Careers at ARIA

Privacy Policy for Job Applicants

ARIA (“we”, “us”) are committed to protecting and respecting your privacy. This Privacy Notice sets out the basis on which the personal data collected from you, or that you provide to us, will be processed by us in connection with our recruitment processes. This Privacy Policy is provided in accordance with the UK General Data Protection Regulation ("UK GDPR") and the Data Protection Act 2018.

The Data Controller and the entity responsible for the processing of your personal data collected during the recruitment process is ARIA.

Where you apply for an opportunity posted by us, this Privacy Policy for Job Applicants will apply to our processing of your personal data.

Your Personal Information

How is your personal data collected?

We collect personal data about you in the following ways:

Direct Interactions: you provide us with your personal information throughout the job application process, including at interviews and in recruitment conversations.
Third Parties: we will receive personal data about you from various third parties, such as from recruitment agencies, third parties that carry-out background checks or other pre-employment background screening, referrers, referees and former employers (e.g.: We may use Pinpoint to link the data you provide to us with other publicly available information about you published on the Internet – this may include sources such as LinkedIn and other social media profiles).
Pinpoint: We use a third party called Pinpoint, whose technology enables us to search various databases – which may include your personal data – to find possible candidates to fill our job openings. When we obtain personal data about you in this way, we rely on our legitimate interests in recruiting suitable staff (UK GDPR Art 6(1)(f)). In these circumstances, we shall provide you with this Privacy Policy no later than one month after we obtained the data, or at the first contact with you, whichever is earlier, as required by the UK GDPR. You can object to this processing at any time.

Information we collect from you

We collect and process some or all of the following types of information from you:

Identity Data: including first name, maiden name, last name, marital status, title, date of birth and gender.
Contact Data: including address, email address and other contact details.
Identity Documents: including copies of Passports, Visa and other Identity documents relating to your entitlement to work.
CV Data: including information about your career history, skills, experience, qualifications and salary information.
Health Data: including information about your health, medical conditions, for which we may have to make reasonable adjustments both during recruitment process and potential employment.
Background Check Data: including biometric data and information obtained through criminal background checks and/or other pre-employment screening.
Interview and Meeting Data: including audio and video recordings of interviews or meetings, AI-generated transcripts, AI-generated summaries, and user-provided notes or annotations related to your interviews and psychometric test data.
References: including information obtained from references from previous employers or other referees.
Other Sensitive Data: including ethnicity, religious beliefs, sexual orientation, and other diversity data. Details of your visits to our careers website including, but not limited to, traffic data, location data and other communication data, the site that referred you to our careers website and the resources that you access.
Open Source Intelligence checks: For Executive and Programme Director positions, we collect and analyse publicly available data.
Conflicts of Interest: At the point of offer, we will ask for disclosure of any potential conflicts of interest. Additional information will be provided.

Special Category Data: We do not routinely request special category personal data. However, special category data may be incidentally captured during interviews if you voluntarily disclose such information in unstructured conversations. We process such data only where necessary for recruitment purposes and in accordance with data protection law. We also collect diversity and equality data on a voluntary basis to monitor equal opportunities, which is processed separately with your explicit consent.

Purposes for which we will use your personal data

Lawful basis for processing

We process your personal data only where allowed under UK data protection law. The primary basis is our legitimate interests (UK GDPR Article 6(1)(f)) in recruiting qualified staff for our business and managing our recruitment process effectively.

Depending on the stage and nature of processing, we also rely on other bases: for example, processing some data is necessary to take steps at your request prior to entering into a contract (Article 6(1)(b)) – this applies to evaluating you for employment and (if successful) preparing an employment contract for you. In addition, certain processing may be necessary for us to comply with our legal obligations (UK GDPR Article 6(1)(c)), such as verifying your right to work in the UK or making reasonable adjustments for disabled candidates under equality laws. If we ask for any information that is not strictly required and you choose to provide it, we may process that based on your consent (UK GDPR Article 6(1)(a)), which you can withdraw at any time. We explain these bases further in the context of specific

Purpose/Activity: Manage, administer and communicate about your application.
Type of data: (a) Identity Data, (b) Contact Data, (c), Identity Documents, (d) CV Data.

Lawful basis for processing including basis of legitimate interest: (a) To take steps prior to entering into an employment contract with you, (b) Necessary for our legitimate interests (to ensure recruitment of the most appropriate applicants).

Purpose/Activity: Assess your suitability for employment (including eligibility to work).
Type of data: (a) Identity Data, (b) Identity Documents, (c) CV Data, (d) References.
Lawful basis for processing including basis of legitimate interest: (a) To take steps prior to entering into an employment contract with you, (b) Necessary for our legitimate interests (to ensure recruitment of the most appropriate applicants), (c) Necessary to comply with a legal obligation.

Purpose/Activity: To record, transcribe, and analyse recruitment interviews and conversations to assess candidate suitability and maintain accurate records of the recruitment process.
Type of Data: (a) Identity Data, (b) Contact Data, (c) CV Data, (d) Interview and Meeting Data
Lawful basis for processing including basis of legitimate interest: (a) To take steps prior to entering into an employment contract with you, (b) Necessary for our legitimate interests (to ensure recruitment of the most appropriate applicants).

Purpose/Activity: Equal-opportunity monitoring and providing reasonable adjustments.
Type of data: (a) Identity Data, (b) Health Data, (c) Other Sensitive Data.
Lawful basis for processing including basis of legitimate interest: (a) Necessary to comply with a legal obligation, (b) Necessary for our legitimate interests / substantial public interest (to ensure equal treatment of candidates), (c) Where required by applicable law, with your consent.

Purpose/Activity: Carrying out background/ security checks (role-dependent).
Type of data: (a) Identity Data, (b) Identity Documents, (c) Criminal Data.
Lawful basis for processing including basis of legitimate interest: (a) Necessary to comply with a legal obligation, (b) Necessary for our legitimate interest / substantial public interest (to prevent and detect unlawful acts), (c) Where required by applicable law, with your consent.

Purpose/Activity: Improve Pinpoint’s recruitment-platform services (analytics, trouble-shooting).
Type of data: (a) Technical/ usage data and candidate data in anonymised or aggregated form only.
Lawful basis for processing including basis of legitimate interest: Art 6 (1)(f) – legitimate interest in enhancing the reliability and user experience of the recruitment system.

ARIA may also process your personal data where required by law and/or in its legitimate interests (in protecting its business and reputation) for the purposes of:

Exercising or fulfilling ARIA's legal rights and responsibilities, including compliance with statutory and regulatory obligations;
Managing legal disputes involving applicants, employees and/or third parties; and
The prevention or detection of fraud, crime or other unlawful or inappropriate conduct.

Disclosure of applicant personal data

Where necessary and lawful, your personal data will be disclosed to certain third parties, for example, to: -

ARIA management and employees;
Our professional advisers, such as solicitors or accountants, and consultants;
Government departments and agencies;
Police and law enforcement agencies;
Courts and tribunals;
Insurers;
Partners, suppliers, agents, and service providers (e.g. Pinpoint & Metaview); and
Third parties to gain references.

Automated decision making / profiling

Our recruitment process involves some automated processing to assist us in identifying suitable candidates and transcribing, summarising and analysing interviews, but we do not make any final hiring decisions based solely on automated decision-making. For example:

We may leverage Pinpoint’s technology to search through candidate profiles based on criteria we have identified (such as specific skills, experience, or qualifications required for the role). This helps us efficiently shortlist candidates whose profiles match the role requirements.
We use Metaview to automatically record, transcribe, and generate AI-powered summaries of recruitment interviews and conversations. These AI-generated transcripts, summaries and associated analysis of recruitment conversations are used to assist our interviewers in assessing candidates consistently and maintaining accurate records of interviews. This helps us to analyse conversations, reduce bias, maintain accurate records, and ensure consistency in our recruitment process. You will be informed ahead of any recorded interview of our intended use of Metaview, and you have the right to object to being recorded at that stage.

Please note that any important decision regarding your application – such as selecting candidates for interview, making an offer, or rejecting an application – is made by our team members, not by an algorithm. There is always human involvement in these decisions, and no algorithm can automatically eliminate you from consideration without human review. Given this, the use of automation will not have legal or similarly significant effects on you without meaningful human input.

How we store your personal data

Security

We take appropriate measures to ensure that all personal data is kept secure including security measures to prevent personal data from being accidentally lost, or used or accessed in any unauthorised way. We limit access to your personal data to those who have a genuine business need to view it. Those processing your information will do so only in an authorised manner and are subject to a duty of confidentiality.

We also have procedures in place to deal with any suspected data security breach. We will notify you and any applicable regulator of a suspected data security breach where we are legally required to do so.

Unfortunately, the transmission of information via the internet is not completely secure. Although we will do our best to protect your personal data, we cannot guarantee the security of your data transmitted through any online means, therefore any transmission remains at your own risk.

Where we store your personal data

The data that we collect from you and process using Pinpoint’s services will be transferred to and stored at one of several datacentre locations in Amsterdam (Netherlands) and may be synchronised to one of several datacentre locations in London (United Kingdom) for backup and redundancy purposes.

Our service provider Pinpoint is incorporated in Jersey, which is itself recognised as adequate by both the EU and the UK.

International transfers of your personal data

We do not routinely transfer applicant data outside the UK / EEA.

If we or our service providers (for example, a background-check or cloud-support vendor) transfer your personal data to a country outside the UK/ EEA, we or they are required to ensure a similar degree of protection is afforded to it in the recipient country by ensuring at least one of the following safeguards is implemented:

Personal data is transferred to countries that have been deemed to provide an adequate level of protection for personal data; and/or
Transfers are made on the basis of specific contracts approved for use in your country of residence which give personal data the same protection it has in your country of residence (such as the EU Standard Contractual Clauses and/or UK International Data Transfer Addendum).

Please contact us if you want further information on the specific mechanism used by us when transferring your personal data internationally.

How long we keep your personal data

We will not retain unsuccessful applicant data for longer than necessary and will delete it once it is no longer required for the purposes set out in the Policy. If your application is unsuccessful (or you decline an offer from us), we will normally keep your personal data for up to 24 months (2 years) from the end of the recruitment process.

After 24 months, or if you request sooner as described below, we will delete or anonymise your personal data from our recruitment system. Your personal information will be deleted on one of the following occurrences:

You choose to delete your data via the Manage Your Data tool; or
You send us a written request to delete your data (see “Your Rights” below on how to request erasure); or
The 24-month retention period expires, in which case we will proactively purge your data from our systems.

Your rights

Under the UK GDPR you have a number of important rights regarding your personal data. In summary, you have the right to:

Access your personal data and to certain other supplementary information;
Require us to correct any mistakes in your information which we hold;
Request the erasure of personal data concerning you in certain situations;
Request access to the personal data concerning you which you have provided to us, in a structured, commonly used and machine-readable format and the right to transmit this data to a third party in certain situations;
Request that we suspend or restrict the processing of your personal data;
Request that we provide you or a third party with a copy of your data in a structured, commonly used, machine-readable format.
Object to processing of personal data concerning you for direct marketing.
Not to be subject to automated decisions – as noted above, you have the right not to be subject to a decision based solely on automated processing that produces legal effects or similarly significant effects.
Withdraw consent – Where we are processing your personal data based on your consent (for example, if you consented to provide special category data or consented to us keeping your data in our talent pool beyond the normal retention period), you have the right to withdraw that consent at any time.
You have the right to claim compensation for damages. While we strive to protect your data and comply fully with the law, we include this right for completeness.

These rights may be subject to conditions and exemptions – for example, we might not erase data we are required to keep by law, or we might refuse a request for data portability if it adversely affects the rights of others – but we will inform you if such circumstances apply.

If you would like to exercise any of those rights, please either:

Utilise the Manage Your Data tool provided; or
Contact us using our contact details below, ensuring we have enough information to identify you, proving your identity and address and confirming which information to which your request relates

How to complain

We hope that we can resolve any query or concern you raise about our use of your information.

If you have any questions about this policy or how we handle your personal data, please contact us or email our Data Protection Officer at dpo@aria.org.uk.

If for any reason you are not happy with the way we have handled your personal data, please contact our Data Protection Officer at dpo@aria.org.uk.

The UK GDPR also gives you right to lodge a complaint with a data protection supervisory authority. In the UK, our primary supervisory authority is the Information Commissioner’s Office (ICO). You can contact the ICO about a concern at https://ico.org.uk/make-a-complaint or by calling their helpline at 0303 123 1113. The ICO’s address is Water Lane, Wycliffe House, Wilmslow, Cheshire SK9 5AF.

Effective Date: This Privacy Notice is effective as of 20 October 2026 and may be updated from time to time. We will notify candidates of any significant changes.