This Privacy Notice (“Notice”) explains how Nomo Fintech collects and uses personal data about job candidates (prospective employees) in connection with their application for employment.
This Notice explains, amongst other things:
Nomo Fintech is a technology business that provides its clients with solutions to power their online digital banking services and is part of the Boubyan Banking Group. Nomo Fintech is a trading name of BB2 Digital Technology Services Limited and BB2 Digital Technology Services ME Limited.
BB2 Digital Technology Services Limited and BB2 Digital Technology Services ME Limited (hereinafter “Nomo Fintech”) are separate independent controllers of any job candidate personal data that they collect and process. The primary controller responsible for the collection and processing of job candidate personal data is identified in the relevant job advert.
In this Notice Nomo Fintech may be referred to as “we”, “us”, “our” or “Nomo Fintech”.
Our contact details are provided on our careers portal or you can write to us at the relevant address below:
If you have any questions about the contents of this Notice or the way we collect and use your personal data, please contact the Human Resources Department in the first instance (email: hr@nomo.tech) or if you prefer you can contact our Data Protection Officer by email: dpo@bb2.tech
4.1
We collect and process the following categories of personal data about you in connection with your job application:
4.1.1
Contact details: Includes name, postal address, email address, telephone number and any additional contact information provided.
4.1.2
Personal details: Includes age, date of birth, gender, place of birth, race, religion, nationality, country of residence, marital status, number of dependants, languages spoken and details about any disabilities and related adjustments we make during the recruitment and selection process.
4.1.3
Identity details: Includes identity documentation, e.g. passport, national identification documentation (e.g. Emirates ID).
4.1.4
Recruitment and selection details: Includes information about your application for employment, CV, skills, experience and employment history, educational and professional qualifications professional memberships, licenses and certifications (including any publicly available information relating to the same), interview and assessment outcomes, employment references, vetting and background screening (e.g. credit history, financial sanctions, and where appropriate and permitted by applicable local laws, criminal record checks), immigration status and right to work information and any other pertinent information.
4.1.5
Remuneration, financial and benefit details: Includes details about your current salary package, bonus and commission entitlements and benefits.
4.1.6
Equality and diversity monitoring details: Where permitted by applicable laws, includes racial or ethnic origin, gender, sexual orientation, age, marital or civil partnership status, religion or similar beliefs and disability details.
4.1.7
Security monitoring details: Where permitted by applicable laws, includes CCTV recordings, photo images, building access control logs and any other security monitoring and authentication data collected when you visit our office premises.
4.1.8
Miscellaneous details: Includes any other miscellaneous personal data you choose to share with us during the recruitment and selection process.
5.1
Where permitted by the applicable data protection laws, we collect and process special categories of personal data as part of the information described above in section 4. For the purpose of this Notice, special categories of personal data (also commonly referred to as sensitive personal data) is personal data relating to racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data, health data, data concerning an individual's sex life or sexual orientation, or data relating to criminal convictions or alleged offences.
5.2
The presumption is that special categories of personal data is more likely to be of a private nature and could be used in a discriminatory way or have a greater impact on individuals if misused. It therefore needs to be treated with greater care than other personal data.
5.3
We generally only collect and process special categories of personal data, where necessary to comply with our legal obligations, exercise our rights as an employer or where you provide us with your explicit consent.
6.1
We collect personal data from you directly and you are required to provide any personal data that we reasonably require to fulfil our obligations in connection with your job application and comply with our legal obligations. Where you refuse or are unable to provide information we reasonably require to fulfil our obligations, we may be unable to progress your job application. Where the provision of specific information is mandatory, we will highlight this at the time of collection. We will also let you know if there are any consequences as result of you failing to provide information that we require.
6.2
We rely on the availability of accurate personal data to manage and administer the recruitment and selection process. You should therefore ensure that any personal data you provide to us is accurate and complete to the best of your knowledge.
6.3
Where you provide us with personal data about third party individuals, such as information about your spouse, civil partner, children, dependants, beneficiaries or emergency contacts, where appropriate, you are required to provide these individuals with a copy of this Notice beforehand, or alternatively, ensure they are otherwise made aware of how their personal data will be used by us.
6.4
In addition to collecting personal data from you directly, we may also collect some personal data about you indirectly from other third parties, such as recruitment agencies, previous employers, your referees, publicly available websites (e.g. LinkedIn), employment vetting and background screening providers and educational and professional membership bodies.
6.5
We also collect some personal data automatically such as CCTV recordings, photo images, building access control logs and any other security monitoring and authentication data collected when you visit our office premises.
7.1
We are required to satisfy one or more of the conditions for processing special categories of personal data set out in the applicable data protection laws, before collecting and processing special categories of personal data about you. When we collect and process special categories of personal data, we rely on one or more of the following conditions:
We are required to satisfy one or more of the lawful bases for processing personal data set out in the applicable data protection laws, before collecting and processing personal data about you. When we collect and process personal data, we rely on one or more of the following lawful bases:
a. Performance of a contract
Where necessary, we collect and process special categories of personal data to protect your vital interests or the interests of others persons, where you are physically or legally incapable of giving consent, e.g. in medical emergency situations.
Where necessary, we collect and process special categories of personal data to exercise or defend legal claims, prospective legal claims or other claims of a similar nature.
Where necessary, we collect and process special categories of personal data for reasons of substantial public interest.
Where necessary, we collect and process special categories of personal data, where the processing is authorised by applicable national laws.
In some limited circumstances we rely on your explicit consent to collect and process special categories of personal data.
b. Legal obligations
c. Vital interests
d. Legitimate interests
e. Consent
a. Employment and social security
b. Vital interests
c. Establishment, exercise and defence of legal claims
d. Substantial public interest
e. National laws
f. Explicit consent
7.2
Where necessary, we collect and process personal data to assess your job application, offer you employment, process your acceptance of the job offer, onboard you as an employee and fulfil our obligations in the employment contract and any other agreement that you enter into with us.
Where necessary, we collect and process personal data to enable us to meet our legal obligations, such as obligations and duties we are required to discharge as an employer and any other applicable legal obligations.
Where necessary, we collect and process personal data to protect your vital interests or the interests of other persons.
Where necessary, we collect and process personal data to pursue our legitimate interests or the interests of a third party, except where your interests or fundamental rights and freedoms override our interests.
In some limited circumstances we rely on your consent to collect and process your personal data, e.g. where you ask us to disclose your personal data to a third party.
Where necessary, we collect and process special categories of personal data to fulfil our obligations and exercise specific rights in the field of employment, social security and social protection law.
8.1
This section describes in more detail how we use your personal data and special categories of personal data and which of the lawful bases and conditions (described above in section 7) we rely on to carryout the processing.
No.
Processing Purpose
Lawful Bases and Conditions
8.1.1
Recruitment and selection
We assess your suitability for the role and make decisions about your recruitment and selection.
Personal data lawful bases
We assess your suitability for the role and make decisions about your recruitment and selection.
8.1.2
Communications
We communicate with you to keep you abreast of developments during the recruitment and selection process.
Personal data lawful bases
We carry out this processing to pursue our legitimate interests, i.e. we have a legitimate interest in communicating with job candidates during the recruitment and selection process in an effective and efficient manner.
8.1.3
Vetting and background screening
Where permitted by applicable laws, we conduct pre-employment and ongoing background screening checks, including right work to checks, to ensure you are suitable to perform your role.
Personal data lawful bases
Condition for special categories of personal data
8.1.4
Offers of employment
We may make offers of employment and take steps to onboard you where you accept an offer of employment.
Personal data lawful bases
8.1.5
Audits and assessments
We conduct audits and assessments to ensure our recruitment and selection process is carried out in accordance with our internal policies and procedures and our legal obligations.
Personal data lawful bases
8.1.6
Physical and logical security
We manage the physical and logical security of our office premises, information technology systems, confidential information and intellectual property.
Personal data lawful bases
We carry out this processing to pursue our legitimate interests, i.e. we have a legitimate interest in protecting the security of our office premises and the confidentiality, integrity and availability of our information technology systems and information assets.
8.1.7
Legal obligations
We discharge our legal obligations in connection with your job application and any other applicable legal obligations.
Personal data lawful bases
We carry out some aspects of this processing to comply with our legal obligations.
Condition for special categories of personal data
We carry out some aspects of this processing to fulfil our obligations and exercise specific rights in the field of employment, social security and social protection law, e.g. to comply with health and safety legislation when job candidates visit our office premises or where a job candidate has a disability and we make related adjustments during the recruitment and selection process.
8.1.8
Equality and diversity monitoring
Where permitted by applicable laws, we conduct monitoring to ensure equality of opportunity and diversity in connection with your job application and to comply with anti-discrimination laws.
Personal data lawful bases
Condition for special categories of personal data
8.1.9
Human resources records
We maintain appropriate recruitment and selection records relating to your job application.
Personal data lawful bases
Condition for special categories of personal data
8.1.10
Legal claims and disputes
We investigate, exercise and defend legal claims and disputes and enforce our rights, including where these relate to you in the context of your employment.
Personal data lawful bases
Condition for special categories of personal data
8.1.11
Preventing and detecting crime
We prevent and detect crime within our organisation and facilitate the apprehension and prosecution of offenders.
Personal data lawful bases
We carry out this processing to pursue our legitimate interests, i.e. we have a legitimate interest in preventing and detecting crime, including fraud and other unlawful acts within our organisation, so as to protect our business, employees and clients.
Condition for special categories of personal data
We carry out some aspects of this processing where necessary for reasons of substantial public interest where the processing is permitted by applicable national laws, e.g. where national laws permit processing to prevent or detect crime and other unlawful acts.
8.1.12
Business continuity and emergency planning
We manage business continuity and ensure the health and safety and well-being of job candidates while they are on our premises.
Personal data lawful bases
Condition for special categories of personal data
We carry out some aspects of this processing to protect the vital interests of job candidates or the interests of other persons, where a job is candidate physically or legally incapable of giving consent, e.g. in medical emergency situations.
8.1.13
Miscellaneous
We may process any other miscellaneous personal data that you choose to share with us during the recruitment and selection process.
Personal data lawful bases
We are likely to carry out this processing on the basis of legitimate interests. However, we will let you know if a different lawful basis applies to the processing of any voluntary information you share with us.
9.1
Legal advisors, insurers and claims investigators: Where necessary to obtain legal advice or investigate, exercise or defend legal claims, insurance claims or other similar claims.
We share your personal data with the following categories of recipients:
9.1.1
Law enforcement agencies: Where necessary for the prevention and detection of crime or the apprehension or prosecution of offenders.
Successors of our business: Where our organisation is sold to, acquired by or merged with another organisation, in whole or in part.
9.1.2
9.1.3
9.1.4
9.1.5
9.1.7
9.1.8
9.19
9.1.6
Recruitment agencies: Where you are represented by a recruitment agency during the job application and recruitment process, and the sharing of data with the agency is necessary to consider your application, make you a job offer and manage and administer your onboarding as an employee.
Our employees, including Human Resources, line managers and other employees: On a strict need-to-know basis, where necessary to manage and administer the recruitment and selection process.
Background screening providers: Where necessary to conduct employment vetting and good repute checks, e.g. these may include, credit reference agencies, educational and examining bodies, professional membership bodies, public authorities and government agencies.
Other Boubyan Banking Group companies: Where necessary to operate our business.
Public authorities, regulators and government agencies: Where necessary for us to comply with our legal and regulatory obligations.
Third party partners and service providers: Where we engage third party partners or outsource our processing operations to service providers that process personal data on our behalf. Where these service providers act as our agents, the processing activities will remain under our control and will be carried out in accordance with our strict instructions and security standards.
10.1
We are established in the United Kingdom (“UK”) and the Dubai International Financial Centre (“DIFC”). However, we operate on a global worldwide basis and we may therefore transfer your personal data to countries or territories outside the UK or DIFC. Some of these countries or territories may not be considered by data protection regulators to provide an adequate level of protection. We have therefore implemented additional safeguards to ensure your personal data receives an adequate level of protection, such as regulatory approved standard contractual clauses, and where necessary and appropriate, other risk-based safeguards.
10.2
If you require further information about the safeguards we have in place to protect your personal data when we make international data transfers, please contact our Data Protection Officer by email: dpo@bb2.tech
11.1
We generally retain your personal data for as long as is necessary to fulfil the purpose for which it was collected and other purposes required by law. The retention period will usually include the period of the recruitment and selection process and the applicable statute of limitation period following this, although it’s important to note that some personal data may be retained for longer to comply with applicable legislation, e.g. health and safety legislation. When personal data is no longer required it will either be anonymised so that it no longer relates to you, or securely destroyed.
11.2
Notwithstanding the above, it is important note that if we offer you employment, different retention periods will apply to the collection and processing of your personal data. If you require further information concerning the predefined retention periods that apply to your personal data, please contact the Human Resources Department.
We do not use your personal data to make significant automated decisions about you without human involvement. We will notify you if we make changes to the way we collect and process your personal data in this respect.
We are committed to protecting the personal data entrusted to us and we have therefore implemented appropriate technical and organisational measures to ensure that your personal data is afforded an adequate level of security protection, including where practicable, access controls, encryption, pseudonymisation and anonymisation measures.
14.1
Right to object: You have the right to object to the processing of your personal data.
You have the following rights in relation to the processing of your personal data:
14.1.1
14.1.2
14.1.3
14.1.4
14.1.5
14.1.7
14.1.8
14.2
14.3
14.1.6
Right of access: You have the right to request a copy of the personal data we hold about you.
Right to rectification: You have the right to request the rectification of any inaccurate or incomplete personal data we hold about you.
Right to erasure: You have the right to request the erasure of your personal data if there is no compelling reason for us to continue holding it.
Right to restrict processing: You have the right to request that we temporarily restrict the processing of your personal data in certain circumstances.
Right to data portability: You the right to ask us to provide your personal data to another organisation in a commonly used machine readable format, where you originally provided the information and the processing is based on your consent or the performance of a contract.
Rights in relation to automated decision-making and profiling: You have the right to object to automated decisions we make about you using your personal data, which have been taken solely by automated means without human involvement.
If you wish to exercise your data protection rights or require further information concerning these rights, please contact the Human Resources Department in the first instance.
It is important to note that some of the data protection rights outlined above may only be exercised in certain circumstance and may be subject to legal exemptions. If we are unable to fulfil a request from you to exercise your rights, we will write to inform you of the reason for refusal.
Right to withdraw consent: Where we rely on your consent to process your personal data, you have the right change your mind and withdraw your consent at any stage.
15.1
If you wish to make a complaint about the way we collect and use your personal data, you should raise this with the Human Resources Department in the first instance or if you prefer you can contact our Data ProtectionOfficer by email: dpo@bb2.tech
15.2
You also have the right to complain to the relevant dataprotection regulator at any stage:
UK Regulator
DIFC Regulator
In the event that you are offered employment with us a separate Employee Privacy Notice will be provided to you to explain how we make use of the personal data we collect and process about you in connection with your employment.
Were serve the right to update this Notice from time-to-time to ensure it accurately reflects the way we collect and process your personal data. Any changes to this Notice will be published on our careers portal. You should therefore periodically review this Notice on our careers portal to ensure you understand how we collect and use your personal data.
