privacy policy

Candidate Privacy Notice – Hamburg

Barclays Bank (referred to in this notice as “we”) is committed to protecting the personal data we hold about you. For the purposes of this notice, you are a “candidate”.

This notice explains what personal data we collect about you, why we need it, what we do with it and how long we keep it. We will only collect personal data about you, which is required for specific purposes and where there is a legal basis for processing it.

“Personal data” is information, or a combination of pieces of information that could reasonably allow an individual to be identified. Certain types of personal data are known as “special categories of data”. These are types of personal data which are considered particularly sensitive (including personal data relating to race, ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, sexual orientation, genetic, biometric or health data). We do not collect special categories of personal data in countries where the collection is prohibited.

“Data controller” is the Barclays entity that decides how and why your personal data is used. The data controller in relation to your personal data is likely to be Barclays Services Limited (“Barclays”), 1 Churchill Place, Canary Wharf, London, E14 5HP. There may be some local variations to this in certain jurisdictions. If your application is successful, your recruiter will provide details of the Barclays entity with which you will have a work relationship (the Barclays entity with which you have a work relationship will be the data controller in relation to your personal data once you have commenced your role at Barclays).

1. What information do we collect about you?

Barclays collects personal data from you during the recruitment process. We also collect personal data about you from our service providers and agents (such as third party recruitment agencies (this may include details of your qualifications and experience) and providers who assist us with candidate screening (this may include details of special categories of personal data)).

Examples of personal data we may collect are:

• identity and contact details (including basic personal details, identification data, and to the extent permitted by applicable law, diversity monitoring data);
• details of your previous experience (including information relating to your previous roles and experience);
• special categories of personal data (to the extent permitted by applicable law, in the context of diversity monitoring and candidate screening).

We may also check publicly available sources such as LinkedIn or similar sites for information regarding your skills, experience or qualifications.

2. How do we use your personal data?

To the extent necessary and as permitted by applicable law, we may use your personal data for the purposes of recruitment administration (including profiling) and compliance with our legal/regulatory obligations.

3. What are our legal grounds for processing your personal data?

We will only collect and process your data where there is a legal basis for doing so. The most common bases for processing personal data are:

• to comply with legal / regulatory requirements;
• where we have a legitimate interest in processing your personal data.

4. With whom might we share your personal data?

All the personal data we hold about you will be processed by our staff and where required, we share your personal data with other Barclays companies, regulators, public authorities, vendors and service providers, for the purposes mentioned.

Barclaysshares personal data with recipients in countries with different data protection laws where required by law or where we put in place contracts or other arrangements to ensure adequate protection of your personal data.

5. How long do we keep hold of your personal data?

Barclays will only retain your personal data following your application for a period of time, depending on the type of personal data, and the purposes for which we hold it. Barclays will only retain your personal data to enable us to:

• maintain business records for analysis and/or audit purposes;
• comply with legal record retention requirements;
• comply with requests of regulators and authorities in connection with their duties;
• defend or bring any existing or potential legal claims; or
• deal with any complaints regarding your application.

The retention period is often linked to the amount of time available to bring a legal claim. We will retain your personal data after this time if we are required to do so to comply with the law, if there are outstanding claims or complaints that will reasonably require your personal data to be retained, or for regulatory or technical reasons. If we retain your personal data, we will continue to make sure your privacy is protected.

If you are unsuccessful in your application, we may retain your personal data in our talent pool in order to contact you in the future in relation to other roles at Barclays which we think may be of interest. However, we will only do so in case you have provided your express consent.

6. What rights do you have in relation to the personal data we hold?

Barclays use of your personal data is subject to an extensive framework of safeguards that help make sure that your rights in relation to your personal data are protected. These include the information given to you about how your personal data will be used and how you can exercise your

rights to obtain your personal data, have it corrected, restricted or deleted, object to it being processed, to obtain and reuse your personal data and complain.

You have the right not to be subject to a decision made by automated processing without human intervention, including profiling, which significantly affects you.

As part of the application process, we will ask you certain qualifying questions (such as whether you have the right to work in Germany). If your response to our questions means that you do not meet certain qualifying criteria (such as if you do not have the right to work in Germany), we will not be able to proceed with your application. As set out above, you have the right not to be subject to this automated processing without human intervention.

At Barclays, when we recruit for certain roles, our candidates undertake online tests, including situational judgement tests, psychometric and competency-based tests during the assessment stage.

You will be informed if you are required to complete an online test as part of the application process. Online testing scores are used to determine whether candidates are automatically shortlisted through to interview stage. If you wish to have your test marked manually by an assessor, we can put such arrangements in place. A manual assessment will extend the duration of the recruitment process but will not have a bearing on whether or not your application is successful.

We may also carry out an initial assessment of your application on an automated basis and may make decisions about whether or not to take your application forward without human intervention. This assessment will include an analysis (based on the qualifications, experience and competencies set out in your application) of whether you are suitable for the role in relation to which you have applied. As set out above, you have the right not to be subject to this automated processing without human intervention.

7. Acknowledgement

By choosing 'I accept' below, you acknowledge your personal data will be held and used as described above.

1. What personal data do we collect about you?

The table below provides a list of personal data that we may collect about you, to the extent this is permitted by applicable law. Please contact the corresponding email address set out in the table below if you have any queries in relation to any of the below (including whether a particular purpose is relevant in your country).

If you are successful in your application, we may also request additional personal data from you in order to set up your payroll record (such as details of your next of kin, tax information, student loans, visa details, bank account and pension funds).

2. How do we use your personal data?

The table below provides a detailed list of the purposes for which we will process your personal data, as well as our legal bases for doing so.

Data protection law allows us to use personal data for our genuine and legitimate reasons, provided we do not unfairly infringe your rights and freedoms. This lawful basis for using your personal data is called “legitimate interests.” When we rely on our legitimate interests as the legal basis for processing your personal data for the purposes set out above, we will carefully consider and balance any potential impact on your rights in relation to your personal data.

3. With whom might we share your personal data?

Categories of recipients

Where necessary Barclays may provide personal data about you:

• to other Barclays Group companies, including internal service companies;
• to its suppliers and agents(for example, third parties who assist with candidate screening, diversity monitoring and contextualised recruitment and cloud and technical support service providers). Where Barclays engages with a supplier or agent to process your personal data on its behalf, it will undertake due diligence, monitoring and assurance activities to ensure that your personal data is appropriately protected, and contractual clauses will be agreed between the parties to ensure that data protection and confidentiality is maintained;
• if Barclays is required, requested or permitted to do so by law, regulation, court order, or supervisory, regulatory or similar authority;
• for international payments where Barclays is required to send details of the payee and the beneficiary with the payment, and to overseas regulators and authorities in connection with their legitimate duties.

Because we operate as part of a global business, the recipients referred to above may be located outside the jurisdiction in which you are located (or in which we provide the services). See the section on “Transfers outside the EEA including safeguards” below for more information.

Transfers outside the EEA including safeguards

Barclays has staff within the following locations outside the EEA: Canada, China, Guernsey, Hong Kong, India, the Isle of Man, Japan, Jersey, Mexico, Monaco, Singapore, South Korea, Switzerland, UAE and the USA. Therefore, Barclays may transmit personal data through, and store personal data within, systems operated or controlled by Barclays or third parties in, and outside, the EEA. Further, many of the third parties referred to in the “Categories of recipients” section above are located (or have systems which are located) outside the EEA. It is therefore likely that your personal data may be transferred outside the EEA (for example, where there is a business requirement to do so, where globally accessible systems are used, and/or where internal data processors are used). The key locations outside the EEA for centralised services and internal data processors are India, Singapore and the USA.

Where Barclaystransfers personal data to locations outside the EEA (in the operation of its business or for example to its suppliers, agents or affiliates) it will ensure that appropriate safeguards are provided in order to ensure that the data transfers are subject to an adequate level of protection. These safeguards may include the use of contractual terms approved by the European data protection authorities in connection to the European Commission. Further information about the safeguards used by Barclays can be obtained from the Barclays Data Protection Officer.

4. What rights do you have in relation to the personal data we hold?

You have the right to access to your personal data, which means that you can ask us whether we are processing your personal data, what personal data we are processing, where we are processing it (including what safeguards are in place to the extent we are transferring your personal data outside the EEA), who has received it, the purpose of us processing it and for how long your personal data will be retained. You can also request an electronic copy of your personal data free of charge.

If any information about you is incomplete or inaccurate, you may also request the rectification of your personal data.

You also have the right to have your personal data erased where there is no longer a compelling reason for Barclays to continue processing your data in certain circumstances. For example:

• where your personal data is no longer necessary in relation to the purpose for which it was originally collected/processed;
• where you withdraw consent for Barclays to continue processing your personal data;
• if you object to the processing and there is no overriding legitimate interest for Barclays to continue the processing;
• where the personal data has been unlawfully processed;
• where your personal data has to be erased in order to comply with a legal obligation.

To the extent we have a compelling reason to continue processing your personal data, we may not be able to delete it. You have the right to ask Barclays to restrict the processing of your personal data in certain circumstances. For example:

• where you contest the accuracy of your personal data;
• where you object to the processing because it is unlawful and you prefer restriction instead of erasure of your personal data;
• where you have objected to our processing of your personal data.

Barclays will confirm the outcome of your request or actions that have been taken in relation to your request.

We will inform recipients of your personal data of the requirement to erase, restrict or rectify your personal data.

You have the right to obtain and reuse your personal data for your own purposes across different services. Your right to data portability only applies to personal data that you have supplied to Barclays, where the processing is based on your consent or for the performance of a contract with you and where we are processing the personal data by automated means. We will provide your data in a commonly used electronic format.

You have the right to object to us processing your personal data (including profiling) where our processing is necessary for the performance of a task carried out in the public interest or carried out for our legitimate business interests. Upon receiving your request, we will cease processing your personal data (unless we have compelling legitimate grounds for such processing).

You also have the right to object to processing which results in a decision based solely on automated decision-making (including profiling), which significantly affects you.

If you wish to exercise any of the rights outlined above and are based in Germany, please send your request to the German SAR team at hradmin@barclays.de or write to the team at the following address:

Barclays Bank Ireland PLC Hamburg Branch (Human Resource), Gasstraße 4c, 22761 Hamburg.

If you wish to exercise any of the rights outlined above and are not based in Germany, please email your request to the appropriate EU country HR mailbox, as follows:

Complaint process

At Barclays we take data privacy and protection seriously but if you are not happy with anything relating to this, our Data Protection Officer can be contacted at: The Data Protection Officer, Gasstraße 4c 22761 Hamburg or datenschutz@barclays.de. You also have the right to make a complaint to the local data protection regulator. Contact details: Der Hamburgische Beauftragte für Datenschutz und Informationsfreiheit (Thomas Fuchs), Ludwig-Erhard-Straße 22, 20459 Hamburg.

5. PersonalInformation ProtectionActNotification

This section only applies to you to the extent you are a Chinese national.

In compliance with the Personal Information Protection Act of the Republic of China (the "PIPA"), we would like to notify you, as a data subject, of the following:

Schedule 1: The Specific Purposes as Defined by the MOJ

(002) human resources management; (003) arrival, departure and immigration; (059) the collection, process and use by financial service enterprises according laws and regulations and for the need of financial supervision; (060) financial dispute resolution; (061) financial supervision, management and examination; (063) the collection, process and use of personal information by non-government agency for fulfillment of regulatory obligations; (064) health and medical services; (068) trust business; (069) contractual, quasi-contractual or other legal relationship affairs; (090) consumer and customer management and services; (104) billing management andcredit transaction business;

(114) labor administration; (120) tax administration; (129) accounting and relevant services; (136) information (tele-) communication and database management; (137) information (tele-) communication security and management; (150) auxiliary and back-office supporting management;

(154) credit checks; (157) investigation, statistics and researchanalysis; (166) securities, futures, securities investment trust and consulting relevant business; (168) passport, visa, and verification documents processing; (177) other financial management business; (181) other business conducted under the business registration items or organizational articles of incorporation; (182) other advisory and consulting services.

Schedule 2: The Specific Categories of Personal Information as Defined by the MOJ

1. Identification category
   (C001) for identification of individual; (C002) for identification of finance; (C003) for identification in government documents;
2. Characteristic category
   (C011) individual description; (C012) description of bodies;
3. Household status
   (C021) household status; (C023) details of other members in the family;
4. Social status
   (C031) residence and facilities; (C032) properties; (C033) immigration status; (C034) travel and other transportation details; (C038) occupation;
5. Education, examination and election, techniques or other professions
   (C051) academic records; (C052) qualification or techniques; (C053) occupational group member qualification; (C054) occupational expertise; (C057) record of students (members) and examination takers;
6. Employment status
   (C061) current employment status; (C062) employment history; (C063) jobs leaving history; (C064) work experiences; (C065) work, travel and attendance records; (C066) health and security records, (C068) salaries and withholding amount; (C070) details of work management; (C071) evaluation details of work; (C072) training records; (C073) security details;
7. Financial details
   (C083) credit ratings; (C086) note credit; (C087) allowances, benefits, gifts; (C088) insurance details; (C089) social security payment, home care payment and other retirement payment; (C091) properties or services provided by the subject of the personal information; (C093) financial transactions; (C094) indemnification;
8. Business information
   (C102) arrangement or agreement; (C103) licenses related to business; (C111) health records; (C116) criminal suspicion information;
9. Other categories of information
   (C131) search of written documents; (C132) non-categorized information.

Note: Schedules 1 and 2 may be amended in accordance with the specific purposes and categories of personal information as promulgated by the MOJ from time to time.