Applicant and Candidate Privacy Policy


Planet Holding Ltd and its subsidiaries (hereinafter referred to as “Planet”, “we”, “us” and “our”) respect your privacy and are committed to protecting your personal data. This Candidate Privacy Notice (hereinafter referred to as “Notice”) is designed to communicate our practices regarding the collection, use, retention and disclosure of information, and to inform you of your privacy rights and how the law protects you when you apply to work with us.

For the purpose of the General Data Protection Regulation (“GDPR”) and the version of the GDPR retained in UK law (“UK GDPR”), the Data Controller is Planet Holding Ltd. For Brazilian Candidates, please refer to section 8 below for further details, as per Brazilians are subject to their own data protection law (Lei Geral de Proteção de Dados Pessoais – LGPD, law number 13.709, dated 14th August 2018 (“LGPD”), which created the legal framework for the use of personal data of individuals in Brazil regardless of where the data processor is located.

Where you apply for a job opening posted by Us, the provisions contained in this Notice will apply to Our processing of your personal information in addition to Our other Privacy Notice, which is available on Our website at

Where you apply for a job opening via the careers function on a job site or similar online service provider (“Partner”), you should note that the relevant Partner may retain your personal data and may also collect data from Us in respect of the progress of your application. Any use by the Partner of your data will be in accordance with the Partner’s Privacy Notice.

This Notice can be printed for reference by using the print command in the settings of any browser.


Information We collect from Candidates

We collect and process some or all of the following types of information from Candidates:

• Information that you provide when you apply for a role. This includes information provided through an online job site, via email, in person at interviews and/or by any other method.
• In particular, we process personal details such as name, email address, address, telephone number, date of birth, qualifications, experience, information relating to your employment history, skills experience that you provide to Us, as well as your video in case you conduct your interview using the video interview feature.
• If you contact Us, we may keep a record of that correspondence.
• A record of your progress through any hiring process that we may conduct.
• Details of your visits to our website including, but not limited to, traffic data, location data, weblogs and other communication data, the site that referred you to our website and the resources that you access.

All the above is, together, herein referred as “Candidate Data”.


We rely on legitimate interest as the lawful basis on which We collect and use your personal data. Our legitimate interests are the recruitment of staff for Our business. When a hiring decision is made, the lawful basis for processing changes as:

Unsuccessful Candidates: We will retain your data in line with our data retention policy for 12 months: If We wish to keep it for a longer period of more than one year to match against suitable roles, We will only continue to process your data under the lawful basis of consent.

Successful Candidates: Once an offer has been accepted, our lawful basis will change to contract.


We use information held about you in the following ways:

• To consider your application in respect of a role for which you have applied.
• To consider your application in respect of other roles.
• To communicate with you in respect of the recruitment process.
• To enhance any information that we receive from you with information obtained from third-party data providers.
• To find appropriate candidates to fill Our job openings.
• To help our service providers (such as the job sites through which you may have applied) improve their services.


As set out above, We may pass your information to our third-party service providers, including those who use it only in accordance with Our instructions and as otherwise required by law.

Where you have applied to a job opening through a Partner, We may disclose data similar to the Candidate Data defined above to such Partner. The Partner shall be the data controller of this data and shall therefore be responsible for complying with all applicable law in respect of the use of that data following its transfer by Us.



We take appropriate measures to ensure that all Candidate Data is kept secure, including security measures to prevent Candidate Data from being accidentally lost or used, or accessed in an unauthorised way. We limit access to your Candidate Data to those who have a genuine business need to know it. Those processing your information will do so only in an authorised manner and are subject to a duty of confidentiality.

We also have procedures in place to deal with any suspected data security breach. We will notify you and any applicable regulator of a suspected data security breach where We are legally required to do so.

Unfortunately, the transmission of information via the internet is not completely secure. Although We will do Our best to protect your Candidate Data, we cannot guarantee the security of your data transmitted through any online means; therefore, any transmission remains at your own risk.


All Candidate Data is stored on our secure servers in the EU.

The data that We collect from Candidates and process may be transferred to, and stored at, a destination outside the UK or the European Economic Area (“EEA”). It may also be processed by staff operating outside the UK or the EEA who work for Us or for one of our service providers. Such staff maybe engaged in, among other things, the provision of support services. By submitting your Candidate Data, you agree to this transfer, storing or processing.

Please contact Us if you want to get in touch with Us to discuss this Notice (see the ‘Contact’ section below).


Under the GDPR and the UK GDPR, you have a number of important rights free of charge. For a summary of those rights please refer to our Privacy Notice.

Contact details

Planet’s contact details are:

Planet Holding Ltd
2nd Floor 22 Eastcheap, London, England
+ 44 203 9825216

We have appointed an external Data Protection Officer (DPO) who is responsible for handling questions in relation to this Policy. If you have any questions about this Notice, including any requests to exercise your legal rights, please contact our external Data Protection Officer (DPO) whose contact details are:

Robert Healey
Formiti Data International Ltd
The Black Church, St. Mary’s Place, Dublin 7 Ireland
+353 14853752

Should you wish to do so at any point, you have the right to make a complaint to the Information Commissioner’s Office (ICO), the UK supervisory authority for data protection issues. Their contact details are:

Information Commissioner’s Office
Wycliffe House, Water Lane, Wilmslow Cheshire, SK9 5AF
0303 123 1113 (local rate)
01625 545 745 (national rate)
Fax: 01625 524 510

For Brazilian Candidates, the LGPD established the Autoridade Nacional de Protecao de Dados (“ANPD”), which is the competent government authority to deal with data protection issues in Brazil. Their contact details are found at: Canais de Atendimento.

We would, however, appreciate the chance to deal with your concerns before you approach the ICO or the ANPD, so please contact us in the first instance.


This section integrates with and supplements the information contained in the rest of this Notice.

The provisions contained in this section apply to all Brazilian Candidates, according to the LGPD. For such Candidates, these provisions supersede any other possibly divergent or conflicting provisions contained in this Notice.

This part of the document uses the term “personal information” as it is defined in the LGPD.

The grounds on which we process your personal information

We can process your personal information solely if we have a legal basis for such processing. Legal bases are as follows:

• your consent to the relevant processing activities.
• compliance with a legal or regulatory obligation that lies with us.
• the carrying out of public policies provided in laws or regulations or based on contracts, agreements and similar legal instruments.
• studies conducted by research entities, preferably carried out on anonymized personal information.
• the carrying out of a contract and its preliminary procedures, in cases where you are a party to said contract.
• the exercising of our rights in judicial, administrative or arbitration procedures.
• protection or physical safety of yourself or a third party.
• the protection of health – in procedures carried out by health entities or professionals.
• our legitimate interests, provided that your fundamental rights and liberties do not prevail over such interests; and
• credit protection.

To find out more about the legal bases, you can contact us at any time using the contact details provided in this document.

Your Brazilian privacy rights, how to file a request and our response to your requests

Your Brazilian privacy rights

You have the right to:

• obtain confirmation of the existence of processing activities on your personal information.
• access to your personal information.
• have incomplete, inaccurate or outdated personal information rectified.
• obtain the anonymization, blocking or elimination of your unnecessary or excessive personal information, or of information that is not being processed in compliance with the LGPD.
• obtain information on the possibility to provide or deny your consent and the consequences thereof.
• obtain information about the third parties with whom we share your personal information.
• obtain, upon your express request, the portability of your personal information (except for anonymized information) to another service or product provider, provided that our commercial and industrial secrets are safeguarded.
• obtain the deletion of your personal information being processed if the processing was based upon your consent, unless one or more exceptions provided for in art. 16 of the LGPD apply.
• revoke your consent at any time.
• lodge a complaint related to your personal information with the ANPD (the National Data Protection Authority) or with consumer protection bodies.
• oppose a processing activity in cases where the processing is not carried out in compliance with the provisions of the law.
• request clear and adequate information regarding the criteria and procedures used for an automated decision; and
• request the review of decisions made solely on the basis of the automated processing of your personal information, which affect your interests. These include decisions to define your personal, professional, consumer and credit profile, or aspects of your personality.

You will never be discriminated against, or otherwise suffer any sort of detriment, if you exercise your rights.

How to file your request

You can file your express request to exercise your rights free from any charge, at any time, by using the contact details provided in this Notice.

How and when we will respond to your request

We will strive to promptly respond to your requests. In any case, should it be impossible for Us to do so, We’ll make sure to communicate to you the factual or legal reasons that prevent us from immediately, or otherwise ever, complying with your requests. In cases where We are not processing your personal information, We will indicate to you the physical or legal person to whom you should address your requests if we are in the position to do so.

In the event that you file an access or personal information processing confirmation request, please make sure that you specify whether you’d like your personal information to be delivered in electronic or printed form. You will also need to let us know whether you want us to answer your request immediately, in which case we will answer in a simplified fashion, or if you need a complete disclosure instead. In the latter case, we’ll respond within 15 days from the time of your request, providing you with all the information on the origin of your personal information, confirmation on whether or not records exist, any criteria used for the processing and the purposes of the processing, while safeguarding Our commercial and industrial secrets.

In the event that you file a rectification, deletion, anonymization, or personal information blocking request, We will make sure to immediately communicate your request to other parties with whom We have shared your personal information in order to enable such third parties to also comply with your request – except in cases where such communication is proven impossible or involves disproportionate effort on Our side.

Transfer of personal information outside of Brazil permitted by the law

We are allowed to transfer your personal information outside of the Brazilian territory in the following cases:

• when the transfer is necessary for international legal cooperation between public intelligence, investigation and prosecution bodies, according to the legal means provided by the international law.
• when the transfer is necessary to protect your life or physical security or those of a third party.
• when the transfer is authorized by the ANPD.
• when the transfer results from a commitment undertaken in an international cooperation agreement.
• when the transfer is necessary for the execution of a public policy or legal attribution of public service.
• when the transfer is necessary for compliance with a legal or regulatory obligation, the carrying out of a contract or preliminary procedures related to a contract, or the regular exercise of rights in judicial, administrative or arbitration procedures.