Recruitment Privacy Approach

We share your personal data only with parties that have a clear need to receive it:

• Thesis People & Culture team, hiring managers and interviewers involved in the role you have applied for.
• Other Thesis group entities, where you are being considered for roles across the group.
• HiBob, as the provider of bob Hiring, processing your data on our behalf.
• Other recruitment service providers, including agencies and headhunters, assessment and testing platforms, scheduling tools, video-interview providers, reference-check providers and background-check providers.
• Professional advisers, such as legal, audit, tax and HR advisers.
• Government authorities, regulators, courts and law-enforcement bodies, where required by law or to protect our legal interests.
• Acquirers and their advisers, in the context of an actual or prospective sale, merger, reorganisation or restructuring of part or all of the Thesis group.

Where your application has been submitted by a third party (such as an agency), we may give that third party limited access to your details and overall application status to provide feedback on submissions.

We do not sell your personal data, and we do not share it for third-party direct-marketing purposes.

Your personal data may be accessed, transferred or stored in the UK, the EU/EEA, the United States and other countries where Thesis group entities or our service providers (including HiBob and its sub-processors) operate.

Where we transfer personal data from the UK, EEA or Switzerland to a country not recognised as providing an adequate level of protection, we put appropriate safeguards in place, typically the European Commission's Standard Contractual Clauses, the UK International Data Transfer Addendum, or another lawful transfer mechanism. You can request a copy of the relevant safeguards by contacting privacy@thesiscloud.com.

• Unsuccessful applicants: typically up to 12 months from the date you are informed of the hiring decision or the closure of the role. Where local law requires a shorter or longer period, we follow the law.
• Successful applicants: where you join Thesis, the relevant parts of your candidate record are transferred into your employee record and retained in line with the Thesis staff privacy notice.
• Talent pool: with your separate consent, we may keep your details for a longer period (for example, up to 24 months) so we can contact you about other suitable roles.
• Background checks: retained for the minimum period required to evidence the check.
• System logs and Usage Data within bob Hiring: retained by HiBob for the periods set out in HiBob's policies and our agreement with them.

Specific retention limits for different categories of records are available on request from privacy@thesiscloud.com.

Subject to applicable law, you have the right to:

• Access the personal data we hold about you and receive a copy.
• Have inaccurate or incomplete data corrected.
• Have your data erased in certain circumstances.
• Restrict or object to certain processing, including processing based on our legitimate interests.
• Receive certain data in a machine-readable format and have it transmitted to another controller (data portability).
• Withdraw any consent at any time, without affecting the lawfulness of processing before withdrawal.
• Lodge a complaint with the data-protection authority in the country where you live, work or believe a breach has occurred. In the UK this is the Information Commissioner's Office (ico.org.uk).

These rights may be limited, for example, where complying would reveal personal data about another person or conflict with a legal obligation. We will explain any exemptions we rely on when responding to your request.

To exercise any of these rights, contact privacy@thesiscloud.com or your people@thesiscloud.com. You can also use the self-service options in the bob Hiring candidate portal. 

If you do not provide personal data we need for legal or contractual reasons (for example, right-to-work documentation), we may not be able to take your application forward.

During your application, we (or HiBob on our behalf) may send you notifications and updates by email, for example, status updates, interview invitations, requests for information or requests for consent to extended retention. You cannot opt out of communications integral to your application, but you can withdraw your application at any time by contacting your recruiter. 

We use industry-standard technical, physical and procedural measures to protect your personal data, including encryption in transit and at rest where appropriate, access controls, audit logging and supplier-security assessments. HiBob applies its own information-security programme to bob Hiring (see hibob.com/security). No system is ever completely secure, but we work hard to safeguard your information.