Keystone Education Group - Teamtailor Recruitment Privacy Policy
This privacy policy applies for processing of personal data when Keystone Education Group or one of its related entities (“Keystone”, “we”, or “us”) processes personal data in the capacity of data controller in the handling of recruitments and simplifying the hiring process as powered by the applicant tracking system Teamtailor.
This privacy policy also extends to careers.keg.com, similarly powered by Teamtailor (“Career Site”). This policy only covers the scope of the services of recruitment and the hiring process (“Recruitment”). For any other personal data processing by us, please refer to Keystone’s Privacy Policy at https://www.keg.com/privacy.
1. Who We Are
Keystone is trusted by more than 120 million unique prospective students every year to help them make one of the most important decisions of their lifetime, namely, which education program to attend. To assist in this vision, Keystone looks to attract and hire talent worldwide and serves as the controller for personal data processed with the purpose of managing and facilitating recruitment of employees to our businesses.
We are further committed to ensuring we meet our legal obligations when processing your personal information under the relevant Data protection Laws, which may include but are not limited to:
the UK General Data Protection Regulation and the EU General Data Protection Regulation 2016/679 (together referred to herein as the “GDPR”);
the California Consumer Privacy Act (“CCPA”);
the Canadian Personal Information Protection and Electronic Documents Act (“PIPEDA”);
the Colorado Privacy Act ("CPA");
the Connecticut Data Privacy Act ("CTDPA");
the Utah Consumer Privacy Act ("UCPA");
the Virginia Consumer Data Protection Act ("VCDPA");
the Digital Personal Data Protection Act of India (“DPDPA”);
the Personal Information Protection Law of China (“PIPL”).
2. Whose Personal Data We Process
This privacy policy governs the processing of personal data of individuals interacting with Keystone via Teamtailor for Recruitment (“Users”). Users can include the following persons:
Candidates submitting personal information through application forms on Teamtailor, our Career Site, or via a third-party source such as Indeed or LinkedIn, or connecting with Keystone via Teamtailor;
Prospective candidates who send inquiries or identifiable data directly to us via Teamtailor;
Visitors to our Career Site.
3. Purpose and Categories of Personal Data, Legal Basis, and Retention Period
We will retain your personal data for only as long as is necessary for the recruitment process. If your candidacy is successful and you are employed or hired by us, your data will be processed and retained as set out in our employee privacy notice, provided to you with your employment paperwork.
The purpose of this privacy notice is to explain what Personal Data we collect and use relating to employment and the associated candidates (“you”, “your”) during the recruitment process.
3.1. Processing of personal data relating to candidate accounts
We collect data directly from Users via applications on Teamtailor, our Career Site, or with the users’ permission through third party sources such as a LinkedIn, Indeed, or similar job boards. Users can also connect to Keystone via Teamtailor, creating a candidate account to receive updates on open roles and hiring activities.
In some cases, existing Keystone employees can make referrals about potential candidates or add candidates manually to Teamtailor which may include personal data. In such cases, the potential candidate is considered a User in the context of this privacy policy and will be informed about the processing. If the User has not given permission within 30 days of being referred/added to Teamtailor, Keystone will reach out to receive confirmation that the processing can continue.
The data we process about you as a candidate includes:
Your name, email address, telephone number, and country of residence;
Pictures and videos, if provided;
Information from linked third-party sources such as LinkedIn;
Answers to application questions and information provided on CVs, cover letters; portfolios, or other application materials;
Publicly available information about the User as apply directly to Recruitment.
The legal basis for processing this personal data under the GDPR is Article 6 no. 1 (f), our legitimate interest of searching for suitable candidates, managing our talent pool, and carrying out/facilitating the recruitment process.
If your candidacy is not successful, we will retain your CV, application details and interview notes (where applicable) for 6 months from the date we notified you we would not move forward with your application, to inform you about any future vacancies we have that may be of interest to you. Please let us know if you would like us to delete your records before our retention period lapses and we will do so.
We will also retain personal data where it is necessary to comply with our legal obligations or as necessary in relation to legal claims. This is rare but may mean we need to retain your data for longer than 6 months.
At the end of the retention period, your personal data will be securely deleted or anonymized, for example by aggregation with other data, so that it can be used in a non-identifiable way for statistical analysis and business planning.
If we have sought and obtained permission to keep your personal data on file as part of our talent pool, we will retain your personal data for 24 months after the recruitment and selection process ends. At this point, we will refresh your preferences and seek permission to include you within our talent pool for a further 24 months. Users can opt-out of being part of our talent pool or request the deletion of their data at any time. For more information on your rights as a user, please refer to section 4.
3.2. Requests and inquiries
When you contact us via forms or tools within Teamtailor, we process the personal data you provide (such as your name and contact information), along with any other personal data included in your request. The processing of this personal data is necessary to effectively respond to your inquiries and provide the information or support you are seeking.
The legal basis for the processing of this personal data is outlined by GDPR Article 6 no. 1 (f), our legitimate interest in responding to your requests. We process your personal data solely to provide the necessary responses and assistance you require.
We will retain your personal data for as long as is necessary to provide you with our assistance and for a reasonable period thereafter to enable us to meet any contractual and legal obligations (and/or to deal with complaints or claims).
3.3. Use of Cookies
Information Users submit via Teamtailor may be stored as cookies. Cookies are passive text files that are stored on your device’s browser when you visit Teamtailor. We use cookies to improve the User’s usage of Teamtailor and to gather information about, for example, statistics about our Recruitment process and the usage of Teamtailor or visitation to our Career Site.
Where these necessary cookies involve the collection or storage of personal data—such as your IP address, operating system details, browser ID, and your interactions with our site —we process this information based on our legitimate interest in maintaining our sites’ functionality and security, as stipulated under Article 6 no. 1 (f) of the GDPR.
In addition to necessary cookies, we may use cookies for other purposes, such as for statistical analysis/measurement, marketing, and integration of social media. The legal basis for using such cookies is your separate consent that you have given through the cookie banner on our websites, pursuant to Article 6. no. 1 (a) of the GDPR.
Further details about the cookies used by us and how to manage them can be found within our cookie banner. Apart from the necessary cookies, which are essential for website functionality, you have the flexibility to tailor your cookie preferences. Options include accepting all cookies, rejecting all cookies, or customizing settings for each cookie category and purpose by selecting "Settings." You can modify or withdraw your consent at any time by adjusting these preferences in the cookie banner.
For more details on Keystone’s cookies policy as it relates to Recruitment, please reference https://careers.keg.com/cookie-policy.
4. Users’ Rights
Depending on your location and the applicable privacy legislation (GDPR for example), you may have certain rights in relation to the processing of your personal data. These may include:
The right to information and access: We strive to be open and transparent about how we process users’ personal data. If you wish to know more about how we process your personal data or wish to receive the personal data we process about you, you can request access to the information we have stored about you. If we receive an access request, we may ask you to provide more information about who you are to ensure that we provide the data to the right person.
The right to rectification: If you become aware that we hold outdated or inaccurate information about you, you can ask us to correct the error at any time by contacting us.
The right to erasure and restriction: You have the right to request that your personal data is erased or that its use is restricted, for example, if you believe that your personal data is being processed in violation of applicable law. We will as far as possibly comply with a request to erase personal data, but we cannot do this if we are required by law to store certain data e.g. for accounting purposes or to comply with a legal claim.
The right to data portability: In some cases, you may have the right to obtain the personal data you have provided to us in a structured, commonly used and machine-readable format. If technically possible, you may also request that the data be transferred to a third party.
The right to object: You have the right to object to our processing of your personal data if, for example, it is processed based on our legitimate interests.
The right to withdraw consent: If you have given consent to our processing of your personal data, you always have the right to withdraw this consent at any time by contacting us. However, this does not affect the lawfulness of the processing based on your consent until you have withdrawn it.
Automated decision-making. You have the right not to be subject to a decision based solely on automated processing which will significantly affect you.
We sometimes use automated screening tools as part of our application process. The answers you provide to one or more of the questions (excluding any special categories/equal opportunity questions) may result in your application being automatically declined. This technology is used to help us manage the high volume of applications we receive.
To exercise your rights, as described above, you can contact us by using the contact details set out at the end of this privacy policy.
You will not have to pay a fee to access your Personal Data (or to exercise any of the other rights). However, we may charge a reasonable fee if your request is manifestly unfounded or excessive. Alternatively, we may refuse to comply with the request in such circumstances.
We may need to request specific information from you to help us confirm your identity and ensure your right to access the information (or to exercise any of your other rights). This is an appropriate security measure to ensure that personal information is not disclosed to any person who has no right to receive it.
If you are in the USA, depending on the state in which you reside, your rights may include the:
Right to know: You can request that we disclose to you: (1) the categories and/or specific pieces of personal information we have collected about you, (2) the categories of sources for that personal information, (3) the purposes for which we use that information, (4) the categories of third parties with whom we disclose the information, and (5) the categories of information that we sell or disclose to third parties. You can make a request to know up to twice a year, free of charge.
Right to delete: You can request that we delete personal information we collected from you and tell our service providers to do the same, subject to certain exceptions (such as if we are legally required to keep the information).
Right to opt-out of sale or sharing: You may request that we stop selling or sharing your personal information (“opt-out”), including via a user-enabled global privacy control. We cannot sell or share your personal information after we receive your opt-out request unless you later authorize us to do so again.
Right to correct: You may ask us to correct inaccurate information that we hold about you.
Right to limit use and disclosure of sensitive personal information: You can direct us to only use your sensitive personal information (for example, your social security number, financial account information, your precise geolocation data, or your genetic data) for limited purposes, such as in the performance of the contract of employment between us and to fulfil our legal obligations.
Right to seek damages: You have the right to seek damages for breach of certain sensitive personal information.
Please visit https://careers.keg.com/data-privacy for options to manage your data and privacy settings.
* Please note that during the recruitment process certain personal information is required for processing. Erasure/restriction, objection, or withdrawal can limit this processing and may impact the ability to proceed with your application.
We also treat all references received as strictly confidential, and therefore, these references will not be available to you under the right of access.
5. Storage and Transfers
5.1. Storage
The Personal Data within Teamtailor is stored within the EU, however they may choose to share your data with service providers and suppliers who process data on their behalf. In such cases, any service providers and/or suppliers are data processors and may only use the data in line with their instructions and not for any other purpose. This and other obligations are agreed in the written contract between Teamtailor and the service providers and suppliers.
Where they need to transfer or store your personal data outside the EEA, they will only do so when relying on an Adequacy Decision, Approved Standard Contractual Clauses, or another approved international data transfer mechanism (which contractually oblige third party organisations in those countries to comply with the same data protection standards as legislated within the EU/UK).
If you are in the USA or another part of the world, Teamtailor may disclose your personal information to third-party service providers and/or business partners located outside of your jurisdiction. Some of these third-party service providers may include online storage providers who may store and process personal information in the cloud.
Where Teamtailor make such disclosures, they have taken reasonable steps to ensure any overseas recipients do not breach the relevant privacy legislation in relation to any personal information. Teamtailor have carried out a thorough due diligence process and have imposed relevant contractual obligations on any offshore recipients to ensure compliance.
5.2. Transfer between Keystone entities
In order to maintain the most efficient Recruitment, we also share data with entities within Keystone Education Group. This includes but is not limited to Keystone Sports, UniQuest, FindAUniversity, Edunation, among others. This processing is subject to inter-company data processing/sharing agreements (as applicable), which ensure coherent processing and sufficient technical and organizational measures.
5.3. Transfer to third parties
We may share Users’ Personal Data with:
our contractors and sub-contractors acting as our Processors and Sub-Processors in accordance with our instructions, for the purpose of recruitment;
authorities or legal advisors in case criminal or improper behaviour is suspected;
authorities, legal advisors or other actors, if required by us according to law or authority’s injunction.
We carefully choose partners to ensure that Users’ personal data is processed in accordance to current privacy legislations. We cooperate with the following categories of processors of personal data:
Teamtailor, who powers our Career Site and serves as an applicant tracking system for our Recruitment Process;
Server and hosting companies;
Reference companies, video processing companies, and other companies with regards to the processing of recruitment and hiring activities.
We do not use or disclose personal information for purposes which would require us to offer you the right to limit our use of your information, nor do we sell or share personal information to another business or third party for monetary or other valuable consideration.
5. 4. Aggregated data
We may share aggregated data with third parties for statistical and analytical purposes. The aggregated data has in such instances been compiled from information that has been collected through the Service and can, for example, consist of statistics of internet traffic or the geological location for the use of the Service. The aggregated data does not contain any information that can be used to identify an individual (anonymous) and is therefore no longer personal data.
5.5. International Data Transfers
As Keystone hires globally, some of our recruitment may occur in countries outside of the EU/EEA. For example, hiring managers or teams might sit outside of the EU/EEA, or Users themselves could be based outside of the EU/EEA. If the personal data is transferred outside the EU/EEA, and the transfer is deemed to be restricted, we will ensure that there is either an adequacy decision in place (which ensures that the third country in question guarantees an adequate level of protection), or that appropriate safeguards have been implemented to ensure that your rights under the EU/UKGDPR are safeguarded. Examples of such safeguards are that the data transfer is subject to the European Commission's Standard Contractual Clauses (SCCs), the UK’s International Data Transfer Addendum, or that the relevant third party has certified under the EU/US Data Privacy Framework.
If you are in the USA or another part of the world, we may disclose your personal information to third-party service providers and/or business partners located outside of your jurisdiction for the purposes indicated in this privacy notice. Some of these third-party service providers may include online storage providers who may store and process personal information in the cloud.
Where we make such disclosures, we have taken reasonable steps to ensure any overseas recipients do not breach the relevant privacy legislation in relation to any personal information. We have carried out a thorough due diligence process and have imposed relevant contractual obligations on any offshore recipients to ensure compliance.
6. Security of the Processing
All our processing of personal data is secured by relevant and appropriate technical and organizational measures to protect your data and ensure your rights. We regularly review our security policies and processes to ensure that our systems are secure and protected.
We handle personal data so that it is accurate, accessible, and processed in accordance with the degree of sensitivity of the data. We also use a range of security technologies and information security procedures to protect personal data from unauthorized access, use, or disclosure.
We have entered into data processing agreements with all our suppliers that process personal data.
We restrict access to personal data strictly to the staff or third parties who have a necessary need to process the data on our behalf. These parties are subject to a duty of confidentiality.
7. Changes
We have the right to, at any time, make changes or additions to this Privacy Policy. The latest version of the Privacy Policy will always be available through Teamtailor. In the event of major changes, we will inform Users of this.
8. Complain
You have the right to lodge a complaint with the relevant supervisory authority if you are concerned about the way in which we are handling your Personal Data. For supervisory authorities within the EU see the link below:
https://edpb.europa.eu/about-edpb/about-edpb/members_en
The supervisory authority in the UK is the Information Commissioner’s Office who can be contacted online at: https://ico.org.uk/make-a-complaint or by telephone on 0303 123 1113.
For individuals located in the USA or another part of the world, please contact your relevant state regulator to lodge a complaint.
9. Contact
For questions about how we process personal data for Recruitment, or if you wish to exercise your rights under the GDPR, please contact us at careers@keg.com. Detailed information on users’ rights can be found in Section 4.
For personal data matters outside of the scope of Recruitment, please refer to Keystone’s Privacy Policy at www.keg.com/privacy.
Our Data Protection Officer can be contacted by emailing: compliance@keg.com.