Careers at Ecorys

Purpose of this Notice

This Global Recruitment Privacy Notice (hereinafter, the 'Notice') explains how Ecorys processes personal data of individuals who apply for roles across the Ecorys Group. It describes what we collect, why we collect it, how we share it, how long we keep it, and how to contact us.

This Notice is based on UK GDPR (the UK General Data Protection Regulation, as incorporated into UK Law by the Data Protection Act 2018) and EU GDPR (Regulation (EU) 2016/679 – the EU General Data Protection Regulation). If you are applying for a role outside these areas, you will find jurisdiction-specific annexes detailed below.

Who we are and how to contact us

Ecorys comprises multiple group entities. The Ecorys entity recruiting for a role will usually act as the organisation responsible for that recruitment process and as the data controller.

Who this Notice applies to

job applicants (employees, experts, and temporary assignments).
individuals who submit speculative applications; and
individuals identified via recruitment platforms or professional networks

This Notice covers personal data processed before, during, and after the recruitment process, whether or not an application is successful.

How we use your data (purposes)

We use applicant data to:

Processing your application, including setting up interviews and contacting you about the results of the application.

Fulfilling our legal and regulatory obligations

Controller details

Ecorys refers to one or more members of the Ecorys Group, each of which is a separate legal entity and can determine the purposes and means of data processing (i.e., act as a data controller). References to “Ecorys”, “we”, “us” or “our” include the Ecorys group entities involved in the recruitment process.

Lawful bases for processing

Ecorys relies on the following lawful bases under Article 6 UK/EU GDPR:

Legitimate interests (Article 6(1)(f)) - to operate an effective recruitment process, such as receiving and assessingapplications and communicating with candidates.

Performance of a contract (Article 6(1)(b)) - where processing is necessary to consider entering an employment contract
Legal obligation (Article 6(1)(c)) - e.g., right to‑ ‑work checks or other legal requirements; Consent (Article 6(1)(a)) where required, such as retaining applicant data for future opportunities (talent pool).

Special categories of personal data

Where we process special categories of personal data, we rely on:

Article 9(2)(b) - obligations and rights in the field of employment/social protection law (where applicable); and/or
Article 9(2)(a) - explicit consent, where appropriate.

We do not intentionally collect unnecessary or excessive personal data

International data transfers (UK/EEA)

Because Ecorys operates internationally, applicant information may be accessed by relevant Ecorys teams or service providers in other countries. Where cross-border transfers are restricted under applicable law, Ecorys employs appropriate safeguards.

Automated Processing of Personal Information

During the recruitment process, we may utilise artificial intelligence recruitment software to review applications. The software will assess job applications against the advertised job criteria. Our recruitment team does not dismiss candidates based on automatically generated recommendations. and you will not be subject to a decision made solely on the automated processing of your personal information. Decisions are never made solely on AI and are always subject to human oversight.

The software we utilise is an online recruitment and applicant tracking system provided by The Infuse Group Ltd (trading as Pinpoint Software). Pinpoint processes personal data on Ecorys’ instructions and supports recruitment administration and workflow.

Pinpoint’s own privacy information (supplementary to this Notice) is available here:
Pinpoint Data Processing Addendum (Aug 2025)

Personal data we collect

Identification and contact details (name, address, email, phone).
Application data (CV, cover letter, qualifications, employment history, skills, experience).
Assessment data (interview notes, test results, scoring, feedback).
Right to work / eligibility information (nationality, immigration status, copies of ID where required).
Publicly available professional information (LinkedIn profile), where relevant to the role.

The data we collect during the recruitment process and how we use it may differ depending on the jurisdiction where the position is based, and providing all data may not be mandatory.

Along with the information you provide, we may also collect personal details about you from third parties, including former employers, vetting service providers, publicly accessible databases, and publicly available professional information on social media platforms.

If your application is successful, you will receive a privacy notice applicable to all Ecorys employees, outlining how Ecorys processes your data as an employee. Sharing your data

Access to applicant data is restricted to people involved in the recruitment, such as:

HR teams and recruiting managers.
interviewers and assessors; and
authorised Ecorys staff and service providers supporting recruitment.

We do not sell or share applicant data for unrelated purposes.

Data retention

Ecorys will retain personal information only for as long as necessary for the purposes outlined in this Notice or to comply with applicable legal or professional obligations.

Recruitment data is kept only for as long as necessary and in accordance with Article 5(1)(e) UK/EU GDPR. Unsuccessful applicants' data is stored in our third-party supplier recruitment system (Pinpoint) for 18 months. Successful applicants will have their application data stored in the third-party supplier system (Pinpoint) for 12 months, after which the information will be transferred to the individual's HR files. The length of time your data will be held will be outlined in the employee privacy notice.

Your rights (UK/EU GDPR)

Subject to applicable law, you may have certain rights in respect of the personal information that we hold about you, including:

Right of access. You have the right to access and obtain a copy of your personal information
Right of Portability. You have the right, in certain circumstances, to receive a copy of the personal information you have provided to us in a structured, commonly used, machine–readable format that supports re-use, or to request the transfer of your personal information to another person.
Right to rectification. You have the right to obtain rectification of any inaccurate or incomplete personal information we hold about you without undue delay.
Right to erasure. You have the right, in some circumstances, to require us to erase your personal information without undue delay if the continued processing of that personal information is not justified
Right to restriction. You have the right, in some circumstances, to require us to limit the purposes for which we process your personal information if the continued processing of the personal information in this way is not justified, such as where the accuracy of the personal information is contested by you.
Right to object. You have a right, in some circumstances, to object to any processing based on our legitimate interests. There may, however, be compelling reasons to continue processing your personal information, and we will assess and inform you if that is the case.

Complaints (UK/EU)

If you believe your personal data has been processed unlawfully, you can lodge a complaint with:

UK: Information Commissioner’s Office (ICO) — https://www.ico.org.uk
EU/EEA: your local data protection supervisory authority.

We encourage you to contact us first at privacy@ecorys.com so we can help resolve any queries.

Changes to this Notice

We may update this Notice from time to time to reflect changes in law, guidance, or recruitment practices. The latest version will be made available during the recruitment process.

We use Pinpoint, an online software product provided by The Infuse Group Ltd (t/a Pinpoint Software), to assist with our recruitment process. We use Pinpoint to process personal information as a data processor on our behalf. Pinpoint is only entitled to process your personal data in accordance with our instructions