Candidate Data Privacy Statement

• personal details, e.g. name, previous names, gender, date and place of birth, employment history, religion or faith.
• next of kin and emergency contact details;
• contact details, e.g. address, email address, landline and mobile numbers;
• information concerning your identity e.g. photo ID, passport information, National ID card, birth number (or equivalent) and nationality;
• information concerning any qualifications you hold e.g., university education, professional certifications;
• health data including medical condition, health and sickness records or confirmation if you are able to perform a given position (as applicable), information about any disabilities you might have;
• information necessary to pay you e.g. bank account details, or to provide you with benefits, e.g. dependants and beneficiaries, driving license details for car schemes we may operate etc.;
• market research, and information and opinions expressed when participating in applicant surveys;
• other information about you that you give us by filling in forms or by communicating with us (e.g. interviews or assessments), whether face-to-face, by phone, email, online, or otherwise.

• information we use to identify and authenticate you, e.g. your signature, your biometric information (such as your voice for HSBC’s voice ID), or additional information that we receive from external sources that we need for compliance purposes;
• geographic information, e.g. about which HSBC offices you visit;
• cookies and similar technologies we use to recognise you, remember your preferences and tailor the content we provide to you – our cookie policy contains more details about how we use cookies and can be found at https://www.hsbc.ae/privacy-statement/#seven;
• investigations data, e.g. due diligence checks, fraud, sanctions and anti-money laundering checks, external intelligence reports, content and metadata related to relevant exchanges of information between and among individuals, organisations, including emails, voicemail, live chat;
• complaints information;
• application data including information about your individual performance in assessments or online tests;
• records of correspondence and other communications between us, including email, live chat, instant messages and social media communications;
• information that we need to support our regulatory obligations, e.g. information about transaction details, detection of any suspicious and unusual activity and information about parties connected to you or these activities (e.g. politically exposed person and sanction checks).

information you’ve asked us to collect for you or we collect as part of our vetting process, e.g. work references from previous employers. 

• to administer your applicant relationship with us e.g. schedule interviews, communicate decisions etc.;
• to carry out your instructions, e.g. send you details of online tests or assessments;
• to manage our relationship with you, including (unless you tell us otherwise) telling you about other roles and services we think may be relevant for you;
• to prevent or detect crime including fraud and financial crime, e.g. financing for terrorism and human trafficking;
• for security, staff vetting, and business continuity;
• for risk management;
• to conduct applicant surveys and data analytics, to better understand our workforce and assist us with succession planning;
• for market research, market benchmarking and statistical purposes (but not without your permission);
• to protect our legal rights and comply with our legal obligations;
• for service, system or product development and planning, insurance, audit and administrative purposes; and/or
• for the purpose of converting an applicant to an employee.
• Further details of how we’ll use your information can be found in Appendix 1 below.

We may use automated systems to help us make decisions about the outcome of your application. We may use technology that helps us identify the level of risk involved in your work for us, e.g. for fraud or financial crime reasons, or to identify market misconduct through analysis of irregular trades.

You have a right to certain information about how we make these decisions. You may also have a right to request human intervention and to challenge the decision. More details can be found in the ‘Your rights’ section below.

We may record details of your interactions with us. We may record and keep track of conversations you have with us including phone calls, face-to-face meetings, letters, emails, live chats, video chats and any other kinds of communication. We may use these recordings to check your instructions to us, assess, analyse and improve our service, train our people, manage risk or to prevent and detect fraud and other crimes. We may also use these recordings to make decisions on the outcome of your application. We may capture additional information about these interactions, e.g. telephone numbers that you call us from and information about the devices or software that you use. We use closed circuit television (CCTV) in and around our sites and these may collect photos or videos of you, or record your voice. 

We will request, collect and process your personal data as part of our vetting procedures. This will be in order to confirm your identity, employment history and relevant qualifications with respect to a role, to comply with the law and for our legitimate interests to be able to assess and manage our risk.

We collect personal data for vetting through the application and recruitment process directly from candidates by teams within HSBC (either based in our offshore Global Service Centres or onshore Employee Vetting Teams and/or HR Teams). Global vendors or other carefully selected local third parties in country may also collect personal data for vetting purposes for us. 

• personal contact details such as name (all legal and alias, current and previous names), title, addresses, telephone numbers, and personal email addresses;
• date of birth and gender;
• passport information and national identification number;
• location of employment or workplace;
• recruitment information (including copies of right to work documentation, references and other information included in a cv or cover letter or as part of the application process);
• information concerning any qualifications you hold e.g. university education, professional certifications;
• employment records (including job titles, work history, working hours, training records and professional memberships). 

• a right to work check;
• verification of your identity;
• criminal records checks;
• credit reference checks - search conducted through an official credit bureau;
• public/negative news screening, indicating no involvement in activities such as fraud, financial crime, money laundering and/or terrorism;
• searches conducted through internal HSBC watch-lists and external watch-lists or database files provided by third parties, indicating no involvement in activities such as fraud, financial crime, money laundering or breach of sanctions;
• verification of your employment history and receipt of satisfactory references, including but not limited to any information that HSBC Group or any agent acting on its behalf requires;
• verification of any relevant educational and/or professional qualifications that HSBC Group or any agent acting on its behalf requires;
• external directorships checks; and/or
• media research check indicating no involvement in activities such as fraud, financial crime, money laundering, breach of sanctions, terrorism.

• verify the accuracy of the data you’ve provided to us;
• prevent criminal activity, fraud and money laundering;
• manage your application(s); and
• monitor your financial wellbeing.

We’ll continue to exchange information about you with CRAs while you have a relationship with us. This information may be supplied to other organisations by CRAs. 

We’ll use your information to meet our compliance obligations, to comply with other laws and regulations and to share with regulators and other authorities that HSBC Group companies are subject to. This may include using it to help detect or prevent crime (including terrorism financing, money laundering and other financial crimes). We’ll only do this on the basis that it’s needed to comply with a legal obligation or it’s in our legitimate interests and that of others. 

• have a public or legal duty to do so, e.g. to assist with detecting and preventing fraud, tax evasion and financial crime;
• need to in connection with regulatory, reporting, litigation or asserting or defending legal rights and interests;
• have a legitimate business reason for doing so, e.g. to manage risk, verify your identity or assess your suitability for roles;
• have asked you for your permission to share it, and you’ve agreed.

• other HSBC Group companies and any sub-contractors, agents or service providers who work for us or provide services to us or other HSBC Group companies (including their employees, sub-contractors, service providers, directors and officers);
• your beneficiaries or intermediaries;
• tax authorities, trade associations, credit reference agencies;
• any people or companies where required in connection with potential or actual corporate restructuring, merger, acquisition or takeover, including any transfer or potential transfer of any of our rights or duties under our agreement with you;
• law enforcement, government, courts, dispute resolution bodies, our regulators, auditors and any party appointed or requested by our regulators to carry out investigations or audits of our activities;
• other parties involved in any disputes, grievances and investigations;
• fraud prevention agencies who’ll also use it to detect and prevent fraud and other financial crime and to verify your identity;
• other companies who do marketing or market research for us (but not without your permission);
• anybody else that we’ve been instructed to share your information with, by you.

We may share aggregated or anonymised information within and outside of the HSBC Group with partners such as research groups, universities or advertisers. You won’t be able to be identified from this information, e.g. we may share information about general employment trends to assist in research.

We keep your information in line with our data retention policy. For example, we’ll normally keep your core application data for a period of ten years from the end of our relationship with you or as per the group or applicable local data retention schedule. This enables us to comply with legal and regulatory requirements or use it where we need to for our legitimate purposes such as dealing with any disputes or concerns that may arise. If your application for a job with HSBC is unsuccessful, we will retain any personal data collected in line with local regulations or otherwise for a period of seven years from the date you are formally rejected.

If you are required to complete an on-line assessment as part of your application, your test results may be valid for future job applications and we will keep them for a period of twelve months.  After twelve months your test results will be deleted and therefore if you apply to either the same role or a different role with HSBC in the future then you may be required to complete a new on-line assessment.

We may need to retain your information for a longer period where we need the information to comply with regulatory or legal requirements or where we may need it for our legitimate purposes, e.g. to help us respond to queries or complaints, fighting fraud and financial crime, responding to requests from regulators, etc.  

If we don’t need to retain information for this period of time, we may destroy, delete or anonymise it more promptly. Where this is not feasible, we may use other technical and organisational measures to secure your data.

Your information may be transferred to and stored in locations outside the DIFC, including locations which may not have the same level of protection for personal information as the DIFC.  We may need to transfer your information in this way to perform our contract with you, to fulfil a legal obligation, and/or for our legitimate business interests, for example to better understand our workforce and assist us with succession planning. The recipient of your information outside the DIFC may be an HSBC Group company or a third party. In some countries the law might compel us to share certain information, e.g. with tax authorities or apply different levels of security. Even in these cases, we’ll only share your information with people who have the right to see it.

Where we transfer your personal information outside the DIFC, we will ensure that it is protected by us in a manner that is consistent with how your information will be protected by us in the DIFC. We will always do this in a way that is permissible under applicable laws and regulations.

When your personal information is disclosed to third parties domiciled in jurisdictions which do not have an appropriate level of data protection, we will ensure that all transfers of your information are subject to appropriate measures or safeguards (such as contractual commitments to protect your information in the form of the DIFC Standard Contractual Clauses or other precautions or justifications) so that your personal information continues to receive appropriate protection.

You can obtain more details of the protection given to your information when it is transferred outside the DIFC by contacting us using the details in the ‘More details about your information’ section below.

• the right to access information we hold about you and to obtain information about how we process it;
• the right to request that we update, correct or rectify your information if it’s inaccurate or incomplete;
• in some circumstances, the right to request that we delete, block or 'forget' your information. There may be circumstances where we may continue to retain your information if we’re entitled or required to retain it;
• the right to object to, and to request that we restrict, our processing of your information in some circumstances. Again, there may be situations where you object to, or ask us to restrict, our processing of your information but we’re entitled to continue processing your information and/or to refuse that request;
• not to use certain automated decision processes that impact you (unless we have to do this to perform our contract with you, or it’s fraud related);
• object to our processing of your information, including direct marketing information. That being said, there may be circumstances where you object to, or ask us to restrict our processing of your information but we are legally entitled to continue processing your information. However, we will not use your information for direct marketing purposes if you ask us not to do so;
• where our processing of your data is based on your consent, you have a right to withdraw your consent at any time.  We will stop processing your data for that purpose, but your withdrawal of consent will not affect the lawfulness of any processing that we have carried out based on your previous consent. Please note, however, that we may still be entitled to process your information if we have another legitimate reason for doing so;
• in some circumstances, the right to receive some information electronically and/or request that we transmit the information to a third party where this is technically feasible. Please note that this right only applies to information which you have provided to us;
• the right to lodge a complaint with the DIFC Commissioner of Data Protection (details of which are provided below) if you think that any of your rights have been infringed by us.

• Carrying out recruitment activities;
• Administering and maintaining personal records;
• Business continuity and emergency management purposes;
• Assessing your performance in interviews, assessments and on-line tests;
• Evaluating your suitability for the role and making decisions on the outcome of your application;
• The pursuit of complaints;
• Equal opportunities matters including the operation of an equal opportunities policy, identifying or keeping under review the existence or absence of the quality of opportunity, or treatment between persons of different protected characteristics, with a view to enabling such quality to be promoted, or maintained.

The lawful reasons for processing these are legitimate interest, legal obligation and in order to perform our contract with you.  

this will include monitoring, mitigation and risk management. We do this to comply with our legal obligations and because it’s in our legitimate interest.

We may also share your information with relevant agencies, law enforcement and other third parties where the law allows us to for the purpose of preventing or detecting crime. Additionally, we and other financial institutions may take steps to help prevent financial crime and manage risk. We’ll do this because we have a legitimate interest, a legal obligation to prevent or detect crime or it’s in the public interest. We may be required to use your information to do this, even if you’ve asked us to stop using your information. That could include (among other things):

• passing information to relevant agencies if we think you’ve given us false or inaccurate information, or we suspect criminal activity; 
• combining the information we have about you with information from other HSBC companies to help us better understand any potential risk.

we’ll use your information to measure, detect and prevent the likelihood of financial, reputational, legal, compliance or customer risk. This includes credit risk, traded risk, operational risk and insurance risk (e.g. for underwriting or claims management purposes). We’ll do this because we have a legitimate interest in ensuring that we carry out a proper risk assessment prior to making offers of employment;

we’ll use your information to allow us to provide you with access to any online platforms in order for you to carry out any relevant online tests. The platform may allow you to directly or indirectly communicate with us. The lawful basis for using your information for this purpose is in our legitimate interest;

we’ll analyse your information to identify possible service and improvements in our recruitment process. The lawful basis for processing your information for this purpose is our legitimate interest. We do this to improve our products and services to best meet the need of our workers;

we’ll analyse your information to identify relevant job opportunities and to better manage our workforce. The lawful basis for using your information in this way is our legitimate interest;

we may need to use your information to protect our legal rights, e.g. in the case of defending or the protection of legal rights and interests (e.g. labour law disputes); court action; managing complaints or disputes; in the event of a restructuring of companies or other mergers or acquisition. This may be in connection with action taken against you or other persons. We’d do this on the basis that it’s in our legitimate interest.