About this Privacy Notice#
This privacy notice is intended to assist individuals in the EU, EEA and UK who apply for work with Comanche Biopharma as an employee, worker or contractor in understanding how we collect, use, protect and transfer your Personal Data during the recruitment process. It also explains how you can exercise your privacy rights and contact us.
In this Notice, Comanche Biopharma Corp. and its affiliates are collectively referred to as “Comanche Biopharma”, “we”, “our” or “us”. We are committed to protecting the privacy and security of your Personal Data. This Notice covers recruitment and selection, interviews, assessment, pre-employment checks where applicable, offers and related recruitment administration.
Who is the controller of your Personal Data?#
For the purposes of applicable Data Protection Legislation, Comanche Biopharma Corp. or its affiliate which is recruiting you is the controller of your Personal Data and determines the purposes and means of the recruitment processing.
Where the European Union (EU) GDPR applies, we process Personal Data in accordance with Regulation (EU) 2016/679 and applicable national law. Where UK law applies, we process Personal Data in accordance with the UK GDPR and Data Protection Act 2018, as amended.
What Personal Data do we collect?#
| Category | Examples |
|---|---|
| Identity and contact information | Name, title, address, email address, telephone number and other contact details. |
| Application and recruitment information | CV or résumé, work history, education, qualifications, skills, languages, references, interview notes, assessments, correspondence and role preferences. |
| Eligibility and verification information | Identity and right-to-work documentation, immigration or work-authorisation status, professional licences and background-check information where checks are lawful and appropriate for the role. |
| Offer and remuneration information | Salary expectations, proposed remuneration and benefit information, and other information needed to prepare an offer or engagement. Bank details are normally collected only when needed for onboarding after an offer is accepted. |
| Health and accessibility information | Information you choose or need to provide about disability, health or reasonable adjustments for the recruitment process. |
| Equality and diversity information | Optional demographic information collected for equal-opportunity monitoring where permitted by law and kept separate from selection decisions where appropriate. |
| Recordings and technical information | Interview recordings where we tell you in advance that recording is used, and technical information generated by recruitment platforms or remote-interview tools. |
You do not have to provide optional diversity information. If you do not provide information that is genuinely necessary to assess your application or complete a legally required pre-employment check, we may be unable to progress your application.
How do we collect your Personal Data?#
We collect information directly from you through applications, interviews, recruitment platforms and communications. We may also receive Personal Data from recruitment agencies, professional networking sites and other legitimate public professional sources, referees, background-screening providers, identity or right-to-work verification providers, and other organisations involved in a recruitment process.
How do we use your Personal Data and what are our lawful bases?#
| Purpose | Typical lawful basis where EU/UK law applies |
|---|---|
| Receive and administer applications, communicate with you, assess suitability and run interviews or assessments. | Steps at your request before entering a contract (Article 6(1)(b)) where the processing is objectively necessary to consider your application; legitimate interests (Article 6(1)(f)) for recruitment administration or related activities that are not necessary pre-contractual steps. |
| Verify identity, right to work, professional qualifications and other eligibility requirements. | Legal obligation where a check is required by law; otherwise steps before contract and legitimate interests where the check is necessary and proportionate. |
| Obtain references and carry out background or criminal-record checks where permitted. | Legitimate interests and/or legal obligation, subject to the additional requirements that apply to criminal-offence data. |
| Prepare and manage an offer, proposed contract, remuneration and onboarding steps. | Steps before entering a contract and legal obligation where required. |
| Provide reasonable adjustments and meet employment-law obligations. | Legal obligation and/or steps before contract; Special Category Personal Data is processed only under an additional Article 9 condition. |
| Monitor equality of opportunity and recruitment outcomes. | Legitimate interests in fair and inclusive recruitment and/or legal obligation where applicable. Special Category Personal Data is processed only where an Article 9 and relevant national-law condition applies. |
| Keep details for future roles after an unsuccessful application. | Consent where we ask you to join a talent pool. You may withdraw that consent at any time. |
| Establish, exercise or defend legal claims and demonstrate that recruitment was conducted fairly. | Legitimate interests and, for Special Category Personal Data where relevant, the legal-claims condition. |
To the extent practicable, equality-monitoring information is kept separate from information used to select candidates and is not used to assess your suitability for a role, except where applicable law specifically permits or requires otherwise.
Special Category Personal Data#
Recruitment may involve Special Category Personal Data, for example health or disability information for reasonable adjustments, or optional equality-monitoring information. We use such data only where an Article 9 or equivalent local-law condition applies. Depending on the purpose and jurisdiction, this may include employment-law obligations, substantial public interest, legal claims or explicit consent where consent is genuinely appropriate.
In the UK, additional conditions and safeguards under the Data Protection Act 2018 may apply, for example to employment and equality monitoring.
Criminal convictions and offences#
We obtain criminal-record information only where it is appropriate to the role and permitted by applicable law. Such data is processed only where authorised by law and subject to the additional safeguards required for criminal-offence data.
Information about other people#
If you provide information about a referee or another person, please make sure you are entitled to give us their details. We will use referee information only for recruitment-related purposes and will provide privacy information where required.
Who do we share your Personal Data with?#
Where necessary and lawful, we may share candidate Personal Data with:
- relevant hiring managers, HR staff and other Comanche affiliates involved in recruitment;
- recruitment platforms, agencies, interview or assessment providers and other recruitment service providers;
- background-screening, identity, right-to-work and reference providers where checks are appropriate;
- immigration advisers or authorities where sponsorship or work authorisation is relevant;
- professional advisers and regulators where required; and
- service providers that host or support our HR and recruitment systems.
International transfers#
Comanche Biopharma operates internationally and uses service providers in multiple countries. Your Personal Data may therefore be transferred to, or accessed from, a country outside the country in which it was collected.
Where EU/EEA transfer restrictions apply, we use a mechanism permitted by the EU GDPR. Depending on the destination and recipient, this may include an adequacy decision, the European Commission Standard Contractual Clauses or another lawful safeguard. Where required, we assess whether additional measures are needed to ensure an essentially equivalent level of protection.
Where UK transfer restrictions apply, we use a mechanism permitted by UK law, such as UK adequacy regulations or an appropriate safeguard including the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses. Where required, we assess the transfer against the UK statutory data protection test and apply additional protections if necessary.
You can contact our privacy contact if you would like more information about the safeguards used for a particular transfer.
How long do we keep your Personal Data?#
For an unsuccessful application, we normally retain recruitment records for up to 12 months after communicating the recruitment decision, unless a different period is required or permitted by local law or needed for a specific legal claim.
If we invite you to join a future-opportunities or talent pool and you consent, we may retain relevant candidate information for up to a further 12 months. In that case, information will normally be deleted no later than 24 months after the end of your most recent application unless you submit a new application or another lawful retention reason applies.
If you are hired or engaged, relevant recruitment information may become part of your employment or contractor record and will then be retained under the Employee Privacy Notice and applicable retention requirements.
How do we protect your Personal Data?#
We use appropriate technical and organisational measures designed to protect Personal Data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access. Measures may include, as appropriate to the processing, access controls, confidentiality obligations, security awareness, encryption where technically suitable, and incident-response procedures.
Access to Personal Data is limited to people who need it for their role. Where a service provider processes Personal Data on our behalf, we require appropriate privacy and security obligations in the relevant agreement.
What are your privacy rights?#
Depending on the law that applies and the reason we use your Personal Data, you may have the right to:
- ask whether we process your Personal Data and obtain a copy;
- ask us to correct inaccurate or incomplete Personal Data;
- ask us to erase Personal Data in certain circumstances;
- ask us to restrict processing in certain circumstances;
- object to processing based on legitimate interests and object at any time to direct marketing;
- receive or transmit certain Personal Data in a portable format where the right applies;
- withdraw consent at any time where processing is based on consent, without affecting processing already carried out; and
- lodge a complaint with a competent privacy or data protection authority at any time, however, we would appreciate the opportunity to address your concerns first, so please contact us in the first instance.
These rights are not absolute. For example, we may need to keep information where a legal or regulatory retention obligation applies. We may ask for information needed to verify your identity before responding to a request.
Where UK data-protection law applies, Comanche Biopharma will handle data-protection complaints in accordance with applicable UK requirements. You may also complain directly to the competent supervisory authority or privacy regulator. In the UK, this is the UK data-protection regulator (ICO). In the EU/EEA, you may complain to the competent supervisory authority under the EU GDPR.
Automated decision-making#
You will not be subject to a recruitment decision that has legal or similarly significant effects based solely on automated processing unless that processing is permitted by applicable law and the required safeguards apply. If Comanche Biopharma introduces such processing, we will provide the information and safeguards required by law.
Third-party recruitment websites and applications#
Our careers or recruitment process may use links to third-party websites or applications. Where a third party acts as our processor, we remain responsible for the processing we instruct it to perform. Where a third party acts for its own purposes, its own privacy notice will apply to that processing.
Changes to this Privacy Notice#
We may update this notice to reflect changes in recruitment practices or applicable law. The current version will be published in the Privacy Centre and will show its effective date.
Contact Us#
If you would like to exercise a privacy right, or you have a question or complaint about this notice or the way your Personal Data is processed, please contact our Data Protection Officer using the details below.
Data Protection Officer (DPO)
The DPO Centre Netherlands B.V.
Vijzelstraat 68, Amsterdam 1017HL, Netherlands
UK Representative (where applicable)
The DPO Centre Limited
50 Liverpool Street, London EC2M 7PY, United Kingdom
The Organisation
Comanche Biopharma Corp.
50 Beharrell Street, Unit B, Concord, MA 01742, United States