This Applicant Privacy Policy explains what personal data we hold about you, how we collect it, and how we use and may share information about you during the recruitment and application process and, if your application is successful, how that information will subsequently form part of your employment record. We are required to notify you of this information under data protection legislation. If you have any questions about this notice, please contact recruitment@gwi.com.
By submitting your personal data, you:
This Applicant Privacy Policy explains how GWI processes applicants’ personal data and applies to all applicants, wherever you are based. The data protection laws that apply to you depend on your location. Those laws may give you rights that differ from, or are more or less extensive than, the rights available in other locations. The country and region-specific terms that apply to you are set out in the Schedules to this policy (within section 12), and should be read together with this core policy. In the event of any conflict between the core policy and a Schedule that applies to you, the Schedule prevails to the extent of that conflict. Regardless of your location, GWI will, as a matter of policy, seek to honour requests to exercise the rights described in the core of this policy and the applicable Schedule, even where local law does not require it.
GWI (trading name for Trendstream Limited) is the primary ‘data controller’ and collects and processes certain information about you which enables GWI to identify you. GWI may also process ‘special categories’ of personal data about you.
GWI operates globally through a group of companies, including group entities in the United States, Czech Republic, Greece, and Singapore. Depending on the location of the role you have applied for and where you would be based, one of these group companies may also act as a data controller of your personal data in its own right, or as a joint controller together with Trendstream Limited. For example, if you apply for a role based in the United States, GlobalWebIndex, Inc. will also act as a controller of your personal data. Trendstream Limited remains the primary controller for the GWI group.
Where a group company other than Trendstream Limited collects your personal data or determines how it is processed, the details specific to that location are set out in the country-specific Schedule at the end of this notice (within section 12). Please refer to the Schedule for the country in which the role you have applied for is based.
Your personal data will be handled in accordance with current data protection legislation.
Personal data
In order to manage your application, we need to process certain personal data about you. We only process your information as necessary for the purposes of progressing your application, and as required by law or regulatory requirements. GWI either collects personal data directly from candidates or sometimes from third-party job boards or background check providers.
This includes, for example, your:
Special category data
During the application process, we may collect some special categories of personal data including, for example, your:
This is collected in order to: (i) make reasonable adjustments to enable candidates to apply for jobs with us; (ii) to attend interviews; (iii) to prepare for starting work with GWI (if successful); and (iv) to ensure we respect diversity and inclusion in our workspace and comply with our legal and regulatory requirements.
We only need special category data for the specific purposes described above. Please do not include special category data in your CV, cover letter, application answers or other free-text materials unless we specifically ask for it or it is genuinely necessary for your application. Where we invite you to provide diversity information, doing so is entirely voluntary, and it is not used to assess your application. Keeping unnecessary special category data out of your application helps us to minimise the personal data we process about you, including in the AI features described below. We will always ask for your consent when we collect special category data.
We will only process your personal data where the law allows us to. The table below sets out the main activities for which we process your personal data during the application and recruitment process, and the lawful basis (or bases) we rely on for each. Where an activity involves special category data (as described above), we have also set out the additional condition we rely on to process that data. We may rely on more than one basis for a given activity depending on the circumstances.
|
Activity |
Personal data used |
Lawful basis |
Additional condition for special category data where relevant |
|
Processing your CV, application form and supporting information to assess your suitability for the role |
Identity, employment history, qualifications, skills and other application data |
Taking steps at your request prior to entering into a contract; and our legitimate interests in assessing and selecting candidates |
Not applicable (special category data is not required for this activity) |
|
Using AI features to prioritise and rank applications to assist with shortlisting |
CV-derived fields (for example skills, job titles, years of experience, employment dates and previous employers) |
Our legitimate interests in managing applications efficiently and consistently |
Not applicable (the AI ranking feature is designed not to use special category data) |
|
Using AI and other tools to detect fraudulent, spam and automated ('bot') applications |
Technical signals such as your IP address |
Our legitimate interests in protecting the integrity and security of our recruitment process |
Not applicable |
|
Verifying the information you provide, and carrying out reference and background checks |
Identity, employment history and information from referees and background-check providers |
Our legitimate interests in verifying candidate information and making informed recruitment decisions |
Not applicable (or, where such checks reveal special category data, your explicit consent) |
|
Carrying out right-to-work and other legally required checks |
Identity, nationality and right-to-work documentation |
Compliance with our legal obligations |
Not applicable |
|
Communicating with you about your application and informing you of further career opportunities |
Identity and contact details |
Taking steps at your request prior to entering into a contract; and our legitimate interests in managing the recruitment process and our talent pipeline |
Not applicable |
|
Storing your application record and communicating internally about your application (for example using Greenhouse, G-Suite and Slack) |
All application data |
Our legitimate interests in administering and keeping records of the recruitment process |
Explicit consent, in relation to any special category data included in your record |
|
Sharing your personal data within the GWI group and with third-party suppliers who support the recruitment process |
Identity and application data |
Our legitimate interests in operating recruitment across the GWI group and using trusted service providers |
Explicit consent, in relation to any special category data shared |
|
Making reasonable adjustments to enable you to apply for a role and attend interviews, and preparing for you to start work if your application is successful |
Disability and health information, and other special category data you provide for this purpose |
Our legitimate interests in supporting candidates through the recruitment process; and, where necessary, compliance with our legal obligations |
Explicit consent |
|
Diversity and equality monitoring |
Special category data (for example data revealing racial or ethnic origin, religious or philosophical beliefs, health or disability information, and data concerning sexual orientation) |
Our legitimate interests in monitoring and promoting equality, diversity and inclusion |
Your explicit consent (this data is provided voluntarily and is not used to assess your application) |
|
Establishing, exercising or defending legal claims, and complying with regulatory requirements |
Identity and application data, and any relevant special category data |
Compliance with our legal obligations; and our legitimate interests in protecting our legal position |
Explicit consent, or processing necessary for the establishment, exercise or defence of legal claims |
Where we rely on our legitimate interests, we have considered your interests, rights and freedoms and are satisfied that they do not override those interests. You can ask us for further information about this balancing exercise at any time by contacting recruitment@gwi.com.
Where we rely on your consent (including for the special category data we process for diversity monitoring and reasonable adjustments), providing that data is entirely voluntary, and you can withdraw your consent at any time as described below in section 10 'Your rights'. Withdrawing your consent will not affect the lawfulness of any processing carried out before you withdraw it.
As a data controller, GWI holds and processes your personal data which is needed to facilitate the selection process and in connection with any subsequent employment. Your personal data may be used to assess your application for employment with GWI, to verify the information you have provided, to conduct reference checks, to communicate with you, and to inform you of further career opportunities.
Throughout your application, we use a third-party applicant tracking system called Greenhouse to track all stages of your application. Greenhouse acts as our data processor and will process your information stored on their platform in accordance with our instructions. A link to their privacy notice can be found here: https://www.greenhouse.io/privacy-policy.
Use of artificial intelligence (AI) in our recruitment process
We use AI features provided within Greenhouse to help us manage applications. These features are used to: (i) detect fraudulent, spam and automated (‘bot’) applications, so that we can protect the integrity of our recruitment process; and (ii) prioritise and rank applications against the criteria for the relevant role to assist us with shortlisting.
The AI is used only to assist our recruitment team. It does not make any decision about your application on its own. A member of our team reviews applications and makes all decisions about whether an application progresses, and we do not reject any application on the basis of an AI or fraud-detection signal alone.
For these features, Greenhouse acts as our data processor and uses sub-processors, including Amazon Web Services and OpenAI. Neither Greenhouse nor its sub-processors is permitted to use your personal data to train their AI models. Only limited information is used by the AI: for ranking, CV-derived fields such as your skills, job titles, years of experience, employment dates and previous employers; and for fraud detection, technical signals such as your IP address. The AI ranking feature is designed not to use special category data.
Because some of these providers are located in the United States, your personal data may be transferred outside the UK and EEA in connection with these features. Where this happens, we ensure appropriate safeguards are in place (for example, the UK Extension to the EU–US Data Privacy Framework and/or standard contractual clauses).
You can ask us not to use these AI features in relation to your application. If you opt out, your application will instead be reviewed manually by our recruitment team, and opting out will not disadvantage your application in any way. To opt out, or if you have any questions or wish to challenge how the AI features have been applied to your application, please contact recruitment@gwi.com.
Your data may also be stored within internal communication channels that we use, such as G Suite and Slack, for HR to communicate to hiring managers on the progress of your application.
In the event of your application resulting in a job offer and acceptance of a position with GWI, the data collected will become part of your employment record and will be used for employment purposes.
We are committed to keeping your personal data secure. We have put in place physical, electronic, and operational procedures intended to safeguard and secure the information we collect. All GWI staff have a legal duty to respect the confidentiality of information, and access to confidential information is restricted to only those who have a reasonable need to access it.
We have procedures in place to deal with any suspected data security breach. We will notify you and the appropriate regulator of a suspected data breach where we are legally required to do so.
Your personal data, including special categories of personal data, may be shared between employees who legitimately need the information as part of the recruitment process. This may include employees who have managerial responsibility for you, or employees in HR responsible for certain HR processes (e.g., recruitment, assessment, reference checks, and pre-employment screening).
We may also share your information with certain external third parties, including suppliers who carry out reference and background checks.
When we transfer your personal data to third parties or to third-party service providers, we do so when required by law, where it is necessary to administer our relationship with you, or where we have another legitimate interest in doing so. We oblige those third parties to protect your information with appropriate security measures and prohibit them from using your information for their own purposes or from disclosing your information to others.
In certain circumstances, these recipients may be outside the UK. This means your personal data may be sent outside the UK and EEA to a jurisdiction that may not offer an equivalent level of protection as is required in the UK and EEA. If this occurs, we will ensure adequate safeguards are in place to protect your data in accordance with applicable legislation.
We do not carry out any processing of your personal data for marketing purposes and will not share this data with anyone for the purpose of marketing to you.
Where requested or if we consider that it is reasonably required, we may also provide your data to government and law enforcement organisations. They may then use your data to carry out their legal functions.
Where your data is no longer required for the purposes described in this privacy notice, we will ensure it is securely deleted. Applications from unsuccessful candidates will be securely deleted after 24 months.
Shorter retention periods apply to the AI features described above within Greenhouse. Any CV data used by the AI features is stored by Greenhouse for no more than 30 days, and any data processed by their AI sub-processor(s) is retained for no more than 30 days. These AI-specific periods are separate from, and shorter than, our general retention period for your wider application record.
As an applicant to GWI, we hold personal data about you as described above. You have certain rights regarding such personal data, depending on your location. The rights set out below relate to UK and EU privacy laws, and the Schedules cover any country-specific rights in other locations. Regardless of your location, GWI will, as a matter of policy, seek to honour requests to exercise the rights described below.
If you would like to exercise one of the rights listed above, please contact our Data Protection Officer, Graeme Barron, by email at legal@gwi.com.
Please use the email template below to confirm the right you wish to exercise together with details of the data in respect of which you are exercising such right.
Subject: <The right you would like to exercise>
Body:
<name>
<The right you would like to exercise>
<grounds for your request (where applicable)>
<personal data which is subject to the rights request>
You will not have to pay a fee to exercise any of these rights. However, we may charge a reasonable fee if your request is clearly unfounded or excessive. Alternatively, we may refuse to comply with the request in such circumstances.
We may need to request specific information from you to help us confirm your identity and ensure your right to exercise any of the rights. This is another appropriate security measure to ensure your personal information is protected.
You have the right to lodge a complaint about our processing of your personal data with a supervisory authority. In the UK, this is the Information Commissioner's Office.
We may update this notice periodically. Where we do this, we will inform you of the date on which the changes take effect. This version of the Applicant Privacy Policy was published on 18 September 2026.
These Schedules set out information specific to applicants for roles based outside the UK. Where there is any conflict between the core of this policy and a Schedule, the Schedule applies for applicants based in the relevant country. Trendstream Limited remains the primary controller for the GWI group in each case.
Schedule 1: Czech Republic
Controller for Czech Republic-based roles: GlobalWebIndex s.r.o., a company registered in the Czech Republic (company identification number 07900775), registered address Panská 854/2, Nové Město, 110 00 Prague 1, Czech Republic.
Role: For applicants for Czech Republic-based roles, GlobalWebIndex s.r.o. acts as a controller of your personal data in its own right and, in some cases, as a joint controller together with Trendstream Limited.
Applicable law and your rights: The Czech Republic is within the EEA and the EU GDPR applies. The position is materially the same as the UK/EU position described in the main core of this policy, save that the competent supervisory authority is the Office for Personal Data Protection.
Schedule 2: Greece
Controller for Greece-based roles: GlobalWebIndex Hellas, a company registered in Greece (registration code 146172601000), registered address Panepistimiou 14, Athina 105 64, Greece (1st floor).
Role: For applicants for Greece-based roles, GlobalWebIndex Hellas acts as a controller of your personal data in its own right and, in some cases, as a joint controller together with Trendstream Limited.
Applicable law and your rights: Greece is within the EEA and the EU GDPR applies. The position is materially the same as the UK/EU position described in the main core of this policy, save that the supervisory authority is the Hellenic Data Protection Authority.
Schedule 3: Singapore
Controller for Singapore-based roles: APAC GWI PTE. LTD, a company registered in Singapore (UEN 202142985E), registered address 2 Havelock Road #06-01 Havelock2, Singapore 059763.
Role: For applicants for Singapore-based roles, APAC GWI PTE. LTD acts as a controller of your personal data in its own right and, in some cases, as a joint controller together with Trendstream Limited.
Applicable law and your rights: The Singapore Personal Data Protection Act 2012 (PDPA) applies to your personal data instead of the UK/EU GDPR. Your rights under the PDPA differ from those described in the main core of this policy - in particular, the PDPA provides rights of access to and correction of your personal data, but does not provide the full set of rights available under UK and EU law. GWI will, as a matter of policy, seek to honour requests to exercise the rights described in this policy regardless of your location.
International transfers: Personal data transferred from the UK or the EEA to APAC GWI PTE. LTD in Singapore is safeguarded by the intra-group data transfer arrangements in place across the GWI group, including the EU Standard Contractual Clauses and the UK International Data Transfer Agreement.
Schedule 4: United States
Controller for US-based roles: GlobalWebIndex, Inc., a company registered in the United States (registration number 6178378), registered address National Registered Agents, Inc., 1209 Orange Street, Wilmington, New Castle, Delaware 19801.
Role: For applicants for US-based roles, GlobalWebIndex, Inc. acts as a controller of your personal data in its own right and, in some cases, as a joint controller together with Trendstream Limited.
Applicable law and your rights: United States privacy laws differ from the UK and EU regime. The rights described in the main core of this policy derive from UK and EU data protection law and may not all apply to you; where applicable US federal or state privacy laws grant you rights, those rights will apply. GWI will, as a matter of policy, seek to honour requests to exercise the rights described in this policy regardless of your location.
If you are a California resident, the California Consumer Privacy Act (CCPA) gives you the rights described in the core policy (which the CCPA calls the right to know, the right to delete and the right to correct), and in addition:
You can exercise any of these rights by contacting legal@gwi.com.
International transfers: Personal data transferred from the UK or the EEA to GlobalWebIndex, Inc. in the United States is safeguarded by the intra-group data transfer arrangements in place across the GWI group, including the EU Standard Contractual Clauses and the UK International Data Transfer Agreement.