Hiscox Recruitment and Employment Data Privacy Notice

Hiscox has partnered with Wilson, a specialist recruitment services provider, to help find and recruit the best talent for roles at Hiscox. 

For certain recruitment activities, we work together as "Joint Controllers" of your personal information. This means that we both work together to decide why and how your personal information is used, and we are both responsible for using your personal information in compliance with data protection laws. 

We are Joint Controllers for activities including sourcing the best talent, initial screening of applications, and manging potential candidates for current or future roles at Hiscox. 

This notice tells you what personal information we collect as Joint Controllers, why we need it, how we use it, and how you can exercise your data protection rights. 

We will not be Joint Controllers for all of the activities undertaken as part of the recruitment process. In such circumstances, our individual privacy notices will set out how we each use and protect your personal information.

• Hiscox will always be solely responsible for making the final decision about making a job offer and on-boarding successful candidates (including carrying out pre-employment background checks).
• As part of our arrangement, Wilson will be Hiscox's data processor for some of the activities undertaken, including administrative tasks such as scheduling interviews or informing you if your application has been unsuccessful. This means that Wilson will only use your personal information under the instructions of Hiscox.

You can find out further details of how each of us individually protect and use your personal information by clicking on the links to our respective privacy notices below.

Hiscox: available here.

Wilson: available here. 

We have worked together to set out our arrangements to ensure that your personal information is always processed and protected in compliance with data protection obligations. For example:

• We have worked together to prepare this notice and Wilson will be responsible for providing you with a copy.
• Wilson will ensure that your personal information is collected fairly and lawfully and is accurate and up to date.
• Hiscox will have primary responsibility for responding to any request to exercise your data protection rights. Please see below for details regarding how to do this.
• Each of us will be responsible for our own data security measures, engaging third parties and record keeping.

We collect and process the following personal information:

• Name and contact information
• Location
• Education
• Work history
• Certifications
• Other personal information customary for recruitment purposes used in the ordinary course of recruitment. 

We collect your personal information:

• From you: we collect your personal information directly from you, for example if you submit your CV or communicate with us about a role at Hiscox.
• From professional networking sites: we use sites including LinkedIn, specialist job boards, professional societies, and developer communities to gather personal information about potential talent for Hiscox roles.

We share your personal information with each other to ensure the smooth running of the recruitment process. Further information about who we each share your personal information with and our transfers of personal data outside of the UK is set out in our individual privacy notices which you can access using the links above.

When we act as Joint Controllers, one or both of us will process your personal information for the following reasons:

• Candidate sourcing – we (primarily Wilson) carry out activities related to the sourcing of potential candidates for Hiscox roles. This includes finding potential candidates that have not pro-actively got in contact with us about a specific role. To do this, Wilson carries out market research and uses professional networking sites as outlined above to help identify potential talent and make contact about Hiscox roles.
• Candidate screening – if you have submitted a CV or applied for a role, we will review your application, prepare long and short-lists for specific roles, and make recommendations regarding next steps.
• Future candidate management – sometimes you may not be successful for a particular role, but we recognise that you do have relevant skills and experience that could make you suitable for future roles at Hiscox. To help us recruit for future roles, we manage and maintain a talent pool of potential candidates and may contact you in the future about other roles at Hiscox.

We do not carry out any automated decision making in respect of the above activities. 

• Legitimate interests - for our legitimate interests as a recruiter (Wilson) and as an employer (Hiscox) in order to source and appoint the best talent for roles at Hiscox. Where we rely on legitimate interests as the reason for processing personal information, we have considered whether those interests are overridden by any separate rights or freedoms of candidates, and have concluded that they are not.
• Contract (for Hiscox only) – processing which is necessary in order to enter into a contract of employment between you and Hiscox
• Consent –  we will seek your consent where we would like to retain your personal information for the purposes of contacting you about future roles at Hiscox. 

We are each committing to protecting your personal information and have implemented technological and organisational security measures to do so. You can find details of the security measures we each have in place in our individual privacy notices which you can access using the links above.

Where we are Joint Controllers, in most cases, your personal information will be retained for six months after the date of the recruitment decision unless you provide your consent for your details to be retained for future roles.

Full details of how long we can keep your personal information for can be found in our individual privacy notices which you can access using the links above.

You have a number of rights in relation to the personal information that we hold about you (subject to certain exemptions):

• to access and obtain copies of your personal information
• to rectify inaccurate information
• to erase your personal information in certain circumstances
• to restrict how we use your personal information in certain circumstances
• to object to our processing of your personal information in certain circumstances
• to ask us to transfer your personal information to another organisation in certain circumstances

Further details about these rights can be found in our individual privacy notices.

You are entitled to exercise your data protection rights by contacting either Hiscox or Wilson. However, we recommend that you contact Hiscox in the first instance using the details set out below. 

We will keep each other informed about your request and co-operate with each other to respond to your request.

We each have a dedicated contact for any queries relating to your personal information including where you wish to exercise your data protection rights:

Hiscox: contact our Group Data Protection Officer contacted at [email protected]

Wilson: contact our Data Protection Officer at [email protected]

We may update this Privacy Notice from time to time to keep up with current legal requirements and the way we work together.

Version 2^nd June 2025.