ies) with us.

If you don’t succeed in the initial recruitment process, we keep your personal data for as long as needed to consider, and potentially contact you, for relevant future job openings.

If you are hired, we will keep your personal data during your employment, for other purposes than those stated above, which you will be informed of.

References

We keep your personal data for as long as we keep the personal data of the Candidate for whom you acted as a reference.

9. What rights do you have, and how can you exercise them?

Your rights depend on where you live.

UK / EEA (UK GDPR / GDPR)

• Rights to be informed, access, rectification, erasure, restriction, portability and objection, in line with the law.
• Where we rely on legitimate interests, you may object and we will assess your request.
• Where processing is based on consent, you can withdraw consent at any time.

Singapore (PDPA)

• Rights to access and correction, and to withdraw consent. We may refuse or redact certain requests where permitted by the PDPA. We retain personal data no longer than is necessary for legal or business purposes.

United States (including California)

• Depending on your state, you may have rights to know/access, correct, delete, and to opt out of sale or sharing or targeted advertising. For California residents specifically, see our California Applicant Privacy Notice for required disclosures and how to exercise rights. We do not sell applicant personal information.

How to exercise your rights

• Use the Data & Privacy page on our Career Site where available;
• Log in to your account settings; or
• Contact us at martyna.ryder@watchtowr.com.
  We may need to verify your identity and will respond within the time required by applicable law.

Complaints

• UK: Information Commissioner’s Office (ICO) - see https://ico.org.uk.
• EU: your national data protection authority, which you can find listed here if you are based in the EU.
• Singapore: Personal Data Protection Commission (PDPC) - see https://pdpc.gov.sg.

Right to withdraw consent
Where we rely on consent (for example, if we record an interview), you can withdraw consent at any time and we will stop that processing. This does not affect the lawfulness of processing before withdrawal.

10. Where can you turn with comments or questions?

If you want to get in touch with us to exercise your rights, or if you have any questions, comments or concerns about how we handle your personal data, you can reach us by sending an email to martyna.ryder@watchtowr.com.

For California residents making a rights request, please include “California Applicant Request” in your subject line. You may use an authorised agent, subject to verification and written permission.

10A. Background checks in the United States

If we request a background check (a “consumer report”) for a US role, we will first provide a stand-alone disclosure and obtain your written authorisation under the Fair Credit Reporting Act (FCRA). If we consider taking adverse action based on a report, we will provide a pre-adverse action notice, a copy of the report and the Summary of Your Rights under the FCRA, and later an adverse action notice if applicable.

11. Updates to this Privacy policy

We update this privacy policy when necessary - for example, because we start processing your personal data in a new way, because we want to make the information even clearer to you, or if it’s necessary to do so in order to comply with applicable data protection laws.

We encourage you to regularly check this page for any changes. You can always check the top of this page to see when this privacy policy was last updated.

Annex - California Applicant Privacy Notice 

California Applicant Privacy Notice

• Categories collected: identifiers; professional/employment information; education; internet/network activity; geolocation (approximate IP-based); audio/visual (interview recordings if you consent); protected classification/sensitive information if provided or required by law for specific roles.
• Sources: you; your devices; public professional sources; referrers; references; service providers; group companies.
• Purposes: recruiting and evaluating candidates; communicating with you; operating and securing the Career Site; maintaining talent pipelines; compliance and legal.
• Disclosures: to service providers, group companies, analytics/cookie partners (with consent), and authorities or others where required by law or for legal claims.
• Selling or sharing: we do not sell or share applicant personal information for cross-context behavioural advertising.
• Retention: typically 12 - 24 months for unsuccessful applicants, subject to legal requirements.
• Rights and requests: access/know, correct, delete, limit use of sensitive personal information in defined circumstances, and opt out of sale/share if ever applicable. Submit requests via the Career Site privacy features or martyna.ryder@watchtowr.com (subject “California Applicant Request”). We will verify your identity and respond within CCPA timelines. No discrimination for exercising rights.