Global Candidate Privacy Notice

Last revised: 12^th December 2024

This privacy notice informs candidates for prospective employment or independent contract work about how First Derivative companies collect and use their personal information, and rights of candidates in this regard. For purpose of this notice, First Derivative companies are defined as First Derivative branded companies worldwide within the EPAM Group. The EPAM Group includes EPAM Systems, Inc., and all its subsidiaries worldwide.

This privacy notice does not apply to candidates who apply via EPAM.com or for non-First Derivative branded positions.

Please click here for a local privacy notice for First Derivative Poland Sp. Zo.o.

What Is The Purpose Of This Document?

First Derivative companies are responsible for deciding how we hold and use personal information about you. For the purposes of data protection legislation in force from time to time, the data controller will be the legal entity that you are engaged by (or, if different, the legal entity with whom you are in contact). A list of First Derivate branded entities to which this privacy notice applies is available here.

This privacy notice makes you aware of how and why your personal information will be used, namely for the purposes of the recruitment exercise, and how long it will usually be retained for.

Data Protection Principles

We will comply with data protection law and principles, which means that your data will be:

Used lawfully, fairly and in a transparent way.
Collected only for valid purposes that we have clearly explained to you and not used in any way that is incompatible with those purposes.
Relevant to the purposes we have told you about and limited only to those purposes.
Accurate and kept up to date.
Kept only as long as necessary for the purposes we have told you about.
Kept securely.

What Information Do We Hold About You?

In connection with our recruitment processes, we will collect, store, and use the following categories of personal information about you:

The information you have provided to us in your curriculum vitae and covering letter or other written materials.
Information included as part of the application process, such as interview or logic test results.
The information you have provided on our application form, which may include name, title, address, telephone number, personal email address, date of birth, gender, education, employment history, qualifications, availability and expected remuneration.
Any additional information you choose to provide voluntarily as part of the recruitment process (e.g., photo, interests).
Data provided by third-party placement firms, recruiters or job search websites, where applicable and to the extent permitted by applicable law.
Data generated by interviewers based on their interactions with you.
Recommendations or references provided by others
Other information we may collect during the recruitment process
We do not collect, store and use any types of sensitive personal information such as information about your health, racial or ethnic origin, trade union membership or sexual orientation, unless such information has been shared voluntarily in any additional information you chose to provide as part of the recruitment process. Generally, HR collects, stores and uses sensitive personal information only when a candidate is hired/engaged.

How Is Your Personal Information Collected?

We collect personal information about candidates from the following sources:

You, the candidate (e.g., through website applications or recruitment events) or it is generated during the recruitment process.
Online recruitment platforms
Job Portals/Boards that you have registered your details on
Third party recruiters or staffing companies acting for us or engaged to act on your behalf
Referrals including word of mouth recommendations
Publicly available sources with professional relevance such as professional social media and networking sites (including LinkedIn)
From background checks as applicable.

How We Will Use Information About You

We will use the personal information we collect about you to:

Assess your skills, qualifications, and suitability for the work or role.
Communicate with you about the recruitment process.
Keep you updated with future vacancies and opportunities (future recruitment).
Keep records related to our hiring processes.
Comply with legal or regulatory requirements.
Communicate with our clients where we may be engaging you to provide services to them.

If You Fail To Provide Personal Information

If you fail to provide information in the scope required by law, necessary to take steps at your request to enter into a contract and for our legitimate interests, where such information is necessary for us to consider your application (such as evidence of qualifications or work history), we will not be able to process your application further.

Legal Basis For Processing Your Personal Information

We will process personal information on the following legal grounds;

Our legitimate interest – for personal information we have requested from you and which we require to evaluate if your skills and experience are relevant and appropriate for a current or future vacancy. To support both candidates’ current and future career opportunities with us and support our clients ongoing needs, we keep a database of candidate information to maintain, expand and develop our business.
Our legal obligations – to the extent we are required to perform any legally required reporting and to respond to legal process.
Your consent – for personal information you have voluntarily provided and which we have not requested from you (e.g., photo, interests).

We will process your personal information for the purposes of future career opportunities based on your prior consent, to the extent such consent is mandatory under applicable law. To the extent you are asked to accept this notice in one of our tools, such acceptance will be considered as your consent to process your personal information for this purpose, only in the countries where such consent is mandatory. In all other countries, clicking on acceptance/agreement buttons, will be considered as a mere acknowledgement of this notice.

How We Use Particularly Sensitive Personal Information

Where particularly sensitive personal information has been provided to us as part of the recruitment process, we will use this information in the following ways:

We will use information relating to any disability status to consider whether we need to provide appropriate adjustments during the recruitment process, for example whether adjustments need to be made during a test or interview and on the basis of applicable law.
We will use such information to ensure meaningful equal opportunity monitoring and reporting to the extent permitted by law.

Information About Criminal Convictions

We will only process information about criminal convictions if it is appropriate given the nature of your role and to the extent permitted by law.

If we offer you a position, HR will collect information about your criminal convictions history as part of our pre-employment/pre-engagement screening procedures (conditional on checks carried out to the extent permitted by laws and any other conditions, such as references, being satisfactory). We may carry out a criminal record check to satisfy ourselves that there is nothing in your criminal convictions history which makes you unsuitable for the role.

Where permitted by applicable laws, we may engage a third party to perform a pre-employment/pre-engagement background screening on our behalf.

Automated Decision-making

You will not be subject to decisions that will have a significant impact on you based solely on automated decision-making.

Data Sharing

As a global organization, we may transfer your personal information internally within the EPAM Group for the purposes of processing your application.

Where we have a role that is connected to providing client services or fulfilling specific roles for our clients, we may share candidate personal information with the client to assess suitability for the potential role.

We may also share your personal information with other recipients acting as a separate controller or our processors, such as recruitment agencies, public authorities, advisors, providers of IT services or other service providers. Information may also be shared in connection with any proposed or actual reorganisation, merger, sale, joint venture, assignment, transfer or other disposition of all or any portion of the business, assets or stock to potential third parties who will be involved in any such activity (e.g., with whom we may be merged with or may be acquired in future).

Our data sharing may take place globally however, First Derivative companies, and the EPAM Group, and our clients, are required to take appropriate security measures to protect your personal information and are only permitted to process your personal information for the specified purposes.

Data may be transferred outside your home country in connection with the processing of your application. First Derivative companies and the EPAM Group will ensure that appropriate data transfer mechanisms are in place to protect such transfers as required by applicable laws. Any transfers of your personal information from within the European Economic Area (EEA) to third countries outside the EEA will be based on an adequacy decision or governed by the EU Standard Contractual Clauses. Any transfers of your personal information from within the United Kingdom (UK) to third countries outside the UK, will be based on an adequacy decision or governed by UK Transfer Clauses or Addendum. Any other international transfers of personal information will take place in accordance with appropriate international data transfer mechanism and safeguards under applicable laws.

Data Security

We have put in place appropriate security measures to prevent your personal information from being accidentally lost, used, accessed in an unauthorised way, altered or disclosed. In addition, we limit access to your personal information to those employees, agents, contractors and other third parties who have a business need-to-know. They will only process your personal information on our instructions and subject to a duty of confidentiality.

We have put in place procedures to deal with any suspected data security breach and will notify you and any applicable regulator of a suspected breach where we are legally required to do so.

Data Retention

If you are given and accept an offer of employment or are engaged by us to provide independent contract work, the personal information collected during your pre-employment/pre-engagement period will become part of your personnel record to be retained throughout and for a period after your employment/engagement with us.

If you are unsuccessful, we may continue to retain and use personal information collected during the recruitment process in order to consider you for new positions, and, if appropriate, to refer to an earlier application if you submit a CV or other information to us again in the future, as well as to perform research and analysis. To determine the appropriate retention period for personal information, we consider the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal requirements.

Your Consent – candidates outside of United Kingdom, European Union

By proceeding with your application, you indicate your acceptance of our collection, saving, use, transfer and disclosure of personal information as described in this notice. If you do not accept the terms, you will not be allowed access to apply for a position online or have your written, offline submission considered for a position. By using this career site or otherwise applying for work with us, you also agree to the transfer of personal information about you to countries outside the country in which you reside, which may include countries with a different data protection regime than in place in the country in which you reside, as outlined above. We will take appropriate technical, organizational, and legal steps to secure personal information about you.

The provision of personal information is voluntary. Please note however, failure to provide sufficient information may result in First Derivative or the EPAM Group being unable to consider your application.

Rights You Have In Relation To The Data We Hold On You

You may have multiple privacy rights, subject to applicable law, in respect of the information we process about you:

Request access to your personal information (commonly known as a “data subject access request”). This enables you to receive confirmation on whether we hold your information and if so, also receive a copy of the personal information we hold about you and certain information about how we use it.
Request correction of the personal information that we hold about you. This enables you to have any incomplete or inaccurate information we hold about you corrected.
Request erasure of your personal information. This enables you to ask us to delete or remove personal information where there is no good reason for us continuing to process it. You also have the right to ask us to delete or remove your personal information where you have exercised your right to object to processing (see below).
Object to processing of your personal information where we are relying on a legitimate interest (or those of a third party) and there is something about your particular situation which makes you want to object to processing on this ground.
Request the restriction of processing of your personal information. This enables you to ask us to suspend the processing of personal information about you, for example if you want us to establish its accuracy or the reason for processing it.
Request the transfer of your personal information to another party.
Withdraw consent where consent has been sought for the processing of your personal information, then you may withdraw that consent at any time by contacting us. This will not impact the lawfulness of the processing conducted before you withdrew your consent.
Lodge a complaint about the way we handle or process your personal information with the relevant data protection authority.

Please contact us if you want to review, verify, correct or request erasure of your personal information, object to the processing, request a restriction of the processing, or request that we transfer a copy of your personal information to another party. Your request will be handled in accordance with your rights under applicable laws.

We’ll respond as soon as we can. Generally, this will be within one month from when we receive your request, however, if the request is going to take longer, we will notify you.

Contact Us

If you have any questions about this privacy notice or our privacy practices, please contact us:

By Mail:
FAO: Data Privacy Team
Brian Conlon House, 3 Canal Quay, Newry, BT35 6BP, Northern Ireland

By Email:
privacy@epam.com

You have the right to register a complaint at any time directly with the relevant data protection authority. We would, however, appreciate the chance to deal with your concerns before you approach the data protection authority so, please contact us in the first instance.

Please note that the application of this Candidate privacy notice may be subject to some amendments in accordance with local law requirements in the different jurisdictions in which First Derivative and the EPAM Group operates and the relevant subsidiary may also issue a country specific data collection statement detailing its practices in that jurisdiction.