Saber.tech Privacy Notice

This Privacy Notice is dated 15/07/26

  1. INTRODUCTION AND SCOPE OF THIS PRIVACY NOTICE
  2. THE DATA WE COLLECT ABOUT YOU
  3. HOW YOUR PERSONAL DATA IS COLLECTED
  4. HOW WE USE YOUR PERSONAL DATA
  5. HOW WE USE PARTICULARLY SENSITIVE INFORMATION
  6. DISCLOSURE OF YOUR PERSONAL DATA
  7. INTERNATIONAL TRANSFERS
  8. AUTOMATED DECISION-MAKING AND THE USE OF AI
  9. DATA SECURITY
  10. DATA RETENTION
  11. YOUR RIGHTS AS A DATA SUBJECT
  12. EXCERCISING YOUR RIGHTS
  13. CHANGES TO THIS PRIVACY NOTICE

1. INTRODUCTION AND SCOPE OF THIS PRIVACY NOTICE

1.1 We respect the privacy of prospective employees, workers and contractors and are committed to protecting your personal data both during and after the application process, regardless of the outcome. This Privacy Notice is aimed at candidates for prospective employment with us and to those seeking to offer their services as private contractors or workers to us (this “Privacy Notice”) and describes how we collect and use personal information about you during the recruitment process, including in the event your application is unsuccessful.

1.2 The terms “we”, “us”, “our”, refer to Saber.tech Systems S.L. a private company incorporated and registered in Spain with its registered office address at c/ Hoyo de Esparteros 3 (Edif. La Mundial) 29005 Malaga, Spain (“Saber.tech”), and where relevant, other companies within the same corporate group that participates in the recruitment process (together, the “Saber.tech Group”).

1.3 The specific company within the Saber.tech Group that is recruiting for a particular role will be the data controller of your Personal Data for that recruitment process. For roles based in Spain, the data controller will typically be Saber.tech Systsems S.L. and the EU General Data Protection Regulation (EU GDPR) will apply.

1.4 We have appointed a data protection officer (DPO) who is responsible for overseeing questions in relation to this Privacy Notice. If you have any questions about this Privacy Notice, including any requests to exercise your rights as a Data Subject (as summarised in this Privacy Notice), please contact our DPO using the details set out below.

2. THE DATA WE COLLECT ABOUT YOU

2.1 In an employment application, employment, engagement and/or HR context, we may collect, use, store and transfer different kinds of Personal Data about you which we have grouped together into “categories” of Personal Data as follows:

  1. Identity Data includes: first name, last name, title, date of birth, gender, nationality, and photographs
  2. Contact Data includes: address, personal email addresses and telephone numbers
  3. HR Data includes: current (if applicable) and previous employment / work history, job titles, job titles, employment references, national insurance number (where applicable), tax identification numbers and tax status, location of workplace (for independent contractors or workers only), training records and professional memberships, compensation history / salary details from current employer (if applicable).
  4. Additional HR Data is only relevant for considering applications involving relocation packages and more senior management roles, and includes: marital status and dependents, right to work and immigration data, proposed working hours.

Identity Data, Contact Data and HR Data are collected primarily from any application form(s) filled in by you as well as from your curriculum vitae (“CV”) and cover letter(s) (if any), which we collectively refer to as “Application Documentation”.

2.2 We do not intentionally seek to collect special categories of Personal Data or data relating to criminal convictions at this stage unless this is necessary for a specific purpose described in section 5 below (for example, to make reasonable adjustments for an interview or to carry out legally required background checks for certain roles).

2.3 Providing the Personal Data described in this Privacy Notice is generally voluntary, but in some cases, it will be necessary for us to assess your application and, if appropriate, enter into an employment or services contract with you. If you do not provide the information we reasonably request, we may be unable to process your application or consider you for the relevant role.

3. HOW YOUR PERSONAL DATA IS COLLECTED

3.1 We use different methods to collect data from and about you including through:

a) Direct interactions: This includes information you provided to us during the recruitment stage, both in your Application Documentation as well as at interview(s). It also includes further information sourced from you during your correspondence with us during the recruitment exercise, via emails, meetings (including e-Meetings), telephone calls, or similar interactions/communications During these direct interactions, we may also generate information internally (e.g. interview notes, salary expectations, relocation requirements, training requirements, proposed employment contracts/service agreements, or proposed revisions thereto)

b) Third parties or publicly available sources: We may also receive Personal Data about you from various third parties (e.g. your named referees) and publicly available sources (e.g. Facebook, LinkedIn, Twitter, and in some limited cases, Credit Reference Agencies) and utilise this information for things such as minimising fraud risks to the business, or to consider you for certain roles where additional checks and information are required under applicable law and/or regulatory guidance. In addition, we may have collected and continue to process information received from employment agencies used during the recruitment process.

4. HOW WE USE YOUR PERSONAL DATA

4.1 We process your Personal Data only to the extent necessary and on the basis of one or more of the lawful bases set out in Article 6 GDPR, in particular our legitimate interests, taking steps to enter into a contract with you, our legal obligations and, where applicable, your consent, for the purposes outlined below.

4.1.1 For the purpose of the recruitment process (filling vacant positions), negotiating the conclusion of an employment or similar relationship

The legal basis for processing your personal data during the recruitment process is primarily our legitimate interest (Article 6(1)(f) GDPR), which enables us to identify and assess candidates for potential employment in an efficient and fair manner. We rely on this basis particularly in the initial stages of the recruitment process (e.g., screening and evaluating applications), where the processing is necessary to manage and improve our recruitment procedures and to select suitable candidates for roles within the Saber.tech Group in an efficient and fair manner.

In the later stages of the recruitment process, where the processing of personal data is directly related to negotiating or concluding an employment contract, we rely on Article 6(1)(b) GDPR (processing necessary for the performance of a contract or to take steps at the request of the data subject prior to entering into a contract).

If you are not selected for the position, and unless you provide us with your consent for future contact regarding job opportunities, your personal data will be retained for period of no longer than six (6) months from the conclusion of the recruitment process for the position you applied for. This retention period allows us to address potential legal claims related to the recruitment process, such as those concerning equal treatment and non-discrimination, and to ensure the transparency and fairness of the selection process. After this period, your personal data will be securely deleted unless further retention is required by law.

4.1.2 For the purpose of maintaining a record of job applicants and contacting them regarding job opportunities (vacancies) within the Saber.tech Group.

We may wish to retain your personal data to contact you in the future with job offers within the Saber.tech. In such cases, we will ask for your consent (Article 6(1)(a) GDPR) either before you submit an official application or after submitting it. The personal data provided in this way will be stored for a maximum period of one (1) year from the granting of consent.

5. HOW WE USE PARTICULARLY SENSITIVE INFORMATION

5.1 In limited cases we may process special categories of Personal Data (such as information about your health or your racial or ethnic origin) during the recruitment process, for example if you choose to volunteer such information in order to request reasonable adjustments for an interview or as part of a background‑check process for certain roles. We will only process such data where this is permitted by law.

5.2 In particular, we may process special categories of Personal Data where the processing is necessary:

a) to carry out our obligations and exercise specific rights in the field of employment and social protection law (Article 9(2)(b) GDPR); and/or

b) for the establishment, exercise or defence of legal claims (Article 9(2)(f) GDPR); and/or

c) where you have given your explicit consent for a specific purpose (Article 9(2)(a) GDPR), which you may withdraw at any time by contacting the DPO.

5.3 For roles that require background or criminal‑records checks, we may process information about criminal convictions and offences only where this is permitted by applicable national law and only to the extent necessary for that purpose.

6. DISCLOSURE OF YOUR PERSONAL DATA

6.1 Your information will be shared internally for the purposes of the recruitment exercise. This includes members of the HR and recruitment team, interviewers involved in the recruitment process, managers in the business area with a vacancy and IT staff if access to the data is necessary for the performance of their roles.

6.2 We may have to share your personal data with the following recipients or categories of recipients set out below:

  1. Other companies in the Saber.tech Group acting as joint controllers or processors and who provide HR, IT, and system administration services (to a limited extent and subject to them not disclosing this further within the organisation without express authority).
  2. Recruitment agencies, job boards and assessment providers that support us in advertising roles, managing applications and running assessments.
  3. Background‑check, identification and verification providers, where this is required for certain roles and permitted by law.
  4. Professional advisers (such as lawyers or auditors) and regulators or authorities where we are required to do so by law or where it is necessary to protect our rights.
  5. IT and software providers (including providers of applicant‑tracking systems, communications tools and cloud services) who host or process Personal Data on our behalf in accordance with our instructions.

Generally, unless you are at final stages of selection, and applying for more senior managerial roles and other controlled functions, we will not need to disclose information regarding your application to third parties outside of the Saber.tech Group beyond the categories mentioned above.

7. INTERNATIONAL TRANSFERS

7.1 Due to the global nature of our operations, from time to time we may need to share your personal data within the Saber.tech Group of companies and third-party service providers which may be located in Spain, elsewhere in the European Economic Area (“EEA”) or outside of the EEA (for example in the United Kingdom or Gibraltar).

7.2 Where we transfer Personal Data outside the EEA, we will ensure that appropriate safeguards are in place, such as an adequacy decision or standard contractual clauses, and you can obtain further information about these safeguards by contacting the DPO

8. AUTOMATED DECISION-MAKING AND THE USE OF Ai

8.1 “Automated decision-making” is the process of making a decision by automated means without any human involvement. A decision is therefore solely automated if there is no meaningful input by a human in the final decision being made about a person. In most cases, we do not use automated decision-making when processing Personal Data as decisions will generally have human involvement. If this changes, we will confirm this to you and provide meaningful information about the logic involved, as well as the significance and the envisaged consequences for you. However, certain third parties (e.g. credit referencing agencies) may use certain automated decision-making tools or software, including artificial intelligence (see below). We are not responsible for any automated decision-making by third parties but may take reasonable steps to bring such automated decision-making to your attention.

8.2 Artificial Intelligence (Ai)

8.2.1 Artificial intelligence (“AI”) refers to when a machine can demonstrate intelligence (i.e. learning, reasoning, understanding of concepts and recognition of patterns etc.) through analysis of inputted data and information. This allows use of machine learning to synthesize, make inferences, and even problem-solve. ‘Generative AI’ typically uses large language models or “LLMs” and some applications create “generative pre-trained transformers” or “GPTs”. Whereas Generative AI turns machine learning inputs into content, ‘Predictive AI’ uses machine learning in an attempt to determine the future and prevent bad outcomes by using data to identify early warning signs.

8.2.2 Where AI makes decisions and there is no human involvement (beyond the inputting stage), then that will be wholly automated decision-making as defined above. However, where the final decision is subject to human intervention or involvement, then this will not be automated decision-making.

8.2.3 From time to time, we may use Ai tools to assist in our recruitment process. These tools may:

  • Screen resumes and applications for relevant qualifications and experience
  • Analyse assessment responses
  • Generate insights from interview recordings
  • Recommend candidates based on skills matching

While we may use these tools to improve efficiency, final hiring decisions are always made with human oversight. You have the right to request human intervention, express your point of view, and contest any decision made using automated processing.

9. DATA SECURITY

9.1 The accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Personal Data is known as a “data breach”. We have put in place appropriate physical, technical and administrative security measures to prevent data breaches and deal with these when they arise. These measures include internal policies regarding data breach prevention and internal/external reporting, as well as physical and IT security measures to monitor and restrict processing. In addition, we limit access to your Personal Data to those employees and any third parties who have a business need to know. Such persons will only process your Personal Data on our instructions and are subject to duties of confidentiality, and of complying with our data protection procedures.

9.2 During the recruitment process, your Personal Data is generally only processed by HR staff. Such persons will only process your Personal Data on our instructions, and they are subject to a duty of confidentiality as outlined above.

9.3 We undertake to inform you, to the extent we are required to do so, if your personal data is compromised and there is a high risk to your rights and freedoms as a result.

10. DATA RETENTION

10.1 We will only retain your personal data for as long as necessary to fulfil the purposes we collected it for, including:

  1. Considering your application and:

If you are: successful, transferring this information to a personnel / HR file or other equivalent internal record(s) kept for our employees and external contractors/workers, which will be retained during your employment or contractor relationship with us and following its conclusion in line with our internal Privacy Notice for Employees, Workers & Contractors;

If you are: unsuccessful, retaining this information with your express written consent in order to consider you for future roles for a predetermined period of up to 12 months following conclusion of the recruitment process, and where no such consent is provided, for a period of up to 6 months.

  1. maintaining business records for the purposes of satisfying any legal, accounting, or reporting requirements
  2. complying with record retention requirements under relevant laws;
  3. exercising, establishing, or defending legal claims

10.2 We may retain your Personal Data for longer periods where such retention is necessary for compliance with a legal obligation to which we are subject, or where another lawful basis applies. In the recruitment context, this will only apply in exceptional circumstances. Similarly, we may retain information pursuant to our legitimate interests, but these will also be rare in the recruitment context and generally be limited to defending any legal claims which we reasonably expect may be brought against us, or which we may wish to bring.

11. YOUR RIGHTS AS A DATA SUBJECT

11.1 You have certain rights under particular data protection legislation. These rights apply equally in an employment and HR context and in the recruitment context and these are summarised below:

Right to information

Right to request access

Right to rectification

Right to erasure (right to be ‘forgotten’)

Right to restriction of processing

Right to data portability

Right to object

Right to freedom from automated decision-making (including profiling)

Right to lodge a complaint with the relevant suoervisory authority; and

Right to withdraw consent

If you have any further questions or doubts regarding the exercise of such rights, please contact the DPO in the first instance using the contact details provided below:

[email protected]

11.2 If we have not responded to you within a reasonable time or if you feel that your complaint has not been resolved to your satisfaction, you are entitled to make a complaint to a supervisory authority. For roles based in Spain, or where Saber.tech Systsems S.L is tehrelevant data controller, this is typically the Spanish Data Protection Agency (Agencia Española de Protección de Datos, "AEPD"). You may contact the AEPD on the below details:

Address:

Calle Jorge Juan, 6, 28001 Madrid

Email: [email protected]

11.3 If you live or work in another member state of the European Economic Area, you may also lodge a complaint with your local supervisory authority.

12. EXERCISING YOUR RIGHTS

12.1 If you wish to exercise any of the rights set out above, please contact the DPO using the contact details set out above in this Privacy Notice. We may need to request specific information from you to help us confirm your identity and to ensure your right to access your Personal Data (or to exercise any of your other rights).

12.2 We aim to respond to all legitimate requests within the time periods required by applicable Data Protection Legislation. Occasionally it may take us longer if your request is particularly complex or you have made a number of requests. In this case, we will notify you and keep you updated.

13. CHANGES TO THIS PRIVACY NOTICE

13.1 We may update this Privacy Notice from time to time, but it is unlikely to be amended during a recruitment process. When we make such changes, we will notify you by providing you with a copy of the new notice and will also update the “Last updated” field at the top of this Privacy Notice.