Privacy Notice for Job Candidates in Europe

Effective as of 25th May 2018

Last updated on 28th September 2021 

As part of the recruitment process, SumUp entities (“we”, “us”, “SumUp”) collect and process personal data of job candidates. Please read this privacy notice (Privacy Notice) carefully, so that you are aware of how and why we process your information. 

For the purpose of the applicable data protection laws including but not limited to Regulation (EU) 2016/679  (the “GDPR” ) the hiring SumUp entity, responsible for your data (data controller) is:

LocationSumUp entity – controller


Sumup Limited, Block 8, Harcourt Centre, Charlotte Way, Dublin 2, Ireland D02 K580

United  Kingdom

SumUp Payments Ltd, 32 - 34 Great Marlborough St, W1F 7JB, London, UK 

The Good Till Co Ltd, 16-20 Shorts Gardens, Seven Dials, London WC2H 9US, United  Kingdom


German branch - SumUp Limited (IE), Grunerstraße 13, D-10179 Berlin

Germany SumUp Services GmbH, Grunerstraße 13, D-10179 Berlin, Germany


Sumup Limited (IE) - Branch Bulgaria; 5 "Nikola Tesla" Str., Office building BSR 2, fl. 9 – 11,  "Hristo Smirnenski" sqr. Slatina region, 1574 Sofia, Bulgaria  

Sumup EOOD; 5 "Nikola Tesla" Str., Office building BSR 2, fl. 9 – 11, "Hristo Smirnenski" sqr.  Slatina region, 1574 Sofia, Bulgaria 

Keysi Europe EOOD, 5 "Nikola Tesla" Str., Office building BSR 2, fl. 9 – 11, "Hristo  Smirnenski" sqr. Slatina region, 1574 Sofia, Bulgaria


Sumup EU Payments UAB, Upės g. 23, LT-08128, Vilnius, Lithuania


SumUp Services (Gmbh) Sp. z o.o., Oddział w Polsce, ul. Inflancka 4C, 00-189 Warszawa, Poland


Sumup MG ApS, Ewaldsgade 3, 1th, DK - 2200 Copenhagen N, Denmark


SumUp Limited Branch Netherlands, KvK no. 70199841, Herengracht 444-H, 1017 BZ,  Amsterdam


SumUp Holdings Luxembourg s.a.r.l. 28, boulevard Joseph II, L-1840 Luxembourg

What types about personal data do we process?

Basic personal and contact details that you share with us in relation to your application - name, date of birth, address, phone number, e-mail address, photo.

Specific data relevant for the recruitment process: Skills and experience, test results (when applicable), qualifications, references, CV, cover letter and application details, interview (including video interview when applicable), assessment data and any other data that you may voluntarily share with us.

Data provided to us by your referees (if applicable). These are reference points that you have given us to contact.

Details of any job offer made to you (when relevant): function, work location, holiday entitlement, working hours, payroll data (salary), social benefits. 

Applicable documents and data required by Law for concluding contracts, if you are selected for the position you apply – described in detail in our privacy notice for employees (such as names, national ID number, Tax number, Social security number, address, date of birth, nationality, city and country of birth, VISA details, details from medical certificates when required by law).

Where do we collect your personal data from? 

Typically, during your recruitment process with us, most of your data is likely to come directly from you: for example, names, contact details, CV details, information about your previous employment, education and skills etc.

 However, in some cases we receive information not directly from you but from third parties such as recruitment agencies or referees/reference points; information can encompass names, contact details, skills, previous employment history summary, performance.

We can also obtain information from professional social networks, such as LinkedIn, job boards and from other publicly accessible sources related to your professional life for the purposes of approaching you with job offers. 

For a very limited number of management positions and where it is strictly necessary and/or required by law, we may perform relevant background checks. 

What are the purposes of processing your data? 

We process your information: 

  • To consider your application for a role in SumUp and manage our recruitment processes.

  • To communicate with you in respect of the recruitment process.

  • To find appropriate candidates to fill our job openings.

  • To prepare an offer and conclude your employment contract with us. 

  • Based on your consent to ask you about your experience within the recruitment process so that we can improve it. 

Collection of data of job applicants for the purposes described above is necessary for us - to assess your application and potentially conclude an employment contract with you. If we cannot collect enough relevant information, we would not be able to proceed with your application.

What is the lawful basis for processing your data? 

We collect your personal data to assess your skills and suitability for a particular position within SumUp. In this regard, the recruitment process is a necessary condition for us to enter into an employment contract with you.

We also rely on legitimate interest as the lawful basis on which we collect and use your personal data. Our legitimate interests are the recruitment of suitable, talented and reliable staff for our business. When we obtain information from your public profile on professional social networks, such as LinkedIn, we base this processing on our legitimate interest to build a decision base in order to establish an employment relationship with you. 

When we invite you to participate in a survey on your satisfaction with the application process at SumUp the relevant legal basis is your consent. 

Furthermore, we may process your personal data where this is necessary to defend ourselves against legal claims arising from the application process that are brought against us. The legal basis for this are performance of a contract, in some cases legal requirement and our legitimate interest to defend our interests - for example, a burden of proof in proceedings under applicable national anti-discrimination laws. 

Once you have passed the recruitment stage, we might also be obliged to collect some additional data about you, as required by law to enter into an employment contract.

Do we share your data with third parties? 

Your information may be shared internally within the SumUp Group for the purposes of the recruitment process. This includes members of the HR team, interviewers involved in the recruitment process, managers in the business area with a vacancy. 

Your personal data may be shared with and/or processed by third parties that are acting on our behalf for specific recruitment related processes like job boards, recruitment software, recruitment agencies. 

In some cases, for management or key functions positions, we may be required to share your personal information with a regulator to comply with the law. 

Do we transfer data outside the sea?

Since SumUp is a global Group of companies, Group-internal transfers of employee data are possible for human resource management and administration purposes.

In the course of our activities, in some cases your information may be transferred to third parties outside of the EEA. We have in place safeguards including security standards as used within SumUp for all data, using only reputable third parties and ensuring adequate agreements are in place with them to ensure the security of your data.

How do we protect your personal data? 

You can be assured that we take the security of personal data we process very seriously. We take appropriate measures to ensure that all personal data is kept secure including security measures to prevent personal data from being accidentally lost, altered, used or accessed in an unauthorised way. We limit access to your personal data to those who have a genuine business need to view it. Those processing your information will do so only in an authorised manner and are subject to a duty of confidentiality. 

We have put in place procedures to deal with any suspected data security breach and will notify you and any applicable regulator of a suspected breach where we are legally required to do so. 

Is there automated decision-making and profiling? 

In our current processing activities relating to job candidates, we do not use automatic decision making or profiling. If we intend to do so in the future, we will amend this Privacy Notice accordingly and make it available to our job candidates.

How long do we keep your personal data? 

Please find all retention periods related to job applicants’ documents and data depending on the country where the hiring SumUp entity is in the table in Annex 1 at the end of this Privacy Notice.

If your application for employment is successful, personal data gathered during the recruitment process will be transferred to your employee file and retained during your employment. The periods for which employee data is held will be provided to you in a separate privacy notice dedicated to employees. 

What are your rights

Under the applicable data protection legislation, including the GDPR you have a number of rights with regard to your personal data. You have the right to:

  • Access to Your Data: You can ask us what data we process for you and/or for a copy of your personal data.

  • Amend (Rectify) your Data: You can request the correction or update of personal data that we hold about you when you believe that it is incorrect or incomplete. 

  • Delete (Erase) Data: You can ask us to erase or delete all or some of your personal data, to the extent permitted by law under certain circumstances. 

  • Object to, or Restrict the processing of your Data: You can ask us to stop using all or some of your personal data or to limit our use of it, to the extent permitted by law under certain circumstances.

  • Data Portability: You have the right to request us to transmit our data to another organisation in a structured, commonly used and machine-readable format. 

If you have provided consent for the processing of your data, you have the right to withdraw that consent at any time which will not affect the lawfulness of the processing before your consent was withdrawn.

You can exercise your rights by contacting us at [email protected]

If you have any question or want to express dissatisfaction with the way SumUp processes your personal data, you can always contact our Data Protection Officer at email address: [email protected]

You can also lodge a complaint to the relevant data protection authority. SumUp will cooperate fully with any such investigation and endeavour to satisfy all queries as fully as possible. The relevant authority for each country can be found on the European Commission website

Updates of this privacy notice 

We may change this job candidates Privacy Notice in the future. The latest version and its effective date will be always made available to job candidates.

Annex 1 – Retention Periods

Primary Records relating to job applicantsInternal recruitment documentation (if applicable – for example to evidence no discrimination within recruitment process)


7y for successful candidates;

12m for unsuccessful

12m for unsuccessful


6y after termination for successful candidates;

1y for unsuccessful



3y after termination for successful candidates;

6m for unsuccessful

6m for unsuccessful


3y for successful candidates;

6m for unsuccessful

3y even for unsuccessful candidates according to art. 52 of local Anti discrimination law


1y after end of recruitment

1y after end of recruitment


0y after termination for successful candidates*;

6m for unsuccessful

6m for unsuccessful


5y for successful candidates;

6m for unsuccessful

6m for unsuccessful


4 weeks; up to 1y with candidate consent

4 weeks; up to 1y with candidate consent


2y after termination for successful candidates; 5,5y for unsuccessful

2y after termination for successful candidates; 5,5y for unsuccessful

Poland* - For the period of the employment and (i) 50 years from the contract termination or (ii) 10 years from the end of a calendar year in which the contract was terminated for employees employed after December 31, 2018.