Job Applicant Privacy Notice
WHO WE ARE
WEP Clinical (“we”, “us”, “WEP”) is the data controller responsible for your personal data when you apply for a position with us. This means we determine how and why your personal data is processed in connection with recruitment.
If you have questions about this notice or how we handle your data, please contact:
SCOPE OF THIS NOTICE
This notice applies to all individuals who apply for employment with us, whether directly through our careers page, via our applicant tracking system (Lever), or through other channels. It explains how we collect, use, store, and protect your personal data throughout the recruitment process.
Additional information for applicants located in the European Economic Area (EEA) is set out in Appendix A.
WHAT PERSONAL DATA WE COLLECT
During the recruitment process, we may collect and process the following categories of personal data:
We do not scrape your CV data, enrich your profile with data from external sources, or source your data from third-party platforms. All personal data processed originates from your application through Lever and your responses during the recruitment workflow.
SPECIAL CATEGORY DATA
We do not request, require, or intentionally collect special category personal data (such as data concerning health, racial or ethnic origin, political opinions, religious beliefs, trade union membership, biometric data, or genetic data) as part of the recruitment process.
Our systems are configured to avoid the structured collection of such data.
If you voluntarily disclose special category data in free-text responses or supporting materials, we will treat it as incidental. Such data will not be used in recruitment decision-making. Where feasible, it will be disregarded or removed in accordance with data minimization principles. Only in exceptional circumstances (for example, to accommodate an explicit request for reasonable adjustments) would we assess whether a lawful basis under Article 9 UK GDPR applies.
HOW WE COLLECT YOUR DATA
Your personal data is collected through the following means:
• Directly from you when you submit an application through Lever (our applicant tracking system).
• Directly from you when you respond to text-based interview questions presented within the recruitment workflow.
• Generated through automated scoring based on your responses to predefined criteria.
• Generated through automated resume-to-job-description matching performed by TalentFit, a feature embedded within Lever.
PURPOSES AND LAWFUL BASIS FOR PROCESSING
A Legitimate Interest Assessment (LIA) has been conducted and is maintained to demonstrate that our interests in processing your data for recruitment purposes are not overridden by your rights and freedoms.
USE OF AUTOMATED TOOLS IN RECRUITMENT
a. What automated tools do we use?
We use Upwage, an automated recruitment support tool integrated within Lever, to assist with candidate screening and prioritization. Upwage processes the personal data you provide through your application and your responses to structured text-based interview questions.
b. What does the automated tool do?
(i) Upwage processes the personal data you provide through your application and your responses to structured text-based interview questions. Upwage scores and ranks candidates as High, Medium, or Low based on predefined, job-related criteria; applies knock-out rules where candidates do not meet mandatory eligibility requirements; and evaluate free-text responses against defined guidelines. Upwage does not scrape external data, infer sensitive characteristics, or conduct behavioral profiling.
(ii) TalentFit is a feature embedded within Lever that reviews your submitted CV/resume and compares it against the job description for the role you have applied for. Based on this comparison, it generates a rating of “Talent Fit” or “Not a Talent Fit” aligned to the role’s qualifications. TalentFit processes only the job description and your CV/resume. It does not collect any information beyond what you have already provided during the application process, and it does not require you to respond to additional questions. Before the comparison is performed, your CV/resume is anonymized.
c. Does either automated tool make hiring decisions?
No. Both Upwage and TalentFit operate as decision-support mechanism only. They do not produce final hiring decisions.
Our HR team reviews and validates all automatically generated candidate rankings and fit ratings. Recruiters can and do override scores, reassess candidates, and independently decide whether to progress or reject applicants.
All final hiring decisions are made exclusively by human decision-makers.
Because meaningful human involvement is embedded throughout the recruitment process, the automated scoring and fit rating does not constitute solely automated decision-making within the meaning of Articles 22A–22D of the UK GDPR (as amended by the Data (Use and Access) Act 2025). For applicants located in the EEA, the equivalent provision is Article 22 of the EU GDPR (see Appendix A, Section A.1).
d. Your rights regarding automated processing
Even though our recruitment process is not solely automated, we are committed to transparency and fairness. You may:
• Request further information about how the automated scoring works and the criteria used.
• Challenge the outcome of your application if you believe the process has been applied unfairly.
• Request that your application is reviewed by a human recruiter independently of the automated scoring.
To exercise any of these rights, please contact us using the details set out in Section 1 above.
WHO WE SHARE YOUR DATA WITH
We share your personal data with the following categories of recipients, acting as data processors on our documented instructions:
We may also share your personal data where required by law, regulation, or legal proceedings, or with professional advisors acting on our behalf. We will not sell your personal data to any third party.
INTERNATIONAL TRANSFERS
Your personal data may be transferred to countries outside the UK or the EEA where our processors operate. Where such transfers occur, we ensure that appropriate safeguards are in place in accordance with Chapter V of the UK GDPR, including; Standard Contractual Clauses (SCCs) or any other applicable mechanism.
Further details are available upon request.
RELEVANT US PRIVACY LAWS
WEP Clinical operates in the United States, with its US operations primarily based in North Carolina.
Where you are located in the United States, relevant US federal and state privacy laws may also apply to the processing of your personal data in connection with your application.
HOW LONG WE WILL KEEP YOUR DATA
When the applicable retention period expires, your personal data will be securely deleted from our systems and from our processors’ systems.
YOUR RIGHTS
Under applicable data protection law, you have the following rights in relation to your personal data:
To exercise any of these rights, please contact us using the details in Section 1. We will respond within one calendar month of receiving your request.
RIGHT TO COMPLAIN
If you are dissatisfied with how we handle your personal data, you have the right to lodge a complaint with the Information Commissioner’s Office (ICO):
We would appreciate the opportunity to address your concerns before you approach the ICO. Please contact us in first instance using the details in Section 1.
If you are located in the EEA, you may also lodge a complaint with the supervisory authority in the EU Member State where you reside, work, or where the alleged infringement occurred. See Appendix A, Section A.3.
CHANGES TO THIS NOTICE
We may update this notice from time to time to reflect changes in our recruitment practices or legal requirements. The current version will always be available on our careers page.
Where changes are material, we will take appropriate steps to bring them to your attention.
Appendix A: Additional Information for Applicants Located in the European Economic Area
Where you are located in the European Economic Area (EEA), the processing of your personal data is also governed by the EU General Data Protection Regulation (Regulation (EU) 2016/679) (“EU GDPR”). References in the main body of this notice to the UK GDPR should be read a including the equivalent provisions of the EU GDPR where applicable to you.
A.1 Lawful Basis and Automated Decision-Making
The Lawful basis set out in the main notice (legitimate interests under Article 6(1)(f), consent under Article 6(1)(a), and legal obligation under Article 6(1)(c)) apply equally under the EU GDPR.
Automated decision-making. The main notice references the UK’s Data (Use and Access) Act 2025, which amended Articles 22A-22D of the UK GDPR. Under the EU GDPR, the equivalent provision is Article 22, which has not been amended in the same way. However, because our recruitment process incorporates meaningful human involvement at every stage – with all final hiring decisions made exclusively by human decision-makers who review, validate, and can override the outputs of both Upwage and TalentFit – the automated scoring and fit rating do not constitute solely automated decision-making under Article 22 of the EU GDPR.
Your rights to obtain human intervention, express your point of view, and contest the decision, as set out Article 22(3) EU GDPR, are fully supported through the process described in the main notice.
A.2 International Transfers
Where your personal data is transferred outside the EEA, we rely on safeguards recognized under Chapter V of the EU GDPR, which may include European Commission adequacy decisions, EU Standard Contractual Clauses (SCCs), or other approved transfer mechanisms. EU and UK transfer frameworks operate independently; accordingly, transfers from the EEA are governed by EU-approved mechanisms, while transfers from the UK are governed by UK-approved mechanisms as described in the main notice.
Further details regarding the specific safeguards applied to your data are available upon request.
A.3 Your Right to Complain
In addition to the right to complain to the UK Information Commissioner’s Office described in the main notice, if you are located in the EEA you have the right to lodge a complaint with the supervisory authority in the EU Member State where you reside, where you work, or where the alleged infringement occurred. A list of EEA supervisory authorities is available on the European Data Protection Board website:
www.edpb.europa.eu/about-edpb/about-edpb/members_en
We would still appreciate the opportunity to address your concerns directly before you approach a supervisory authority.
Last Updated – April 2026