CAA Recruitment Privacy Notice

1.         Introduction

CAA will process personal information relating to job applicants hoping to work for CAA, as part of its application and recruitment process. The purpose of this privacy notice (“Notice”) is to inform those applying to work at CAA’s entities in the European Union and the UK (“EU”) about how their personal data will be processed and protected and their rights under data protection laws.

We are committed to the protection of personal data relating to job applicants (“you” or “your”) in line with the EU General Data Protection Regulation 2016 (“GDPR) and its implementing laws.

It is important that you read this Notice, so that you are aware of how and why we use your personal data and what safeguards are in place to protect it

We may amend this Notice from time to time and will inform you in advance of the effective date of any material changes that we intend to implement.

2.         Identity of the Data Controller

The controller of your personal data that you provide during the application and recruitment process will be the EU CAA entity that you are applying to work for, namely one of: Creative Artists Agency UK Limited, CAA Sports UK Limited and CAA ICON UK Limited, each of which has a business address at 12, Hammersmith Grove, London, United Kingdom W6 7AP, Creative Artists Agency GmbH, which has a business address at 11A Haus C 80797 Munich, Germany;  CAA Base Ltd, with its business address at 67-169 Wardour Street, London, United Kingdom, W1F 8WP; Or CAA Sports Sweden AB, with its business address at Varta Huset, Bryggavagen 133 178 51 Ekero, Sweden (referred to in this policy as “CAA”, “we” or “us”). This means that we are responsible for deciding how we hold and use your personal information and that we are  required to notify you of the information contained in this Notice.

If you have any queries about this Notice or how we process your personal data, you can contact using the details provided at the end of this Notice in the “Contacting Us” section.

                                                                                          

3.         Our Legal Basis for Processing your Personal Data

We will collect various types of personal information from you during the application process. Further details of the personal data we collect and how we use it are set out in Section 4 (‘What Information do we Collect’) below.

We only process personal data about applicants where the processing can be legally justified. This will usually be where the processing is necessary:

• Pursuant to Art. 6 (1) b) of the GDPR the processing is necessary to take steps at your request as you sent us your application and we are checking whether you are a promising candidate;
• if you are successful, to enter into and/or to perform the employment contract;
• to ensure compliance with our legal obligations as a potential employer, e.g. to ensure you have the right to work; and/or
• for our legitimate interests (or those of a third party), provided that your interests and fundamental rights do not override those interests, e.g. for effective management of the recruitment process, to assess and confirm a candidate’s suitability for employment and to decide whom to offer a job. For further information, please contact us using the details in the “Contacting Us” section at the end of this Notice.

 

In rare cases, we also may need to process personal data about applicants in order to respond to and defend against legal claims.

 

In the case of special categories of personal data (such as information about your health), additional conditions apply to our use. We therefore usually only process such information in the following circumstances:

• with your explicit written consent, where permitted by law. Further details about the processing of such data will be provided to you at the time such consent is sought;
• where it is necessary for the purposes of performing obligations or exercising rights under employment law, for example, if we need to make reasonable adjustments to the recruitment process for candidates who have a disability or if you are subsequently offered employment with us; and/or
• where it is necessary in order to establish, exercise or defend potential legal claims.

 

4. What Information do we collect?

In order to decide whether to shortlist you as a candidate and in order to contact you in relation to your application, we may ask for or you may disclose the following information about yourself up to and including the shortlisting and interview stages of the recruitment process:

• your name and contact details (e.g. address, home and mobile phone numbers, email address);
• your curriculum vitae (CV)/resume;
• details of your qualifications, skills, experience, employment history (including job titles, references, current salary and benefit entitlements), personal interests*, languages spoken and job preferences (i.e. willingness to relocate and type of employment sought);
• salary expectations;
• If you have the right to work in the relevant jurisdiction and if you have sponsorship requirements;
• Whether you have friends or family members currently working with us; and
• details of your referees*, where permitted by local law.

 

We may not be able to process your application without this information except as marked with * above which indicates that provision is voluntary.

After the shortlisting stage, we may need to collect some or all of the following information about you to allow us to make our final decision as to whether to recruit you:

• additional information about your previous academic and/or employment history, including, where permitted by local law: details of any conduct, grievance or performance issues, appraisals, time and attendance, from references obtained about you from previous employers and/or education providers*;
• whether or not you have a disability for which the organisation needs to make reasonable adjustments during the recruitment process;
• information regarding your academic and (where relevant) professional qualifications;
• information regarding any relevant criminal convictions, where permitted by local law; and
• where relevant and permitted by local law, your nationality and immigration status and information from related documents, such as your passport or other identification and immigration information and a copy of your driving licence, in order to comply with our legal obligations to verify your right to work, for example, in the UK.

If your application is successful, we will use the information provided above (where relevant and permitted by local law) to the extent necessary to administer your employment. Further details about how we will process your personal data pursuant to your employment will be provided in our Employee Privacy Notice, a copy of which will be provided to you during the onboarding process.

 

We will not carry out any solely automated decision making using your personal data during the application process.

 

Criminal Records Checks

For some roles and subject to local laws, we are obliged to seek information about criminal convictions and offences. Where we seek this information, we do this because it is necessary for us to carry out our obligations in relation to employment and because the checks we carry out are necessary and proportionate to the role applied for. If we intend to perform a criminal records check, we will inform you in advance and provide you with further information, for example, about the type of offences we need to know about and the consequences of a positive result.

 

5.         How We Source Your Personal Data

Most of the personal data that we process about you during the application process will have been provided by you, for example, when you complete our application form or provide your CV. We may obtain additional personal data about you from your referees, where this is permitted by local law, such as former employers (where you provide their details in order for us to obtain a reference from them and depending on local law requirements you provided us with a written consent to obtain such information), educational establishments where you have received qualification and criminal records bureaux (such as the Disclosure and Barring Service in the UK) or from recruitment agencies.

Where this is permitted by local law, we may also review social media profiles (generally professional networks) and consider information that is publicly available.

 

6.         Disclosure of Your Personal Data

We will share your personal information collected during the application process with other parties, such as our service providers under the protection of contractual agreements with them. This includes the provider of our recruitment platform, Workday Inc., who will have access to applicants’ personal data in order for them to provide their services to us and HireRight, the company who carry out our background checks who will have access to information that you provide them directly in order for them to provide their services to us.

Your personal information may also be accessed by other CAA group companies for one of the purposes described in this Notice. This includes our parent company, Creative Artists Agency, LLC (“CAA LLC”), who may assist us in the recruitment process and to allow CAA LLC to carry out processing activities on our behalf, including the storage and hosting of personal data for security purposes, including system back-up and failure. Your personal data will only be accessible by competent employees of CAA LLC who need to know this data for their job role.

 

We will also disclose your personal information to third parties:

• in the event that we sell or buy any business or assets, in which case we may disclose your personal data to the prospective seller or buyer of such business or assets;
• if we or substantially all of our assets are acquired by a third party, in which case personal data held by us about our applicants and employees will be one of the transferred assets; and/or
• if we are under a duty to disclose or share your personal data in order to comply with any legal obligation, or in order to enforce or apply our agreements; or to protect the rights, property, or safety of us, our applicants, employees, customers and providers.

 

If your application for employment is successful and we make you an offer of employment, we will share your data with your former employers in order to obtain references for you, and HireRight, the company who carry out our background checks who will have access to information that you provide them directly in order for them to provide their services to us.

Further information can be obtained by contacting us using the details set out in the “Contacting Us” section at the end of this Notice.

 

7.         Where Information May be Held

CAA is a global organisation head-quartered in the US. This means your personal data may be transferred to or accessed from outside the UK/EEA in a jurisdiction that is not governed by EU data protection laws. However, safeguards are in place to protect applicant data in these circumstances as further described below.

The transfer of applicants’ personal data from CAA entities located in the UK/EEA to CAA LLC in the US is governed by EU Commission-approved Standard Contractual Clauses for controllers. You can request a copy by contacting us using the details provided in this Notice below.

The provider of our recruitment platform, Workday Inc., has entered into model clauses with us, which provides protection for personal data that has been transferred from the UK/EEA in line with EU and UK privacy laws.

Microsoft Corporation, the provider of our email communication system and cloud-based storage platform, has entered into model clauses with us, which provides protection for personal data that has been transferred from the UK/EEA in line with EU and UK privacy laws.

 

8.         Storage of Your Personal Data

We will keep the personal information that we obtain about you for as long as we need to in order to complete our recruitment process. Personal data relating to unsuccessful applicants will then be deleted at the latest 6 months following completion of our recruitment process, unless you have agreed to us retaining your details so that we can inform you of any suitable vacancies that arise in which case we will retain your personal information for up to 2 years.

If your application is successful, we will keep only the recruitment information that is necessary in relation to your employment in accordance with our Employee Privacy Notice and our records retention policy.

We take the security and confidentiality of your personal information very seriously. We will use strict procedures and security features to aim at preventing unauthorised access. Unfortunately, the transmission of information via the internet is not completely secure. Although we will do our best to protect your personal data, we cannot guarantee the security of your data transmitted to us; any transmission is at your own risk.

 

9.         Your Rights  

As a data subject, you have a number of rights. These rights are not absolute and may be subject to certain conditions and exemptions under the GDPR/local implementing laws.

 

The right to:

• request access to your personal information (commonly known as a “data subject access request”). This enables you to receive a copy of the personal information we hold about you and to check that we are lawfully processing it;
• require us to change incorrect or incomplete data we hold about you;
• request erasure of your personal information. This enables you to require us to delete your data, for example, where the data is no longer necessary for the purposes of processing. You also have the right to ask us to delete or remove your personal information where you have exercised your right to object to processing (see below);
• in certain circumstances to request the transfer of your personal information to another party; and
• request the restriction of processing of your personal information, for example if you want to establish its accuracy or the reason for processing it.

 

You also have the right to object to the processing of your personal information where we are relying on a legitimate interest (or those of a third party) and there is something about your particular situation that makes you want to object to processing on this ground.

You will not have to pay a fee to access your personal information (or to exercise any of the other rights above). However, we may charge a reasonable fee if your request for access is clearly unfounded or excessive. Alternatively, we may refuse to comply with the request in such circumstances.

Where we rely on your consent to process your personal data, you have the right to withdraw your consent for that specific processing at any time. If we receive notice from you withdrawing your consent, we will stop that specific processing of your personal data.

If you think any information we have about you is incorrect or incomplete, please write to us or email us using the contact details set out in the “Contacting Us” section below and we will correct or update any information as soon as possible.

Should you wish to exercise any of these rights, please contact us using the contact details set out in the “Contacting Us” section below.

 

10.       Contacting Us

If you have any questions about this privacy notice or the information we hold about you please contact privacy@caa.com or sent by post to Katerina Krumwiede, c/o Business Affairs, London at CAA, 12 Hammersmith Grove, London W6 7AP. Where you are a job applicant for a position in our Munich office, please note, you may also contact Abigail Carpenter by phone on 0044 (0)2083964640.

 

11.       Complaints

You have the right to lodge a complaint with a supervisory body for data protection in your jurisdiction or competent for the respective CAA entity that processes your personal data, if you are not happy with how we handle your personal data.