Privacy Policy

Recruitment Privacy Note

1. Summary

Documents designed for DEKRA UK entities are defined as follows:

Policy: Our Policies are the high-level statements of management intent, expectations, and
direction. They show our principles and requirements.

Process: Our processes provides steps and procedures that must be followed. They show the
actions and instructions to complete tasks.

2. Introduction
2.1 Purpose

Thank you for your interest in DEKRA.
DEKRA respects your privacy and is committed to protecting your personal data. This Privacy
Policy Notice will inform you as to how we look after your personal data and tell you about your
privacy rights and how the law protects you.
You are being sent a copy of this Privacy Notice because you are applying to work with us
(whether as an employee, worker, or contractor). It makes you aware of how and why your
personal data will be used, namely for the purposes of the recruitment exercise, and to explain
how long we will usually retain your data. It provides you with certain information that must be
provided under the UK General Data Protection Regulation (UK GDPR).

2.2 Target Audience

This notice applies to all individuals who are applying to work for us whether as an employee,
worker or contractor.

2.3 Scope

The DEKRA group globally defines the scope for a group wide policy as follows (Source: DEKRA
Group Chief Compliance Officer 2017):
"The (DEKRA) Group Policy is valid for all companies in the DEKRA Group, i.e. DEKRA e.V, DEKRA
SE and all of its dependent subsidiaries as well as affiliated companies and their employees. A
dependent subsidiary is a company which DEKRA SE is able to either directly or indirectly
exercise a controlling influence over."
This Privacy Notice is issued on behalf of the DEKRA UK group of companies to all current and
former employees, workers and contractors of the following companies registered in the UK:
DEKRA Automotive Limited (company no. 03245911)

DEKRA Certification UK Limited (company no. 13129030)
DEKRA Claims Services UK Limited (company no. 00893346)
DEKRA UK Management Limited (company no. 03899419)
DEKRA UK Limited (company no. 02000153)

3. Policy
3.1 Who is responsible for data processing and
how to contact us

DEKRA UK Group acts as the controller for recruitment and selection processes.

DEKRA UK Group contact details:

Data Protection Officer
DEKRA UK Management Ltd
Stokenchurch House
Oxford Road
Stokenchurch
Bucks
HP14 3SX

Email: dpo.uk@dekra.com Telephone number: 01494 480500

The data controller deemed responsible for the processing of your personal data in connection
with your visit to the DEKRA website and the creation of a candidate profile via the DEKRA
candidate portal is:

DEKRA SE
With its registered office in Stuttgart, and registered in the commercial register of the
Stuttgart District Court under HRB 734316,
Handwerkstr. 15, 70565 Stuttgart, Germany

If you create a candidate profile via the DEKRA candidate portal independently of an application
and do not make your profile visible, DEKRA SE is the controller.

If you make your candidate profile via the DEKRA candidate portal visible to recruiters from
participating Group companies worldwide or nationally i.e. in the country / region of your place
of residence, the following Group Companies act as joint controllers for processing in connection
with your candidate profile outside of a specific application, depending on your selection:

DEKRA SE, Handwerkstr. 15, 70565 Stuttgart, Germany
konzerndatenschutz@dekra.com

If you apply to one of the DEKRA UK Group of companies, it will act as a data controller for the
subsequent application process in relation to the personal information collected and processed.
Please refer to the further information in the respective job advertisement and on our website.

DEKRA UK Group work with selected data processors that are instructed to collect, store and
process personal information on our behalf for the purposes of recruitment services. DEKRA UK
Group is contracted with Tribepost, for our recruiting and applicant tracking platform in order to
handle your personal data as a candidate. We also contract with Thomas International as a
psychometric and aptitude test provider. We may engage with other third-party suppliers from
time to time for specific or specialised recruitment activities, such as the Home Office Disclosure
and Barring Service checks.

If you have questions about how these processors process your personal data, you must access
their privacy notices.

For any general questions and queries regarding the collection and processing of your personal
data, please contact the persons mentioned in the respective job advertisement.

You can also contact the UK Data Protection Officer if you have any questions regarding this
Privacy Notice.

Changes to the privacy notice

The further development of our company may also have an impact on the handling of personal
data. We, therefore, reserve the right to amend this privacy notice in the future within the
framework of the applicable data protection laws and, if necessary, to adapt it to changed data
processing realities. We will notify you separately of any significant changes to the content.

This version was last updated in July 2025

3.2 The data we collect

We receive personal data about you as a candidate for positions within any of our companies,
such as:

Contact details such as name, title, addresses, telephone numbers, and personal email
addresses
Copies of driving licence, passport, birth certificates as proof of identity and proof of current
address, such as bank statements and council tax bills
Evidence of how you meet the requirements of the job, including CVs, training, qualifications
and references
Evidence of your right to work in the UK and immigration status
Evidence of personal insurances and company insurances and liabilities where appropriate
For the appointment of directors, evidence that you are not disqualified from being a
company director
If you contact us regarding your application, a record of that correspondence
Any information you provide to us during your application and at interview
References, if sought, from past employers
Any information received as part of any tests undertaken by you.

We may also collect, store and use the following "special categories" of more sensitive personal
information.

Diversity and equal opportunities monitoring information – this can include information about your race or ethnicity, religious beliefs, sexual orientation, disability where we request if special arrangements need to be made and other ‘special category data’
Information about your health, including any medical needs or conditions, health and sickness records.
Information about criminal convictions and offences, where applicable to the role.

3.3 What sources do we use to collect your
personal data?

We process personal data for the purpose of enabling the use of the DEKRA candidate portal,
and for carrying out selection procedures to establish an employment relationship from the
following sources:

Directly from you as part of the candidate process, or the creation of your account and candidate profile on the DEKRA candidate portal
A recruitment agency
Psychometric and aptitude testing results through third parties, such as Thomas International or other similar in respect of any tests undertaken as part of the recruitment process.
Disclosure and Barring Services, in respect of criminal convictions
Data permissibly collected from public sources or from third parties or which has been disclosed to us, for example, by public authorities, insurance providers, pension funds, credit institutions, educational and training institutions, other external service providers or by third parties that you have named as references

Relevant personal data may include: Personal information (e.g. title, last name, first name),
contact information (e.g. e-mail address, postal address, telephone number), information about
your career (e.g. curriculum vitae), information about your qualifications (e.g. certificates),
documentation data (e.g. interview notes) and other data comparable to the categories
mentioned.

If you fail to provide personal data

You are not obliged to provide us with personal data. In the context of an application procedure,
however, you must provide us with the personal data that is required for the procedure itself, in
order to participate as a candidate in a selection process.

3.4 Legal Basis for processing personal data

We process your personal data in accordance with the provisions of all applicable data
protection laws.

We process personal data throughout our recruitment process under the following legal basis
dependant on the processing activity being carried out.

A. For the purpose of the technical provision of the website
When you visit our website, it is necessary for the purpose of the website’s technical provision
(and ensuring the requisite system security) that we process certain information automatically
transmitted by your browser so that our website can be displayed in your browser and you can
use the website. This information is automatically collected each time our website is accessed
and automatically stored in so-called server log files; this information essentially comprises:

IP address of the requesting computer
Host name of the accessing computer
Recognition data of the browser and operating system used
Date and time of access
Website from which the access is made (referrer URL)

Our legitimate interest in this regard is that we can make our website and our candidate portal
technically available to you.
LEGAL BASIS
Art. 6 (1) lit. f GDPR

B. For the purpose of creating a user account and candidate profile
In the event that you create a user account in our DEKRA candidate portal, we process your
personal data for the purpose of creating and managing this user account. When you create a
candidate profile within your user account and provide us with information about your career
and qualifications, we process your personal data for the purpose of enabling the creation and
management of your candidate profile.
This primarily comprises personal information, address data, communication data, access data
(e-mail address, password), as well as data pertaining to your professional experience and
qualifications.
LEGAL BASIS
Art. 6 (1) lit. b GDPR

C. For the purpose of communication
For the purpose of communicating with you in order to progress your application, we process
personal data, in order to respond to your enquiries or to communicate with you in the context
of job recruitment procedures and to send you pre-contractual documents.
This may include, in particular, your first name, last name, home address, e-mail address,
telephone number and, if applicable, contract data.
Our legitimate interest here is to be able to stay in touch and communicate with you in the
context of enquiries and vacancy procedures. This is to ensure smooth preparation of job
placements and support of interested parties.
LEGAL BASIS
Art. 6 (1) lit. a, b and f GDPR

For any processing relating to the provision of consent, the legal basis is Art. 6 (1) lit. f GDPR,
whereby our legitimate interest is to defend ourselves against possible legal claims. You can
withdraw any consent given at any time with effect for the future in any appropriate form.

D. For the purpose of inclusion in a candidate pool
In the event that you provide us with your consent to store your personal data for the purpose
of worldwide or nationwide matching with future job profiles in the context of selection
procedures for possible employment, we will process your personal data in accordance with
your selection for the purpose of notifying you by e-mail about jobs that match the
requirements and qualifications you have indicated.

This may include, in particular, your personal information (title, last name, first name), address
data (street, house number, postal code, city), contact data (private e-mail address, social media
profiles), the preferred language of communication, candidate documents (cover letter, resume,
references, salary requirements, notice period, possible start date), individual responses (how
did the candidates become aware of the position, is the candidates of legal age, willing to
relocate), previous activities, language skills and interests.
LEGAL BASIS
Art. 6 (1) lit. a GDPR

E. For the purpose of conducting a selection process for possible employment
In the event that you apply for a specific position or have given us your consent to store your
candidate data in our candidates pool for suitable positions in the future, we process your
personal data in the context of job filling procedures for the purpose of conducting a selection
process for possible employment. For this purpose, your personal data will be transferred to the
DEKRA company that has advertised the vacancy.
This may include, in particular, your first name, last name, address, country, e-mail address,
telephone number, work experience, qualifications, references and language skills.
LEGAL BASIS
Art. 6 (1) lit. a and b GDPR

F. For the purpose of sending the newsletter (information about career opportunities) and
sending the job newsletter
In the event that you provide us with your consent to send you regular information about career
opportunities by e-mail or to inform you about jobs of interest to you via our job newsletter, we
will process your personal data for the purpose of informing you by e-mail.
This may include, in particular, your first name, last name, e-mail address and your selection
based on the filters set in the candidate profile.
We use the so-called double opt-in procedure for sending the newsletter. This means that we will
only send you an e-mail newsletter once you have expressly confirmed that you consent to
receiving newsletters. We will first send you a confirmation e-mail asking you to confirm that you
wish to receive future newsletters by clicking on an appropriate link.
When you register for the newsletter, we store your IP address entered by your Internet service
provider (ISP), as well as the date and time of registration, in order to be able to trace any
possible misuse of your e-mail address at a later date. We also store your registration to prove
that you have registered and agreed.
You may unsubscribe from the newsletter at any time via the link provided for this purpose in
the newsletter, or by withdrawing your declaration of consent vis-a-vis the data controller.
For the purpose of sending the newsletter, we store your data until you withdraw your consent
or until the newsletter is permanently discontinued. For the purpose of proving consent, no
longer than by the end of the fourth calendar year following the last advertising e-mail dispatch.
LEGAL BASIS
Art. 6 (1) lit. a GDPR

G. For the purpose of progressing your application from vacancy to job offer
For the purpose of progressing your application through the recruitment process, we process
personal data, in order to respond to your enquiries or to communicate with you in the context
of the job recruitment procedures, to carry out interviews and pre employment checks and to
send you pre-contractual documents.
LEGAL BASIS
Art. 6 (1) lit. a, b, c and f GDPR

We collect, use and hold sensitive information such as criminal convictions on the lawful bases
of Art 6 (1) b, c and f GDPR

3.5 How we will use your personal information

We will use the personal information we collect about you to:

Assess your skills, qualifications, and suitability for the role;
Carry out background and reference checks, where applicable to the role;
Communicate with you about the recruitment process;
Move your application forward through the different stages of the recruitment process
Keep records related to our hiring processes; and
Comply with legal or regulatory requirements.

Processing Special Category Data

We will use your particularly sensitive personal information in the following ways:

We will use information about your disability status to consider whether we need to provide appropriate adjustments during the recruitment process, for example whether adjustments need to be made during a test or interview.
We will use information about your race or national or ethnic origin, religious, philosophical or moral beliefs, or your sexual life or sexual orientation, to ensure meaningful equal opportunity monitoring and reporting.
In order to process special category data we have in place an appropriate policy document and safeguards in place which we are required by law to maintain when processing such data.

Information about criminal convictions

In order to protect our reputation and to minimise the risk of workplace incidents, fraud or
negligence, we will ask you to conduct a basic disclosure of your criminal records history
through the Disclosure and Barring Service (DBS). Where applicable to the role, we will use
information about your criminal convictions if we would like to proceed with your application or
offer you the role (conditional on checks and any other conditions, such as references, being
satisfactory). This information may be required to fulfil regulatory or legal obligations, to ensure
that there is nothing in your criminal records history which makes you unsuitable for the role.

Automated Decision Making

In order to carry out the recruitment process or facilitate the use of an candidate profile in the
DEKRA candidate portal, we do not use fully automated decision-making in accordance with
Article 22 GDPR.

3.6 How and when do we share your personal
data?

Your personal information will be processed confidentially at all times.
In order for us to process your data in accordance with the purposes described above, it may
also be necessary to provide other recipients with your data for processing.

We will only share your personal information with selected third parties and any other relevant
DEKRA group company for the purposes of processing your application.

Within our group of companies, your data will also be transferred to other companies if they
have advertised the vacant position or perform data processing tasks centrally for the
companies affiliated in the group (e.g. IT services, HR support, disposal of files, etc.). Information
on data protection is available on the website of the respective DEKRA company, or on DEKRA’s
data protection portal (Data privacy notice).

With regard to the transfer of data to recipients outside the DEKRA Group, we only pass on
information if this is required by law, if the candidates has issued their consent, or this is
necessary, in order to protect our legitimate interests.

Under these conditions, the recipients of personal data may include, for example, service
providers and vicarious agents employed by us who receive data for these purposes, provided
they observe confidentiality and data protection requirements. These can be companies
operating within HR, Recruitment and IT services, telecommunications and consulting
categories, for example. We ensure that your personal data is used in accordance with your
instructions by concluding group-internal data processing agreements and with commissioned
service providers.

The processing operations described in this data protection notice with regards to the DEKRA
candidate portal are processed via the SuccessFactors candidate of SAP Deutschland SE & Co. KG, Hasso-Plattner-Ring 7, 69190 Walldorf. A corresponding data processing agreement has
been concluded with SAP to this end, which ensures that your personal data is processed by SAP in accordance with instructions and in compliance with the requirements of data protection law. For more information pertaining to data privacy at SAP, see the SAP Data Protection Declaration
and the Data Protection Area of the SAP Trust Center.

All our third-party service providers and other entities in the group are required to take
appropriate security measures to protect your personal information in line with our policies. We
do not allow our third-party service providers to use your personal data for their own purposes.
We only permit them to process your personal data for specified purposes and in accordance
with our instructions.

If you are successfully recruited, we will upload your details to our HR system. As a member of
staff, you will sign a contract of employment and agree to additional terms on how your data is
handled and stored.

Is data transferred to a third country or to an international organisation?
Data is only transferred to countries within the European Union under the UK adequacy decision
and outside the European Union (so-called third countries) if you have given us your
consent. We would like to expressly point out that your data could also be transferred to third
countries that lack the requisite security provisions for which neither an EU adequacy decision
nor other suitable data protection guarantees currently apply. The protection of your data may
not be guaranteed in the destination country, as in some cases, there is no level of data
protection equivalent to that in the EU or UK. Therefore, said data transmission is accompanied
by corresponding risks. In particular, there are no guarantees with regard to the prevention of
access to your transmitted data by government agencies. In this context, we would like to
expressly point out that you, as a UK citizen, may not enjoy any effective legal protection against
the processing of your data by authorities in third countries that lack the requisite security
provisions. If you nevertheless issue us with your consent with regard to the transfer to third
countries, you do so in full knowledge of these risks, which you also consciously accept by doing
so.

3.7 How do we keep your information secure?

We have put in place appropriate security measures and safeguards to prevent your personal
information from being accidentally lost, used or accessed in an unauthorised way, altered or
disclosed.

We have put in place procedures to deal with any suspected data security breach and will notify
you and any applicable regulator of a suspected breach where we are legally required to do so.

3.8 How long will you store my personal data?

We will retain your personal information for a period of 6 months after the recruitment process.
We retain your personal information for that period so that we can show, in the event of a legal
claim, that we have not discriminated against candidates on prohibited grounds and that we
have conducted the recruitment exercise in a fair and transparent way. After this period, we will
securely destroy your personal information in accordance with our policies and/or applicable
laws and regulations.

If you have consented to be included in our candidate pool, we will process your data for this
purpose for two years.

Other data processing based on consent shall be carried out at the longest until the time of withdrawal of your consent. We store any consent given to us for a period of four years from the
time of its revocation or expiry.

In addition, we store your data for the purpose of complying with statutory retention periods,
and for exercising legal claims or defending against legal claims within the scope of the
statutory limitation provisions.

3.9 Your legal rights

You have the following rights in relation to the personal information that we hold about you:

The Right to Request access to your personal information (commonly known as a "data subject access request"). This enables you to receive a copy of the personal information we hold about you and to check that we are lawfully processing it.
The Right to Request correction of the personal information that we hold about you. This enables you to have any incomplete or inaccurate information we hold about you corrected.
The right to request erasure of your personal information in some circumstances This enables you to ask us to delete or remove personal information where there is no good reason for us continuing to process it. You also have the right to ask us to delete or remove your personal information where you have exercised your right to object to processing (see below).
The right to object to us processing your personal information where we are relying on a legitimate interest (or those of a third party) and there is something about your particular situation which makes you want to object to processing on this ground. You also have the right to object where we are processing your personal information for direct marketing purposes. This also applies to profiling based on this provision within the meaning of Article 4 No. 4 GDPR. If you object, we will no longer process your personal data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves the purpose of asserting, exercising or defending legal claims.
The Right to Request the restriction of processing of your personal information. This enables you to ask us to suspend the processing of personal information about you, for example if you want us to establish its accuracy or the reason for processing it.
The right to data portability of your personal information to another party.

For more information on your legal rights or if you would like to exercise any of them or if you
are unhappy with how we have used your personal information you have and wish to lodge a
complaint, please contact the UK Data Protection Officer via the contact details provided.

Right to withdraw consent

When you applied for this role, if you provided specific consent to us processing your personal
information for the purposes of the recruitment exercise, then you have the right to withdraw your
consent for processing for that purpose at any time. To withdraw your consent, please contact our
recruitment team. Once we have received notification that you have withdrawn your consent, we will no longer process your application and, subject to our retention policy, we will dispose of your personal data securely.