# Sett AI Candidate Privacy Notice: How ShonZ Ltd. Processes Job Applicant Personal Information _Last updated: 2025-11-17_ ShonZ Ltd. d.b.a Sett AI ("Sett") is the controller of job candidates' Personal Information. This notice explains what Sett collects during recruitment, why it is processed, how long it is kept, and the rights candidates hold under the Israeli Protection of Privacy Law, 1981 (PPL), the UK Data Protection Act 2018, and the General Data Protection Regulation (GDPR). Contact: . ## Who Is Covered and Who Controls the Data This notice applies to all Personal Information related to job applicants ("Candidates") processed by Sett. A Candidate is any applicant for a position at Sett as a temporary, full-time or part-time employee, intern, contractor or contingent worker. Under the UK Data Protection Act 2018 and the GDPR, ShonZ Ltd. is the independent controller of the Personal Information. Under the PPL, ShonZ Ltd. is the database controller. ShonZ Ltd.'s address is Beit Oved 3, Tel Aviv, 6721103, Israel. It can be contacted at . Sett may amend this notice from time to time. Changes will be posted on the website a reasonable time before they take effect, and Sett will make efforts to notify candidates proactively by email. ## Personal Information Collected During Recruitment Sett collects and processes Candidate Personal Information to administer employment applications and carry out recruitment steps before a hiring decision and, where relevant, before entering into an employment agreement. Collected information includes name, contact details, residential address, date of birth, photograph (if proactively provided with a CV), details of qualifications, information shared during interviews, employment history, work permit information, information in a CV or cover letter, employment references, current and historic salary details (if shared), and salary expectations. Personal Information may also include names and contact details for references. Candidates are responsible for obtaining their references' consent before providing their details to Sett. Information originates from the Candidate through hard copy and web-based application forms, email correspondence, interviews, and assessment tests and questionnaires administered by Sett. Sett may also collect information from third parties, such as references provided about former employers, recruiters and recruitment agencies. ## Providing Information and Its Consequences Candidates are not under a legal obligation to provide Personal Information. Sett needs it to consider a job application. If Personal Information is not provided (and consent is not given to its processing, where that is the appropriate legal basis), Sett will not be able to consider the application. ## Where Candidate Data Is Stored Sett processes Candidate Personal Information mainly through a cloud-based service operated by Comeet Technologies. If an application is successful, relevant data is transferred to Sett's HR information system. ## Purposes and Legal Bases Under the GDPR | Purpose | Illustrative Scenarios | Legal Basis under the GDPR | |---|---|---| | Recruitment: reviewing candidacy for the open position applied for | CV, interviews, assessment tests and questionnaires, references from other parties | Sett's legitimate interests in properly reviewing candidacy and making a recruitment decision; steps necessary before entering into an employment contract | | Defending or asserting legal claims relating to candidacy | A legal claim asserted by Candidate or a third party about how candidacy was handled | Sett's legitimate interests in asserting or defending legal claims that impact its business or reputation | | Retaining candidacy for future positions beyond those applied for | A later job opening for a similar position that may be relevant | Sett's legitimate business interests in considering the Candidate for other open positions | Sett may process Personal Information for additional purposes, provided notice is given and consent is obtained where required by law. ## Sharing Candidate Personal Information Sett shares Candidate Personal Information within its internal HR teams. Some information is shared with Processors, such as service providers, that help with the applicant review process. Processors operate under Sett's instructions. Sett aims to ensure each Processor takes adequate measures to protect the information, by signing a data processing agreement. Where required by law, Sett discloses Candidate Personal Information to a governmental authority, in response to legal process, or when it believes in good faith that the law requires it. The legal basis is a legal obligation to which Sett is subject and Sett's legitimate business interests in complying with binding requests of governmental authorities. ## International Data Transfers Sett's headquarters are in Israel, and Candidate Personal Information may be accessed and handled from Israel. Candidate Personal Information is stored on Comeet Technologies, Sett's service provider. When Personal Information is transferred outside the UK or the European Economic Area (such as to the U.S.), Sett aims to do so under a data transfer agreement with adequate safeguards determined by the EU Commission and the UK Information Commissioner's Office. ## Retention and Security Candidate Personal Information is not kept longer than necessary for the recruitment process, for handling legal claims, and for considering the Candidate for future open positions. Where information is relevant to a successful Candidate's employment, it is transferred to Sett's HR information system. Where the UK Data Protection Act or the GDPR applies, Personal Information of unsuccessful Candidates is deleted within 24 months of the decision, unless Sett decides to retain it for an additional 18 months to consider the Candidate for other potential job openings. Sett implements measures to reduce the risks of damage, loss of information, and unauthorized access or use of Candidate Personal Information. Sett cannot guarantee absolute protection. ## GDPR Rights for Candidates in the EEA and UK Candidates in the European Economic Area or the UK have the following rights: - **Access:** to receive a copy of the Personal Information Sett processes. - **Rectification:** to have inaccurate information corrected and incomplete information completed. - **Data portability:** to receive provided information in a structured, commonly used, machine-readable format, and to transmit it to another entity. Where technically feasible, the data can be transmitted directly from Sett to that entity. - **Objection:** to processing based on Sett's legitimate interest. Sett may override the objection if it demonstrates compelling legitimate grounds, or if processing is needed for the establishment, exercise, or defense of legal claims. - **Restriction:** Sett may only store the data while restriction applies in these cases: (a) accuracy is contested, for the period needed to verify accuracy; (b) processing is unlawful and the Candidate prefers restriction to deletion; (c) Sett no longer needs the data but the Candidate requires it for legal claims; or (d) the Candidate objected based on legitimate interest, for the period needed to determine whether Sett's grounds override the Candidate's. - **Erasure:** in certain circumstances, such as when the Candidate objects to processing based on legitimate interest and there are no overriding legitimate grounds. Sett may still process data where necessary to comply with legal obligations or for legal claims. - **Withdrawal of consent:** where processing is based on consent, withdrawal can be made at any time. Withdrawal does not affect the lawfulness of processing before withdrawal. To exercise these rights, contact Sett through the channels in this notice. Sett may ask for reasonable evidence of identity before providing information. If Sett cannot provide requested information, it will explain why. ## Complaints Subject to applicable law, Candidates may lodge a complaint with their local data protection authority. In the EU, under Article 77 of the GDPR, a complaint may be lodged with the supervisory authority in the Member State of residence, place of work, or place of alleged infringement. A list of EU supervisory authorities is available [here](http://ec.europa.eu/newsroom/article29/document.cfm?action=display&doc_id=50061). In the UK, complaints go to the Information Commissioner's Office (ICO) [here](https://ico.org.uk/make-a-complaint/). ## Minors Sett does not recruit or employ individuals under the age of 18 and does not knowingly collect Personal Information about individuals under that age. ## Contact To exercise any rights, contact . _Source states: last updated in August 2025._