UK Prospective Employee Privacy Policy

Last updated: October 1, 2026

Purpose

This Prospective Employee Privacy Notice (“Privacy Notice”) describes, among other things, how Nisos Holdings Inc. and its affiliates (“Nisos” or the “Company”) collects, processes, and uses your Personal Data (“Personal Data”) during your recruitment process with Nisos. Should you be selected for a position at Nisos, during onboarding, you will be provided with Nisos’s EU/EEA/UK Employee Privacy Notice, which further explains the processing of your Personal Data for purposes of entering into an employment contract with Nisos and processing during and after the expiration of the employment relationship. To this end, we process your Personal Data to the extent that is necessary and in compliance with the United Kingdom’s General Data Protection Regulation (“UK GDPR”) and the Data Protection Act 2018 (“DPA 2018”).

Nisos’ Data Processing Activities

We collect Personal Data from you when you provide it to us, such as when you submit a job application or communicate with us as part of the application process. We may also collect your Personal Data from third parties authorized to share it with us, such as recruiters that share information about potential applicants.

Data Protection Officer and UK Representative

Nisos has not appointed a Data Protection Officer as its processing does not meet the threshold requiring one under Article 37 of the UK GDPR. If you have questions about this Privacy Notice or about how your Personal Data is processed, please contact ps@nisos.com.

Types of Personal Data Being Processed

“Personal Data” means information relating to an identified or identifiable person. Nisos may collect and process the following categories of Personal Data about you:

⎻ Personal contact details such as name, job title, phone number, home address, e-mail address;

⎻ Recruitment information (including copies of right to work documentation, references and other information included in a resume or cover letter as part of the application process);

⎻ Date of birth;

⎻ Gender;

⎻ Ethnicity and Religion;

⎻ Information about professional qualifications;

⎻ Employment history;

⎻ The CV/Resume you submitted and all information therein;

⎻ A LinkedIn profile (if applicable);

⎻ Any other information you chose to provide to us.

Sources of Personal Information

The above information is collected in the following methods listed below:

⎻ Job applications (hard copy or electronic copy);

⎻ Resume(s)/Curriculum Vitaes/references;

⎻ Information provided during job forums and recruitment events;

⎻ Information forwarded by recruitment agencies;

⎻ Information provided directly by prospective employee;

⎻ Publicly available sources such as your social media profile (e.g. LinkedIn, X, Facebook);

⎻ Information provided through reference checks.

Special Category Data

Some of the information we may collect during the recruitment process falls within the “special categories” of personal data under Article 9(1) of the UK GDPR, including ethnicity, religion, gender, and (where applicable) health information.

The Article 9(2) condition we rely on for processing this data is:

⎻ Article 9(2)(b): processing is necessary for the purposes of carrying out the obligations and exercising the rights of the controller or of the data subject in the field of employment law (e.g. right-to-work checks, reasonable adjustments), read with Schedule 1, Part 1, paragraph 1 of the DPA 2018.

⎻ Where processing relates to equality or diversity monitoring: Article 9(2)(g) (substantial public interest), read with Schedule 1, Part 2, paragraph 8 of the DPA 2018 (equality of opportunity or treatment). Provision of equality monitoring information is voluntary and will not affect your application.

⎻ Where you have provided explicit consent: Article 9(2)(a).

Purpose of Processing

During the recruitment process, we only process data that is necessary to assess your suitability for the position you are applying to and, in the case of a successful candidacy, for the conclusion of the employment contract.

The legal basis for the processing of your data during the recruitment process and, in the case of a successful candidacy, for purposes of concluding an employment contract is Nisos’s legitimate interest in finding the best and most suitable candidates for the positions for which said candidates have applied to, and Nisos’s interest in concluding an employment contract with the selected candidate(s).

Where we process your Personal Data for equality and diversity monitoring during the recruitment process, we rely on the substantial public interest condition (Article 9(2)(g) UK GDPR, read with Schedule 1, Part 2, paragraph 8 DPA 2018). Providing this information is voluntary and will not affect your candidacy.

Any other processing of your Personal Data will only be undertaken if there is a legal basis for it, i.e., if processing is necessary to fulfill a legal obligation to which Nisos is subject. Should such a situation occur, we will notify you of it.

Sharing Your Personal Data

We may share your Personal Data as necessary for the purposes described in this Privacy Notice. For example, we may share your Personal Data as follows:

⎻ Affiliates: We may share your Personal Data with our Affiliates.

⎻ Third-Party Service Providers: We may use third party service providers to host and facilitate our operations and business (including human resources operations), such as cloud services providers, accounting service providers, human resource providers, payroll service providers, benefits providers, building management and travel service providers.

⎻ Business Transfers: We may transfer your Personal Data to a third party if we undergo a merger, acquisition, bankruptcy, or other transaction in which the third party assumes control of our business (in whole or in part).

⎻ Professional Advisors: We may share your Personal Data with other professional advisors.

⎻ Law Enforcement or Other Lawful Authority: We may also share your Personal Data with third parties for purposes of fulfilling our legal obligations under applicable law, regulation, court order, or other legal process, such as (i) preventing, detecting, and investigating security incidents and potentially illegal or prohibited activities; (ii) protecting the rights, property, or safety of you, us, or another party: (iii) enforcing any agreements with you; (iv) responding to claims; and (v) resolving disputes.

In any other case, we will only transfer your Personal Data to third parties if you have given explicit, effective consent for Nisos to do so. You are not obligated to give consent. Effective consent can only be given freely, and consent can be withdrawn at any time.

Transfer of Your Data Outside of the UK

Nisos affiliates and third-party service providers may be located outside the UK. We may therefore transfer your Personal Data to the United States or other countries outside the UK (“Third Countries”) in accordance with this Privacy Notice, including to recruitment personnel and department heads in the US for review and processing in connection with your employment.

Where we transfer your Personal Data to a Third Country, we will do so only where one of the following applies:

⎻ The UK government has made adequacy regulations recognising that the Third Country provides an adequate level of protection for personal data;

⎻ We have put in place appropriate safeguards, such as the UK International Data Transfer Agreement (UK IDTA) issued by the ICO, or the UK International Data Transfer Addendum to the EU Commission Standard Contractual Clauses, together with a Transfer Risk Assessment confirming that the standard of protection for your Personal Data is not materially lower than under UK data protection law; or

⎻ A specific exception under Article 49 of the UK GDPR applies.

Your Personal Data will primarily be stored in the UK but may also be stored in the US for processing purposes.

Retention of Your Data

Nisos will not maintain your Personal Data for longer than necessary for the purpose for which it was collected.

⎻ Unsuccessful candidates: We will retain your Personal Data for 6 months after the conclusion of the recruitment process for which you applied, after which it will be securely deleted unless you have consented to longer retention for the purpose described below.

⎻ Successful candidates: If you are selected for a position at Nisos, your recruitment data will be transferred to your employment file and retained in accordance with our UK Employee Privacy Notice, which you will receive during onboarding.

⎻ Talent pool/future opportunities: With your consent, we may retain your Personal Data for up to 12 months after the conclusion of the recruitment process to consider you for future openings at Nisos. At the end of this period, your data will be securely deleted unless you renew your consent. You may withdraw your consent and request deletion at any time by emailing careers@nisos.com.

Security of Your Data

We employ commercially reasonable technical and organizational security measures, taking into account (i) the current level of available technology; (ii) the cost-efficacy ratio of current technology; (iii) the extent, scope, context, and purposes of processing; and (iv) the risks associated with specific processing activities. We may limit access to your Personal Data to those who have a genuine business need to know it. Those processing your Personal Data will do so only in an authorized manner and are subject to a duty of confidentiality. We also have procedures in place to deal with any data security incident. We will notify you and any applicable regulator of a data security incident where we are legally required to.

Your Rights As a Data Subject

Under the UK GDPR and the DPA 2018, you have the following rights in relation to the Personal Data that Nisos processes about you:

⎻ Right to Access. You have the right to access your Personal Data processed by Nisos.

⎻ Specifically, you have the right to access any Personal Data that Nisos processes about you and to request information about:

  • The purposes for processing your Personal Data;
  • The categories of Personal Data concerned;
  • The recipients or categories of recipients to whom the Personal Data has been or will be disclosed;
  • For how long Nisos intends to store your Personal Data;
  • If we did not collect the data directly from you, information about the source;
  • Whether we use automated decision-making (including profiling), and, if so, the logic involved and the intended consequences of such processing; and
  • The safeguards we employ when transferring your data to another country outside EU/EEA or UK.
Upon your request, Nisos will provide you with a copy of your Personal Data in a structured, commonly used electronic form.

⎻ Right to Rectification. If you believe that Nisos holds any incomplete or inaccurate data about you, you have the right to request that Nisos correct and or complete the information. Nisos will correct or complete the information, provided that Nisos will notify you if it has a legal reason for being unable to do so.

⎻ Rights to Delete, Restrict, or Object. You have the right to request erasure of your Personal Data or to restrict processing in certain circumstances in accordance with the data protection laws, as well as to object to any processing of Personal Data on grounds relating to your particular situation, if the processing is based on legitimate interests pursued by Nisos.

⎻ Data Portability. If we are processing your Personal Data based on your consent, pursuant to a contract, or by automated means, you may request a copy of your Personal Data in a structured, commonly used and machine-readable format. You also have the right to withdraw your consent for processing at any time.

⎻ Automated Decision-Making. Where Nisos makes a significant decision about you that is based solely on automated processing (i.e. without meaningful human involvement), and that decision produces a legal effect or a similarly significant effect on you, Nisos will ensure that safeguards are in place. These safeguards include the right to be informed about the decision, the right to make representations about it, the right to obtain human intervention, and the right to contest the decision. As at the date of this Privacy Notice, Nisos does not make significant decisions about candidates based solely on automated processing (such as automated CV screening that results in rejection without human review). If this changes, we will update this Privacy Notice and inform you before any such processing begins.

Data Subject Requests

In order to exercise your rights under this Privacy Notice and applicable data protection laws, you may contact Nisos via the contact information listed below.

If Nisos receives a request from you to exercise any of your rights, Nisos may ask you to provide additional information which we may deem necessary to confirm your identity, before acting on the request.

Due to certain requirements under applicable laws Nisos may be unable to complete your request. We will notify you when this occurs and provide the legal basis for our inability to complete your request.

If you believe Nisos is failing to adequately meet any of the rights outlined above, please contact us immediately. You have the right to lodge a complaint with the Information Commissioner’s Office (see contact information below).

Changes to the Privacy Notice

We may change this Privacy Notice from time to time and/or will update this Privacy Notice periodically.

Contact Information for Nisos

If you have any questions regarding this Privacy Notice or regarding your rights as a data subject, or if you wish to exercise such rights, please contact us at:
E-mail address: ps@nisos.com
Phone: +1 7033828106
Address: 3rd Floor Dax House, 22 Howard Street, Belfast BT1 6PA

Contact Information of the Supervisory Authority

The Information Commissioner’s Office – Northern Ireland
3rd Floor
14 Cromac Place,
Belfast BT7 2JB
Telephone: 0303 123 1114 / Email: ni@ico.org.uk