E-Recruitment Privacy Statement

I. Who is the controller responsible for processing your personal data and how can the data protection officer be contacted

The controller responsible for processing your personal data for the purpose of Art. 4 (7) of the General Data Protection Regulation (EU) 2016/679) (hereinafter “GDPR”) is the respective R-R entity specified below:

• If you are applying for a job at Rolls-Royce plc. (UK), then, for the purposes of the Data Protection Act 1998, the data controller is Rolls-Royce plc of Kings Place, 90 York Way, LONDON N1 9FX (UK) (“R-R plc”). The Chief Privacy Officer can be contacted via this address, or email: [email protected].
• If you are applying for a job at Rolls-Royce Deutschland Ltd & Co KG (Germany), then for the purposes of the Bundesdatenschutzgesetz (“BDSG”), the data controller is Rolls-Royce Deutschland Ltd & Co KG, Eschenweg 11, Dahlewitz, 15827 Blankenfelde-Mahlow (Germany) (“R-R Germany”). The Data Privacy Officer can be contacted via this address.

If and to the extent you have declared your respective explicit consent at any stage of the recruitment process, your information and data may consequently be transferred to and shared with the affiliate enterprises of R-R plc and R-R Germany as listed on the R-R internet pages (such enterprises collectively “R-R Group Entities”), whereas in such case these R-R Group Entities shall process the respective information and data as joint controllers for the purpose of Art. 26 GDPR.

To the extent your information and data is processed by aforesaid R-R Group Entities in their capacity as joint controllers, processing of your personal data is carried out by these R-R Group Entities on the basis of a respective joint controllership agreement pursuant to Art. 26 (1) GDPR specifying, in particular, the roles and responsibilities of each R-R Group Entity involved in terms of protecting your personal data. Under said agreement, R-R plc is responsible for the performance of the obligations with respect to the fulfilment of data subjects’ rights pursuant to Chapter 3 of the GDPR, in particular with regard to information and access to as well as rectification, erasure and portability of personal data and the restriction of processing of such. This means for you that, in order to exercise your rights with respect to your personal data, you may contact R-R plc at the contact details specified above at any time. For further information on the exact scope of your rights with respect to your personal data, please see the respective detailed information in below section “Your Rights”.

Hereinafter, the respective R-R Group Entity or, as the case may be, the R-R Group Entities acting as (joint) controller(s) for the purpose of Art. 4 (7) GDPR are referred to as “R-R”, “we” or “us”, respectively.

II. Information R-R collects

(1) Application Data

As part of the job application process, R-R collects the following of your personal data (“Application Data”):

• Contact information (e.g. name, postal address and email address)
• Nationality and country of birth
• Date of birth
• Academic and vocational qualifications, skills and competencies
• Resume/CV documents that support your job applications, including reference letters and transcripts
• Employment history
• Job application history
• Remuneration and Benefits package
• Results from the Leadership Assessment and background screening we may ask you to complete
• Financial and banking details
• Your responses to job-specific questions
• Information relating to how you heard about our job opportunities
• Diversity and equal opportunities information
• Marital status
• Identification (Right to Work) as contained in your passport and related documentation
• Special adjustments required for interview (examples - disability or dietary requirements)
• Personal information about you from a publicly available source that you control (such as a job board, job application or a career based social media platform), insofar as such information is relevant for assessment of whether your qualification and skills meet the demands of the considered job post
• Personal information that you make publicly available via social media may be collected if necessary, depending on the nature and level of the role applied for
• Any other information you voluntarily provide to R-R.

Application Data may also include special categories of personal data for the purpose of Art. 9 (1) GDPR (such as a photo revealing information about ethnic origin, information on physical disabilities) to the extent that you have voluntarily provided such data as part of your application documents or R-R has specifically requested such data. R-R will only process such special categories of Application Data for the purpose of assessing your working capacity and your suitability for the particular job post in question. We will only process such special categories of Application Data in such a manner and to the extent necessary for aforesaid purpose. Since R-R will assess your working capacity and your suitability for the specific job post which you apply for, we would kindly ask you to refrain from making available to us any information that is not relevant for the purpose of assessing your working capacity and suitability for the job post which you are applying for.

(2) Registration Data

It is possible for you to register on our careers website in order to use the full range of functions available (“Registration Data”). We have highlighted the data which you are obliged to supply by designating them as compulsory fields. These comprise of your e-mail address and creation of a password. If these data fields are not completed, you will be unable to complete registration.

III. Purposes of processing of your personal data

The personal data collected and processed by R-R as set out above is processed for the following purposes:

(1) Recruitment Purposes

Your Application Data listed above is processed for the following recruitment purposes:

• To evaluate your qualifications for the position you have applied for and, subject to your respective consent, for other current/future positions with R-R
• To process your application
• To support any offer of engagement and induction to R-R
• As the basis for your employee record
• To contact you for further information, where necessary
• To comply with applicable legal requirements and R-R’s policies, for example, to carry out due diligence checks in line with our Employment and Assignment Screening Policy
• Anonymised data may be used to ensure compliance with legal requirements that concern equal opportunities and employment
• To monitor customer satisfaction, generate reports/management information, and drive process improvement

You are not legally bound to provide us with your Application Data, However, kindly note that, in case you choose not to provide us with certain of your Application Data, we may not be able to further consider your application in the context of our job vacancies or that your application for a particular job offer may not be successful.

(2) Applicants’ Pooling

If and to the extent that you have declared your respective explicit consent, we may store and process your Application Data beyond the duration and scope of your application for one particular job offer or independent from an application for a particular job post as part of our talent pools.

Likewise, subject to your explicit respective consent, we may transfer your Application Data to other R-R Group Entities.

Such processing of your Application Data is carried out exclusively for the purpose of consideration of your application for present or future job vacancies with R-R, including the possibility of contacting you, where necessary, for this purpose.

We will contact you annually from the point that you provide your consent to the intake of your application to our talent pools in order to request an update to your Application Data, and also confirm if you would like to remain within the talent pool. If we do not receive your confirmation that you would like to remain within the talent pool within two months from the time of our request, we will delete your data (except for data pertaining to any of your pending applications for a particular job post) and close your user account with our talent pool platform. If you nominate to remain within the talent pool, we will retain your data until either you withdraw your consent to the processing of your data within the talent pool, or, within two months from the time of our next request for reconfirmation, should we not receive any request from you within this time period. If you have applied for a senior leadership level role and have given consent to being added to the talent pool, we will contact you every 3 years in order to request an update to your application data, and to confirm if you would like to remain within the talent pool or have your data removed. In the event that you would like your data removed from the talent pool, we will delete your data (except for data pertaining to any of your pending applications for a particular job post).

In addition you can withdraw your consent to the processing of your Application Data as part of our talent pool at any time by contacting the relevant data privacy officer as detailed in Section 1. Kindly note that such withdrawal of your consent does not affect the lawfulness of our processing of your data based on such consent before the time of its withdrawal. When you declare your consent to the processing of your Application Data as part of our talent pool, we will both delete your Application Data that is stored in our talent pool (except for data pertaining to any of your pending applications for a particular job post) and close your user account to our talent pool platform, insofar as there is no further legal basis for continued storage and use of such data.

You are not legally bound to consent to the processing of your data as part of our applicants’ pooling, however, please also note, that, in case you do not choose to provide your respective consent or in case of your withdrawal of such consent, your application may no longer be considered in the context of potential present or future job vacancies with R-R.

(3) Compliance with compulsory statutory obligations on counterterrorism and combating of economic crime

The following examples of Application Data may be used by R-R in order to conduct mandatory pre-employment screenings prescribed by applicable statutory law and corresponding internal Rolls-Royce compliance policies on counterterrorism and combating of economic crime. Not all of these checks may apply, and any checks made will align to local labour law dependent on your country of application:

• Contact information (e.g. name, phone number, postal address and email address)
• Nationality and Country of birth
• Date of birth
• Identification (Right to Work) as contained in your passport and related documentation
• Financial history and banking details to conduct financial probity checks insofar as this is strictly relevant to the employment decision
• Employment history (to include contact details for referees to complete reference checks)
• Education history (including professional qualifications where considered essential for the role)
• Declaration of any criminal history insofar as this is strictly relevant to the employment decision (including convictions for motoring offences)
• And any other information that you provide voluntarily to us in order for us to undertake pre-employment screening

(4) Operation and use of this website

Your Access Data and Registration Data is used by R-R in order to be able to operate this website and enable you to administrate your account settings as well as your application along with all the other functions contained in the log-in area of this portal.

(5) Improvement of this website

In order to continually improve this website on a demand-driven basis, R-R may use your Access Data for data analysis and system administration purposes, such as to determine whether you’ve visited this website before or are new to this website.

(6) Vacancy Alert Notifications

When you create an account on this website, R-R will ask for your consent to send you job alert email notifications whenever a new position matching your profile is posted. You can stop receiving these notices with effect for the future by logging into your user account and modifying your preferences. Such declared withdrawal of your consent leaves such processing of your data unaffected, which has occurred up until the time of the withdrawal of consent.

Other than that, R-R will not use Information collected on this website for marketing purposes without your consent.

IV. Our legal basis for processing your personal data

R-R obligations under privacy legislation includes ensuring that we have determined a legal basis for the processing of your information.

As for the processing of your Application Data for recruitment purposes and compliance with compulsory statutory obligations on counterterrorism and combating of economic crime as set out in above sections III. (1) and III. (3), legal basis for such processing is Article 6(1)(b) and Article 88(1) of the GDPR in connection with the applicable national statutory provision, i.e., for the UK, Part 2 Schedule 1 of the Data Protection Act 2018], and for Germany Section 26(1) sentence 1 of the German Federal Data Protection Act (“Bundesdatenschutzgesetz”, “BDSG”).

With respect to the processing of your Access and Registration Data for the purpose of operating und enabling the use of this website as per above section III. (4), legal basis for such processing or your data is Article 6(1)(b) GDPR.

As far as processing of your Access Data for the purpose of improvement of this website in accordance with above section III. (5) is concerned, legal basis for such processing of your data is Article 6(1)(f) GDPR, whereas our “legitimate interests” for the purpose of Article 6(1)(f) GDPR is our interest in the continuous optimization and demand-led design of our website based on our analysis of your use of this website.

With regard to the processing of your data for recruitment purposes as set out in above section III. (2) as well as for the processing of your data for the purpose of automated dispatch of vacancy alert notifications by email in accordance with above section III. (6), legal basis for such processing of your data is your respective explicit consent according to Article 6(1)(a) GDPR.

V. Information R-R shares and recipients of your personal data

We disclose your data to recipients only if:

• You have given us your express consent for us to do so, under Article 6(1)(a) of the GDPR,
• Such disclosure, under Article 6(1)(f) of the GDPR, is necessary to assert, exercise or defend legal claims, and no grounds exist to suppose that you have a protective interest, outweighing these other considerations, in not allowing your data to be passed on (such as in case of a respective disclosure requirement by legal process (such as a court order), in response to a request by law enforcement authorities, or where R-R believes disclosure is necessary or appropriate to prevent physical harm or financial loss or in connection with an investigation of suspected or actual illegal activity),
• We have a legal duty, under Article 6(1)(c) of the GDPR, to make such disclosure, or
• This is legally permitted and, under Article 6(1)(b) of the GDPR, is necessary for the handling of contractual relations with yourself or for the execution of precontractual actions effected in response to your enquiry.

A part of our data processing may be effected through our service providers, which are listed in the following table:

Along with the service providers listed above, such service providers may further include, in particular, computer centres which store our website and databases, IT service providers which maintain our systems, other service providers, and corporate consultants.

Insofar as our service providers as processors on our behalf, these providers may only use such data in order to carry out their tasks, are carefully selected and commissioned by ourselves. They are contractually bound to follow our instructions, dispose of suitable technical and organisational arrangements for the protection of the rights of data subjects, and are monitored by us regularly.

In case you have applied for a specific job vacancy and your application should turn out not to be successful, we may, subject to your respective explicit consent, transfer your Application Data to other R-R Group Entities for consideration in the context of present or future job vacancies with these R-R Group Entities. In such case, your Application Data, Registration Data as well as your Access Data will be processed by the involved R-R Group Entities as joint controllers as described in above section I.

Further disclosure may also be made in connection with enquires by official bodies, court decisions and legal proceedings if it is necessary for prosecution or legal enforcement.

For further information on how R-R’s service providers process your information, contact R-R as set out in above section I.

If you are employed by R-R, R-R reserves the right to transfer your Information, if applicable, in connection with the sale or transfer of all or a portion of its business or assets. If your employment is transferred you should contact your new employer with any inquiries concerning the processing of that Information.

VI. Automated decision making (incl. Profiling)

In the course of the recruitment process, we make use of certain automated recruitment interview solutions that are operated by our service provider Cut-e GmbH (Großer Burstah 18-32, 20457 Hamburg, Germany). In case that and insofar as your data is processed via this tool, it may be subject to a procedure of individual automated decision making for the purpose of Art. 22 (1) GDPR. Like many other companies, our application process includes online assessments that rely on automated decision making at an early stage, so we need to make you aware of this, and of the significance and consequences of it. The automated decision making is in relation to your online assessment pass mark. If you do not achieve a pre-determined minimum pass mark, then your application will be rejected automatically, and you will not go through to the next stage of the process. Our minimum pass mark is verified each year and is based upon bespoke Rolls-Royce plc norm groups created by Cut-e. If you would like to know more about this, you can contact us via the details given in section I above. If your results are below the minimum pass mark then you can still apply for any other Rolls-Royce (Non-Early Career) opportunities or re-apply to an Early Career Programme in the following year.

VII. Storage periods

Insofar as you have applied for a specific job offer, we store your Application Data for as long as this is necessary in order to complete the recruitment procedure for that particular job offer, unless any other legal basis for continued storage and processing of your data applies (e.g. in case we are obligated to store your data due to applicable statutory retention obligations).

In case your application is successful, we will store your Application Data for as long as this is necessary in order to perform the ensuing employment contract with you, unless any other legal basis for continued storage and processing of your data applies (e.g. in case we are obligated to store your data due to applicable statutory retention obligations).

In case your application for a particular job offer is not successful, and you have not consented to an intake of your data into our talent pool as per above section III. (2), we will generally store your Application Data only if and only for as long as this is necessary for the establishment, exercise or defence of legal claims arising out of or in connection with your application or, respectively, the rejection of such on our part, under the national law applicable in the individual case.

In case your application for a specific job offer is not successful and you have declared your explicit corresponding consent to the intake of your data into our applicants’ pool we will store and process your data as detailed above in section III. (2).

Your Registration Data is stored and processed and stored by us until you close your account on our portal or until you declare the withdrawal of your consent with the processing of your Registration Data by corresponding notice to us, unless any other legal basis for continued storage and processing of your data applies (e.g. in case we are obligated to store your data due to applicable statutory retention obligations). Kindly note, that you will no longer be able to enjoy the full scope of functionalities with respect to reviewing and administering your applications and pertaining documents offered as part of the log-in area of our platform in case you withdraw your necessary consent for storing and processing or your Registration Data.

VIII. Your rights

You can withdraw your consent to the processing of your Information as set out in this Privacy Statement by requesting that your account is deactivated. See below on how to Contact Us.

Dependant on your country or State of residence you may also be able to access your Information by either contacting your regional HR Shared Service Centre at [email protected] or by contacting R-R as set out in the “How to Contact Us” section below. Subject to applicable law a minimal fee may apply to access your Information.

You can update or amend your Information at any time by accessing your account on this website using your user name and password.

You have other rights under applicable privacy legislation, such as lodging a complaint with the relevant national Supervisory Authority if you think R-R is not handling your personal information properly. Please either contact our privacy officers or use the Contact Us details below to request more information in relation to your rights.

IX. How R-R protects your information

R-R maintains reasonable administrative, technical and physical safeguards in an effort to protect against unauthorised access, use, modification or disclosure of your Information in its custody and control. Your Information is stored on servers by Workday in its capacity as R-R’s data processor. Workday has its own privacy policy, which can be accessed by the attached link: http://www.workday.com/content/dam/web/en-us/documents/datasheets/datasheet-workday-privacy-program-us.pdf .

R-R will require you to establish a user name and password to access your Information through this website. You are responsible for keeping your user name and password confidential and you should not share them with anyone. R-R will never ask you for your password in any unsolicited communication, such as a letter, phone call or email message.

R-R has retention processes designed to retain Information for no longer than necessary for the purposes described in this Privacy Statement and to comply with applicable legal requirements.

X. Links to other sites

This website may provide links to other websites for your convenience. These websites may operate independently from R-R. Linked websites may have their own privacy notices or policies, which R-R strongly suggests you review if visited. To the extent any linked websites you visit are not owned or controlled by R-R, R-R is not responsible for the websites’ content, any use of the websites, or the privacy practices of those websites.

XI. Updates to R-R’s privacy statement

This Privacy Statement may be updated periodically and without prior notice to you to reflect changes in R-R’s Information practices. R-R will post a prominent notice on this website to notify you of any significant changes to R-R’s Privacy Statement and indicate at the top of the Privacy Statement when it was most recently updated.