Gecko Hospitality – privacy notice

FOR CANDIDATES

Last updated: January 2024

Summary of how we use your data

• Gecko Hospitality UK Limited (“Gecko”, “Gecko Hospitality”, “we”, “us” or "our") uses your personal data as a data controller to provide our corporate clients (our “Clients”) with workers who apply directly through Gecko or Gecko’s Franchisees (“Candidates”). 
• In some scenarios we and our Franchisees act as “joint controllers” of your personal data, meaning we jointly determine the means and purposes of processing your personal data with these parties. Please see the Joint Controllership Statement below for more details. 
• Personal data is shared with others including our Franchisees, other Gecko group companies and third party vendors. In some instances, personal data is transferred outside the UK/EEA, including to the US. 
• Where we rely on your consent, such as for direct marketing in some countries and in some circumstances, you can withdraw this consent at any time.
• You also have other data protection rights including the right to object to some of the processing which we carry out. 

       1. What does this notice cover?

This notice describes how Gecko Hospitality UK Limited processes your personal data in connection with your application through us and our Franchisees to be considered for a position with our  Clients.  It also describes your data protection rights, including a right to object to some of the processing which Gecko Hospitality carries out. More information about your rights, and how to exercise them, is set out in the Your choices and rights section.

Please note that this Privacy Notice covers Candidates only. If you are a Business Contact at one of our Clients, a Prospective Franchisee and/or a Website User, our processing of your data is covered by our separate Website Privacy Notice rather than this document. If you are an individual acting as or applying to be a Franchisee our processing of your data is covered by our supplementary Franchisee Privacy Notice. If you are a Candidate and also a Website User, this Privacy Notice is supplementary and covers our processing of your personal data specifically in relation to your role as a Candidate only.

We also may provide you with additional information when we collect personal data, where we feel it would be helpful to provide relevant and timely information. 

JOINT CONTROLLERSHIP STATEMENT 

We are a Franchisor and so have direct relationships with Franchisees. We and our Franchisees are “joint controllers” for the purposes of applicable data protection laws where:

• We collect and manage your personal data, including your name and email address, for joint marketing campaigns which might be sent out by Franchisees but where we influence the content of the campaigns.
• We host and store your personal information, including your name, residential address, email address, phone number, reference contact information and responses from your references, cover letter, position preferences, willingness to relocate, desired salary and details contained in your full CV (which we may collect either through the application form on our website or which may be collected/shared with us by one of our Franchisees) in our candidate database (“Database”) during our relationship with our Franchisees. 

This means that in those scenarios, we and the Franchisee are working together to make decisions about why and how your personal information is processed and we are jointly responsible under data protection laws for that processing.  You should reach out to the contact details in the applicable Franchisee’s Privacy Notice (see below) if you want to exercise your data protection rights in respect of this processing.

In other situations, we and our Franchisees make decisions about how and why we process your personal information separately from each other, and we are each “independent controllers” for this processing. For a summary of our Franchisees’ processing, including the processing for which the Franchisees are each an independent controller, please consult their Privacy Notices. 

Where this Privacy Notice describes the processing described above for which we are joint controllers, “we” refers to both us and our Franchisees. It also describes the processing for which we are an independent controller. For more information about the joint controllership arrangements we have in place, please reach out to us at our contact details below. 
 

       2. What categories of personal data we collect  

• Personal Identification and Communication Information: your name, home address, phone number, email address, date of birth, and gender.
• Marketing Information: Your marketing preferences including any consents you have given us. 
• Application Related Information: curriculum vitae (CV), cover letter, reference contact information and responses from your referees, position preferences, willingness to relocate, and desired salary.

Please note that other than reference contact information and responses from your referees, information related to pre-employment screening will only be collected and processed by our Clients (in the event they offer you a role), and will not be processed by Gecko. 

We sometimes collect this information from you directly. For example, data is collected through our application portal. We may also collect information about you from our Franchisees if they have shared your information with us; or other people (e.g.from recruiters, referrals, your referees or other organisations such as from LinkedIn).
 

       3. Why we collect, use and store this personal data

We have to have a legal basis to process your data. We explain each of these legal bases below. We also set out the purposes for which we process your data. For each purpose, we explain the lawful basis for that processing, the processing operations that we carry out and the categories of data that we process. 

Explanation of the different legal bases which we may rely on to process your personal data

Consent – sometimes we ask for your consent to use your data.  

Legitimate interests – we can process your data when this is necessary for us to achieve a business purpose, or where this is necessary for someone else to achieve their purpose.   We explain below what interests we, or others, are trying to achieve when we process your data on this legal basis. Where we process personal data on the basis of a legitimate interest, then – as required by data protection law – we have carried out a balancing test to document our interests, to consider what the impact of the processing will be on you and other individuals and to determine whether those individuals’ interests outweigh our interests in the processing taking place. You can obtain more information about this balancing test by using the contact details at the end of this notice.

Where we are a joint controller with our Franchisees and we refer to our “legitimate interests” below, this is referring to the legitimate interests of both us and our Franchisees. 

Legal obligation – we have obligations to comply with legal and regulatory requirements under laws in various jurisdictions in which our business operates, including the UK and Ireland. In certain cases, we have to use or disclose your data to meet these obligations. 

Explanation of the different purposes for which we may process your personal data

We have set out below why we process your data, what data we use for each purpose, and who it may be shared with. We also indicate in brackets for each purpose which legal basis we rely on for this processing:

Administering your application – (legitimate interests) 

We have an interest in appropriately filling the job openings requested by our Clients, in order to provide a satisfactory service to our Clients and safeguard our business reputation. To achieve this, we collect and use your personal data so we can process your application tofor roles with our Clients. We also collect and use your Job Search Information in order to show you job openings which are most relevant to your search. We store, and where needed, update, your personal information to communicate with you about your application, and to respond to your inquiries.

To do this we use your Personal Identification and Communication Information.

This information will be shared with Franchisees, who may also need to communicate with you in order to help us administer your application; Clients, whom we provide with details about you to assess whether you would be suitable for a role and so they can contact you about your application; and companies who host our Database. 

Keeping in touch – (consent) 

With your consent, we use your data to contact you about future career opportunities with our Clients and to ensure we are sending you opportunities that are most relevant to you. The processing involved for this purpose includes analysing and storing your data, keeping it up to date, and using it to contact you. 

We use your Personal Identification and Communication Information and Application-Related Information (as described in Section 2) for this.

Where you provide your consent, this information will also be shared with Franchisees, Clients, and/or other companies in our group (including our parent company) so they can also contact you about relevant opportunities and promotional material you may be interested in. In addition this information will be shared with companies who host our Database.

Improving our sourcing process – (legitimate interests)

We have an interest in improving our sourcing processes so that we are more able to deliver a satisfactory service to our Clients as part of future sourcing processes, and to safeguard our business reputation. To achieve this, we analyse your data and compare it to past recruitment processes.

We use your Personal Identification and Communication Information and Application-Related Information (as described in Section 2) for this purpose.

This information will be shared with Franchisees who are carrying out sourcing activities alongside us so they can also improve their future processes; other companies in the Gecko group, who also use this information to help improve and develop our services; and companies who host our Database.  

Reviewing and assessing your CV – (legitimate interests) 

We have an interest in assessing the relevance of your application to the job openings of our Clients in order to provide a satisfactory service to our Clients and to safeguard our business reputation. To achieve this we carry out appropriate checks based on your CV. In addition, in order to help you with your application, we request that our Franchisees use a third-party AI tool to scan CVs for spelling and grammar errors. Such errors would only be corrected with permission from the Candidate. We do not make any decisions as to your suitability for roles with our Clients based on any errors identified.

We use your Personal Identification Information and Communication Information, and Application Related Information (as described in Section 2) for this.

This information will be shared with Franchisees, who will also need to review this information in order to assess your application's relevance to specific job openings; Clients, to whom we pass on this information so they can assess your suitability for their job opening, and companies who host our Database. 

Obtaining references (where an offer has been made by a Client) – (legitimate interests)

We have an interest in ensuring we fulfil our contractual obligations to our Clients in relation to obtaining references to assess your suitability for their roles. To achieve this, where an offer has been made to you by a Client, we ask our Franchisees to reach out to the reference contact details you have provided, and to provide their responses to the Client once received. 

We use your Personal Identification and Communication Information and Application-Related Information (as described in Section 2) for this purpose.

This information will be shared with Franchisees, so they are able to reach out to the references with the relevant questions; Clients, so that they can further assess your suitability for their job opening based on the responses received from references; and companies who host our Database. Additionally, where we ask our Franchisees to check references, this will require them to disclose the fact that you have applied to us to educational institutions and to previous employers, and we may also disclose to them specific information contained in your CV and/or application (for example pertaining to your education, qualifications or experience) which we may wish to verify with them.

Business interests – (legitimate interests) 

We have an interest in protecting our business interests and legal rights, including, in connection with legal claims, compliance, regulatory, auditing, investigative and disciplinary purposes and ethics and compliance reporting requirements. To achieve this we may need to provide evidence about our compliance, or another party's non-compliance, the relevant requirements of which may incorporate information about you.

To do this, we store, use and may transmit your Personal Identification and Communication Information, Application-Related Information.

This information will be shared with Franchisees to the extent they are also involved in the relevant matter; our other Gecko group companies, to the extent necessary to meet our compliance obligations; and companies who host our Database. We share information with legal and other advisers if there are investigations or potential claims, and with relevant courts, regulators, auditors, investigative bodies, disciplinary bodies, and other authorities we are dealing with in the respect of such matters.

Compliance with law – (legal obligation) 

We use your data to comply with legal, regulatory and other requirements under laws in various jurisdictions in which our business operates including UK and/or Irish corporate, tax, financial and other laws by analysing and possibly transmitting your personal data. To do this we use your Personal Identification and Communication Information, and Application-Related Information.

This information will be shared with Franchisees to the extent they are also involved in the relevant matter, and with government authorities and/or law enforcement officials if mandated by law.
 

       4. How we share your personal data

We share your personal data with our Franchisees by hosting and storing your personal information in our Database during our relationship with our Franchisees. Franchisees will be able to access and use this information in order to source and place Candidates with our Clients until our relationship with those Franchisees has ended. We also share personal data with Franchisees for them to send joint marketing campaigns (solely where you have provided your consent), and to enhance their sourcing processes using the analytics data we provide them with, as described above. Please also see our Joint Controllership Statement above.We may also share your personal data with Franchisees where they are involved in a relevant legal, regulatory or disciplinary matter with us and the data is necessary for that purpose. For our legal basis for this sharing, please see information above in relation to each of the relevant legal bases listed in the Why we collect, use and store this personal data section.

Your personal data will be shared with Clients so that they can assess the suitability of your application and so that you are able to apply to, and take up a position with them (if you are successful in your application). We will also share your personal data with Clients for Clients to send marketing materials to Candidates (solely where you have provided your consent)as described above; and so that Clients can confirm that satisfactory references have been obtained from your referees. For our legal basis for this sharing, please see information above in relation to each of the relevant legal bases listed in the Why we collect, use and store this personal data section.

Your personal data will be shared with other Gecko group companies in order to operate, improve and develop our services, to operate our business, to communicate with you on behalf of the Franchisee and/or to meet our compliance obligations under applicable law. We also share personal data with our group companies (including our parent company) for them to send their own marketing campaigns as described above. Other than where specified below, our legal basis for sharing this data is legitimate interests, since we have a legitimate interest in managing our business with our Franchisees and facilitating the provision of services to our Clients. We also have various legal obligations under corporate, tax, financial and other legislation in various jurisdictions; complying with such obligations may require us to process your personal data. See also information above in the Why we collect, use and store this personal data section in relation to our and our group companies' direct marketing activities, for which we will only ever share your personal data with other Gecko group companies where we have also collected your consent to receiving such marketing communications from those Gecko group companies.

Your personal data will be shared with companies providing services to us, such as technology services including hosting, maintenance, administration and analysis, as well as other agencies, under contract to Gecko Hospitality as part of the Candidate sourcing process. When we share your data with these companies, we have explained this according to each purpose under the Why we collect, use and store this personal data section above. Our legal basis for sharing this data is legitimate interests, since we have a legitimate interest in operating our business and in engaging third parties to provide us with services that will enable the operation of our business.

Your personal data also will be shared with government authorities and/or law enforcement officials if mandated by law or if required for the protection of our legitimate interests in compliance with applicable laws. For our legal basis for this sharing, please see information above in relation to Compliance with law.

In the event that a Gecko Hospitality business is sold or integrated with another business, your details may be disclosed to our advisers and any prospective purchaser's adviser and will be passed to the new owners of the business. Our legal basis for sharing this data is legitimate interests, since we have a legitimate interest in pursuing commercial and strategic aims by carrying out the sale of our business or any part(s) of our business and/or in acquiring or merging any part(s) of our business with another business.
 

       5. Where we transfer your personal data

The personal data we process is typically stored within the UK and Ireland.  

Personal data that we collect from you may be transferred to and stored at a destination outside the UK/European Economic Area (“EEA”).

Where we transfer personal data from the EEA to the UK, we rely on the decision of the European Commission, which has confirmed the UK provides an adequate level of protection for personal data (an “adequacy decision”). You can view this adequacy decision here.

Due to the global nature of our business, your personal data may be disclosed to Group Companies outside of the UK/EEA including, in particular, to the United States. Where these locations do not provide an adequate level of data protection, we ensure appropriate safeguards are in place to protect the transfer of your personal data to these countries. 

In the majority of cases, we will rely on data transfer mechanisms (e.g. the European Union’s Standard Contractual Clauses (“EU SCCs”), the UK International Data Transfer Agreement (IDTA) and/or the UK addendum to the EU SCCs). A copy of the relevant mechanism can be obtained for review on request by getting in touch with our contact details below. 
 

       6. Your choices and rights

You have the right to object to the processing of your personal data in certain circumstances, as described in more detail below. 

You also have the following rights:

These rights may be limited, for example if fulfilling your request would reveal personal data about another person, or if you ask us to delete information which we are required by law or have compelling legitimate interests to keep. 

If you wish to exercise any of these rights, please contact us at the contact details set out below. If you have unresolved concerns, you have the right to complain to a data protection authority in the country that you reside in or, the country of your place of work or the country where the alleged infringement took place. In the UK, this will be the Information Commissioner, the contact details for which can be found here. In Ireland, this will be the Data Protection Commission, the contact details for which can be found at How to contact us | Data Protection Commission. For all other EU/ EEA jurisdictions, a full list of data protection authority contact details can be found here.

Wherever we rely on your consent, you have the right to withdraw that consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal. We may however have other legal grounds for processing your data for other purposes, such as those set out above.
 

       7. Automated processing

Please see the section on Processing your CV above which describes how we may request that our Franchisees use a third-party AI tool to scan CVs for spelling and grammar errors. We do not make any decisions as to your suitability for roles with our Clients based on any errors identified, and this does not constitute automated decision-making with legal or similarly significant effects.
 

       8. How long we retain your personal data

If you are successful in being placed with a Client: we will retain your personal data only so as long as we need it to be able to deal with any legal claims linked to the application process. This will generally be for 7 years following placement, and any personal data which is not necessary for this purpose will be removed at an earlier stage. After this period, we will take steps to delete your personal data or hold it in a form that no longer identifies you.

Please note that if you become an employee of a Client, relevant personal information you provide will become a part of your employee file and may be used later by that Client for the management of the employment relationship.

If you are not successful in being placed with a Client or if you withdraw from the application process: we will retain your personal data with your consent for 7 years so we can keep you in mind for future recruitment processes with our Clients; otherwise, it will be deleted after 6 months.

Where you have searched for a job opening using our job search functionality, we do not retain your Job Search Information for longer than your browser session.
 

       9. Will provision of your personal data be mandatory?

Where we collect personal data to administer our contract with you to provide the sourcing services, this is mandatory and we will not be able to manage the application relationship without this information. In all other cases, provision of the requested personal data is optional, but this may affect your ability to participate in certain programs or systems, where the information is needed for those purposes.
 

       10. Updates to this Privacy Notice

We reserve the right to update this Privacy Notice at any time, and we will provide you with a new Privacy Notice when we make any substantial updates. We may also notify you in other ways from time to time about the processing of your personal information. 
 

       11. Contact us

If you have questions about this Privacy Notice or wish to contact us for any reason in relation to our personal data processing, please contact us at privacy@geckohospitality.com.

To comply with the General Data Protection Regulation (2016/679) we have appointed a European representative. If you wish to contact them, their details are as follows:

Bird & Bird GDPR Representative Services SRL

Avenue Louise 235

1050 Bruxelles

Belgium

EUrepresentative.Gecko@twobirds.com