Applicant Privacy Notice

WENDY’S RESTAURANTS OF U.K. LIMITED

NOTICE TO APPLICANTS

REGARDING THE PROCESSING OF PERSONAL DATA

Wendy’s Restaurants of U.K. Limited (“the Company” or “we”) is committed to protecting the privacy and security of personal data and/or special category data (“Personal Data”) of prospective employees (“Applicants” or “you”). The Company collects, processes, and transfers personal data of Applicants in connection with its human resources recruitment, selection and security vetting activities. The Company is committed to complying with the UK Data Protection Act 2018 and the EU General Data Protection Regulation (GDPR) and all data protection laws, employment and labour laws, and collective agreements in the countries in which it employs employees and does business.

The contact information for the Company’s main establishment and representative in the United Kingdom is:

COMPANY: Wendy’s Restaurants of U.K. Limited

ADDRESS: Rutland House, 148 Edmund Street, Birmingham B3 2JR (c/o Squire Patton Boggs (UK) LLP)

The contact information for the Company’s principal contact for Data Protection issues is Brigette Guyer, Director of Data Governance at GDPRPrivacy@wendys.com.

Personal Data Processed

The Company collects, processes, and stores Personal Data regarding Applicants for the purposes detailed below in connection with its human resources recruitment, selection and security vetting activities. The Company will keep and use the information to enable it to hire suitable personnel and manage its relationship with you effectively, lawfully and appropriately during the recruitment, selection and onboarding process, whilst you are working for the Company, at the time when your employment ends and after you have left. This includes using information to enable the Company to comply with the employment contract, to comply with any legal requirements, pursue the legitimate interests of the Company and protect the Company’s legal position in the event of legal proceedings. Further information on why we process your Personal Data is set out below. If you do not provide this data, the Company may be unable in some circumstances to comply with its obligations and will tell you about the implications of that decision.

  • Recruitment: The Company processes Personal Data of Applicants such as name; age; contact information; travel and expense reimbursement information; education, language(s) and job-related competencies; certification information; employment history; work experience; military service information and background check information (to the extent that such checks are possible under applicable law) to fulfil its legitimate interest and legal obligations in employing the most qualified Applicants. The Company may give you the option to provide some of the above Personal Data to the Company via video recording, which may capture your image in a manner that discloses ‘Special Category’ Personal Data to the Company. Such Special Category Personal Data is incidental and not a requirement and is processed solely with your consent, which you provide when you submit the video recording to the Company. The processing of criminal convictions and offences data in connection with the Company’s security vetting activities will be carried out only under the control of official authority or as permitted by EU or UK law. The Company may collect recruitment-related Personal Data from third parties such as recruiters, background check companies, government authorities, former employers and references you provide as notified to you. The Company will use TrustID to confirm your right-to-work status and First Advantage to conduct background checks that will include verification of education information, employment history, and for certain roles, criminal convictions and offence data. The Company may also collect Personal Data from publicly accessible sources such as public and job-related (not personal) social media profiles. The Company may process some of your Personal Data, including your age, right-to-work status, and work experience, using automated decision-making to determine whether you qualify for a particular job.  You consent to this automated decision-making when you provide your Personal Data to the Company in connection with an application for employment.
  • Health and safety: The Company processes Personal Data regarding medical or health conditions for the purposes of facilitating interviews and selection processes, assessments of your working capacity, medical diagnosis for making reasonable accommodation or adjustments, the provision of health or social care or treatment and management of health or social care systems and services as required during the recruitment process. This information is processed for the protection of your vital interests or the vital interests of another person and to comply with obligations and specific rights in the field of employment and health and safety law in so far as legally permitted. This information may also be processed pursuant to a collective agreement and legal obligations to provide a safe workplace. The Company may collect such information from third parties such as health care providers and third party benefits administrators and government authorities as notified to you.
  • Defence of legal claims: The Company processes Personal Data necessary for the establishment, exercise or defence of legal claims.

RECIPIENTS OF YOUR PERSONAL DATA

Your Personal Data will be disclosed to:

  • The Company’s management, human resources (HR) personnel, security personnel, information technology (IT) personnel, and legal and data governance personnel who have a need to know about your Personal Data.
  • The Company’s affiliates, their management, HR personnel, security personnel, IT personnel, and legal and data governance personnel located in the United States and Canada who have a need to know about your Personal Data.

The Company and its affiliated companies in the United States have implemented appropriate safeguards for the transfer of your Personal Data to the U.S. as permitted through standard contract clauses under Article 46 (2) of GDPR and the UK Data Protection Act 2018. Further information regarding these safeguards can be obtained from your HR representative.

  • Third party processors such as recruiters, background check and security companies, computer, internet, and other technology service providers, government agencies and others who have a need to process your Personal Data in connection with your recruitment or employment with the Company as part of the operation of the business, includingTrustID, First Advantage, and Harri.

To the extent that such third party processors are located outside of the UK or the EU, the Company has implemented appropriate safeguards for the transfer of your Personal Data to these countries through standard contract clauses. Further information regarding these safeguards can be obtained from your HR representative.

  • Additionally, the Company may be required to disclose Personal Data in response to lawful requests by public authorities to comply with national security or law enforcement requirements, but only as permitted under the UK Data Protection Act 2018 and GDPR.

RETENTION OF YOUR PERSONAL DATA

The Company, its affiliates, and any applicable third party processors will retain your Personal Data for (1) the period of time that it is necessary to process your Personal Data for the purposes for which it was collected and processed, (2) the period required under record retention laws, (3) the applicable statute of limitations for employment or discrimination claims, or (4) the necessary period of time to establish, exercise, or defend legal claims. Please refer to the Company’s Data Retention Policy for more information. Generally, for unsuccessful applicants, the Company and applicable third party processors will delete your Personal Data upon completion of the application and employment decision process in accordance with our data retention policies unless you specifically request the Company to retain your Personal Data for further consideration.

YOUR RIGHTS REGARDING YOUR PERSONAL DATA

As a data subject, you have the following rights regarding your Personal Data:

  • Right of Access: You have the right to obtain confirmation from the Company as to whether or not Personal Data concerning you is being processed. You also have the right to obtain the following information unless providing such Personal Data adversely affects the rights and freedoms of others: (1) purpose of the processing, (2) categories of Personal Data concerned, (3) the recipients or categories of recipients to whom your Personal Data has or will be disclosed, (4) the envisaged period for which your Personal Data will be stored, (5) your right to request rectification or erasure of your Personal Data or restriction of processing of Personal Data, (6) your right to lodge a complaint with a supervisory authority, (7) the source from which your Personal Data was obtained if you did not provide the Personal Data, (8) the existence of any automated decision-making, including profiling, the logic involved in such decision-making, and the significance and consequences of such processing, and (9) the countries to which your Personal Data is transferred if it is transferred to third countries. The Company will provide a copy of the Personal Data being processed in a commonly used electronic form where you have made your access request by electronic means.
  • Right to Rectification: You have the right to request and obtain the rectification of inaccurate Personal Data and the completion of incomplete Personal Data including providing a supplementary statement. The Company will notify any recipients of your Personal Data regarding the rectification unless such notification involves disproportionate effort. The Company will inform you about such recipients upon your request.
  • Right to Erasure (Right to be Forgotten): You have the right to request and obtain erasure of Personal Data concerning you under the following circumstances: (1) the Personal Data is no longer necessary for the purposes for which it was collected or processed, (2) you have withdrawn consent for any processing based on your prior consent, (3) you object to the processing of your Personal Data based on the Company’s legitimate interest and there are no overriding legitimate grounds for the processing, (4) your Personal Data has not been lawfully processed, or (5) the Personal Data is required to be erased based on the Company’s legal obligation to erase the Personal Data. However, your right to erasure does not apply where the processing is necessary for (a) exercising the right of freedom of expression and information, (b) the Company has a legal obligation requiring the processing of your Personal Data, (c) for reasons of public interest in the area of public health, or (d) for the establishment, exercise or defence of legal claims. The Company will notify any recipients of your Personal Data regarding the erasure unless such notification involves disproportionate effort. The Company will inform you about such recipients upon your request.
  • Right to Restrict Processing: You have the right to obtain a restriction on the processing of your Personal Data under the following circumstances: (1) during the period of time necessary for the Company to verify the accuracy of your Personal Data where you have objected to its accuracy, (2) the processing is unlawful and you do not want the Personal Data erased, (3) the Company no longer needs the Personal Data for the purposes for which it was processed but you require the Company to retain the information for the establishment, exercise or defence of legal claims, (4) you have objected to the Company’s legitimate interest for processing the data and then during the period of time that the Company determines whether the legitimate interest overrides your privacy rights. While the restriction is in place, the Company will store and process the Personal Data subject to the restriction; process such Personal Data with your consent, for the establishment, exercise or defence of legal claims, to protect the rights of others, or for reasons of important public interest. Further, the Company will provide you with prior notice if the restriction is being lifted. The Company will notify any recipients of your Personal Data regarding the restriction unless such notification involves disproportionate effort. The Company will inform you about such recipients upon your request.
  • Right to Portability: You have the right to receive Personal Data that you have provided to the Company and transmit such Personal Data to another controller where the processing of such Personal Data is based on consent or on a contract and is processed by automated means. Additionally, you have the right to require the Company to transmit such Personal Data directly to another controller, where technically feasible. This right is not applicable if it adversely affects the rights and freedoms of others.
  • Right to Object: You have the right to object to the processing of your Personal Data if the processing is based upon the Company’s legitimate interest, including any profiling based on such processing. The Company will cease processing such Personal Data unless the Company can demonstrate a compelling legitimate ground for the processing that outweighs your interest, rights or freedoms; or unless continued processing is necessary for the establishment, exercise or defence of legal claims.
  • Right not to be Subject to Automated Decision Making, Including Profiling: You have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or significantly affects you. However, this right does not apply if the decision is necessary to enter into or perform a contract between you and the Company, is authorised by applicable law, or is based on your explicit consent. If based on your consent or a contract, you may contact the Company to express your point of view and contest the automated decision.

To make a subject access request or other request related to your individual rights, you should complete the webform here. The Company may need to ask for proof of identification before the request can be processed. The Company will inform you if it needs to verify your identity and the documents it requires.

The Company normally will respond to a request within a period of one month from the date it is received. In some cases, such as where the Company processes large amounts of an individual’s personal data, it may respond within three months of the date the request is received. The Company will write to you within one month of receiving the original request to tell you if this is the case.

If an access request is manifestly unfounded or excessive, the Company is not required to comply with it. Alternatively, the Company can agree to respond but will charge a fee, which will be based on the administrative cost of responding to the request. An access request is likely to be manifestly unfounded or excessive where it repeats a request to which the Company has already responded. If a request is unfounded or excessive, the Company will notify you that this is the case and whether or not it will respond to it.

Questions And Complaints

Questions or complaints regarding the processing of your Personal Data should be directed to your hiring contact at the Company in the first instance. If the enquiry cannot be answered or the complaint is not resolved locally, please direct the matter to the Company by letter, telephone or email to the Company’s principal contact for Data Protection issues whose contact details are set out above.

You have the right to lodge a complaint with the Information Commissioner’s Office which is situated at:

Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

Or by telephone on 0303 123 1113, or find more details at www.ico.org.uk.

If in the future the Company intends to process your Personal Data for a purpose other than that which it was collected the Company will provide you with information on that purpose and any other relevant information.