APPLICANT PRIVACY NOTICE

Version: 2026

1. INTRODUCTION

We are committed to protecting your personal data and handling it in a transparent and secure manner.

This Applicant Privacy Notice explains how we collect, use, and process your personal data during the recruitment process across our entities.

2. IDENTITY OF THE DATA CONTROLLERS

Depending on the role and location, your data is processed by:

Fishtank Consultancy, S.L.
Barcelona, Spain
Fishtank Consultancy México, S.A. de C.V.
Mexico

Both entities operate jointly and may act as joint controllers for recruitment activities.

Contact:
dataprivacy@fishtankconsultancy.com

3. PURPOSE OF PROCESSING

We process your personal data to:

manage and administer the recruitment process
assess your suitability for a role
communicate with you during the recruitment process
make hiring decisions
manage potential future opportunities (if applicable)
support recruitment activities for our clients

As part of this process, we may use system-supported tools, including AI-based functionalities, to support the evaluation and organisation of applications.

4. WHAT DATA WE COLLECT

We may process the following personal data:

contact details (name, email, phone number)
CV and professional experience
education and qualifications
interview notes and evaluation feedback
communication records
any information you voluntarily provide

In certain cases, we may also process:

availability information
salary expectations
references (if applicable)

We do not intentionally collect sensitive personal data unless required and permitted by law.

5. LEGAL BASIS

For EU candidates (GDPR):

Pre-contractual steps (Art. 6(1)(b))
Legitimate interest
Consent (e.g. talent pool)

For Mexico (LFPDPPP):

Consent provided by submitting your application
Legitimate business purpose for recruitment

6. HOW WE COLLECT YOUR DATA

We collect your data:

directly from you (applications, emails, interviews)
via recruitment platforms or referrals (if applicable)

7. TOOLS AND SYSTEMS USED

We use the following systems:

Zoho Recruit (applicant tracking system, including AI-supported functionalities)
Microsoft Teams (interviews and communication)
Email communication tools

These systems may be used by both entities as part of a shared operating model.

8. DATA SHARING

Your data may be shared with:

internal team members across our entities
clients, when recruitment is performed on their behalf
service providers supporting the recruitment process

Access is limited to what is necessary.

9. INTERNATIONAL DATA TRANSFERS

Your data may be processed across:

Spain (EU)
Mexico

Additionally, some service providers may process data outside these locations.

Where required, we ensure appropriate safeguards, such as:

Standard Contractual Clauses
contractual data protection agreements

10. DATA RETENTION

We retain your data:

during the recruitment process
up to 6 months after completion

If you consent to be considered for future roles, we may retain your data for a longer period.

11. YOUR RIGHTS

EU candidates:

access, correction, deletion
restriction or objection
data portability
withdraw consent
lodge a complaint with a supervisory authority

Mexico (ARCO rights):

Access
Rectification
Cancellation
Opposition

Requests can be submitted via:
dataprivacy@fishtankconsultancy.com

12. OBLIGATION TO PROVIDE DATA

Providing your data is voluntary.
However, without certain information, we may not be able to process your application.

13. AUTOMATED DECISION-MAKING

We do not make hiring decisions based solely on automated processing.

System-supported tools, including AI-based functionalities within our recruitment platform, may assist in organising, analysing, or ranking candidate information. All hiring decisions are made with human involvement.