Blue Octopus By IRIS (“We”) are committed to complying with legal requirements and industry best practices while providing an excellent service and respecting your privacy.

The policies and procedures on this page (together with any other documents referred to) set out the basis on which any personal data we collect from you, or that you provide to us, will be processed.

The policies and procedures on this page apply situations where we are the data controller:

* When you use the Blue Octopus By IRIS company website (https://www.blueoctopus.co.uk)
* When you use the ‘Octo’ ATS website in relation to a client on a Standard licence or a Platinum licence
* To companies’ sales contacts of Blue Octopus by IRIS potential and actual clients whose data is processed based on Blue Octopus by IRIS’s legitimate interest. Blue Octopus by IRIS’s processing in this regard takes into account ICO’s guidance
* We may act as a data processor when you use the ‘Octo’ ATS website in relation a client on a Platinum licence (formerly known as FirstClass licence) – in such circumstances our behaviour is governed by the terms we have to abide by as the data processor, the policies and procedures of the client; which are available from the client as the data controller. However, in some of these cases we may control the data jointly with our client. In such cases, joint controllers would mutually assist each other with their responsibilities in relation to data processing. You can exercise your rights against either of the joint controllers.

Questions, comments and requests regarding the content of this page are welcomed and should be addressed to support@blueoctopus.co.uk.

The data controller is:

IRIS Software Group Ltd
Heathrow Approach
470 London Road
Slough
SL3 8QY
Email: https://www.iris.co.uk/contact-us/
(+44) (0)20 3917 4158

The Data Protection Officer is:

Vincenzo Ardilio
Heathrow Approach
470 London Road
Slough
SL3 8QY
Email: dataprotection@iris.co.uk
Please mark the envelope 'Group Data Protection Officer'.

* Data protection enquiries about our products should be directed to the relevant Support Team in the first instance. If you do not know how to contact Support, then please contact us through our Contact Us page.
* Routine data protection enquiries should also be directed through our Contact Us page.
* Enquiries about the security of our websites: webmaster@iris.co.uk.

The legal basis for the processing of personal data that you provide to us is generally consent. In addition, data may be processed based on our legitimate interests such as recruitment process management, user account management, marketing, fraud prevention and cybersecurity. Such data may include system logs or company-related email addresses

The purpose of processing such data is to support recruitment processes as our core activity.

Data we collect may include your name, contact details, work history, education history, and other information required to make an informed decision on your suitability for the vacancy.

Data is shared with employers owning the vacancy you have applied for. This may involve the use of the recruitment cloud platforms designated by the client. We may share this information for incomplete applications as well as complete applications, or for applications where you’ve expressed an interest but not completed a full application form. Data is processed by our data hosting company (Rackspace), and may be stored with cloud hosting providers (AWS and/or Azure). Data may be shared with additional 3rd party-companies – we’ll contact you before doing so to ensure you consent to this. Your IP address is shared with Google in order to provide analytic services.

Data we explicitly collect is not transferred outside of the UK, either by ourselves or any other company we allow to process your data. Companies we share your IP address with may transfer that information to other countries but it is our understanding that they operate under Standard Contract Clauses.

We hold information we collect for different periods of time depending on the data:

Information in your profile is kept until you delete it.
Information contained in your applications to vacancies are kept for 6 months until after the vacancy closes.
Emails and other communication may be kept for up to 3 years.
Data may continue to be held in our backup process for up to 14 days after it has been deleted.
You have a number of rights, guaranteed under law. An overview of these rights is contained in this policy document.

Everyone has rights with regard to how their personal information is handled. During the course of our activities we will collect, store and process personal information about our staff, clients, candidates, suppliers and other third parties. We recognise the need to treat it in an appropriate and lawful manner.

Any breach of this policy will be taken seriously and may result in disciplinary action.

You are legally guaranteed rights as below:

The right to be informed

You must agree to your information to be processed for purposes you are aware of before it can be processed. You can do this by indicating your consent when providing the information.

The right of access

You may request a copy of all personal data we hold on you in our role as data controller. If you have account, you can do this access this information via your profile. If you do not have an account you can do this by sending us an email to [email protected].

As well as your personal data, we’ll provide you with:

(a) the purposes of the processing;

(b) the categories of personal data concerned;

(c) the recipients or categories of recipient to whom the personal data have been or will be disclosed;

(d) the envisaged period for which the personal data will be stored;

(e) your rights, as laid out in this policy;

(f) the right to lodge a complaint with a supervisory authority;

(g) the source of the data

(h) any automated decision-making in use on your data, including the logic involved, as well as the significance and the envisaged consequences

The right to rectification

You have the right to have your data rectified, for example, if it is incorrect or incomplete. You can exercise this right by logging in to your profile. If you do not have an account or wish to amend other data you can do this by sending an email to [email protected].

The right to erasure

You may exercise your right to withdraw consent or to request erasure of personal data by logging into your profile and deleting it. If you do not have an account or wish to delete specific data you can do this by sending an email to [email protected]. Please note that the deletion may not affect an ongoing recruitment process where the employer has already received the data as part of the recruitment process.

The right to restrict processing

You can request that we keep your data but do not process it further. You can do this by sending an email to [email protected].

The right to data portability

You can request a copy of the information you’ve provided to us in a commonly used format. You can exercise this right by logging in to your profile or by sending an email to [email protected].

The right to object

You have the right to object to the use of your data for direct marketing purposes and profiling, should such profiling take place in the scope of direct marketing or our legitimate interest.

Rights in relation to automated decision making and profiling

You have the right to not be subject to entirely automatic profiling algorithms. If any such algorithms are used you have the right to know details of their operation. You can request information about any automated profiling algorithms by sending email to [email protected].

Based on the answers you provide in your application form, we may provide automated scoring, which you can use to improve your application. In some cases, for example where you lack the right qualifications or the right to work in the UK, your application may be automatically refused. In such cases, you may request human intervention by emailing us at [email protected]

We may collect information from and process the following data about you:

Information that you provide by filling in forms on our website – this includes:

Information provided at the time of registering to use our site Making an application
Subscribing to our service
Acceptance for inclusion on a mailing list or database Posting material or requesting further services

This information may include your name, address, email address and phone numbers, and may also include work history, education history, a CV, and other information dependent on the role you are applying for.

If we place you with our clients, we shall also request and hold copies of documentation showing your legal right to work in the UK (or the country in which you have chosen to work). We may record and store any telephone calls you have with us for record keeping and quality control purposes. We may undertake credit references, and other lawful checks, where a recruitment client or third party requests such information.

If you contact us (by email, telephone or letter), we may keep a record of that correspondence for future reference.
We may also ask you to complete surveys that we use for research purposes, although you do not have to respond to them. Details of transactions you carry out through our site and of the fulfilment of your orders.

Details of your visits to our site including, but not limited to, traffic data, location data, weblogs and other communication data, whether this is required for our own billing purposes or otherwise and the resources that you access.

We also collect general information as a total in order to provide us with a better understanding of the users of our site as a group, but which does not contain personally identifiable information. We may also use the information for direct marketing via email or telephone.

We may also store cookies as set out in more detail below.

We may collect information about your computer, including your IP address, operating system and browser type, for system administration and to report aggregate information. You do not have to provide this information, any information we do collect, hold or process is done with your consent.

We will take all steps reasonably necessary to ensure that your data is treated securely and in accordance with this privacy policy.

The transmission of information via the internet is not completely secure. Although we will do our best to protect your personal data, we cannot guarantee the security of your data transmitted to our site; any transmission is at your own risk. Once we have received your information, we will use strict procedures and security features to try to prevent unauthorised access.

Uses Made Of the Information

When someone visits www.blueoctopus.co.uk we collect standard internet log information and details of visitor behaviour patterns. We do this to find out things such as the number of visitors to the various parts of the site. We collect this information in a way which does not identify anyone. We do not make any attempt to find out the identities of those visiting our site. We will not associate any data gathered from this site with any personally identifying information from any source. If we do want to collect personally identifiable information through our website, we will be up front about this. We will make it clear when we collect personal information and will explain what we intend to do with it.

Disclosure of Your Information

We may disclose your personal information to any member of our group, which means our subsidiaries, our ultimate holding company and its subsidiaries, as defined in section 1159 of the UK Companies Act 2006.

We may also disclose your personal information to third parties:

In the event that we sell or buy any business or assets, in which case we may disclose your personal data to the prospective seller or buyer of such business or assets.
* If Blue Octopus Recruitment Limited or substantially all of its assets are acquired by a third party, in which case personal data held by it about its customers will be one of the transferred assets.
* If we are under a duty to disclose or share your personal data in order to comply with any legal obligation, or in order to enforce or apply our website Terms of Use or any other agreements; or to protect the rights, property, or safety of Blue Octopus Recruitment Limited, our customers, or others. This includes exchanging information with other companies and organisations for the purposes of fraud protection and credit risk reduction.
* To provide our recruitment service and facilitate the recruitment process.
* To send information provided by candidates to our clients in order for our clients to assess candidates eligibility for jobs.
* If you are progressed onto interview stage, and indicate consent, then we might pass your name and email onto our third-party review provider (Feefo).
Although we may provide information to service providers that handle information on our behalf, we will usually not share the information with third parties for secondary or unrelated purposes unless otherwise disclosed at the point of collection.
Our site may, from time to time, contain links to and from the websites of our partner networks, advertisers and affiliates. If you follow a link to any of these websites, please note that these websites have their own privacy policies and that we do not accept any responsibility or liability for these policies. Please check these policies before you submit any personal data to these websites.

Cookies are pieces of data created when you visit a site and are stored in the cookie directory of your hard drive. They do not contain any personal information about you and cannot be used to identify an individual user. They are used to help you when you return to a website.

Cookies information is provided on our homepage once you visit it for the first time.

Blue Octopus uses a number of cookies for various purposes:

For authentication to help protect access to any data you supply or request from us (or our clients).

For maintaining a vacancy shortlist to allow websites visitors to keep a list of vacancies for later references. Vacancies are kept in the shortlist for an indefinite period on your personal device. This is designed to make it easier for users to locate vacancies that are of interest to them.

Blue Octopus uses a third-party service that relies on its own cookies; Google Analytics. Such services are used to track the performance of the website, but please check these third parties’ privacy policies to learn about any further uses by them. You can opt in to these services via the prompt displayed when you visit the website. Once opted-in you can opt-out of these services via the following link; Google. If you have any questions relating to this, please feel free to contact us.

Personal data will only be processed for the specific purposes notified to the data subject when the data was first collected or for any other purposes specifically permitted by the Act. This means that personal data will not be collected for one purpose and then used for another. If it becomes necessary to change the purpose for which the data is processed, the data subject will be informed of the new purpose before any processing occurs. By creating a profile candidates are opting in to being contacted by the data controller or the data processor in relation to vacancies matching their selection criteria. This contact preference can be changed via the profile area of the Octo website. By not creating a profile candidates are opting out of contact not related to the specific vacancy being applied for.

Any member of staff dealing with enquiries from third parties should be careful about disclosing any personal information held by us. In particular they should:

Check the identity of the person making the enquiry and whether they are legally entitled to receive the information they have requested. Suggest that the third party put their request in writing so the third party’s identity and entitlement to the information may be verified. Refer to the Data Protection Officer for assistance in difficult situations.
Where providing information to a third party, do so in accordance with the eight data protection principles.

Any changes we may make to this policy will be posted on this page.