Duff & Phelps Talent Acquisition Privacy Notice
Duff & Phelps LLC (and all affiliates and subsidiaries, collectively "D&P"), is committed to complying with the applicable data privacy and security requirements in the countries in which it operates. D&P complies with internationally recognized standards of privacy protection, and with various privacy laws globally including, but not limited to, the EU General Data Protection Regulation (GDPR). This Privacy Notice applies only to job applicant data.
- Who is Collecting Data
- Data We Collect
- Processing of Personal Data
- Processing of Sensitive Data
- How Data is Processed
- Storage of Personal Data
- Disclosure/Sharing of Personal Data
- Cross – Border Transfers of Personal Data
- Your Rights
- Automated Decision Making
- Providing Information to D&P
- Third Party Websites or Services
- Contact Us
Data will be collected by Duff & Phelps LLC (and all affiliates and subsidiaries, collectively "D&P"), the Data Controller.
Data We Collect
Most of the personal data D&P collects about you is directly from your application and resume or curriculum vitae submitted through our online recruiting system, or from third parties designated by you, such as recruiting agencies. We may also collect data from interviews and phone-screenings you may have.
We collect data contained in your social media profile, such as LinkedIn, when you choose to share this with us. We may collect information about you from certain third parties, to: (a) verify information about your credentials, such as education and prior employment, (b) follow-up on references that you may provide, and (c) conduct background investigations, where permitted or required by law. We will only collect such information from third parties if you have completed an employment application authorizing us to do so, or we have otherwise obtained your authorization to proceed.
Processing of Personal Data
D&P collects and uses your data to take steps prior to entering into an employment contract. D&P also collects and uses your data for the purposes of the legitimate interests of our company in human resources and business management. When we process your personal data for our legitimate interests, we make sure to consider and balance any potential impact on you and your rights under data protection laws. Our legitimate business interests do not automatically override your interests - we will not use your personal data for activities where our interests are overridden by the impact on you (unless we have your consent or are otherwise required or permitted to by law). Such legitimate interests may include:
- Managing your job applicant account, including password recovery
- Where you have applied for a position with D&P:
- Assessing your skills and qualifications for employment and reaching a hiring decision
- Verifying your information and carrying out reference checks and/or conducting background checks, where permitted or required by law.
- Communicating with you about the recruitment process and/or your application(s).
- Analyzing the hiring process and outcomes
- Complying with applicable laws, regulations, corporate governance requirements, legal processes or enforceable governmental requests
D&P also processes your data for other purposes if you have provided us consent for such specified purposes. Such other purposes will be clearly provided at the time you provide consent. For example, where you have consented, we will send you email notifications whenever a new position matching your profile is posted. You have the right to withdraw your consent at any time. You can unsubscribe from these communications at any time by sending a request via email to: [email protected]
Processing of Sensitive Data
D&P may request certain sensitive personal data, such as race, ethnicity, marital status, religion, or disability during the recruitment process. Requests to applicants to provide sensitive data will be voluntary, except where required by law. Collection and processing of sensitive data is necessary for D&P to carry out the obligations and exercise specific rights in the field of employment and social security. For example, we may need information to verify that you are permitted to work in a certain country, or to process immigration applications.
Your sensitive personal data will not be used for any other purpose other than for your recruitment and/or your future employment with us.
How Data is Processed
Personal data is processed both manually and electronically in accordance with the above-mentioned purposes and in compliance with current regulations. We permit only authorized D&P employees and Third-Party processors to have access to your information. Such employees and Third-Party processors are appropriately designated and trained to process data only according to the instructions we provide them.
Storage of Personal Data
D&P will retain personal data for a reasonable period, taking into account legitimate business needs to capture and retain such information. Information will also be retained for a period necessary to comply with state, local, federal regulations, or country specific regulations and requirements, and in accordance with D&P’s Document Retention Schedule.
Disclosure/Sharing of Personal Data
We only share your personal data with your consent or in accordance with this policy. We will not otherwise share, sell or distribute any of the information you provide to us except as described in this Privacy Notice.
- We share personal data among Duff & Phelps-controlled affiliates and subsidiaries who act for Duff & Phelps for the purposes set out in this notice.
- D&P may share your information with external third parties, such as vendors, consultants and other service providers who are performing certain services on behalf of D&P. Such third parties have access to Personal Data solely for the purposes of performing the services specified in the applicable service contract, and not for any other purpose. D&P requires these third parties to undertake security measures consistent with the protections specified in this notice.
- D&P may be required to disclose Personal Data in response to lawful requests by public authorities, including meeting national security or law enforcement requirements.
- If D&P’s business enters into a joint venture with or is merged with another business entity, your information may be disclosed to our new business partners.
Cross – Border Transfers of Personal Data
D&P is a global firm with operations in over 25 countries. Personal data may be transferred, accessed and stored globally as necessary for the uses stated above in accordance with this notice.
Data concerning EU data subjects may be transferred to or processed in locations outside of the EU only where one of the following safeguards is in effect:
- Transfers to the US, pursuant to D&P’s participation in the EU-U.S. Privacy Shield
- Transfers to certain countries which the EU Commission has determined ensures an adequate level of protection
- Transfers pursuant to standard contractual clauses or contract terms ensuring adequate data protection
Where required, D&P entities have entered into European Union Model Clause Agreements which allows for the processing of your personal information and for transfers of your personal information.
You have the following rights concerning your data processed by D&P:
- Access: You have the right to request access to personal data that D&P holds about you.
- Rectification: You have the right to ask us to rectify information D&P holds about you if it is inaccurate or not complete.
- Erasure: You can request that D&P erase your personal data. We will keep basic data to identify you and retain it solely for preventing further unwanted processing.
- Restrict Processing: You have the right to ask D&P to restrict how we process your data. This means we are permitted to store the data but not further process it. We keep just enough data to make sure we respect your request in the future.
- Object to processing: Where processing is based on legitimate interests, you have the right to object to D&P processing your data. D&P will discontinue processing your data, unless we can demonstrate compelling legitimate grounds for the processing. We will keep basic data to identify you and retain it solely for preventing further unwanted processing.
- Portability: Where processing is based on consent or performance of a contract, you have the right to data portability. D&P must allow you to obtain and reuse your personal data for your own purposes in a safe and secure way without this effecting the usability of your data. This right only applies to personal data that you have provided to D&P as the Data Controller.
Please contact [email protected] to request access, rectification, or erasure, or to restrict processing, to object to processing, to request data portability.
Automated Decision Making
In some instances, processing of your personal data may result in automated decisions that may affect the outcome of your job application. For example, we use automated decisions to assess whether an applicant possesses the basic qualifications which are required for a position.
When we make an automated decision about you, you have the right to contest the decision, to express your point of view, and to request a human review of the decision. You can ask about decisions made about your application by speaking to your contact within our recruitment team or by emailing [email protected].
Providing Information to D&P
If you choose not to provide certain personal information, we may not be able to consider you for employment with Duff & Phelps.
Third Party Websites or Other Services
You may choose to provide us with access to certain personal data maintained by third parties such as LinkedIn. The information we may receive varies by site and is controlled by the operator of the site and your privacy settings thereon. We are not responsible for the privacy practices of any non-D&P operated websites, mobile apps or other digital services, including those that may be linked through the recruitment system, and we encourage you to review the privacy policies or notices published thereon.
Duff & Phelps Corporate Headquarters
55 E 52 Street
New York, NY 10055
If you are in the EU:
D&P EU Data Protection Officer: Daniela Mosca
- Email: [email protected]
- Telephone +39.039.64.23.812
- Post: Daniela Mosca at Duff & Phelps REAG SpA, Centro Direzionale Colleoni, Palazzo Cassiopea 3, 7th Floor, Via Paracelso 26, 20864 Agrate Brianza (MB) - Italy
For data subjects located in the EU: if we are not able to satisfactorily resolve your questions, concerns, or complaints, or if you believe that the processing of your personal data infringes on your rights under applicable data protection laws, you have the right, without prejudice to any other administrative or judicial remedies, to lodge a complaint with a supervisory authority, in particular, in the Member State of your habitual residence, place of work or place of the alleged infringement. Contact information for the supervisory authorities may be found here: EU Data Protection Authorities