Global Job Applicant

Who is using your Personal Information

CFA Institute is the "data controller" for the Personal Information that we obtain from you or others as a result of your application for employment. This means that we decide how to use the Personal Information and are responsible for looking after it in accordance with applicable data privacy laws.

Access to your data within CFA Institute will be provided to those employees who need to view it as part of their work in carrying out the purposes set out below. It will also be shared with third parties as described in this notice.

This notice does not form part of any contract of employment or other contract to provide services. We may update this notice at any time.

The types of data we hold about you

The information we hold about you may include the following:

• Personal details, including name, title, address, telephone number, email address, date of birth;
• The information in your application, including copies of right to work documentation, references, a CV, cover letter and previous employment details;
• Any information you provide to us during an interview;
• Information obtained through a background or reference check (as applicable), such as employment verification, education verification, and information about past disciplinary proceedings or allegations of bullying or harassment;
• We may also collect, store and use the following "special categories" of more sensitive personal information:
  • Information required for equality and diversity monitoring (such as your race or ethnicity, religious beliefs, sexual orientation and/or your health, including any disability and/or medical condition);
  • Information about criminal convictions and offences.

Please note that the information collected in the equality and diversity monitoring section will not form part of the assessment of your application.

How CFA Institute obtained your data

We collect most information directly from you, when you complete the online application form via WorkDay. We also obtain information from third parties, such as references, recruitment agencies and background check providers.

If you fail to provide information when requested, which is necessary for us to consider your application, we will not be able to fully process your application. For example, if we require a reference for the role and you fail to provide us with relevant details, we will not be able to take your application further.

How CFA Institute uses your data

We process your information for a number of purposes arising from your application for employment, including to assess your skills and suitability for the relevant role, to communicate with you about the recruitment process, to carry out background and reference checks and to keep records relating to our recruitment process. It is necessary for us to process your data for these purposes in order to meet our legitimate interests relating to recruitment administration, or because you have asked us to take steps prior to entering into a contract or because it is necessary for us to comply with our legal obligations, such as those relating to the monitoring of equal opportunities.

There may be situations where we ask for your consent to process your data, e.g. where we ask you to volunteer information about yourself or where we ask for your permission to share sensitive information.  

Special category data and criminal conviction data

Special category data and criminal conviction data require a higher level of protection. Listed below are examples of processing activities that we regularly undertake in respect of these types of data.  In addition to the activities listed below, it may sometimes be necessary to process this sort of information for exceptional reasons, for example, because it is necessary to protect your vital interests or those of another person.

• Health (including people with health conditions or impairments): We will process information about your health in order to make any arrangements or adjustments required in relation to your application e.g. to arrange access for interviews, and/or to monitor equal opportunities.  This processing is necessary to meet our legal obligations.
• Criminal conduct: Data about criminal convictions will only be collected if you have been offered a position in which information about criminal convictions has a direct impact on the performance of the role or we are legally required to seek this information. We will notify you of our intent to seek such information if it is required. 
• Racial or ethnic origin, sexual orientation and religious belief: Data about your racial and ethnic origin, sexual orientation or religious belief will only be processed where you have volunteered it to support our diversity, equity, and inclusion initiatives or where we need to process it in order to meet our statutory obligations.

Data Sharing with third parties

In order to process your application, we may need to share your information with the following types of organisations:

• External companies providing services to us, for example, recruitment or vetting agencies, or recruitment systems’ IT support; 
• Previous employers, including referees.

Where information is shared with third parties, we will seek to share the minimum amount necessary. All third-party service providers that process data on our behalf are required to take appropriate security measures to protect your data in line with our policies. We do not allow them to use your data for their own purposes. We permit them to process your data only for specified purposes and in accordance with our instructions.

Cross-Border data transfers

CFA Institute has its headquarters in the United States. By providing CFA Institute with your Personal Information, you acknowledge that your Personal Information will be transferred to the United States and will be processed and stored in the United States by CFA Institute and third-party data processors such as Workday. We provide appropriate protections for cross-border transfers as required by law for international data transfers through data processing agreements and standard contractual clauses, whenever appropriate. Where required by such laws, you may request a copy of the suitable mechanisms we have in place by contacting us as detailed below.  We only transfer the personal data to our Rights.

Your rights under this Privacy Notice

We provide you with the rights to:

• Withdraw your consent to processing your Personal Information. 
• Request access to your Personal Information. 
• Request rectification of your Personal Information. 
• Request erasure of your Personal Information. 
• Request restriction of processing of your Personal Information. 
• Request data portability. 
• Object to the processing of your Personal Information (including objection to profiling). 

Please note that all of these rights are limited under your applicable local data protection law. If you exercise or seek to exercise any of those rights, our obligations to respond are limited by and subject to applicable law.

Right to withdraw your consent: If a specific element of our processing of your Personal Information relies upon your consent, you may withdraw your consent at any time with future effect. Such a withdrawal will not affect the lawfulness of the processing prior to the consent withdrawal but may affect our ability to process your job application.

Right to request access: You may request to receive a copy of your Personal Information on file with us by contacting us via email.

You also have the right to obtain from us confirmation as to whether Personal Information concerning you is being processed, and, where that is the case, to request access to the Personal Information. This access information includes:

• The purposes of the processing,
• The categories of Personal Information concerned, and
• The recipients or categories of recipient to whom the Personal Information have been or will be disclosed.

However, this is not an absolute right and the interests of other individuals can restrict your right of access.

You have the right to obtain a copy of the Personal Information undergoing processing free of charge. For further copies requested by you, we will charge a reasonable fee based on administrative costs.

Right to request rectification: You have the right to obtain from us the rectification of inaccurate Personal Information concerning you. Depending on the purposes of the processing, you may have the right to have incomplete Personal Information completed, including by means of providing a supplementary statement. 

Right to request erasure (“Right to be forgotten”): Under some circumstances, you have the right to obtain from us the erasure of Personal Information concerning you. This is not an absolute right and may be limited by our need to retain data to support our business operations or comply with legal or regulatory requirements.

Right to request restriction of processing: Under some circumstances, you have the right to obtain from us restriction of processing your Personal Information. In such case, the respective data will be marked and may only be processed by us for certain purposes.

Right to request data portability: Under certain circumstances, you have the right to receive the Personal Information concerning you, which you have provided to us, in a structured, commonly used and machine-readable format and you have the right to transmit those data to another entity without hindrance from us.

Right to object: Under certain circumstances, you have the right to object, on grounds relating to your particular situation, at any time to the processing of your Personal Information by us and we can be required to no longer process your Personal Information. If you have a right to object and you exercise this right, your Personal Information will no longer be processed for such purposes by us. You may exercise this right by contacting us as stated in the “Contact Us” section of this Privacy Policy. Such a right to object may, in particular, not exist if the processing of your Personal Information is necessary to take steps prior to entering into a contract or to perform a contract already concluded.

To exercise your rights, please contact us at [email protected].  In some cases you also have the right to lodge a complaint with the competent data protection supervisory authority.

Keeping your data up-to-date

It is important that the data we hold about you is accurate and current. If your job candidacy is still active, please keep us informed of any changes after you submit your application.

Changes to this Notice

Except where limited by applicable law, we reserve the right to update this Notice to reflect changes to our information practices by prominently posting notice of the update on this Site, and, if required, obtaining your consent. Any updates will become effective immediately after posting the updates to this Notice and apply to all information collected about you, or where required, upon your consent. You agree that you will review this Notice periodically. If we make any changes to this Notice, we will change the "Last Updated" date above. 

If we make any changes to this Notice that materially and adversely impacts previously collected information about you, we will obtain your consent for processing information previously collected about you in such a manner.