← Back to home

CANDIDATE PRIVACY NOTICE

About This Notice

This Candidate Privacy Notice (the "Notice") is issued by 'Lumina', a brand name of Lumina Strategy Solutions (SMC-Private) Limited, a company incorporated under the laws of Pakistan (Company Registration No. 0337302), with registered offices at Techverx, 3-P 2nd Floor, Sir Syed Road, Block-P, Gulberg-II, Pakistan (referred to throughout as "Lumina" or the "Company").

The Company is committed to safeguarding the personal data of individuals who interact with us in the context of recruitment. This Notice explains who we are, what personal data we collect about you, why we collect it, how we use and protect it, and the rights available to you under applicable data protection legislation.

This Notice applies to all individuals who submit an application for employment or engagement with the Company, whether through our website, a recruitment platform, or any other channel (referred to as "Candidates", "you", and "your"). Please read this Notice carefully before submitting any personal data to us

Principles for Data Protection

The Company processes personal data in compliance with applicable data protection laws and in accordance with the following core principles:

• Lawfulness, fairness, and transparency - we process personal data on a lawful basis, in a fair manner, and with full transparency towards data subjects.
• Purpose limitation - personal data is collected only for specified, explicit, and legitimate purposes and will not be processed in a manner that is incompatible with those purposes.
• Data minimisation - we collect only personal data that is adequate, relevant, and limited to what is necessary in relation to the purpose for which it is processed.
• Accuracy - we take reasonable steps to ensure that personal data is accurate and, where necessary, kept up to date.
• Storage limitation - personal data is retained only for as long as is necessary to fulfil the purposes for which it was collected, or as required by law.
• Integrity and confidentiality - we implement appropriate technical and organisational measures to ensure the security of personal data and to protect it against unauthorised or unlawful processing, accidental loss, destruction, or damage.

Personal Data We Collect About You

Depending on the role applied for and the stage of the recruitment process, the Company may collect and process the following categories of personal data:

1. 1. Data You Provide Directly

• Identity and contact information: including your full name, title, date of birth, gender, nationality, home address, telephone number, and personal email address.
• Professional background: including your employment history, job titles, responsibilities, and reasons for leaving previous roles.
• Qualifications and education: including academic qualifications, diplomas, transcripts, professional certifications, memberships, and language proficiencies.
• Additional information: including your social media profiles (e.g. LinkedIn), national service completion (where applicable), and any other information you choose to include in your CV, covering letter, or application form.
• Interview information: any information disclosed or generated during interviews or assessments conducted at our premises or remotely.

1. 2. Data We Collect from Third Parties

References (where applicable): we may receive information from referees you have nominated, including your full name, periods of previous employment, and performance during previous roles.

Publicly available sources: we may collect information from professional networking platforms (such as LinkedIn) and other publicly accessible sources, including your name, email address, work history, and professional profile content.

How Is Your Personal Data Collected?

We collect personal data through the following means:

Directly from you: through application forms submitted via our website or recruitment platforms, CVs and covering letters you provide, and information you share during interviews or assessments.

From your named referees: following your consent or at the relevant stage of the recruitment process.

From publicly accessible sources: such as professional networking websites, where we may carry out background research as part of our candidate evaluation process.

Purposes and Legal Basis for Processing

The Company processes Candidate personal data for the following purposes and on the following legal bases:

Recruitment and Assessment

We process your personal data to manage and administer the recruitment process, including to assess your skills, qualifications, and suitability for the role applied for; to shortlist candidates and conduct interviews; to carry out background checks and verify references; and to make and communicate hiring decisions. The legal basis for this processing is the necessity to take steps at your request prior to entering into a contract, and the Company's legitimate interest in identifying and appointing suitably qualified candidates.

Legal and Regulatory Compliance

We may process your personal data where necessary to comply with a legal or regulatory obligation to which the Company is subject, including the maintenance of records demonstrating a fair, non-discriminatory, and transparent recruitment process.

Consideration for Future Opportunities

With your consent, or where otherwise permissible under applicable law, we may retain your personal data following the conclusion of a recruitment process to consider you for future positions that may become available and for which your profile may be relevant.

Consequences of Not Providing Personal Data

Where the provision of certain personal data is a prerequisite for the Company to assess your application, such as proof of qualifications or a verifiable employment history, failure to provide such information may mean that we are unable to consider your application or progress it to subsequent stages of the recruitment process.

Processing of Sensitive Personal Data

Certain categories of personal data are afforded heightened protection under applicable data protection law. The Company will process such sensitive data only where strictly necessary and proportionate, and only in the following limited circumstances:

Disability and accessibility: where you have disclosed information regarding a disability or health condition, we will use that information solely to consider what reasonable adjustments may be required to accommodate you during the recruitment process (for example, during a written assessment or interview).

Nationality and immigration status: information regarding your nationality may be processed to the extent necessary to assess whether you would require a work permit or visa in order to lawfully take up employment in the relevant jurisdiction.

All sensitive personal data is processed with strict confidentiality and in accordance with applicable law. We do not process sensitive personal data for any purpose beyond those identified above without your explicit consent.

Sharing of Personal Data

The Company treats Candidate personal data with strict confidentiality. Access is limited to individuals within the Company who have a genuine need to review your information as part of the recruitment process. All such individuals are bound by duties of confidentiality.

We may share your personal data with other entities within our corporate group, strictly and solely for the purpose of assessing your suitability for a specific role. We will not disclose your personal data to external third parties unless we are legally required to do so.

We do not sell, rent, or otherwise commercially transfer personal data to third parties.

Automated Decision Making

The Company does not utillise any automated decision-making methods in relation to the recruitment process, thus your personal data will not be subject to decisions that will have a significant impact on you based solely on such methods.

Data Security

The Company has implemented appropriate technical and organisational security measures designed to prevent your personal data from being accidentally lost, used, accessed, altered, or disclosed without authorisation. Access to personal data is granted on a strict need-to-know basis and is limited to Company personnel who require such access in order to carry out their functions in connection with the recruitment process.

We maintain procedures to detect, investigate, and respond to suspected personal data breaches. In the event of a breach that is likely to result in a risk to your rights and freedoms, we will notify you and any applicable supervisory authority as required by law. Further details of the security measures we employ are available in the Company's Privacy Policy, which can be accessed on our website.

Data Retention

We will retain your personal data only for as long as is necessary to fulfil the purposes set out in this Notice. In practice, this means that personal data collected during a recruitment process will be retained for a period sufficient to:

• Demonstrate that the recruitment process was conducted in a fair, transparent, and non-discriminatory manner, including in the event of any legal challenge or regulatory enquiry.
• Consider your profile for comparable or related roles that may arise within the Company within a reasonable period following the conclusion of the recruitment process.

The precise retention period will depend on the applicable legal and regulatory framework in the relevant jurisdiction. Upon expiry of the applicable retention period, your personal data will be securely deleted or anonymised in accordance with the Company's policies.

Your Rights

Subject to applicable data protection law and certain conditions or exceptions, you have the following rights in respect of your personal data:

Right of access: you may request a copy of the personal data we hold about you and information regarding how it is being processed (commonly referred to as a Data Subject Access Request).

Right to rectification: you may ask us to correct any inaccurate or incomplete personal data we hold about you.

Right to erasure: in certain circumstances, you may request that we delete your personal data where there is no longer a lawful basis for us to retain it.

Right to object: where we rely on legitimate interests as our legal basis for processing, you may object to that processing on grounds relating to your particular situation. You also have the right to object to processing of your personal data for direct marketing purposes.

Right to restriction of processing: you may ask us to suspend the processing of your personal data in certain circumstances, for example while you contest its accuracy or the grounds on which we are processing it.

Right to data portability: in certain circumstances, you may request that we transfer personal data you have provided to us to another organisation, or directly to you, in a structured, commonly used, and machine-readable format.

Contact and Queries

If you want to review, verify or correct your personal data or to request erasure of your personal data or object to the processing of your personal data, please, please contact us here.