Recruitment Data Privacy Policy

Personal Data refers to any information – whether physical or digital – that relates to an identified or identifiable individual. If data can directly or indirectly reveal the identity of an individual, it qualifies as Personal Data. Examples include full name, contact details, passport number, biometric data, health data etc).

We collect only the Personal Data necessary to assess your suitability for employment. The Company you apply to will act as the Data Controller of your Personal Data.

By submitting your application, you consent to the collection, use, and disclosure of your Personal Data for recruitment and employment purposes, in accordance with this Policy and the Applicable Data Protection Laws. You are responsible for ensuring that the Personal Data you provide is accurate, complete, and up to date. Please note that failure to provide the requested Personal Data may affect our ability to process your application.

As part of the recruitment process, we may collect the following categories of Personal Data about you (whether provided directly by you or obtained from third parties):

• Identification details: name, address, contact details, nationality, date of birth, marital status, and (where required by law) racial or ethnic origin or religion
• Government-issued identifiers: passport number, identity card numbers, or equivalent identification numbers
• Employment-related information: CV, application forms, employment history, references, qualifications, licenses, and training records.
• Education history and transcripts.
• Health data: only where required or permitted by law to assess fitness for work.
• Criminal records or financial probity checks: only where permitted by law and with your explicit consent.
• Information collected automatically via our website (cookies and similar technologies).
• Recruitment materials: interview notes, assessment results, video submissions, or presentations.
• Photo and video data: images, video recordings, or other visual media captured through CCTV, event photography, or submitted by you through our platforms or communications.

We will collect, use, and disclose your Personal Data only where permitted, including where: –

• it is necessary to take steps at your request prior to entering into an employment contract (e.g. assessing your application);
• it is required to comply with legal or regulatory obligations;
• it is necessary for our legitimate business purposes, provided these are not inconsistent with your rights under applicable law; or
• you have provided your consent, which you may withdraw at any time by contacting our Data Protection Officer (see Section 7).

We generally collect your Personal Data in one of the following ways:

• Directly from you when you submit a job application, CV, or supporting documents to us.
• From third parties with whom you have registered an interest in working with the Company (for example, recruitment agencies or job boards).

All Personal Data collected and held by us will be treated as strictly confidential. In evaluating your application, we may also obtain information from other sources where relevant and appropriate for recruitment purposes.

In some cases, we may obtain your contact details from publicly available sources, such as professional networking platforms, to make initial contact with you regarding potential opportunities. If we contact you in this way, we will first inform you of this Recruitment Data Privacy Policy and obtain your consent before collecting or using your Personal Data. You may opt out at the point of initial contact or at any time thereafter by contacting the Company’s Data Protection Officer (DPO) at dpo@bgc.com.bn .

If you provide us with Personal Data relating to other individuals (for example, referees), or if you are submitting information about applicants in your capacity as a recruitment agency, you must ensure that the individual has been informed of the disclosure and that you have obtained all necessary consents on their behalf. Upon request, you may be required to confirm or provide evidence of such consents.

Recruitment agencies must also ensure that applicants are made aware of this Recruitment Data Privacy Policy and that all relevant written consents have been obtained before submitting any CVs or applicant information to the Company.

Your Personal Data will be collected, used, and disclosed for the following purposes:

• Application assessment: verifying and processing your application, and evaluating your suitability for current or prospective employment opportunities with the Company.
• Due diligence and screening: conducting background checks, reference checks, and other employment screening activities in accordance with legal or regulatory requirements, or as part of the Company’s risk management procedures.
• Communication: contacting you in relation to your application, providing administrative updates, and informing you of other relevant employment opportunities.
• Related purposes: any purposes reasonably connected with or incidental to the above.

We may share your Personal Data with the following parties, strictly for the purposes outlined in this Policy:

• Subsidiaries and affiliates: on a need-to-know basis for recruitment and administrative purposes.
• Authorised third-party service providers engaged by Company to support recruitment and related processes.
• Other offices within the Company, where necessary for recruitment or administrative purposes
• Regulatory and legal authorities, where disclosure is required by applicable law, regulation, or in response to a lawful request by law enforcement or regulatory bodies.
• External legal advisors, where necessary to obtain legal advice or in connection with actual or potential legal proceedings.
• Any party to whom you authorise us to disclose your Personal Data.
• In urgent circumstances, to protect your vital interests or personal safety.

Your Personal Data may, from time to time, be transferred to and stored in jurisdictions outside of your country of residence. These jurisdictions may have data protection laws that differ from, and may be less stringent than, those in your home jurisdiction. Where such cross-border transfers occur, the Company will ensure that:

• Appropriate contractual and technical safeguards are in place to protect your Personal Data.
• Transfers are made strictly on a need-to-know basis and only for the purposes described in this Policy.
• The receiving party provides a comparable standard of protection to that required under the Applicable Data Protection Laws.

We take the protection of your Personal Data seriously and implement reasonable security arrangements to protect against unauthorised access, collection, use, disclosure, copying, modification, disposal, or other similar risks.

All Personal Data is stored on secure servers, whether operated by the Company or by authorized subcontractors. Access to Personal Data is restricted to authorised personnel who require it strictly on a need-to-know basis. We maintain physical, electronic, and procedural safeguards that are commercially appropriate and consistent with the requirements of the Applicable Data Protection Laws.

While no method of transmission over the Internet, mobile applications, email, or other communication channels can be guaranteed to be fully secure, we adopt measures designed to minimise the risk of intrusion or unauthorised access. We comply with our internal security policies and standards when accessing or using Personal Data, and we require our service providers to do the same.

Where you have been provided with, or have created, a password to access certain parts of our website or services, you are responsible for maintaining the confidentiality of that password. Please do not share your password with anyone.

We will retain your Personal Data only for as long as necessary to fulfil the purposes for which it was collected, in accordance with our internal retention policies and procedures, or as otherwise permitted or required by applicable law.

• If your application is unsuccessful, we may retain and use the information you provided for up to six (6) months from the date the position you applied for has been filled. This allows us to address any matters that may arise in connection with your application and, where appropriate, to contact you regarding other recruitment opportunities.
• If you do not wish to be considered for positions other than the one you applied for, please clearly state in your cover letter: “I do not wish to be considered for positions other than that I have applied for.”
• If your application is successful, your Personal Data will form part of your employment records and will be used for the administration and management of your employment in accordance with applicable laws and internal policies.

Once the retention period has expired, or once the data is no longer required for the purposes for which it was collected, we will securely delete or anonymise your Personal Data, unless retention is required for legal, regulatory, or business purposes.

You have the following rights in relation to your Personal Data (subject to applicable exceptions and legal or contractual restrictions):

• Access: request access to the Personal Data we hold about you.
• Correction: request correction of any inaccurate or incomplete Personal Data.
• Withdrawal of consent: withdraw your consent to our collection, use, or disclosure of your Personal Data. Please note that withdrawal of consent may affect our ability to process your application or continue with any recruitment-related activities.
• Usage and disclosure information: request information on how your Personal Data has been used or disclosed in the past year.
• Deletion: request deletion of your Personal Data, where permitted under applicable law.

Requests to exercise these rights should be directed to our Data Protection Officer (DPO) at dpo@bgc.com.bn by filling in the BGC Personal Data Handling Request Form.

We will assess and respond to each request in accordance with the Applicable Data Protection Laws. A reasonable fee may be charged for processing access requests, as permitted by law.

You also have the right to lodge a complaint with the relevant Data Protection Authority in your jurisdiction if you believe that your Personal Data has not been handled in accordance with the Applicable Data Protection Laws.

You may visit our micro-sites on various social media platforms, and as such, may choose to provide us with personal data through these social media platforms, such as through forms, account portals, interfaces, and interactions with other support portals/channels. By doing so, you consent to the use of this personal data in accordance with this Policy. BGC may receive information related or connected to an account with a third-party service that you use to sign up or log in, or when you associate that account. For instance, when you associate your account, we may receive your public profile, your friends list, your contacts, and your email address. If you delete your profile from a third-party service, such as Google or Facebook, information that has been shared with BGC from that service may still be retained by BGC. If you do not wish for us to retain such information, please contact our Data Protection Officer (DPO) at dpo@bgc.com.bn

We do not engage in automated decision-making or profiling in relation to your Personal Data. All recruitment decisions are made through human review and assessment.

We may update or amend this Recruitment Data Privacy Policy from time to time to reflect changes in our practices, legal or regulatory requirements, or other circumstances. Any updates will be published on our careers website. We encourage you to review this Policy periodically to stay informed about how we manage your Personal Data. Your continued use of this Site and acceptance of our services after any changes to this Privacy Policy constitutes your consent to any such changes, to the extent such consent is not otherwise provided.

This Privacy Policy was last updated on 11 December 2025.