Privacy policy for job applicants

Candidates’ personal data are processed in compliance with applicable data protection legislation. Depending on the applicant’s location and circumstances, this includes the Swiss Federal Data Protection Act (FADP), the UK General Data Protection Regulation (UK GDPR), and the Data Protection Act 2018. The recruitment process is managed by Peptone Switzerland AG or Peptone Ltd.

This policy provides the information required by applicable data protection regulations regarding personal data collected and processed during recruitment.

1. Categories of personal data processed and definitions

Personal data provided by you, or otherwise acquired in compliance with applicable legislative and contractual provisions, that is inherent in, connected with, or instrumental to the assessment of your application will be processed in accordance with applicable data protection regulations and confidentiality obligations.

Personal data: all information relating to an identified or identifiable person.

Sensitive personal data: religious, ideological, political or trade union-related views or activities, health, the intimate sphere or racial origin, social security measures, administrative or criminal proceedings, and sanctions.

Data subjects: natural or legal persons whose data is processed, also referred to as “you”.

Processing: any operation involving personal data, irrespective of the means and procedure applied. This includes collection, storage, use, revision, disclosure, archiving, and destruction.

Disclosure: making personal data accessible, for example by permitting access, transmission, or publication.

We will process personal data supplied through our website and recruitment platforms and contained in your CV, motivational letters, and related materials. This may include your name, surname, email address, previous work experience, education, and references. Data required to submit your application will be marked as required.

2. Identity and contact details of the data controller

Peptone Ltd

If you apply for a position at Peptone Ltd, your personal data will be processed by:

Peptone Ltd
Cromwell House
68 West Gate
Mansfield, Nottinghamshire NG18 1RR
England

Peptone Ltd acts as data controller in accordance with the UK GDPR and the Data Protection Act 2018, represented by its legal representative.

Peptone Switzerland AG

If you apply for a position at Peptone Switzerland AG, your personal data will be processed by:

Peptone Switzerland AG
Via Vela 6
6500 Bellinzona
Switzerland
Company number CHE-405.886/945

Peptone Switzerland AG acts as data controller in accordance with the FADP, represented by its legal representative.

You can contact the data controller at privacy@peptone.io.

Data Protection Officer

We have appointed a Data Protection Officer (DPO), who may be contacted at dpo.peptone@privacydesk.ch.

3. Purposes, grounds, retention, and nature of provision

Purpose of processing	Grounds for justification	Data retention period	Nature of provision
Recruitment, including research and selection of job applicants for the possible establishment of an employment relationship, including positions other than the one for which the data subject has spontaneously applied. This includes managing applications submitted in response to roles published on our website or sent by email or post. Personal data may also be collected from third-party career pages, such as LinkedIn. Interviews may be conducted remotely and may involve image and audio processing.	Pre-contractual measures	Data will be retained throughout the recruitment process. After that period, data will be retained for a maximum of one year.	Providing personal data is necessary to participate in the recruitment process. Without it, participation in the recruitment process will not be possible.
Visiting a job applicant’s publicly accessible social profile on social media or networks. The data controller may collect and process personal data to the extent necessary and relevant to the recruitment process.	Legitimate interest or overriding interest	Data will be retained throughout the candidate’s recruitment process.	Providing the data is necessary to achieve the legitimate interest of the data controller.
Upon consent, verifying information supplied in your CV and motivational letters with the training, educational, or university institutions you identified, including attendance periods and qualifications obtained, and contacting the people you list as references, including former employers.	Consent	Data will be retained throughout the recruitment process. After that period, data will be retained for a maximum of one year.	Providing this data is optional. Without it, the controller will not be able to use your references, but you may still participate in the selection process.

4. Recipients of personal data

We may share your personal information with employees or staff acting under the authority of the data controller who have been instructed for these purposes, as well as with third parties contractually connected to the data controller where necessary to fulfil contractual obligations and the stated processing purposes.

Third parties will process data as data processors or independent data controllers. Categories of recipients may include:

• providers maintaining information systems and telecommunications networks, including recruitment tools;
• firms or companies providing assistance and consultancy;
• competent authorities where required to fulfil legal obligations or comply with requests from public bodies;
• the relevant Peptone office in Switzerland responsible for recruitment activities, including recruitment on behalf of Peptone Ltd, where the applicant is based in the United Kingdom.

5. Transfers of personal data outside Switzerland

Personal data may be communicated abroad. If you are a UK-based candidate, your personal data will be transferred to Switzerland, where the relevant office responsible for recruitment activities, including recruitment on behalf of Peptone Ltd, is located.

Switzerland is recognised by the United Kingdom as providing an adequate level of protection for personal data. The transfer is made pursuant to Article 45A of the UK GDPR and Schedule 21, Part 3, paragraph 5 of the Data Protection Act 2018.

6. Rights of the data subject

Subject to the conditions in applicable data protection legislation, you may exercise the following rights:

• obtain rectification of inaccurate or obsolete personal data;
• be informed in writing and free of charge whether personal data concerning you is being processed;
• revoke consent previously given for data processing, where applicable;
• prevent the communication of sensitive personal data to third parties, where applicable;
• express your opinion on an automated individual decision or request review by a natural person, where applicable;
• obtain personal data portability or request transmission to a third party;
• request restriction or blocking of data processing, prevention of disclosure to third parties, rectification, or destruction of personal data;
• request that specific processing of personal data, or specific communication of personal data to third parties, be prohibited, or that certain personal data be deleted or destroyed;
• request that a note indicating the disputed nature of personal data be added where neither its correctness nor inaccuracy can be proved;
• request that rectification, destruction, blocking, communication to third parties, the disputed character of data, or a judgment be communicated to third parties or published;
• have unlawful processing of personal data declared and lodge a complaint with the UK Information Commissioner’s Office (ICO) where UK data protection legislation applies, or report an alleged infringement to the Swiss Federal Data Protection and Information Commissioner (FDPIC) where Swiss data protection legislation applies, without prejudice to other administrative or judicial remedies.

You may exercise your rights by contacting the data controller at privacy@peptone.io or the Data Protection Officer at dpo.peptone@privacydesk.ch.

7. Additional information, modifications, and updates

We do not sell your data.

The data controller reserves the right to revise, update, add, or remove any part of this privacy policy at its discretion and at any time. If the policy is modified, the date of the update will be shown.

Date of last update: July 22, 2026.