Applicant Privacy Notice

Last modified on 3 October 2024.

1. Introduction

This is the Ultromics Applicant Privacy Notice. The Ultromics Group has a parent company, Ultromics Ltd, which is based in the UK and a subsidiary, Ultromics Inc, which is based in the US. We are committed to being transparent about how we collect, store and manage your personal data, where we decide the purpose and means of the information processing (as a Controller) or we otherwise process it (as a Processor) under the authorisation of another organisation. Ultromics is registered with the Information Commissioner’s Office (ICO) with registration number ZA756042. We will let you know which entity will be the Controller for the personal data we hold about you.

As part of any recruitment process, Ultromics (“the Company”), collects and processes personal data relating to job applicants. We are committed to being transparent about how we collect, store and manage your personal data. This privacy notice will also tell you about your rights when it comes to your data.

Ultromics Ltd

Office address: 4630 Kingsgate, Cascade Way, Oxford Business Park South, Oxford, OX4 2SU. Telephone number: 0808 196 8558

Ultromics Inc

Office address: Atlanta Financial Center, 3343 Peachtree Rd NE Ste 145-1626, Atlanta, GA, 30326. Telephone number: 877-577-3420

Data Protection Officer (DPO)

We have appointed a Data Protection Officer (DPO), HelloDPO who can be contacted at the following address: hello@hellodpo.com.

2. What we do 

Ultromics is a global health technology firm. We have developed and manufactured a suite of software products and services, called EchoGo®. Our products are each classed as a medical device. EchoGo® uses artificial intelligence to assist with automating analysis and calculations.

3. What data we have  

Ultromics collects data from you:

When you use and engage with our brand website(s);

When you visit our offices (personal identifiers, cctv images and contact details);

When you engage with us for recruiting activities (personal identifiers, contact details, resume, screening results, references); and

When you contact us through any means for example social media, website forms, website chat function, survey responses, other enquiry routes.

What types of personal data do we collect

We collect and use a range of information about you. This may include:

your name, address and contact details, including email address and telephone number;

details of your qualifications, skills, experience and employment history;

information about your current level of remuneration, including benefit entitlements;

whether or not you have a disability for which the Company needs to make reasonable adjustments during the recruitment process;

information about your entitlement to work in the UK; and

equal opportunities monitoring information, including information about your ethnic origin, sexual orientation, health, and religion or belief.

The Company collects this information in a variety of ways. For example, data might be contained in application forms, CVs or resumes, obtained from your passport or other identity documents, or collected through interviews or other forms of assessment.

The Company will also collect personal data about you from third parties, such as references supplied by former employers only once a job offer to you has been made.

Data may be stored at Ultromics’ UK office and will be stored in a range of different systems, including on your application record, in HR management systems and on other IT systems (including email).

Cookies and online tracking

In addition to the cookies used with our website, the section of our website managing applications for open positions is a third-party system which may also use cookies.

4. Why we have your data

Ultromics must identify a legal basis to process your personal data. We have detailed the legal bases which we rely upon to process personal data below:

Purpose/activity	Data Type	Lawful Basis
When you contact us through any means, for example social media, website forms, website chat function, survey responses, other enquiry routes	Personal identifiers and contact details	Legitimate business interest
We collect your details for recruitment with a view to your joining us as an employee When you engage with us for career development and recruiting activities	Your professional qualifications, educational background and your public life when you communicate with us through our website or email, for careers purposes, or have otherwise made publicly available. (personal identifiers, contact details, resume, screening results, references)	Legitimate business interest and performance of a contract
We have a duty to keep a register and associated records, or where laws and authorities may require us to do so.	names, roles and contact details (telephone, email, address), photographs and video or call recordings such as may be provided by you when filling out our forms, visiting our offices, or provided by you or your organisation for engagement with us for the purposes of supplying our services or collaborating with us on projects. Special category information (such as ethnic origin, sexual orientation, health or religion or belief)	Compliance with a legal obligation (Health and Safety laws) Equal opportunities monitoring purposes (Data Protection Act)
We have a duty to process successful applicant health information if “reasonable adjustments” discussions are triggered	Successful applicant sensitive personal health information	Compliance with a legal obligation – such as UK Disabilities Act
Right to work eligibility checks for successful applicant	Name and address	Compliance with a legal obligation
You might visit our office and have an accident or need medical attention whilst on our site	names, roles and contact details (telephone, email, address), photographs and video or call recordings such as may be provided by you when filling out our forms, visiting our offices	To protect your vital interests in line with Health and Safety laws

When you visit our offices or engage with us at conferences and events (personal identifiers, cctv images and contact details)

Access tracking if you visit our offices in person and are provided with a temporary access fob for entry to our office building.

Legitimate business interest

When you use and engage with our brand website(s);

IP address, browser information, device type such as may be provided by you when you connect to our website, fill in our online forms

Browsing behaviour if you have agreed to our use of non-essential cookies when you interact with our website

Consent

5. What sub-processors we use

We may share your personal information with the following third parties:

Service providers and advisors. We may share your personal information with third party vendors and your former employer(s). This may include providing storage and hosting services, network services, email or call handling, chat services, web hosting, email for requesting references and recruitment support platforms.
Purchasers and third parties in connection with a business transaction. Your personal information may be disclosed to third parties in connection with a transaction, such as a merger, sale of assets or shares, reorganisation, financing, change of control or acquisition of all or a portion of our business. This is under the provision that we inform the buyer it must use your personal information only for the purposes disclosed in this privacy notice.
Law enforcement, regulators and other parties for legal reasons. We may share your personal information with third parties as required by law or if we reasonably believe that such action is necessary to (i) comply with the law and the reasonable requests of law enforcement; (ii) detect and investigate illegal activities and breaches of agreements; and/or (iii) exercise or protect the rights, property, or personal safety of Ultromics, its users, or others.

A list of our current sub-processors is available on request by contacting privacy@ultromics.com.

Third-party links on this website. There are social media links on our website, such as LinkedIn, Twitter and Facebook. From time to time we may also publish links to other third-party sites such as links to academic publications, or medical associations and organisations. Clicking on these links or enabling those connections may enable the third-party to collect or share data about you. For example, when you click on the social media links you land on our social media page relevant to the link. If you are logged into your social media account and you click through to these from our website, the social media service provider may collect information indicating that you have visited our website and link the site visit to your social media profile.

We do not control these third-party websites and are not responsible for their privacy notices or practices. When you leave our website, we recommend that you read the privacy notice of the sites you choose to visit.

6. How we keep your personal information secure

The Company takes the security of your data seriously. We are ISO/IEC 27001:2013 and Cyber Essentials certified; representative of our focus on ensuring that we have implemented reasonable and appropriate technical and organisational measures to securely protect the personal information we process against accidental or unlawful destruction, loss, change or damage. We have internal policies (including supplier risk management) and controls in place to ensure that your data is not lost, accidentally destroyed, misused or disclosed to unauthorised individuals.

Despite these safeguards, no internet-based transmission or information storage technology can be guaranteed 100% secure so we cannot promise that our security measures won’t be overcome. We will follow our security incident response procedures should this occur.

Please contact us at security@ultromics.com if you have concerns.

7. Where we process your personal data

Our business administration activities use service providers and other third parties which can support our business administration by processing in the UK, US, Canada, New Zealand, EEA and EU.

We have appropriate legal agreements in place, based on adequacy decision, appropriate safeguards or standard contractual clauses with those supporting organisations, for the transfer of your data outside the UK or EEA where this is restricted.

8. How long we keep your personal data

We will store the personal information we collect for our own purposes for no longer than necessary for the purposes set out and in accordance with our legal obligations and legitimate business interests.

If your application for employment is unsuccessful, the Company will hold your data on file for 6 months after the end of the relevant recruitment process to support legitimate business needs. At the end of that period, your data is deleted or destroyed.

If your application for employment is successful, personal data gathered during the recruitment process will be transferred to your personnel file and retained during your employment. The periods for which your data will be held will be provided to you in a new privacy notice, which we have published for our employees.

9. Your personal data rights

Where we are acting as a data Controller and depending on your location and subject to applicable law, you may have information rights. This is particularly the case if you are resident in the UK or European Union. If you wish to exercise one of these rights, please contact us. Under UK and EU data protection law, you have rights including:

Your right of access – You have the right to ask us for copies of your personal information.

Your right of rectification – You have the right to ask us to rectify personal information you think is inaccurate. You also have the right to ask us to complete information you think is incomplete.

Your right to erasure – You have the right to ask us to erase your personal information in certain circumstances, such as it is no longer necessary for the purposes we originally collected it for. This is also known as the right to be forgotten.

Your right to restriction of processing – You have the right to ask us to restrict the processing of your personal information in certain circumstances

Your right to object to processing – You have the right to object to the processing of your personal information in certain circumstances. However, we may not need to stop if we can give strong and legitimate reasons to continue using it. You also have the right to withdraw consent, where our processing of your data is on the basis of consent previously given by you.

Your right to data portability – You have the right to ask that we transfer the personal information you gave us to another organisation, or to you, in certain circumstances.

Your right not to be subject to automated processing – Automated decision-making takes place when an electronic system uses personal data to make a decision without human intervention. You have the right not to be subject to automated decisions that will create legal effects or have a similar significant impact on you, unless you have given us your consent, it is necessary for a contract between you and us or is otherwise permitted by law. You also have certain rights to challenge decisions made about you. We do not make any automated decisions about you. Ultromics does not currently carry out any automated processing.

You are not required to pay any charge for exercising your rights. If you make a request, we have one month to respond to you. Before we can process your request, we may need information from you to help us confirm your identity.

10. Children’s privacy

Our recruitment capabilities are not directed at, or intended for, persons under 16 years old, and we do not knowingly collect personal information from or relating to children. If you believe, or become aware, that a child under 16 years may have provided us with personal information, then please contact us so that we can take steps to remove such information.

11. How to raise questions, complaints or exercise rights

Please contact us at any time should you have any questions, complaints regarding this privacy notice or our associated practices, or wish to exercise your personal data protection rights. All communication will be investigated thoroughly. Please use the contact us form on our website or send an email to privacy@ultromics.com.

You also have the right to lodge a complaint to the Information Commissioner’s Office (ICO), or your national/local data protection authority. If you would like to complain to the ICO about how we have dealt with your request, please contact:

Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

Helpline number: 0303 123 1113

ICO website: https://www.ico.org.uk

If you are outside of the UK, please check with your local data protection authority for advice.

The European Data Protection Board member authorities list can be founds here.

Change History

October 2024

We updated office addresses and DPO contact details.

We updated information in How long we keep your personal data and Why does the Company process personal data.

We enhanced How to raise questions, complaints or exercise rights section.

September 2020

New privacy notice.