YouGov Candidate Privacy Notice – FAQs

At YouGov, we are passionate about attracting, developing and retaining fearless talent across the world, and we are excited that you want to be part of that. Your personal data is a key part of our recruitment process – without it, we won’t be able to process your application, set up interviews or communicate with you – and we know that you place trust in us to treat your data responsibly.

We have created an FAQ to summarise the key points that you really need to know to ensure you understand how we collect and use your data. Our Candidate Privacy Notice is available in full on the following pages, so we encourage you to read on if you would like more information.

Q: What personal data do you need, and where do you get it?

A: We need two main types of information to run our recruitment process – your contact details, and the information that you would normally include in your CV. You may provide us with this information when you apply, or we may get it from third party job boards or recruitment agencies if you have previously registered with them.

Q: What do you use my personal data for?

A: Quite simply, we need this information to assess your suitability for roles that we are recruiting, and to contact you about those roles.

Q: What do you do with my personal data if my application is not successful?

A: We will ask if you would like to be added to our Talent Pool, so we can contact you about other roles at YouGov. If you agree, we will hold your data for 24 months. If you do not wish to be added to the Talent Pool, we will store but not otherwise use your data for 12 months.

Q: Do you share my personal data with anyone?

A: We may share your data with other companies in the YouGov Group, for example if you apply for a role that has a global remit it may be necessary to share your application with colleagues in other offices that are involved in the assessment or interviews. We also share data with our suppliers, who perform services on our behalf.

Q: Can I speak to someone if I want more information?

A: Yes, you can contact us at any time using the details provided in our Candidate Privacy Notice below (which also contains more information about the way we use your personal data, so we recommend reading this first, as it may answer any questions you have).

We hope that this information is helpful. Thank you for being interested in YouGov!

YouGov Candidate Privacy Notice

Last updated: 6 July 2022

As a global data company and provider of research insights, we take privacy and data security very seriously, and believe that everyone’s personal data should be handled responsibly and ethically. We know that without the trust of everyone whose data we collect and use, we could not produce the research that helps our clients make better decisions.

We’ve tried to make this notice as easy to read as possible, but if anything is unclear, please contact us dataprotection@yougov.com, and we’ll be happy to clear it up.

What this notice covers

As an organisation that relies on the use of personal data, YouGov is responsible for collecting and using your data in a responsible and secure way, and that starts with clearly telling you how we collect, use and protect your personal data. This notice sets out:

• The personal data we may collect from you;

• How and why we collect and use your personal data;

• Why we may share personal data within YouGov and with other organisations; and

• The rights and choices you have when it comes to your personal data.

YouGov is made up of a number of companies, each of which separately controls the data provided to it by those applying for roles at YouGov. A data controller is an organisation that chooses why and how personal data is processed, and you can check which YouGov group company is the controller of your data by matching the job location to this list. That data controller is referred to as “we”, “us”, “our” or “YouGov” in this privacy notice.

Personal data we collect

In this section we explain what personal data we may collect when you apply for a job at YouGov, as well as data that we may collect from other sources

Data that we collect from you

When you apply for a job with YouGov you will provide us with information that allows us to assess your suitability for roles that we are looking to fill. The table below describes the personal data that we collect from you during our recruitment process.

When you send us your job application and CV, we collect:	Contact details such as your name, email and postal address and phone number Any information that you have included in your application and CV, for example a covering letter
We may contact you over the phone or email for additional information, including:	Any additional information that will help us to progress your application, for example salary expectations, notice period and information that will help us schedule an interview
Should you be selected to attend an interview, we collect:	Any information that you provide to us during the interview, either in response to specific questions we ask or other information that you volunteer to us; this information may be recorded in note-form by our interviewers

Special categories of personal data

Some of the data that you provide us will fall within what data protection law describes as ‘special categories of personal data’, or ‘sensitive personal data’. This may include information about your racial or ethnic origin, religious beliefs or information concerning your health or sexual orientation.

Where we are legally able to do so, we may ask you to provide this type of data for diversity monitoring purposes. Providing information for this purpose will always be voluntary, and we will provide information about how the information will be used at the time we ask you to provide information.

Personal data collected from other sources

We may also collect personal data from the following other sources:

• Job boards and recruitment agencies, from which we collect contact information and any other information that you have uploaded to that site or provided to them to register; for example, if you apply through LinkedIn we will receive a summary of your public job board profile, and your CV if you choose to share it, and we may use the LinkedIn Recruiter tool to communicate with you.

• Referrers, from which we collect any information that a referrer sends to us for the purposes of demonstrating your suitability for a role.

How long we’ll keep your data

In this section we explain that how long we keep your personal data depends on how it is used

If your application for a role is successful, your data will be made available to our HR teams for the purposes of onboarding. Your data will then be held according to the retention periods stated in our Staff privacy notice, which is provided during the onboarding process.

If your application for a role is not successful, we will ask if you would like to be added to our Talent Pool so we can contact you about other roles at YouGov. If you agree, we will hold your data for 24 months from the date we communicate our hiring decision to you. If you do not wish to be added to the Talent Pool, we will store but not otherwise use your data for 12 months from the date we communicate our hiring decision to you. We hold data for 12 months so that, should we need to, we can show that we have conducted the recruitment exercise fairly.

You can exercise your right to erasure at any time, which is explained in the ‘Your Rights’ section below.

How and why we use your personal data

In this section we explain how and why we use your personal data

We use the data that you share with us, or that we receive from the other sources mentioned above, to communicate with you and to assess you against roles that we are recruiting. Our uses of personal data are described in more detail in the table below.

We use personal data to…	For example…
Assess your suitability for roles that we are recruiting	We will look at the skills, qualifications and work history described in your CV to determine whether you meet the requirements to be shortlisted, and will combine that with any information you provide in an interview to decide whether to offer you a role
Communicate with you about the recruitment process, or any other roles we think you may be interested in	We will use your email address and phone number to contact you to obtain more information or arrange an interview; if you are unsuccessful for a role (and you have consented to us doing so) we will put your information in our Talent Pool so we can contact you about other roles
Document our hiring process	We carefully document the hiring process so we are prepared for the rare cases where we need to exercise or defend our legal rights in connection to our recruitment process

Legal grounds for processing your personal data

YouGov is committed to the lawful, fair and transparent use of personal data. For most of the uses of personal data we have described, we process your personal data on the grounds that our processing is necessary for legitimate interests we pursue as a business, namely that our business relies on the ability to use your personal data to assess the suitability to appoint you to a role.

We will also ask you for your consent:

• To collect and use special categories of data (as described above); and

• Where you are unsuccessful for a role you have applied for and would like to add your details to our Talent Pool so we can contact you in the future about other roles at YouGov.

In addition, our processing of personal data can be necessary to exercise or defend our legal rights or to comply with our legal obligations.

If you have any questions about the grounds under which we process your personal data or would like to find out more about the approach we take to determine that these grounds apply, please contact our Data Protection Officer using the details in the ‘How to contact us’ section below.

Who we may share your personal data with

In order to use your personal data in the ways described above, we may share it within YouGov, with trusted third parties who provide services to us, and on rare occasions with clients (but only if you have specifically agreed to that). Here is some more information about the types of organisation and what we may share with them:

YouGov Group companies	YouGov is a global organisation. This means that some of the personal data that we collect may be transferred to companies in the YouGov group that are in different countries, for example, when we are recruiting for a role that has a global remit.
Our service providers	We work with trusted service providers that carry out certain functions on our behalf so we can provide our services to you. These organisations process data on our behalf. They only have access to the personal data that they absolutely need to provide the specific service to us, and in all cases we have contractual safeguards in place to ensure that they do not disclose or use it for any other purposes. Our service providers fall within the following categories: Cloud recruitment technology (tools such as SmartRecruiters that help us in the hiring process) Cloud & physical data storage (data storage, which is managed by YouGov Services Limited) Web application firewall (protects web applications by filtering and monitoring HTTP traffic between a web application and the Internet)
Other organisations	These circumstances are unusual, but we may share personal data with other organisations if: we have to share your information to comply with legal or regulatory requirements (or we reasonably believe that we need to disclose your information for such purposes); we need to share personal data in order to establish, exercise or defend our legal rights, including with our legal and other professional advisors; we restructure our business or if we buy or sell any business or assets we may share your data with the prospective buyer or seller; all or substantially all of our company assets are acquired by another

Transferring personal data outside the EEA

If you are based in the European Economic Area (“EEA”), or Switzerland, we take all steps possible to ensure that your personal data remains within those areas. However, in some cases we need to share data with other YouGov group companies or third parties that are in countries outside those areas. These countries may not have similar data protection laws and so they may not protect the use of your personal information to the same extent.

In these cases we put in place appropriate safeguards to make sure your personal data remains adequately protected. Specifically, we make use of the following:

• Standard contractual clauses: we use standard contractual clauses for the transfer of personal data to organisations outside the EEA. These contractual commitments have been adopted by the European Commission and ensure adequate protection for personal data transferred to countries outside the EEA by binding recipients of personal data to certain data protection standards including obliging them to apply appropriate technical and security measures. We use standard contractual clauses when we transfer data to other Yougov Group companies and for transfers to recipients that are not located in a country covered by an adequacy decision (see below).

• Adequacy decisions: where the European Commission, or other relevant competent authority, has determined that a country outside the EEA or Switzerland offers an adequate level of data protection, personal data may be sent to that third country without implementing any other safeguards mentioned above. YouGov may rely on adequacy decisions when transferring data to companies based in countries where such assurances have been given.

How we store and protect your personal data

We know how important it is to protect your personal data while we have it. This section describes some of the measures we take to ensure that it is kept secure

We do everything we can to protect your personal data from loss or misuse, and from unauthorised access, disclosure, alteration and destruction. This section describes some of the measures we take to ensure that your personal data is secure:

• We use data centres that have a high level of physical security measures to host and protect your data and our systems;

• We conduct independent penetration tests on an annual basis and are continuously scanning our systems and applications for vulnerabilities in our systems;

• We use encryption to secure your personal data whilst it is in transit using TLS and in storage using AES256 encryption;

• We allow access to attributable data (by which we mean data that directly identifies you) only to those YouGov employees and contractors who need it to carry out their job responsibilities, for example our support team to allow them to respond to you when you contact us;

• We make security the responsibility of all our employees and we train our staff to identify security risks and protect your data.

Our website may from time to time contain links to and from other websites. If you follow a link to any of those websites, please note that those websites ought to have their own privacy notices and that we do not accept any responsibility or liability for those websites. Please check those privacy notices before you submit your information to those websites.

Your rights

This section explains the rights that you have in relation to the personal data that we hold about you

You have certain rights in relation to the personal data that we hold about you, which are designed to give you more choice and control over your personal data. These rights are explained below.

Right	What does this mean?
The right to request access to personal data	You can request confirmation that we are processing your personal data, and a copy of the data we hold about you and related information (including when you gave us permission to use your data).
The right to request rectification of personal data	You can ask us to correct any inaccurate data about you and to complete any incomplete data that we hold about you.
The right to request erasure of personal data	You can request that we delete the personal data we hold about you.
The right to withdraw consent	Whenever you have given us your consent to use your personal data, you have the right to change your mind at any time and withdraw that consent.
The right to request a restriction on processing of personal data	You can request that we restrict our use of your data to storage only, that we stop using it for all other purposes or that we retain data that was due for deletion.
The right to object to the processing of personal data	You can object to certain types of processing of your personal data in certain specific circumstances.
The right of data portability	Whenever you have given us your consent to use your personal data, you have the right to receive a copy of your personal data in a structured and machine-readable format and, where possible, have this sent to another organisation.

Automated decision-making

We do not envisage that any decisions that will have a legal or other significant effect on you will be taken about you using purely automated means, however we will update this notice if this position changes and notify you of those changes.

Exercising your rights

You can exercise any of these rights by using the contact details below. Once you have submitted your request, we may contact you to request further information to authenticate your identity (because we want to make sure it is actually you requesting your data) or to help us to respond to your request. Except in rare cases, we will respond to you within 1 month of receiving this information or, where no such information is required, after we have received full details of your request. While some rights apply generally, some are only available in certain circumstances, so if we feel that any right is not available to you, we will let you know along with the reason for our decision.

Lodging a complaint with a regulator

You have the right to lodge a complaint with a data protection regulator where your legal rights have been infringed, or where your personal information has or is being used in a way that you believe does not comply with data protection regulations. You may also be entitled to seek judicial remedy. You can find the contact details of the appropriate regulator online, for example by searching for ‘Data Regulator’ and the country you live or work in. However, we encourage you to contact us before making any complaint and we will seek to resolve any issues or concerns you may have.

How to contact us

If you have questions about this notice, or about how we collect, store, and use personal data, or wish to exercise any of the rights described in the Your rights section of this privacy notice, you can contact our Data Protection Officer –

By email:	dataprotection@yougov.com
By mail:	The Data Protection Officer YouGov Plc 50 Featherstone Street London EC1Y 8RT United Kingdom

Updates to this notice

This notice was last updated on the date that appears at the beginning of the notice. While we reserve the right to change this notice at any time, if any material changes are made we will let you know via email or any other appropriate means to give you the opportunity to review the changes before they become effective.