Applicant Privacy Notice
Before we begin
This notice (Privacy Notice) applies to personal information relating to your application for employment with HSBC Group held by members of the HSBC Group as data managers, as described below. It explains what information we collect about you, how we’ll use that information, who we’ll share it with, the circumstances when we’ll share it and what steps we’ll take to make sure it stays private and secure. This Privacy Notice covers all aspects of your interaction with HSBC in your capacity as an applicant, including recruitment and pre-employment screening and we may update this notice at any time.
Some of the links on our websites lead to other HSBC or non-HSBC websites with their own privacy notices, which may be different to this notice. You’ll need to make sure you’re happy with their privacy notices when using those other sites.
Wherever we’ve said ‘you’ or ‘your’, this means you or any authorised person who engages with us on your behalf (e.g. recruitment agencies you have authorised to liaise with us on your behalf).
When we say ‘we’, we mean HSBC Group companies which act as a data manager in respect of your personal data in your applicant capacity. Unless otherwise stated below, the data manager for the purposes of this Privacy Notice will be HSBC Bank Middle East Limited Bahrain Branch, or if different, the HSBC Group company that you have applied for employment with. Where the data manager is HSBC Bank Middle East Limited Bahrain Branch, the address for the data manager is P.O. Box 57, Manama, Kingdom of Bahrain.
If you’d like to get in touch with us, you can also find contact details set out in the ‘More details about your information’ section below.
What information we collect
We’ll only collect relevant information about you in line with applicable regulations and law. We may collect it from a range of sources and it may relate to any of the roles you apply for, currently hold or have held in the past both within and outside of the HSBC Group. We may also collect information about you when you interact with us, e.g. call us, visit our websites or mobile channels, or use services we make available to you in your applicant capacity (e.g. online tests).
Some of it will come directly from you, e.g. when you provide ID to verify your identity or right to work. It can also come from your previous employers, other HSBC companies, or other sources you’ve asked us to obtain information from. We might also get some of it from publicly available sources. The information we collect may include:
Information that you provide to us, e.g.:
Information we collect or generate about you, e.g.:
Information we collect from other sources, e.g.:
How we’ll use your information
The reasons we use your information include:
How we make decisions about you
We may use automated systems to help us make decisions about the outcome of your application. We may use technology that helps us identify the level of risk involved in your work for us, e.g. for fraud or financial crime reasons, or to identify market misconduct through analysis of irregular trades.
You have a right to certain information about how we make these decisions. You may also have a right to request human intervention and to challenge the decision. More details can be found in the ‘Your rights’ section below.
Tracking or recording what you say or do
We may record details of your interactions with us. We may record and keep track of conversations you have with us including phone calls, face-to-face meetings, letters, emails, live chats, video chats and any other kinds of communication. We may use these recordings to check your instructions to us, assess, analyse and improve our service, train our people, manage risk or to prevent and detect fraud and other crimes. We may also use these recordings to make decisions on the outcome of your application. We may capture additional information about these interactions, e.g. telephone numbers that you call us from and information about the devices or software that you use. We use closed circuit television (CCTV) in and around our sites and these may collect photos or videos of you, or record your voice.
We will request, collect and process your personal data as part of our vetting procedures. This will be in order to confirm your identity, employment history and relevant qualifications with respect to a role, to comply with the law and for our legitimate interests to be able to assess and manage our risk.
We collect personal data for vetting through the application and recruitment process directly from candidates by teams within HSBC (either based in our offshore Global Service Centres or onshore Employee Vetting Teams and/or HR Teams). Global vendors or other carefully selected local third parties in country may also collect personal data for vetting purposes for us.
We'll typically collect, store, and use the following categories of personal information about you:
Vetting checks we perform may also include conducting the following checks, but not limited to:
We will only use your personal information for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose. If we need to use your personal information for an unrelated purpose, we will notify you and we will explain the legal basis which allows us to do so.
Please note also that we may process your personal information without your knowledge, where this is required or permitted by law.
All new entrants to the HSBC will be vetted as part of their recruitment, and periodically throughout your employment. Certain posts within HSBC are Enhanced Vetting (EV) posts. EV posts are posts that provide particular opportunity to an employee to abuse their position in order to cause significant financial, reputational or physical damage to HSBC, its people, its clients, its data or its premises. Those who apply for such posts will be subject to Enhanced Vetting during recruitment and those who occupy such posts must be Enhanced Vetted every three years to confirm that their continued employment in such posts does not expose HSBC to unacceptable levels of risk. EV remains valid for three years and employees can move from EV role to EV role within this three year period without EV being repeated, unless local regulations dictate otherwise.
We may request information about criminal convictions if it is appropriate (i.e. for regulated roles) and where we are legally able to do so. We may also collect information about criminal convictions to meet our legal obligations in connection with your employment. We may collect information about criminal convictions in any country where you have resided for a period of 6 months or more within the last five years.
Credit Reference Checks
As part of your application to us, we may perform credit and identity checks on you with one or more credit reference agencies (CRAs). We will conduct credit reference checks with CRAs in any country where you have resided for a period of 6 months or more within the last five years.
To do this, we’ll supply your personal information to CRAs and they’ll give us information about you. This will include information from your credit application and about your financial situation and financial history. CRAs will supply us with both public and shared credit information, financial situation, history and fraud prevention information.
We may use this information to:
Compliance with laws and regulatory compliance obligations
We’ll use your information to meet our compliance obligations, to comply with other laws and regulations and to share with regulators and other authorities that HSBC Group companies are subject to. This may include using it to help detect or prevent crime (including terrorism financing, money laundering and other financial crimes). We’ll only do this on the basis that it’s needed to comply with a legal obligation or it’s in our legitimate interests and that of others.
Who we might share your information with
We may share your information with others where lawful to do so including where we or they:
We may share your information for these purposes with others including:
Sharing aggregated or anonymised information
We may share aggregated or anonymised information within and outside of the HSBC Group with partners such as research groups, universities or advertisers. You won’t be able to be identified from this information, e.g. we may share information about general employment trends to assist in research.
How long we’ll keep your information
We keep your information in line with our data retention policy. For example we’ll normally keep your core application data for a period of seven years from the end of our relationship with you or as per the group or applicable local data retention schedule. This enables us to comply with legal and regulatory requirements or use it where we need to for our legitimate purposes such as dealing with any disputes or concerns that may arise. If your application for a job with HSBC is unsuccessful, we will retain any personal data collected in line with local regulations or otherwise for a period of five years from the date you are formally rejected.
If you are required to complete an on-line assessment as part of your application, your test results may be valid for future job applications and we will keep them for a period of twelve months. After twelve months your test results will be deleted and therefore if you apply to either the same role or a different role with HSBC in the future then you may be required to complete a new on-line assessment.
We may need to retain your information for a longer period where we need the information to comply with regulatory or legal requirements or where we may need it for our legitimate purposes, e.g. to help us respond to queries or complaints, fighting fraud and financial crime, responding to requests from regulators, etc.
If we don’t need to retain information for this period of time, we may destroy, delete or anonymise it more promptly.
Transferring your information overseas
Your information may be transferred to and stored in locations outside the Kingdom of Bahrain, or to an international organisation where the data protection laws are not as strict with the permission of Bahrain's Personal Data Protection Authority. In some countries the law might compel us to share certain information, e.g. with tax authorities or apply different levels of security. Even in these cases, we’ll only share your information with people who have the right to see it.
When we do this, we’ll ensure it has an appropriate level of protection and that the transfer is lawful. We may need to transfer your information in this way to perform our contract with you, to fulfil a legal obligation, to protect the vital interests of individuals, in certain circumstances to protect the public interest and for our legitimate business interests.
Where we transfer information about you outside the Kingdom of Bahrain we will always take appropriate measures aimed to ensure that your information is protected. To do this we will ensure that all transfers of your information are subject to appropriate or suitable safeguards (such as encryption and contractual commitments to protect your information).
You can obtain more details of the protection given to your information when it is transferred outside the Kingdom of Bahrain by contacting us using the details in the ‘More details about your information’ section below.
These rights include:
You can exercise your rights by contacting us using the details set out in the ‘More details about your information’ section below. You also have a right to complain to Bahrain's Personal Data Protection Authority.
What we need from you
You’re responsible for making sure the information you give us is accurate and up to date, and you must tell us if anything changes as soon as possible.
The absence or inaccuracy of any records may affect the outcome of your application and/or we may be prevented from complying with our legal obligations.
How we keep your information secure
We use a range of measures to keep your information safe and secure which may include encryption and other forms of security. We require our staff and any third parties who carry out any work on our behalf to comply with appropriate compliance standards including obligations to protect any information and applying appropriate measures for the use and transfer of information.
More details about your information
If you’d like further information on anything we’ve said in this Privacy Notice please contact us via your recruitment contact.
Appendix 1 – How we process your information
We’ll use your information for purposes including: