Purpose and basis for processing
Our purpose for processing candidate data is to assess your suitability for a role at Capco.
Where applicable, data protection laws require a lawful basis for processing personal data. We rely on legitimate interest or to take steps at your request, before entering into a contract. These bases are recognised under global data protection laws, including but not limited to:
- UK and EU – the General Data Protection Regulation (GDPR)
- Canada – Personal Information Protection and Electronic Documents Act (PIPEDA)
- Brazil – Lei Geral de Proteção de Dados Pessoais (LGPD)
- Singapore / Malaysia – Personal Data Protection Act (PDPA)
- US – such as the California Consumer Privacy Act (CCPA)
Where data protection laws requires a lawful basis for processing sensitive or special category personal data, such as health, racial or ethnic origin, religious beliefs, the processing is necessary for the purposes of carrying out the obligations and exercising specific rights of the controller or of the data subject in the field of employment, social security and social protection law. Additionally, in some cases we may rely on social media information, where the processing will relate to personal data which are manifestly made public.
For criminal offence data (UK only) we rely on processing under Schedule 1, Part 1 of the Data Protection Act 2018.
We’ll use all the information you provide us during the recruitment process to progress your application, or to fulfil legal or regulatory requirements, where necessary.
We do not sell your personal data for monetary or other valuable consideration.
If you are a resident of the US State of California, when you use our website, under California law, certain sharing of personal data (such as through third-party cookies to analytics providers e.g. Google Analytics) may be considered a "sale" or "sharing."
For more information, please refer to our CCPA Privacy Notice, available here.
Artificial Intelligence (AI)
At Capco we may use certain AI features within our applicant management platform, to support and enhance our recruitment processes. These AI tools assist with specific tasks, such as summarising feedback notes, and screening CVs using pattern recognition and keyword matching to identify candidates whose qualifications and experience most closely match the job profile. Our aim is to improve efficiency and fairness in the early stages of the recruitment process.
No final hiring decisions are made solely by automated means and all shortlisted candidates are reviewed by Capco recruiters.
Any personal data processed through AI embedded tools is handled in accordance with applicable data protection laws and is also intended to support inclusive hiring by reducing potential human bias. We take appropriate measures to ensure accuracy, transparency and security when using AI within the recruitment process.
Information we collect
We do not collect more information than we need to fulfil our stated purposes and will not retain it for longer than is necessary.
Application stage
All job application details submitted to Capco, either by yourself, using one of our online application systems, via a recruitment agency on your behalf, by one of Capco’s recruitment team after discussing a job opportunity with you or via Capco’s employee referral scheme, will be managed by Capco’s recruitment team and processed on our candidate application management platform.
We ask you for your personal details including name and contact details. We’ll also ask you about your eligibility to work in the country concerned, previous work experience, education, referees and for answers to questions relevant to the role. Our recruitment team and hiring managers will have access to all this information.
Shortlisting
Our recruiters and hiring managers shortlist applications for interview. As stated above, AI tools may be used to screen CVs to assist our recruitment process.
Assessments
We may ask you to participate in assessment days; case studies; attend an interview (including by recorded video); or a combination of these. Information will be generated by you and by us. For example, you might complete a written assignment, or we might take interview notes. This information is held by us.
If you are unsuccessful after assessment for the role, we may ask if you would like your details retained in Capco’s own talent pool. If you agree, we may proactively contact you should any further suitable vacancies arise.
Employment offer
If we make an offer of employment, we’ll ask you for information so that we can carry out pre-employment checks. You must successfully complete pre-employment checks to progress to employment. We must confirm the identity of our staff and their right to work in the relevant country, verification of employment, education and financial stability, such as but not limited to, any county court judgements (CCJ’s).
You must therefore provide:
- Proof of ID (personal ID card, passport, birth certificate)
- Proof of right to work in a country where the job is based
- Proof of address
We may also perform the following, subject to local laws and practices:
- Criminal record check (searching up to 7 years of address history)
- Electronic ID verification check
- Credit and bankruptcy checks (searching up to 7 years of address history)
- Global financial sanctions checks
- Compliance checks (including the Office of Foreign Assets Control (OFAC))
- Directorship and media searches
- Educational and professional qualification checks
- Employment references (up to 7 years and gaps of more than a month to be verified)
Source of Data
Please see below an overview of where we obtain your personal data from:
- Directly from you
- Tax authorities (e.g., UK HMRC)
- Registrar of companies or corporate registry, such as Companies House (UK), where you have been a director of a company
- TrueLayer or any other party involved with connecting to your bank account
- Previous employers
- Educational providers, including Universities
- Credit reference agencies
- Government agencies (e.g., UK DBS or OFAC)
Data Retention
Successful candidates (or candidates that have failed background checks) – Please refer to our Employee Privacy Notice.
Unsuccessful candidates – Recruitment candidate information (including third party referee details provided by the applicant) will be destroyed 12 months after the last action unless you consent for information to be held for longer. Except in Poland, where candidate information is retained for 6 months and in the United States for 24 months.
Your Rights
Your rights may vary depending on applicable local data protection laws. We respect and uphold the following rights regarding your personal information:
- Right to be informed – to know what personal data we collect and how we use it.
- Right of access – to request access to the personal data we hold about you.
- Right to rectification – to request correction of inaccurate or incomplete information.
- Right to erasure – to request deletion of your personal information, subject to legal limitations.
- Right to data portability – to receive your data in a structured, commonly used and machine-readable format.
- Right to object – to object to processing, including automated decision-making or profiling.
- Right to opt-out – you may choose not to provide certain information or withdraw your consent at any time, including unsubscribing from marketing communications.
- Right to lodge a complaint – to file a complaint with us or the appropriate supervisory authority if you believe your rights have been violated.
We also take steps to ensure your personal information is accurate and kept up to date.
To exercise your rights please contact us via our webform or email ask.capco.dpo@capco.com.
Note to California individuals: If you reside in the US State of California, additional rights may apply. For more information about your rights please see here.
Data Processors
We use different processors to support us with recruitment services:
On-line Candidate Application Management Service
- Greenhouse – our candidate application management platform. You can access their Privacy Policy here: www.greenhouse.io/privacy-policy.
- DocuSign – to provide successful candidates with an electronic offer letter and other documentation relating to the hiring process. You can access their Privacy Policy here: www.docusign.com/company/privacy-policy.
Recruitment Agencies and Talent Pools
We have relationships with several recruitment agencies and talent pools. If you have applied for a position with Capco through an agency or registered with a particular talent pool, you should approach them directly for information on their Privacy Policy.
Employment Vetting and Background Checks
We use the following providers, depending on your location and operational requirements:
- First Advantage, also known as Fadv (previously Sterling Check) – you can access their Privacy Policy here: fadv.com/privacy-policy/.
- In the US, their service also includes I-9 eligibility checks.
- If you have UK employment history, you will also be required to confirm this via Fadv partners, called Konfir and TrueLayer, which enable them both to use a combination of payroll, banking and tax data to verify your UK employment details.
- HireRight – for Hong Kong, Malaysia and APAC. You can access their Privacy Policy here: www.hireright.com/emea/legal/privacy-policy/emea-and-apac-candidate-policy
- Hello Verify – for India. You can access their Privacy Policy here: https://www.helloverify.com/en/privacy-policy.
Please contact your local recruitment team contact if you wish to identify the provider relevant to your application.
Notice Version: 25 SEPTEMBER 2026