Job Applicant & Candidate Privacy Notice

1. Types of Personal Data We Collect & Legal Basis

In connection with your job application process, we collect the following:

• Identifiers – Name, address, email address, telephone number, and other contact information.
• Resume, CV, cover letter, previous work experience, professional licenses and certifications, job skills and qualifications, languages spoken, and education information.
• Reference information and feedback.
• Ability to work in the country where the position is located.
• Any other information you elect to provide to us, e.g., employment preferences, willingness to relocate, current salary, desired salary, awards, or professional memberships.
• CCTV footage of candidates when visiting our offices during interviews.

We do not actively collect any special categories of personal data – as that term is defined in the General Data Protection Regulation (EU) 2016/679 – from candidates or applicants. However, certain characteristics you manifestly make public, such as racial or ethnic origin, religious beliefs, and physical or mental health condition, may be revealed to us during interviews or through our CCTV footage. We do not record our interviews, nor do we keep notes on any of the foregoing characteristics from our interviews. Our CCTV footage is retained in accordance with this Privacy Notice and is not used to infer characteristics about you.

2. How We Collect Your Personal Data

We may collect this data in a variety of ways, including from our career portal; application forms; CVs or résumés, identity documents; third parties such as from your references, or from online or agency recruiters; from recruiting events; surveys; from other forms of pre–hire assessment, and through interviews.

If we ask you to provide personal data that we consider to be mandatory for us to manage your job application and candidate relationship with us, we will let you know at the time we’re collecting it. If you do not provide the data, we may not be able to process your application properly or at all.

3. How We Use Candidate Data

We will use your personal data collected pursuant to this Privacy Notice only for the purposes of carrying out the job application and recruitment process. In particular, we use your personal data to:

• Administer and manage your profile in our career portal.
• Assess your skills, qualifications, and interests against our career opportunities and determine your suitability for employment.
• Contact you if we need more information related to your application, to invite you to an event or to respond to a survey, or respond to questions from you.
• Schedule and/or conduct an interview with you.
• Decide whether to offer you a job.
• Carry out reference, checks if you are offered a job.
• Communicate with you about the recruitment process and/or your job application(s), including, in appropriate cases, informing you of other potential career opportunities.
• Maintain appropriate record–keeping related to recruitment and hiring practices and processes.
• Detect and protect against security incidents and malicious, deceptive, fraudulent or illegal activity, or violations of our policies or the law; for fraud and crime prevention; and for information protection and cybersecurity.
• Comply with our disaster recovery, business continuity, and record keeping obligations.
• Comply with applicable laws, regulations, legal processes, or governmental requests.

We do not subject job applicants and candidates to automated decision–making.

If you are offered and accept employment with us, the personal data collected during the job application and recruitment process may become part of your employment record. 

4. When We Disclose Your Personal Data

We may disclose your personal data as described in this Privacy Notice to the following categories of recipients: 

• Within the RB Global group of companies to carry out the job application and recruitment process and to establish your employment relationship with the group company that is your employer.
• Vendors, service providers and contractors we use to assist in providing services to us or assist us in administering the recruitment process. We require all our vendors, service providers and contractors, by written contract, to implement appropriate security measures designed to protect your personal data consistent with our policies and any data security obligations applicable to us.
• Third parties with your authorization.
• Law enforcement agencies, courts, supervisory authorities, regulatory bodies and certain other third parties, to the extent that we are permitted or required to do so by applicable law, or to comply with our legal and regulatory obligations, or in the interests of national security, or to respond to verified requests relating to a civil or criminal investigation or alleged or suspected illegal activity, or when we believe in good faith that disclosure is necessary to protect our rights, your safety or the safety of others, or investigate fraud.
• To third parties, in connection with a change of corporate control or other investment, such as a restructuring, merger, transfer, or sale of some or all of our assets.

5. Data Subject Rights

Job applicants and candidates are provided with privacy rights under applicable data protection or privacy law, subject to identity verification and certain exceptions and limitations, including:

• Right of Access: You have the right to obtain confirmation whether your personal data is being processed, and, where that is the case, obtain a copy of your personal data.
• Right to Rectification (Correction): You have the right to correct inaccurate personal data and the right to have incomplete personal data completed.
• Right to Withdraw Consent – for personal data you’ve provided to us on a consensual
  basis, you can withdraw your consent for future processing.

In addition, EU/EEA and UK applicants and candidates only:

• • Right to Erasure (Right to be Forgotten): You have the right to request we erase your personal data.
  • Right to Restriction of Processing: You have the right to restrict certain processing of your personal data.
• Right to Data Portability: You have the right to request the transfer of your personal data directly to you or to another organization in a structured, commonly used, and machine–readable format.
  • Right to Object: You have the right to object to certain processing of your personal data.

You have the right to lodge a complaint regarding our use of your data if your request or concern is not satisfactorily resolved. You may approach your local data protection/supervisory authority, including:

• EEA – European Data Protection Board
• UK – Information Commissioner’s Office
• Australia – Office of the Australian Information Commissioner

Under specific circumstances these rights may be limited. For example, if fulfilling your request would reveal personal data about another individual, or if you ask us to delete personal data which we are required by law to keep or which we need to defend claims against us. If there is an exception to fulfilling your request, we will communicate clearly and fully with you about the reason.

To exercise any of these rights, please contact us by using the contact details under the “Contact Us” or by submitting a request through our online privacy request portal. Please note, we may take steps to verify your identity by matching the information you provide with your request with the information we have on file about you. Depending on the sensitivity of the information at issue, we may utilize more stringent verification methods.

We will respond to such requests in accordance with the requirements of applicable data protection laws.

6. International Transfers

As a global organization, we may need to transfer your personal data to one or more RB Global group companies or to third parties for the purposes described in this Privacy Notice. Group companies or service providers may be located in countries other than where you reside, and those countries may have data protection laws that are different from the laws of the country in which you are located.

If your personal data is transferred to an RB Global recipient or third party in a country that is not considered to provide adequate protection under applicable data protection or privacy law, we take measures designed to ensure that your personal data is adequately protected and where required, ensure an appropriate transfer mechanism exists such as the EU–U.S. Data Privacy Framework, UK Extension to the EU–U.S. Data Privacy Framework, and Swiss–U.S. Data Privacy Framework, and agreements such as EU Standard Contractual Clauses or similar legally recognized standard contractual clauses.

7. Additional EU/EEA and UK Notices

Legal Bases for Processing. In the context of our activities in the EU/EEA and UK, our legal basis for processing your personal data is the following:

• • We have a legitimate interest in processing your contact and related information to consider your candidacy and communicate with you. The method by which we contact you is based on your consent.
  • Processing of data relating to your application that you share with us, such as resume, CV, skills, qualifications, references is based on our legitimate interest to find the most suitable candidate for the position
  • Our limited processing of special categories revealed to us through interviews or
    CCTV is based on our legitimate interest to monitor our premises and conduct in–person interviews.
  • Our processing of personal data, such as background checks and other screening, will be based on your consent, but may be necessary to enter into a contract with you for employment purposes depending on the role.
  • Processing of data about you when you participate in a survey or event is based on your consent and we may process this data to gather feedback about our process and your recruitment experience.
  • Our processing of data about you for security purposes is based on our legitimate interest in protecting our systems and networks.
  • Our processing of data about you for legal and regulatory purposes is based on a legal obligation or on our legitimate interest in complying with applicable laws and regulations.
  • Processing of data about you for business continuity and record keeping purposes is based on our legitimate interest in operating our business in an efficient and appropriate manner

What does each legal basis mean?

• • Consent: You have given clear consent for us to process your personal data and can choose to withdraw your consent by contacting us or using our online request form.
  • Legitimate Interests: The processing is necessary in connection with our legitimate interests in recruitment and hiring candidates and which do not override your data protection interests or fundamental rights and freedoms.
  • Legal Obligations: The processing is necessary to comply with our legal obligations, such as retaining records relating to the recruitment process for periods required under applicable laws or regulations.

If you have questions about or need further information concerning the legal basis on which we collect and use your personal data, please contact us using the contact details provided in the “Contact Us” section below.

Control of Personal Data. In the context of our activities in the EU/EEA and UK, the following group companies control the processing of your personal data:

• For any Ritchie Bros. positions:
  • Ritchie Bros. Shared Services B.V. located at Bijster 3, 4817 HX Breda, the Netherlands.
  • In the UK, its legal representative, Ritchie Bros UK Limited, located at Maltby Colliery, Tickhill Rd, Maltby S66 7QW.
• For any Synetiq positions:
  • Synetiq Limited, located at Bentley Moor Lane, Adwick–le–Street, Doncaster, DN6 7BD.
• For any positions that will support Rouse and/or SmartEquip operations:
  • Rouse Services LLC, located at 8383 Wilshire Blvd., Suite 900 Beverly Hills, CA 90211, USA or SmartEquip, Inc., located at Building 501 Merritt 7, Fifth Floor, Norwalk, CT 06851, USA, respectively, and in each case jointly with Ritchie Bros. Shared Services B.V.
  • In the EU/EEA Ritchie Bros. Shared Services B.V. acts as legal representative.
  • In the UK, Ritchie Bros. UK Limited.
• For any positions that will support Ritchie Bros. Financial Services operations:
  • Ritchie Bros. Financial Services Ltd. located at 9500 Glenlyon Parkway, Burnaby, British Columbia, Canada, V5J 0C6 jointly with Ritchie Bros. Shared Services B.V.
  • In the EU/EEA Ritchie Bros. Shared Services B.V. acts as legal representative.
  • In the UK, Ritchie Bros. UK Limited acts as legal representative. 

Any concerns or questions about a specific state or country, should be directed to us using the contact details provided in the “Contact Us” section below. If you are offered and accept employment, the personal data that becomes part of your employment record will be controlled by different group companies. Information about those companies and their processing of your data will be made available in an Employee Privacy Notice at or before the time employment commences.

RB Global’s US operating companies participate in the EU–U.S. Data Privacy Framework Principles (“EU–U.S. DPF”) and the UK Extension to the EU–U.S. DPF, and the Swiss–U.S. Data Privacy Framework Principles (“Swiss–U.S. DPF”, and together with the EU–U.S. DPF and UK Extension, the “Principles”) as set forth by the U.S. Department of Commerce regarding the collection, use, and retention of all pre–employment personal data that is transferred from the European Union (“EU”), the European Economic Area (“EEA”), the United Kingdom (“UK”) and Switzerland to the United States within the scope of its certification. The US operating companies have certified to the U.S. Department of Commerce that they adhere to the Principles. If there is any conflict between the statements in this privacy notice and the Principles, the Principles shall govern. To learn more about the Data Privacy Framework (“DPF”) program, and to view our certification, please visit the Data Privacy Framework site here.

The following RB Global, Inc.’s US operating subsidiaries adhere to the Principles: Ritchie Bros. Auctioneers (America) Inc., IronPlanet, Inc., Ritchie Bros. Asset Solutions Inc., Rouse Services LLC, Rouse Appraisals, LLC, Rouse Analytics, LLC, Rouse Sales, LLC, SmartEquip, Inc., Insurance Auto Auctions of Georgia LLC, Insurance Auto Auctions Tennessee LLC, Auto Disposal Systems Inc. Decision Dynamics LLC, Impact Texas LLC, Automotive Recovery Services , Inc., Insurance Auto Auctions, and Insurance Auto Auctions Corp.
In cases where transfers or disclosures (or onward transfers) to third parties are made, we rely on a service provider’s certification to the Principles (if sent to the US) and/or contractual means to require administrative and technological safeguards designed to mitigate the threat of unauthorized access, use or disclosure of your information (such as standard data protection clauses issued or approved by the European Commission). The US operating companies will remain liable under the Principles for any failure by a third party to comply with the Principles or a contractual arrangement with them unless, where permitted by applicable law, we prove we are not responsible for the event giving rise to the damage.

For information on how to exercise your privacy rights under the Principles, follow the instructions in section 5 of this notice above.

Please contact us if you have any questions about the transmission of information among members of the RB Global group of companies or our transfers to service providers using the contact information in section 10 below. We have designated JAMS, an alternative dispute resolution provider which has locations in the United States, EU, the UK and Switzerland, to address unresolved complaints concerning our handling of personal data received in reliance on the Principles. If you do not receive timely acknowledgment of your Principles-related complaint from us, or if we have not addressed your Principles-related complaint to your satisfaction, please visit JAMS by clicking here for more information or to file a complaint. The services of JAMS are provided at no cost to you.

Under certain conditions, a binding arbitration option may be available to you in order to address complaints not resolved by any other means. For further information, please visit the DPF site by clicking here. The US operating companies are subject to the investigatory and enforcement powers of the U.S. Federal Trade Commission with respect to all matters associated with the Principles. 

8. Security & Retention

We maintain technical and organizational measures, including, but not limited to, reasonably designed administrative, physical, and technical safeguards, designed to protect the personal data obtained as discussed in this Privacy Notice from accidental or unlawful destruction, loss, alteration, unauthorized disclosure, and access. However, no system of safeguards can guarantee the security of your personal data.

Unless a longer retention period is required by law, we will retain your personal data in accordance with our retention policies and for as long as is needed to fulfill the purposes outlined in this Privacy Notice. When the retention of your personal data is no longer required for these purposes or to comply with law, we will either delete or anonymize it.

As noted above, if you are offered and accept employment with us, the personal data collected during the job application and recruitment process may become part of your employment record.

9. Changes to this Privacy Notice

We will update this Privacy Notice from time to time. We will post the revised notice with an updated revision date on the career’s website.

10. Contact Us

If you have any questions, comments, complaints, or requests regarding this Notice or our processing of your information, please contact us directly at: dataprotection@rbglobal.com

Our address is:

RB Global, Inc.
Data Protection Office
Two Westbrook Corporate Center
Suite #1000
Westchester, Illinois, 60154

Toll Free: +1.800.663.1739