Candidate Privacy Notice

This notice applies when Rockstone sources, contacts, assesses, represents, places or employs a candidate. The controller depends on the market, client, role and contractual relationship.

Rockstone entities

The Irish entity normally controls Irish recruitment and Irish employment records; the Swiss entity normally controls Swiss recruitment and Swiss employment records. A project may involve both entities as independent or joint controllers. Rockstone will identify the responsible entity on request and in contractual documentation. Recruitment services are carried out only where required licences and permissions are in place.

• identity, contact, location, work-authorisation and availability information;
• CV, employment and education history, skills, qualifications, professional memberships, portfolio and compensation expectations;
• communications, interview notes, assessments, preferences and consultant observations relevant to the role;
• references, background-screening results and identity or right-to-work evidence where lawful and necessary;
• special-category data, including adjustment, health, diversity or trade-union information, only where a lawful condition applies;
• criminal-offence data only where legally permitted and genuinely relevant to the role; and
• information supplied by you, referees, clients, former employers, public professional profiles, job boards, referrals, approved sourcing tools and public records.

If Rockstone obtains your information from another source, it will provide this notice at the first communication with you and in any event no later than one month after obtaining the data, or before the first disclosure to a client if that occurs sooner, unless a lawful exception applies.

A consultant must identify the client and opportunity and record your permission before releasing an identifiable CV or profile. General agreement to be contacted, a website privacy acknowledgement or inclusion in a talent pool is not permission for a client submission. Rockstone will normally contact referees only after informing you and obtaining permission. Where a client requests direct contact, you will be told unless law prevents it.

Recipients may include the other Rockstone entity, the specific client you authorise, interview or assessment providers, reference and lawful screening providers, payroll and employment-administration providers, professional advisers, approved IT and communications providers, insurers and public authorities. Rockstone limits disclosures to what is necessary and uses processor terms where a supplier acts on its instructions.

Candidate data may be accessed in Switzerland, Ireland or a client or service-provider country. Rockstone uses adequacy decisions, approved standard contractual clauses or another lawful safeguard for restricted transfers. Candidate permission to submit a CV is separate from, and does not replace, the legal transfer safeguard.

Rockstone may use approved tools to search, organise or compare information. A responsible person reviews material outputs and makes the final recruitment decision within Rockstone’s control. Rockstone does not use solely automated decision-making that produces legal or similarly significant effects. Unapproved public AI tools must not be used with identifiable candidate information.

• ask for access, correction, deletion, restriction or portability where the legal conditions apply;
• object to legitimate-interest processing and direct marketing;
• withdraw consent or candidate-submission authorisation before the disclosure occurs;
• ask Rockstone to identify the source of data it did not receive from you; and
• complain to a competent data-protection authority.

Withdrawing authorisation cannot reverse a disclosure already made with permission, but Rockstone will record the change and take reasonable next steps. Rockstone may retain limited information where required by law or needed for legal claims.

Rockstone applies access controls, confidentiality obligations, approved systems, secure transfer and incident-response measures appropriate to recruitment data. Please keep your information accurate and avoid sending unnecessary sensitive documents. The current version and issue date of this notice will be published online.

Candidate privacy questions, rights requests or complaints may be sent to info@rockstoneengineering.com. Please state the Rockstone entity, role or recruitment process concerned. Rockstone will route the request to the responsible team and entity.

You may also complain to the Irish Data Protection Commission (www.dataprotection.ie) or the Swiss Federal Data Protection and Information Commissioner (www.edoeb.admin.ch). You may contact the authority in the country connected with your matter; other competent authorities may also be available under applicable law.