Privacy Notice for Candidates
Last updated: August 18, 2026
This privacy notice (the “Notice”) describes how we collect, use, and disclose personal information about applicants in connection with their application for employment. Please note that any reference in this Notice to the “Company”, “Gambit”, “we”, “us”, or “our” refers to the applicable Gambit entity that is recruiting for the relevant role and that may become your employer if your application is successful, including Gambit Security Inc. and/or Gambit Security Ltd, as applicable based on the position, employing entity, and location. This Notice does not form part of any employment contract or contract to provide services. Important note: Nothing in this privacy notice is intended to limit in any way your statutory rights, including your rights to a remedy or means of enforcement.
In connection with your application, we have to process your personal information. In that context, Company will be a database owner, which means that Company will be responsible for the processing of your personal information. We know that the fact that we will need to use your personal information may be quite obvious to you. However, the purpose of this Notice is to give you information about the sorts of personal information we may collect, process and use about you, and the circumstances in which we may use it.
1. We collect personal information either directly from you or, where applicable, from other sources, such as professional networking websites, job posting platforms, employment agencies, recruitment firms, individuals who refer you to us (which may include our own employees), academic institutions, background check providers, your professional references, or publicly accessible sources. Personal information we process may include contact details (name, title, addresses, telephone numbers, work and personal email addresses), information included in a CV and/or cover letter or as part of the application process (including education and qualifications details, employment records including job titles, work history, salary expectations, and professional memberships), social media activity, audio or visual information collected during interviews or recruitment activities (such as video or audio recordings, photographs, or CCTV footage on our premises), and similar information as needed to consider the application and as permissible under local law. We will not collect personal information that is not necessary for the purposes stated in this Notice. Where required by applicable law, we will seek your explicit consent for the collection of sensitive categories of personal data. If the applicant receives and accepts an offer of employment with the Company, they may have to provide proof of their identity and, in some countries, proof of their right to work (failure to provide this will mean that the Company is unable to hire the applicant).
2. We need to process the listed personal information in order to assess you as a candidate and verify your suitability for employment, skills and qualifications, as well as to overall verify, consider and process your application and candidacy for any of our positions, to communicate with you regarding such processes, to assist you with obtaining an immigration visa or work permit where required and requested by you, and to comply with applicable legal requirements. We will not use your personal information for automated decision-making or profiling, unless strictly permitted under applicable law. Additionally, you are not obligated to provide us with the mentioned personal information, and you may refuse to do so. The Company requires this information as it is legally required to obtain it, it is necessary for the Company to perform or exercise its rights and obligations under employment law and/or because it is in the Company’s legitimate interests in its role as prospective employer to verify who they are, that they can work for the Company and that they are suitable for the role they have applied for. Failure to provide the necessary personal information requested by the Company during the application process may result in our inability to consider your application for employment. Without this personal information, the Company may not be able to assess your suitability for the position applied for, verify your qualifications and experience, or fulfil legal and regulatory obligations.
3. Legal Bases for Processing (EEA and UK Applicants). Where required by applicable law, we process your personal information on the following legal bases: (a) Contract: where processing is necessary in order to take steps at your request prior to entering into an employment relationship; (b) Legal obligation: where processing is necessary for compliance with applicable employment, tax, or social security laws; (c) Legitimate interests: where processing is necessary for our legitimate interests in evaluating candidates, maintaining the security of our premises and systems, and managing our recruitment operations, provided such interests are not overridden by your data protection rights; and (d) Consent: where you have given your explicit consent to the processing of your personal information for one or more specific purposes, which you may withdraw at any time without affecting the lawfulness of processing based on consent before its withdrawal.
4. Any offer and commencement of employment is conditional on the verification, to the satisfaction of the Company, of the personal information the applicant provides as part of their application (to the extent permissible by local law) and on the Company being able to obtain references with which it is satisfied. If individuals apply for a position in the US, receive and accept an offer of employment with the Company, they may undergo pre-employment screening and that this will involve verification of the details as specified below.
5. Either the Company or an independent agent acting on behalf of the Company may verify the information provided by applicants and (to the extent permissible by local law) carry out further enquiries which may include a CV check and gap analysis, ID check, employment and education verification, reference check, a media search (which may include publicly accessible social media and search engine searches) and where legally required and permissible, other background checks relevant to the role. We retain interview feedback, assessment results and recruitment decisions. If the applicant fails to supply personal information which the Company lawfully requires in order to satisfy these checks, the Company might be unable to employ them.
6. Where the applicant’s personal history requires verifications to be carried out in countries where they have worked and resided, their data may be sent and processed in those relevant countries, in which case, the Company will comply with any requirements with respect to data transfer.
7. We will retain the applicant’s personal information for as long as necessary to fulfil the relevant purpose and comply with our legal obligations, including managing the recruitment process, considering you for the role for which you applied and, where permitted by applicable law, for other suitable current or future roles, maintaining appropriate business and legal records, responding to claims or disputes, and complying with legal obligations. If you do not want us to retain your information for consideration for other roles, or want us to update it, please contact careers@gambit.security. Please note, however, that we may retain some information if required by law or as necessary to protect ourselves from legal claims. To determine the appropriate retention period for personal information, we consider the amount, source, nature, and sensitivity of the personal information, the potential risk of harm from unauthorized use or disclosure, the purposes for which we process your personal information and whether we can achieve those purposes through other means, and the applicable local legal requirements as well employees’ interest in privacy.
8. In some circumstances, we may anonymize, aggregate or de-identify the personal information so that it can no longer be associated with you, in which case we may use such information without further notice to you. If it is no longer necessary for us to retain it, we will securely destroy the information.
9. Sharing of personal information.
(a) We may share your personal information with our affiliated companies about you.
(b) We may use third party service providers to process your information for the purposes outlined above, including, without limitation:
- (i) With cloud service providers for hosting purposes; and
- (ii) With email providers, candidate management systems, recruitment platforms, assessment providers, scheduling tools and HR-related platforms in order to help us manage the recruitment process. These tools may include some AI features that assist with recruitment administration, organization, screening support, note taking, workflow management or similar functions, and systems which may process your personal information.
(c) To the extent necessary, with regulators, courts, banks or competent authorities, to comply with applicable laws, regulations and rules (including, without limitation, federal, state or local laws), and requests of law enforcement, regulatory and other governmental agencies or if required to do so by court order, as well as for internal compliance procedures and to protect the safety, security, and integrity of the Company, customers, employees, property, and the public.
(d) If, in the future, we sell or transfer, or we consider selling or transferring, some or all of our business, shares or assets to a third party, we will disclose your information to such third party (whether actual or potential) in connection with the foregoing events (including, without limitation, our current or potential investors). In the event that we are acquired by, or merged with, a third party entity, or in the event of bankruptcy or a comparable event, we reserve the right to transfer, disclose or assign your information in connection with the foregoing events.
(e) Where necessary, to protect our legal rights and interests, to establish, exercise or defend legal claims, or to prevent fraud, security threats or illegal activity.
(f) Where you have otherwise provided your consent to us for sharing or transferring your personal information.
(g) It is your responsibility to obtain consent from your references before providing their personal information to us.
10. If the applicant is successful in obtaining employment at the Company, some information which the Company needs to keep in order to make further arrangements for their employment will be retained whilst their employment continues and as set out in the Company’s Data Retention and Deletion Policy.
11. Your rights. In connection with the Company’s processing of your personal information, you may have certain rights under applicable law, which may include the right to:
- (a) ask to review the personal information held by Company;
- (b) ask for rectification of inaccurate personal information and to have any incomplete data completed; and
- (c) ask for erasure of personal information.
- (d) request the portability of your personal information in a structured, commonly used and machine-readable format, where technically feasible;
- (e) object to or restrict the Company's processing of your personal information for certain purposes;
- (f) withdraw your consent at any time, where the Company's processing of your personal information is based on your consent, without affecting the lawfulness of processing carried out prior to such withdrawal; and
- (g) lodge a complaint with your local data protection authority, where applicable.
If you wish to exercise any of the above rights, please contact careers@gambit.security and specify the right(s) you wish to exercise. We may take reasonable steps to verify your identity before responding to a request. We will not discriminate against you for exercising your rights. We will respond to any requests in accordance with applicable law, and so there may be circumstances where we are not able to comply with your request, including where it is reasonably necessary for us to retain your personal information to comply with law, detect security incidents, or protect against malicious, deceptive, fraudulent, or illegal activity. We do not charge a fee to process or respond to your request unless it is excessive, repetitive, or manifestly unfounded. If we do not take action on your request, we will inform you in writing of the reasons for not taking action, as well as provide an explanation of any rights you have to appeal the decision.
12. If the applicant is not successful, then any personal documents that they have submitted to the Company will be confidentially destroyed in accordance with the Company’s Data Retention and Deletion Policy.
13. This Notice can be updated from time to time and, therefore, we ask you to check back periodically for the latest version of this Notice. If we implement material changes in the way we use your personal information, in a manner that is different from that stated at the time of collection, we will notify you by posting a notice on our website, or by other means and take the steps required by applicable law.
14. If the applicant has any questions, they can contact careers@gambit.security.
