wamo Recruitment Privacy Notice
Date of publication: 15-04-2026
At wamo, we use our careers site and recruitment tools to manage employer branding, candidate engagement and hiring processes. This Notice explains how we process your personal data when you visit our careers site, connect with us, apply for a role, are sourced or referred to us, or act as a referee for a candidate.
1. About personal data
Personal data means any information relating to an identified or identifiable natural person, such as a name, email address, phone number, CV, IP address or interview notes. Processing means any operation performed on personal data, including collection, recording, storage, review, use, sharing, retention and deletion.
2. Who this Notice applies to
- Visitors – people who browse or use the careers site.
- Connecting Candidates – people who create a profile or opt in to hear about current or future opportunities.
- Applying Candidates – people who apply for a specific role.
- Sourced Candidates – people whose professional profile we identify from public or professional sources.
- Referred Candidates – people referred to us by employees or trusted partners.
- References – people identified by a candidate to provide a reference.
3. Who is responsible for your personal data
The controller of your personal data will usually be the wamo entity that receives your application, manages the relevant recruitment process, or otherwise has the most direct recruitment relationship with you.
Depending on the role and business set-up, other wamo Group entities may also access or process candidate data for group recruitment administration, People support, IT, security, compliance, legal, management reporting or business continuity purposes on a need-to-know basis. Where two or more wamo Group entities jointly determine the purposes and means of processing candidate data, they act as joint controllers under Article 26 GDPR and have put in place an internal arrangement governing their respective responsibilities. The key elements of that arrangement are available to candidates on request.
- wamo Solutions Ltd (Malta) – Portomaso Tower, Level 11, St Julians, STJ 4011, Malta
- wamo Solutions Oy (Finland) – Itämerenkatu 3A, 00180 Helsinki, Finland
- wamo Technology Ltd (United Kingdom) – Technique Building, 132-140 Goswell Road, Unit 3, London EC1V 7DY, United Kingdom
For privacy questions or rights requests, you can contact wamo at complaints@wamo.io. If wamo later appoints or publishes a separate Data Protection Officer contact for recruitment matters, this Notice will be updated accordingly.
4. What personal data we may process
Visitors
- device and browser information, IP address, language, operating system, traffic source, cookie identifiers and careers-site usage data;
- technical and statistical information about how the careers site is used; and
- communications you send through the site or other recruitment channels.
Candidates
- name, contact details, country/location and professional profile information;
- CV, résumé, cover letter, application answers, work history, education and qualifications;
- interview notes, assessment results, work samples, salary expectations, notice period, right-to-work information and recruitment feedback;
- public professional information from sources such as LinkedIn or an employer website where lawful and relevant;
- reference information and referral information;
- optional diversity, accommodation or accessibility information where provided or collected lawfully; and
- optional audio/video recordings or transcripts where you are informed in advance and, where required, consent is obtained.
References
- name, role, contact details, relationship to the candidate and any information you provide about the candidate.
Please do not include special category data or criminal offence data in your application unless we ask for it or it is necessary for the recruitment process. If such data is provided, we will only use it where lawful and necessary.
5. Where we get your personal data from
- directly from you when you browse the careers site, create a profile, apply, correspond with us or otherwise engage with us;
- from recruiters, recruitment partners or referral sources acting on our behalf or introducing you to us;
- from public professional sources, such as LinkedIn or an employer website, where lawful and relevant to recruitment;
- from references you provide or from referees who respond to our request;
- from Teamtailor and other tools used to operate the careers site and recruitment workflow; and
- from our own recruitment process, including interview notes, assessments and evaluation records created during the process.
If we obtain personal data about you from a source other than you, we will provide the information required by applicable law within the relevant legal timeframe.
Where we collect reference data, we will notify the referee at or before the point their personal data is first used, or direct them to a separate privacy notice, in accordance with our obligations under Article 14 GDPR.
6. Why we process your personal data and the legal bases we rely on
Managing applications and assessing suitability for a current role
Purpose: to review applications, communicate with candidates, conduct interviews, assess suitability and make recruitment decisions.
Legal basis: taking steps at the request of the candidate prior to entering into a contract; legitimate interests in operating an effective, proportionate and secure recruitment process; and legal obligation where required.
Sourcing and approaching potential candidates
Purpose: to identify potential candidates for current vacancies and make an initial contact.
Legal basis: legitimate interests, provided the sourcing activity is relevant, proportionate and supported by appropriate transparency.
Talent community and future opportunities
Purpose: to keep candidate details for future relevant opportunities and send vacancy updates where the candidate has chosen to stay connected.
Legal basis: consent. Where a person has actively chosen to join the talent community or stay connected, consent is the basis wamo relies on for that future-opportunity retention.
Referrals and reference checks
Purpose: to receive candidate referrals and obtain reference information where relevant to the recruitment decision.
Legal basis: legitimate interests; legal obligation where required; and consent where a particular check or local practice makes consent appropriate.
Interview recordings or transcripts
Purpose: to record or transcribe an interview where this is offered or used.
Legal basis: consent. Recording or transcription will not occur unless the candidate has been informed and, where required, has agreed.
Assessments or tests
Purpose: to run role-relevant skills, aptitude or work-sample assessments.
Legal basis: legitimate interests in assessing suitability in a fair and proportionate way; or consent where the specific assessment set-up makes that more appropriate.
Background checks
Purpose: to verify information or carry out role-specific screening where necessary for legal, regulatory, security or fraud-prevention reasons.
Legal basis: legal obligation, legitimate interests, and where relevant additional conditions under applicable law.
Diversity, reasonable adjustments and accessibility
Purpose: to provide adjustments, support accessibility and comply with equality obligations where applicable.
Legal basis: legal obligation, legitimate interests, and — for special category data — Article 9(2)(b) GDPR (processing necessary for the purposes of carrying out obligations in the field of employment law) and/or Article 9(2)(h) GDPR (processing necessary for the purposes of occupational medicine or the assessment of the working capacity of an employee), as applicable.
Establishment, exercise or defence of legal claims
Purpose: to defend or bring legal claims, manage disputes and evidence compliance.
Legal basis: legitimate interests; legal obligation; and, for special category data, Article 9(2)(f) GDPR (processing necessary for the establishment, exercise or defence of legal claims).
Where recruitment involves special category data or criminal offence data, wamo will only process it where there is a valid Article 6 basis and any additional condition required by applicable law, and will apply enhanced access and confidentiality controls.
Where wamo Solutions Oy processes candidate data in connection with recruitment in Finland, it does so in compliance with the Finnish Act on the Protection of Privacy in Working Life (759/2004) and will only collect information that is necessary and directly relevant to the employment relationship or the role being recruited for.
7. Who we share your personal data with
- recruitment and HR technology providers, including Teamtailor and associated service providers;
- other wamo Group entities involved in recruitment support, hiring, management, IT, security, legal, compliance or administration;
- recruitment agencies, assessment providers, background screening providers or other suppliers where used lawfully;
- professional advisers, auditors, regulators, authorities, courts or law enforcement where required or appropriate; and
- parties involved in restructurings, financing, due diligence or corporate transactions where lawful and appropriate.
Where service providers process personal data on our behalf, they are required to process it only on our instructions and to apply appropriate security and confidentiality protections.
8. International transfers
Because we operate internationally and use service providers that may support us from other jurisdictions, your personal data may be accessed from or transferred to countries outside the country in which it was originally collected. This may include countries outside the European Economic Area (EEA) or the United Kingdom, such as those where our technology providers (including Teamtailor and its sub-processors) have operations.
Where required, we use lawful transfer mechanisms and appropriate safeguards, such as adequacy decisions, the European Commission’s Standard Contractual Clauses (SCCs), the UK International Data Transfer Agreement (IDTA) or UK Addendum, or another mechanism permitted by applicable law.
For details of the countries to which transfers may occur, candidates may refer to Teamtailor’s sub-processor list, which Teamtailor maintains and publishes at:
⚠ INSERT URL: [TEAMTAILOR SUB-PROCESSOR URL FROM YOUR DPA HERE]
For transfers involving other wamo service providers, further information is available on request by contacting complaints@wamo.io.
9. How long we keep your personal data
wamo keeps personal data only for as long as necessary for the purposes described in this Notice, including to manage recruitment records, respond to queries, defend legal claims and comply with legal or regulatory obligations.
- Visitor and basic technical data: in line with the Cookie Policy and site security settings; careers-site security logs should not normally be kept longer than 12 months.
- Current application records: for the duration of the recruitment process and up to 12 months after the role is closed or the candidate is rejected, unless a longer period is required for a clearly documented legal-claims purpose or legal obligation.
- Connecting Candidates / talent community records: up to 24 months from the date of connection or consent, after which consent should be renewed or the record deleted.
- Sourced or referred candidates who do not engage or apply: up to 6 months from first contact, unless the individual chooses to stay connected for longer.
- Referee data: no longer than the related candidate record is retained, unless a shorter retention period is appropriate.
- Successful candidates: relevant recruitment records may be moved into the applicable employee or contractor privacy framework and retention schedule after hiring.
10. Automated decision-making, AI tools and profiling
wamo does not make recruitment decisions based solely on automated processing that produces legal effects or similarly significant effects on candidates.
If wamo uses automation or AI-assisted tools within Teamtailor or connected systems to help organise applications, draft communications, summarise information or support screening, those tools are used to support human decision-making and do not replace human review for material recruitment decisions.
11. Are you required to provide your personal data?
In many cases, yes. You may need to provide certain information so that we can assess your application, communicate with you, verify your eligibility to work, and progress the recruitment process. If you do not provide information that is necessary for these purposes, we may be unable to continue with your application or consider you for the relevant role.
12. Your rights
Subject to applicable law, you have the right to:
- request access to your personal data;
- request rectification of inaccurate or incomplete data;
- request erasure of your personal data;
- request restriction of processing;
- object to processing based on legitimate interests;
- request data portability in relevant cases;
- withdraw consent where processing is based on consent; and
- lodge a complaint with a competent supervisory authority.
We will respond to rights requests within one month of receipt. Where a request is complex or we receive a high volume of requests, this period may be extended by a further two months. We will inform you of any such extension within the first month, together with the reasons for the delay.
You may exercise your rights through the careers site privacy tools where available, through your candidate account where available, or by contacting complaints@wamo.io.
13. Cookies, candidate privacy tools and careers-site links
The careers site may provide a Cookie Policy, cookie preference tools, a Data & Privacy page and a candidate account area. These tools and links should remain available on the careers site to help candidates manage privacy preferences, rights requests and account details.
Where available, candidates may also be able to request a copy of their data, request deletion, or manage certain privacy preferences through Teamtailor’s Data & Privacy tools.
14. Complaints
If you have concerns about how we process your personal data, we encourage you to contact us first at complaints@wamo.io so that we can try to resolve the matter.
You also have the right to lodge a complaint with the supervisory authority in the country of your habitual residence, place of work, or the place of an alleged infringement. The supervisory authorities responsible for the wamo entities are:
Malta – Office of the Information and Data Protection Commissioner (IDPC)
Finland – Office of the Data Protection Ombudsman
United Kingdom – Information Commissioner’s Office (ICO)
Candidates residing or working in other EU/EEA member states may also contact the supervisory authority in their country of habitual residence or place of work.
15. Changes to this Notice
We may update this Notice from time to time to reflect changes in law, recruitment practices, systems or business operations. The latest version will remain available on the careers site.
Where changes are material, we will take reasonable steps to bring them to the attention of candidates whose data we hold, including talent community members whose processing is based on consent, in line with our obligations under applicable data protection law.
