This notice is also available in Malay and Bahasa Indonesia.

This notice explains how the Luno Group and its wholly owned subsidiaries (“Luno”) process personal data concerning job applicants. The Luno company in the country you are applying to is responsible for protecting personal data. Depending on where you are located, the company with that responsibility will typically be known as the "data controller" or the "responsible party.” Please read this notice carefully.This notice is reviewed regularly and may be updated. We will ensure the most up to date version of this notice is published here.

An overview of our recruitment process

We receive applications directly from you through our website or LinkedIn, which feed into our applicant tracking system, Greenhouse (the ATS), or from recruiters who upload CVs directly to the ATS. The hiring manager, together with the talent acquisition team, will review the applications and shortlist applicants for the next stage, which could be either a take home test or a first round interview.Only once we have decided to extend you an offer will we contact your referees, conduct background checks and verify your right to work in the country you are applying to. If your application is successful and you accept a job with Luno, your personal data will become part of your employee file and will be processed in accordance with our employee privacy notice.

The personal data we obtain and process

We obtain categories of personal data from various sources. We need this information to assess your suitability for the role and for employment. You do not have to give us the information we ask for; however, if you choose not to provide this information, it may affect your application for employment with us.

Click here to see specific categories of personal data we may process

Sensitive personal data

We may be required to collect personal data that is considered sensitive or is classed as “special category” personal data. Sensitive personal data usually requires added protections under local law.

We will only process sensitive personal data for limited purposes and when permitted by local law in the following circumstances:

• We may ask you to disclose the existence of any fraud listings, criminal convictions and/or offences as part of the final stages of the application process to decide whether to proceed with offering you the relevant role. We may also independently check this information with external service providers together with information about your credit score. Given the nature of the services Luno offers its customers, any role requires a high degree of trust and integrity and so we use this information to satisfy ourselves that there is nothing which makes you unsuitable for the role.

• You may disclose your religious beliefs, disability status, health or any medical condition where it will assist us in making appropriate adjustments during the recruitment process.

• For candidates in South Africa, we may ask you to tell us your race, gender and disability status for data capturing purposes, where this is required to meet our transformation obligations relevant to hiring.

Why we use personal data

This section explains why we use personal data and the legal bases we rely on to use it. In most cases we use personal data because it is in our legitimate interest to do so, to take steps to enter into a contract of employment with you and to comply with our legal obligations. We may also ask for your consent before using certain personal data concerning you, including if the law of your country of residence does not recognise one or more of these legal bases.

See our more detailed reasons for processing personal data:

To determine your suitability for the role, to make hiring decisions and to manage our recruitment process.

This may include processing personal data to evaluate your application, discussing the role with you at an interview, assessing your skills, competence and knowledge by means of an online or written take home test and to communicate with you about your application.To do this we rely on our legitimate interest in recruiting qualified and experienced candidates and in order to take steps, at your request, to enter into an employment contract with you.

To carry out reasonable and proportionate pre-employment screening and background checks.

This may include conducting searches of public media, social media, criminal record checks and other such checks necessary for the role, including to check your right to work status and to contact and discuss your application with your referees.

To do this we rely on our legitimate interest in recruiting suitable candidates and in order to take steps, at your request, to enter into an employment contract with you.

To contact you about future roles and career events. 

We will ask for your consent before using personal data for this reason.

To provide you with reasonable accommodation during the recruitment process. 

For example, to accommodate any health issues or dietary requirements, etc.To do this we rely on our legitimate interest in providing an accessible experience for certain candidates. Please also see the section on processing of sensitive personal data.

To comply with diversity, inclusion, equal opportunities and similar anti-discrimination laws which require record keeping and reporting.

To do this we rely on our need to comply with legal obligations or, when provision of such information is voluntary, we will ask for your consent.

Should your application be successful, to create your employee profile, prepare your employment contract and begin setting you up on our systems.

To do this we rely on our legitimate interest in speedy and efficient onboarding and to take steps, at your request, to enter into an employment contract with you.

To protect our rights in the event of disputes, litigation, etc.

To do this we rely on our need to comply with legal obligations, to establish or defend legal claims, for our legitimate interest in defending ourselves and our employees or to exercise our rights.

To protect our rights and our property, and the safety of our employees and other individuals.

This may include collecting personal data to prevent, detect and respond to security incidents and fraudulent activity, to secure our office premises and for reasons of public health or otherwise required by law.

To do this we rely on the legitimate interests of Luno and third parties or to protect the vital interests of an individual (only in limited circumstances, usually emergencies).

When you are referred by a Luno employee or alumni.

To do this we rely on our legitimate interest in recruiting qualified and experienced candidates.

To monitor diversity, inclusion and equal opportunities at Luno. 

This typically involves compiling anonymised information gathered during our recruitment process. We do this to evaluate the effectiveness of our policies.

To do this we rely on our legitimate interest in the continuous development and improvement of our recruitment processes.

How we obtain personal data

We obtain personal data from the following sources:

• You, as the job applicant, when you submit your application online or send a speculative application by email.
  
  

• Your named referees when we contact them to discuss your application with them.
  
  

• Publicly available sources such as LinkedIn, careers sites and jobs boards.
  
  

• Luno employees or alumni who have referred you to us.
  
  

• Recruiters and headhunters.
  
  

• Other third parties such as screening services, law enforcement agencies and government authorities.

Who we share personal data with and why

Luno engages third party service providers and works with partners and other third parties who support our employment processes. This requires us to share or give access to personal data for the reasons given below.

Third-party service providers

Our service providers who help us to manage our recruitment processes. These providers act on our behalf as data processors in terms of a contract with Luno. They cannot process personal data about you unless we have instructed them to do so and they may not share it with anyone else. All our third-party service providers are required to take appropriate security measures to protect your personal data and keep it confidential.

Service providers we use in our recruitment processes include:

• Greenhouse: If you apply to us through our website you will submit your application to us via Greenhouse, which will hold your application data. Only authorised Luno employees will have access to your application. Greenhouse provides these services to us under contract.

• HackerRank: for carrying out our pre-employment tests.

• Metaview: AI note-taking service used to video record interviews and transcribe key points during the interview, allowing interviewers to focus on engaging with you rather than taking manual notes. You will be informed about the use of the AI note-taking service prior to the interview. You will have the option to opt out of this service freely, and doing so will not negatively impact your application process.

Luno Group 

Certain recruitment tasks may be carried out by employees of a Luno company other than the company you are applying to in order to process your application. All Luno group entities are required to take appropriate security measures to protect your personal data and keep it confidential.

Other third parties

We may also share personal data about you with these third parties:

• Background screening services such as Refinitiv WorldCheck, HireRight, LexisNexis, MIE as well as government databases.

• Recruiters, to inform them about the outcome of your application.

• Law enforcement authorities.

• Other government and regulatory agencies.

When data processing is carried out on our behalf, we conclude a separate agreement with service providers, called a data processing agreement, which ensures that they process personal data on our instructions and implement appropriate technical and organisational measures to keep personal data secure and to protect your rights. 

Sometimes third parties may use personal data to comply with their own legal obligations, for example payments processors and banks, others may use the data, usually in anonymised and aggregate form, to improve their services. When they do this they do so as the data controller and are responsible for compliance with data protection law.

International transfers of personal data

Personal data may be transferred to, and processed in, countries other than the country in which you are located. These countries may have data protection laws that are different to the laws of your country and may have laws which provide a lower level of protection.For example, personal data will be processed by Luno companies in various jurisdictions and by our third parties who operate around the world. We will only transfer personal data where permitted by local law and with appropriate safeguards such as standard contractual clauses. 

How long we keep personal data for

If your application is successful and you accept an offer from us, personal data will be kept in accordance with our employee privacy notice. If you are unsuccessful, we will retain personal data for up to 12 months after we have communicated our decision to you, unless local law requires a longer period of time, in line with our data retention policy and retention schedule. We retain your application in case of legal claims and to ensure that our recruitment process is fair, transparent and does not unfairly discriminate. We will also retain your personal data for internal auditing and talent pooling, as well as anonymised, aggregated data to analyse our diversity, equity and inclusion effectiveness. After this period we will securely dispose of your application.We will ask for your permission to keep your application for longer than 12 months if we think that you might be suitable for opportunities that may arise in the future.

Keeping personal data secure

Luno places great importance on data security and has put in place appropriate security measures to prevent personal data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. We limit access to your personal data to those employees, agents, contractors and other third parties who have a business need-to-know in the hiring process. They will only process your personal data on our instructions and they are subject to a duty of confidentiality. We also have procedures in place to deal with any suspected data security breach and will notify you and any applicable regulator of a suspected breach where we are legally required to do so.

Your rights

Depending on the applicable law and the circumstances of the processing, you may be entitled to exercise the following rights:

• Ask us to give you access to personal data. 

This right entitles you to receive confirmation that we process personal data relating to you and you may sometimes also be able to request a copy of the personal data. Remember that you can access and update your details on Greenhouse at any time.

• Ask to have personal data relating to you erased. 

This right entitles you to ask us to delete or remove personal data concerning you. Please note that we may not be able to comply with your request either in whole or in part because of certain legal reasons. To the extent that we can’t comply with your request we will get in touch with you to give you the reasons for our decision.

• Object to our processing of personal data. 

Where we process personal data based on our legitimate interests but you believe there are circumstances that mean we shouldn’t, you may submit an objection; however there may be times when we can demonstrate legitimate grounds that override your objection. If we believe we have legitimate grounds to override your objection we will be in touch with you to give you the reasons for our decision. You may also object to our processing for the purpose of sending you direct marketing communications. 

• Ask for processing to be restricted. 

If you are unsure about the accuracy of the personal data we are processing relating to you or you think we shouldn’t be processing it or our reason for processing is unclear, you may ask us to restrict the processing.

• Ask for personal data relating to you to be corrected or updated. 

You may ask us to update any inaccurate or out of date record. Remember that you can access and update your details on Greenhouse at any time. 

• Make a complaint to a supervisory authority. 

You may have the right under local law to complain to the local supervisory authority in your country. 

Luno will honour these rights to the extent required by law. You may exercise your rights by submitting your request to [email protected] in the first instance.

How to contact us

Should you have any query in relation to this Privacy Notice or how we handle personal data please contact our Talent Acquisition Team in the first instance.