Privacy Policy

The Infuse Group Ltd, trading as Pinpoint Software, is the controller of the personal information described in this notice. We are a company incorporated in Jersey, registration number 124135, with our registered office at 9 Bond Street, St Helier, Jersey, JE2 3NP. We refer to ourselves below as “Pinpoint”, “we” and “us”.

This notice explains what we do with your personal information when you apply to work with us, and when we find you or contact you about a role. It is separate from the privacy policy that covers our customers and our website visitors.

If you have any questions about this notice, or you want to exercise any of the rights described in it, email us at privacy@pinpointhq.com.

•          Your name, email address, phone number and location

•          Your CV, and anything else you upload or tell us

•          Your work history, qualifications, skills and experience

•          Your answers to our application questions

•          Your LinkedIn profile, if you apply using LinkedIn or you share it with us

•          Notes, recordings and transcripts from interviews and assessments

•          Anything you tell us during the process, by email, on a call or in person

•          Your right to work status, and any adjustments you ask us to make

•          Diversity monitoring information, if you choose to give it

•          Technical information about your visit to our careers site, including the pages you viewed and how you reached us

You do not have to give us any of this information. If you do not give us what is marked as required on our application form, we will not be able to consider your application.

Sometimes we hold information about you that did not come from you directly. Where that happens, the information is of the same kinds described above:

•          Your name and contact details

•          Your work history, skills and qualifications

•          The content of your public professional profile

•          A CV and any accompanying notes supplied by a recruitment agency

•          What a referee tells us about you

•          The result of a background check

•          Sourcing platforms we use to find candidates

•          Publicly available professional profiles, including LinkedIn

•          Referrals from our own employees

•          Recruitment agencies, where we are working with them on a role

•          Referees you nominate, at offer stage and only with your knowledge

•          Background check providers

If we obtain your information this way, we will tell you within one month of obtaining it, or when we first contact you if that is sooner.

Below is each thing we do with your information, and the lawful basis we rely on for it.

To assess your application and run our hiring process. We use everything described above that relates to your application: your CV, your answers, and the notes and assessments from your interviews. Where you have applied directly, our lawful basis is your consent, which you give when you submit your application. You can withdraw it at any time by emailing us, and we will stop assessing your application. Where we have sourced your profile and instigated contact, we rely on legitimate interests. You can object at any time.

To monitor and improve the fairness of our hiring. We use your diversity monitoring answers, if you choose to give them. Our lawful basis is our legitimate interests in monitoring equality of opportunity. Where these answers are special category information, our additional condition is equality of opportunity or treatment.

To make adjustments so you can take part in our process. We use what you tell us about the adjustments you need, which may include information about your health. Our lawful basis is our legal obligation to consider reasonable adjustments. Where this is health information, our additional condition is that the processing is necessary for employment purposes.

To carry out pre-employment background checks, including criminal records checks. We use your identity, your employment and education history, and criminal records information. Our lawful basis is our legitimate interests in verifying what candidates tell us and in making safe hiring decisions. Where criminal records information is involved, our additional condition is that the processing is necessary for us to meet our obligations and exercise our rights as an employer. We keep a policy document explaining how we comply when we process this information, and you can ask us for a copy.

To check that you have the right to work, and to meet our other legal obligations. We use your identity documents and right to work status, and whatever else is necessary for the obligation in question, including records we are required to keep. Our lawful basis is our legal obligation.

To establish or defend legal claims. We use whatever is necessary for the claim in question. Our lawful basis is our legitimate interests in protecting our legal position.

Where we rely on our legitimate interests, we have assessed that our interests do not override your rights, and you can ask us for that assessment.

Our application form asks about your gender identity, whether you are a member of the LGBTQIA+ community, your age bracket, whether you are disabled, your ethnicity, and your pronouns.

Answering is entirely optional, and it does not affect your application. Apart from your pronouns, these answers are anonymised. They are not visible to anyone making a decision about your application, they are hidden from hiring managers, and they are available only in aggregated form to a small number of people who monitor the fairness of our hiring.

Some of this information is special category information. Our condition for processing it is equality of opportunity or treatment. We keep a policy document explaining how we comply when we process this information, and you can ask us for a copy.

We also ask whether you need any adjustments in order to take part in our process. We use that only to make the adjustment.

We carry out pre-employment checks on candidates we intend to hire. Depending on the role, these cover your identity, your employment and education history, and criminal records.

We use specialist providers to run these checks, currently Zinc and Certn. We will always tell you before a check is carried out, and we will tell you what it covers.

A criminal record will never automatically rule you out. If a check returns something, we will discuss it with you before we make any decision, and we will consider how relevant it is to the role, how long ago it was, and the circumstances.

We use AI in three ways, and we want to be clear about all of them.

Reviewing applications. Every application is scored against the criteria we set for the role by an AI screening tool, provided by Dweet Ltd, trading as Nova. It reads your application and CV and produces a score, together with an explanation of how it reached that score.

A human always decides. The score is an input, not a decision. A member of our talent team reviews every application. The AI does not reject anyone and does not advance anyone on its own. Nobody is filtered out of our process without a person having looked at their application.

Interview notes. We use Metaview to record and transcribe interviews and to draft notes and scorecards from them. Our interviewers review and edit those notes. We will always tell you before an interview is recorded.

Writing to you. We sometimes use AI tools to help draft emails to candidates. A person reviews and sends every one.

You can ask us at any time to:

•          explain how the AI assessed your application

•          have a person review a decision, and tell us anything you want them to take into account

•          challenge a decision you think is wrong

•          assess your application without AI screening, in which case we will review it manually 

To ask for any of these, email privacy@pinpointhq.com, or reply to whoever is dealing with your application.

We share your information with the people who work for us who need to see it in order to run our hiring process. We also use service providers who process it on our instructions, in the following categories:

•          CV parsing

•          AI screening

•          Skills assessments and one-way video interviews

•          Interview scheduling, recording and transcription

•          Background checks

•          Electronic signature

•          Hosting, email and text messaging

•          Analytics, monitoring and error tracking

•          AI tooling that supports the above

Our platform sub-processors are listed at pinpointhq.com/security-privacy/sub-processors. In addition to those, we use a number of additional recipient tools in our own hiring to our hiring, including background checking providers and assessment tools.

We use a number of tools for sourcing. These include  Juicebox, LinkedIn and Cord.

We will also share your information where we are legally required to, and where we need to in order to establish or defend a legal claim.

We do not sell your information, and we do not share it for advertising.

Some of the providers we use are located outside the United Kingdom and the European Economic Area, which means your information may be transferred to those countries.

Where the destination is covered by UK adequacy regulations or an EU adequacy decision, we rely on that. 

For transfers to the United States, we rely either on the EU-US Data Privacy Framework and its UK Extension, where the provider is certified under it, or on the European Commission’s standard contractual clauses together with the UK International Data Transfer Addendum, supported by a transfer risk assessment.

You can ask us for a copy of the safeguards we rely on, and for the mechanism that applies to a particular provider, by emailing privacy@pinpointhq.com.

We take appropriate measures to keep your personal information secure, including measures to prevent it from being accidentally lost, or used or accessed in an unauthorised way. We limit access to those who have a genuine business need to see it, and the people who handle it are subject to a duty of confidentiality.

Our recruitment platform is ISO27001, ISO42001 and SOC2 Type II certified.

We keep your information for 24 months from the date of application, or 3 months since last activity, whichever is more recent. 

If you are in our talent pipeline, the same period applies. Before it ends, we will email you to ask whether you want to stay on it. If you do not reply, we delete your information.

If we hire you, your information becomes part of your employee record, and a separate retention policy applies.

You can delete your information yourself at any time using the Manage Your Data tool, or by emailing us.

You have a number of rights over your personal information under data protection law. Most of them apply in particular circumstances rather than absolutely, so we will explain if we cannot do what you have asked, and why.

You have the right to:

•          ask for a copy of the personal information we hold about you

•          have inaccurate information corrected

•          have your information deleted in certain circumstances

•          withdraw your consent, at any time, where we rely on it

•          object to us using your information where we rely on our legitimate interests, including where we profile you

•          ask us to restrict how we use your information in certain circumstances

•          receive your information in a portable format in certain circumstances

•          ask for a person to review, and to challenge, a decision made about you with the help of automated processing

To use any of these rights, email privacy@pinpointhq.com or use the Manage Your Data tool. We will respond within one month. If your request is complex, or you have made several, we may need longer, and we will tell you if that is the case.

If you are unhappy with how we have handled your information, please tell us first by emailing privacy@pinpointhq.com. We will acknowledge your complaint within 30 days, look into it without undue delay, keep you updated while we do, and tell you the outcome.

You also have the right to complain to a data protection supervisory authority. This may be the authority in the country where you live or work, or where you consider the problem to have happened.

The supervisory authority for The Infuse Group Ltd is the Jersey Office of the Information Commissioner