CREDIT KARMA UK Job Applicant Privacy Notice

Version: 1.1
Last Updated: June 28, 2022

Credit Karma was built upon a singular mission — to make financial progress possible for everyone. So far, we’ve done this with free access to credit scores, reports, tools and education. But most of the opportunities that lay ahead are still unknown. So are you up for the challenge? 

We’re excited that you’ve made it this far! We wanted to let you know about how we use the personal data we get about you during our job application process. It covers the following topics: 

  1. Who we are and how you can contact us
  2. What we use personal data for
  3. What kinds of personal data we use, and where we get it from
  4. Who we share the personal data with
  5. Where the personal data is stored and sent
  6. How long the personal data is kept for
  7. Your rights in respect of the personal data we hold about you
  8. Who you can complain to if you are unhappy about the use of your personal data
  9. Changes to the privacy notice

1. WHO WE ARE AND HOW YOU CAN CONTACT US

You’re applying for a job with Credit Karma UK Limited, a company registered in England and Wales with company number 7891157 and registered address 4th Floor One New Oxford Street, London, United Kingdom, WC1A 1NU. We are the controller of your personal data – that is we’re responsible for ensuring your personal data is used fairly and lawfully. 

We’re part of the Credit Karma Group (CK Group), a group of companies with headquarters at 760 Market Street, 2nd Floor, San Francisco, CA 94102, United States. They help us with the recruitment process – you can find more information about who we share personal data with in section 5 as well. 

You can contact us about issues relating to your personal data, including the contents of this notice, by emailing us at UK-Recruiting@creditkarma.com. Alternatively, you can contact our DPO by email at DPO@creditkarma.com.

2. WHAT WE USE PERSONAL DATA FOR

This section explains the purposes for which we collect and process personal data about you. We respect your privacy so how we use your personal data will depend on the stage of the application process.

To manage the recruitment process

  • To review your information on platforms such as LinkedIn, for the purpose of identifying potential candidates for the job. We might also transfer your details from these platforms into our applications platform, to assess your skills, qualifications and interests, and to facilitate your application should you choose to apply.
  •  To send you information about other positions within Credit Karma in accordance with your preferences. 
  • To communicate with you and (on a strict need to know basis) relevant CK personnel involved in the recruitment process, and relevant third parties. 
  • To record and demonstrate how we have conducted the application and recruitment process and arrived at our decision regarding your application. 
  • To deal with your enquiries and requests. 
  • To operate, evaluate, and improve the application platform and recruitment system. 

For employment screening checks if we decide to make you an offer of employment. 

As a regulated business, we need to undertake identity verification checks and employment screening. These checks will be carried out if you’re offered the position and will depend on the role you’ve applied for. Completion of these checks will require you to present certain documentation or provide additional details, and may require acknowledgement from you – further details will be provided with any offer of employment. We may engage a third party for this purpose, as outlined in section 5 below. 

Checks may include identity verification, your employment and educational references, your qualifications, your credit file, criminal record and fraud prevention checks. 

For making reasonable disability adjustments (as applicable)

To ensure appropriate arrangements are in place for disability or health conditions throughout the recruitment process and, if your application is successful, to prepare for you commencing employment. 

For legal and regulatory purposes

To comply with the law, we may need to do things like checking your right to work in the UK. We may need to respond to and defend any legal claims that may arise out of the recruitment process. We may also need to provide information to law enforcement agencies to comply with our legal obligations, or of our own choice where we consider there is a compelling reason to do so to protect our employees, visitors, our customers (or their customers), or our general business interests.

3. WHAT KINDS OF PERSONAL DATA WE USE, AND WHERE WE GET IT FROM

We obtain and use information from various different sources. 

Information we collect directly from you: 

  • Name and contact details: This is basic personal data about you, and how to get in touch with you. It includes your current home address, email address and telephone number.
  • Date of birth: To make sure we attribute our records and any employee checks to the correct person and, where needed, for any minimum qualifying age applicable to the position in question.
  • Driver information: We require proof of driving and vehicle insurance eligibility where driving is relevant to the role or involves a company vehicle.
  • Right to work in the UK: You will be asked to provide relevant documentation for us to check eligibility both at application stage, and if you commence employment with us, to repeat those checks at intervals throughout the employment relationship.
  • Other application details: Previous work history including work references, qualifications including educational details (e.g., educational history, certifications, skills), and where applicable, professional memberships, your reasons for applying and suitability for the position, and other details you provide in the application form and during interview(s).
  • Photograph used for identification purposes during the onsite interview process.

Information we collect about you from other sources:

  • Background check information from employment screening agencies, publicly available registers, DBS and the UK VISA and Immigration service (as allowed by law).
  •  Publicly available professional profiles on websites or social media (e.g., LinkedIn).
  • Information about your performance or conduct from references or clients or service providers you worked with and who may provide feedback about you.
  • Information about your relationship with previous employers, including prior work experience.
  • Your CV from recruitment firms.

We may also collect sensitive information (also known as special category information) about you as permitted or required by law. This is a category of personal data that has special protection under data protection laws and includes:

  • Health or disability information (where applicable): For any facilities or practical arrangements to assist you in the recruitment process (and should any offer of employment be accepted, to prepare the workplace for your arrival).

Source of sensitive information: This information is typically obtained directly from you in the application form, from the checks described above, from interviews, or as otherwise notified to you within the application process. 

In some circumstances we will use a third party service provider to verify the personal information you submit in the course of your application, including through reference checks and where applicable, background checks as described above. 

The above information is mandatory to the application and recruitment process. We consider this appropriate having regard to the nature of our business and our legal and regulatory responsibilities as referred to above. If you have any questions or concerns, please get in touch with your Human Resources contact or email us at UK-Recruiting@creditkarma.com.

4. OUR LEGAL GROUNDS FOR PROCESSING PERSONAL DATA

This section explains the basis on which we process your personal data. 

To consider your application and assess whether to employ you. 

To comply with our legal and regulatory obligations both generally as a business and in relation to your application for employment. For example proof of your right to work status or regarding adjustments for disability or health conditions. 

Legitimate interests In other cases, CK has a legitimate interest in processing personal data during and after the end of the recruitment process, including: 

  • administering and managing the recruitment process
  • deciding to whom to offer a job
  • keeping records of an applicant’s name and reasons for previous unsuccessful job applications to CK.

When we process personal data to meet our legitimate interests, we put in place safeguards to ensure that your privacy is protected and to ensure that our legitimate interests are not overridden by your interests or fundamental rights and freedoms. For more information about the balancing test that we carry out to process your personal information to meet our legitimate interests, please contact us as noted below. 

We may obtain your explicit consent to collect and use certain types of personal information when we are required to do so by law (for example, when we process some categories of sensitive information). 

You can withdraw your consent at any time by contacting us using the details at the end of this privacy notice.

5. WHO WE SHARE THE PERSONAL DATA WITH

Our group companies We may share your personal data with relevant members of the CK Group. We’ve set these out below, although the list may change from time to time. 

Credit Karma, Inc., ATTENTION: Legal Department, 760 Market Street, 2nd Floor, San Francisco, CA 94102, United States; UK-Recruiting@creditkarma.com. 

Credit Karma UK Holdings Limited, ATTENTION: Legal Department, 4th Floor One New Oxford Street, London, United Kingdom, WC1A 1NU; UK-Recruiting@creditkarma.com. Alternatively, you can contact our DPO by email at DPO@creditkarma.com. 

Service providers We may provide your information to third parties who help us use it for the purposes described in section 2. For example: 

  • Our database of personal data may be hosted by third parties on our behalf.
  • Our applications platform and other software used to process your application may be provided by third parties
  • Background checks may be carried out by third parties
  • Recruiting firms

These service providers, where they process your personal data under our instructions, will not be allowed to use your information for their own purposes or on behalf of other organisations.

Other third parties We may share your personal data with third parties: 

  • where required to do so by law, including with regulators and enforcement agencies to comply with legal and/or regulatory requirements;
  • with third parties to protect and defend our rights and property, where permitted by law.

Business transfers If we sell our business to a third party, or go through a corporate reorganisation, this will involve the transfer of our corresponding human resources records (including recruitment records), to the new undertaking for them to use in the same way as set out in this privacy notice.

6. WHERE THE PERSONAL DATA IS STORED AND SENT

Our parent company, Credit Karma, Inc., is based in the US. When we transfer your personal data to the US, this will be in accordance with a data sharing agreement based on the standard contractual clauses approved by the European Commission.

Other examples of situations where data might be transferred outside the EEA are where we use cloud-based technology or a data centre or backup facility overseas. People in other countries may also need to access data for purposes such as technical support or system development and testing. 

While countries within the European Union all ensure a high standard of data protection law, some parts of the world may not provide the same level of legal protection in relation to personal data. As a result, when we do send personal data overseas, we will make sure that suitable safeguards are in place to protect the information. These safeguards include the standard contractual clauses approved by the European Commission and the additional technical and organisational safeguards we have put in place. 

If your information has been sent overseas like this, you can obtain further information about the safeguards used by emailing us at UK-Recruiting@creditkarma.com.

7. HOW LONG THE PERSONAL DATA IS KEPT FOR

To enable us to deal with any queries or issues that may arise from the job application process, we will, unless otherwise stated in this privacy notice, retain your personal details in our records for a period of six months from the date that we formally notify you of our decision. Certain details, such as name and adjustments for disability or health conditions might be retained for longer for regulatory reasons and potential litigation up to six years.

We may also keep certain details, such as name and reasons for an unsuccessful application, in case you apply again in the future, for up to one year from the date that we formally notify you of our decision. If your application is successful, we’ll transfer these records to your employee file and our Employee Privacy Notice will apply. 

8. YOUR RIGHTS IN RESPECT OF THE PERSONAL DATA THAT WE HOLD ABOUT YOU

You have several different rights in relation to the personal data that we hold about you. These are briefly described below. To discuss or exercise these rights, please contact us using the details above.

  • Access: You have a right to find out what personal data we hold about you, and certain other information such as how we are using it. 
    • Rectification: If the information that we hold about you is inaccurate or out of date, you have a right to ask us to correct it. 
    • Objection to legitimate interests: If you disagree with us relying on the legitimate interests grounds for using your personal data (see section 4 above), you can object to us doing so. Subject to applicable law, we will then reassess the extent to which we can continue to use the data in light of your particular circumstances. 
    • Erasure: In certain circumstances you can ask us to delete your personal data from our systems. 
    • Restriction: In some circumstances you can ask us to restrict the ways in which we use your personal data. 
    • Portability: You have the right to receive some limited kinds of information in a useable electronic format and transmit it to a third party. 

9. WHO YOU CAN COMPLAIN TO IF YOU ARE UNHAPPY ABOUT THE USE OF YOUR PERSONAL DATA

If you are not happy with the way we use or handle your personal data you should contact us so that we can investigate your concerns. Please contact us by sending an email to UK-Recruiting@creditkarma.com.  You also have the right to lodge a complaint with your local supervisory authority in the European country where you work, reside, or where the subject-matter of your complaint arises.  The supervisory authority in the UK is the Information Commissioner’s Office (ICO).

10. CHANGES TO THE PRIVACY NOTICE

You may request a copy of this privacy notice using the contact details set out above. We may modify or update this privacy notice from time to time.

Where changes to this privacy notice will have a fundamental impact on the nature of the processing or otherwise have a substantial impact on you, we will give you sufficient notice so that you have the opportunity to exercise your rights (e.g., to object to the processing).