Candidate Privacy Policy content 2

Lyca Mobile (‘We’, ‘Us’) is a mobile virtual network operator (MVNO) operating in 23 countries worldwide. Lyca Mobile provides national and international calls, texts and data to customers. Lyca Mobile was founded in 2006 and is headquartered in London as Lyca Mobile UK Limited at 3rd Floor Walbrook Building, 195 Marsh Wall, London, E14 9SG.

For the purpose of the applicable data protection legislation, Lyca Mobile is the data controller.

The representative of Lyca Mobile can be directly contacted at [email protected].

It is important that you read this policy, together with any other policy or notice we may provide on specific occasions when we are processing personal data about you, so that you are aware of how and why we are using such information.

This policy has been designed in accordance to the General Data Protection Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC. Where the national law imposes a requirement that is stricter than that imposed by this policy, the requirements in national law (as amended from time to time) will be followed. Furthermore, where national law imposes a requirement that is not addressed in this policy, the relevant national law will be adhered to.

The aim of this policy is to make you aware of how and why your personal information will be used, namely for the purposes of the recruitment exercise, and how long it will usually be retained for. It provides you with certain information that must be provided under the applicable data protection legislation.

Lyca Mobile will comply with applicable data protection laws and principles, which means that your data will be:

• Used lawfully, fairly and in a transparent way.
• Collected only for valid purposes that we have clearly explained to you and not used in any way that is incompatible with those purposes.
• Relevant to the purposes we have told you about and limited only to those purposes.
• Accurate and kept up to date.
• Kept only as long as necessary for the purposes we have told you about.
• Kept securely.

In connection with your application for work with us, we will collect, store, and use the following categories of personal information about you:

• The information you have provided to us in your curriculum vitae.
• Any information you may provide to us during an interview.

We may also gather a test result as a result of an aptitude test carried out in the recruitment process.

We may also collect, store and use the information about criminal convictions and offences which constitutes sensitive personal information.

We may also collect, store and use CCTV footage, when you attend our premises for an interview.

We collect personal information from you directly or sometimes from publicly available sources where you have made such information public.

We may also collect personal information about candidates from the following sources for some specific roles and depending on the level of seniority:

• Background check provider, from which we collect the background check results.
• Credit reference agency, from which we collect the credit reference results.
• Disclosure and Barring Service in respect of criminal convictions and offences.

We will use the personal information we collect about you to:

• Assess your skills, qualifications, and suitability for the role.
• Communicate with you about the recruitment process.
• Carry out background checks, where applicable.
• Keep records related to our hiring processes.
• Comply with regulatory requirements.

We also need to process your personal information to decide whether to enter into a contract of employment with you.

Below are the key stages of the recruitment process where we process your personal information:

• Application stage – we receive your curriculum vitae.
• Application shortlisting – we decide whether you meet the basic requirements to be shortlisted for the role.
• If you do, we will decide whether your application is strong enough for an interview.
• Following an interview, we may also request you to take an aptitude test.
• We will use the information you provide to us during the interview and [aptitude test, where applicable] to decide whether to offer you the role.
• If we decide to offer you the role, we will carry out background checks and/or criminal record checks, as required, before confirming your appointment and will confirm your appointment by signing an employment contract with you.

It is in our legitimate interests to decide whether to appoint you for this role since it would be beneficial to our business to appoint someone for that role.

If you fail to provide information when requested, which is necessary for us to consider your application, we will not be able to process your application successfully. For example, if we require a credit reference for the role you have applied with us and you fail to provide us with relevant details, we will not be able to take your application any further.

How we use particularly sensitive personal information – criminal convictions

We may process information about criminal convictions for certain roles.

This will be in the case where we are required to carry out a criminal record check to satisfy ourselves that there is nothing in a prospective employee’s criminal convictions history which makes them unsuitable for a specific role. We will inform you if the nature of the role requires these checks.

In particular, we are legally required to carry out criminal record checks in the following cases:

• The role is eligible for a basic check from the Disclosure and Barring Service.
• Certain key roles require a high degree of trust and integrity since it involves dealing with law enforcement bodies and sensitive information and so the role requires enhanced security vetting for verifying criminal records history.

We have in place an appropriate policy document and safeguards which we are required by law to maintain when processing such data.

We will seek for your consent before carrying out any background checks and/or criminal record checks.

If you attend our premises for an interview, we will collect your CCTV footage to take precautionary measures to protect our employees’ safety, and to safeguard our business, and our business assets, including products and property.

You will not be subject to decisions that will have a significant impact on you based solely on automated decision-making.

Your information will only be shared externally if it is necessary or required (for example in order to carry out pre-employment screening).

Your personal information may be shared externally with the following third parties:

• Suppliers who undertake background screening on our behalf (credit reference agencies, background check providers and criminal check bureaus).
• Service provider for hosting data services

To enable the recruitment key stages mentioned under “HOW WILL WE USE INFORMATION ABOUT YOU?” above, your personal information may be shared within Lyca Mobile, but the information shared will be limited to what is required by each individual to perform their role in the recruitment process.

Your personal information may be shared internally with the following key people:

• Those employees who would have managerial responsibility for you;
• Employees in HR and recruitment departments who have responsibility for certain HR processes (for example recruitment, assessment, pre-employment screening);
• Employees in IT and system owners who manage user access; and
• Security managers for facilities/premises.

We will retain your personal information for a period of 12 months after we have communicated to you our decision about whether to appoint you for the role. We retain your personal information for that period so that we can show, in the event of a legal claim, that we have not discriminated against candidates on prohibited grounds and that we have conducted the recruitment exercise in a fair and transparent way. After this period, we will securely destroy your personal information in accordance with our data retention and disposal policy.

Should you be unsuccessful, we will retain your personal information, on the basis that a further opportunity may arise in future and we may wish to consider you for that. For this purpose, we will write to you separately to obtain your consent to retain your personal information for a period of 12 months after we have communicated to you our decision.

You will have the right to consent or not provide consent for this processing. You will also have the right to withdraw consent for processing for this processing at any time. Once we receive your notification that you have withdrawn consent, we will no longer process your personal information and we will dispose your personal information securely.

Under certain circumstances, by law you have the right to:

• Request access to your personal information (commonly known as a “data subject access request”). This enables you to receive a copy of the personal information we hold about you and to check that we are lawfully processing it.
• Request rectification of the personal information that we hold about you. This enables you to have any incomplete or inaccurate information we hold about you corrected.
• Request erasure of your personal information. This enables you to ask us to delete or remove personal information where there is no good reason for us continuing to process it. You also have the right to ask us to delete or remove your personal information where you have exercised your right to object to processing (see below).
• Object to processing of your personal information where we are relying on a legitimate interest and there is something about your particular situation which makes you want to object to processing on this ground.
• Request the restriction of processing of your personal information. This enables you to ask us to suspend the processing of personal information about you, for example if you want us to establish its accuracy or the reason for processing it.
• Request the transfer of your personal information to another party.

If you want to review, verify, correct or request erasure of your personal information, object to the processing of your personal data, restrict the processing of your personal data or request that we transfer a copy of your personal information to another party, please contact us in writing at [email protected].

You will not have to pay a fee to access your personal information (or to exercise any of the other rights). However, we may charge a reasonable fee if your request for access is clearly unfounded or excessive. Alternatively, we may refuse to comply with the request in such circumstances.

If you have any questions about this privacy notice and policy or how we handle your personal information, please contact the Data Protection Officer at [email protected].

You have the right to make a complaint at any time to the Data Protection Authority for data protection issues.

This policy does not form part of any contract of employment or other contract for services. We may update this policy at any time and make the new privacy policy and notice available when we make any substantial updates.