Privacy Policy

Fortis Recruitment respects your privacy and is committed to protecting your personal data.

This Privacy Policy explains how we collect, use, store and share personal information in connection with our recruitment services, our business activities and your use of fortis.ie.

​

It also explains your rights under applicable data protection law, including the EU General Data Protection Regulation (GDPR), the Data Protection Act 2018 and, where relevant, the European Communities (Electronic Communications Networks and Services) (Privacy and Electronic Communications) Regulations 2011, commonly referred to as the ePrivacy Regulations.

For the purposes of data protection law, Fortis Recruitment is generally the data controller of the personal data described in this policy. This means we determine why and how that personal data is processed.

​

1. Who we are

Fortis Recruitment is a recruitment and talent solutions business based in Dublin, Ireland.

We provide services including permanent recruitment, contract recruitment, executive and retained search, recruitment process outsourcing and related talent advisory services.

For questions about this Privacy Policy or about how we process your personal data, you can contact us at:

Fortis Recruitment
Floor 3 North Block, Rockfield Central
Dundrum
Dublin 16
D16 PK60
Ireland

Email: info@fortis.ie

If Fortis appoints a dedicated privacy or data protection contact in future, the contact details on this page will be updated accordingly.

​

2. Who this policy applies to

This policy may apply to you if you are:

• a candidate or prospective candidate

• someone we have approached about a potential career opportunity

• a contractor or temporary worker

• an employee or prospective employee of Fortis

• a client or prospective client

• an employee or representative of one of our clients

• a referee or other person whose details have been supplied in connection with a candidate

• a supplier, service provider or professional adviser

• a visitor to our website

• someone who communicates with us by telephone, email, social media, web form or another channel

The type of information we collect and how we use it will depend on your relationship with us.

​

3. Personal data we may collect

Candidate and recruitment information

Where you are a candidate or prospective candidate, we may process information including:

• your name

• contact details

• postal address

• CV or résumé

• employment history

• education and qualifications

• professional memberships

• skills and experience

• current and previous job titles

• salary and remuneration information

• salary expectations

• availability and notice period

• preferred roles, sectors and locations

• work authorisation and visa status

• information you provide during interviews or conversations with us

• interview notes and consultant assessments

• references and referee details

• information relating to job applications

• records of roles we have discussed or submitted you for

• client feedback

• offer and placement information

• correspondence and communications with you

• publicly available professional information, including information appearing on professional networking platforms

• other information reasonably relevant to providing recruitment services

​

We aim to collect only information that is relevant and necessary for the recruitment services we provide.

​

Client and business contact information

Where you are a client, prospective client or business contact, we may process:

• your name

• job title

• employer or organisation

• business email address

• telephone number

• office location

• details of your hiring requirements

• records of meetings and conversations

• contractual and commercial information

• correspondence

• information relating to recruitment assignments

• invoicing and payment-related information

• professional information available from public or business sources

​

Website and technical information

When you use our website, certain technical information may be collected automatically, including:

• IP address

• browser type

• device type

• operating system

• referring website

• pages visited

• date and time of visits

• interaction with website features

• cookie and similar technology identifiers

• general location information derived from technical data

​

Some of this information may constitute personal data under GDPR.

Information you submit through the website

We may collect information when you:

• submit a CV

• apply for a role

• complete a contact form

• submit a hiring enquiry

• register your interest

• contact a member of the Fortis team

• subscribe to updates or communications

• otherwise provide information through the website

​

4. Special category and sensitive personal data

Certain personal information receives additional protection under GDPR. This includes information revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic or biometric information used for identification, health information and information concerning a person's sex life or sexual orientation. 

 

Fortis does not routinely require this information to provide recruitment services.

​

We ask candidates not to include unnecessary sensitive personal information in their CVs or applications.

Where we do need to process special category information, we will only do so where permitted by law and where an appropriate condition under Article 9 GDPR applies.

​

Information relating to criminal convictions or offences will only be processed where legally permitted and where genuinely required for a particular role or compliance requirement.

​

5. Where we obtain personal data

We may obtain information directly from you when you:

• send us your CV

• apply for a vacancy

• contact us

• speak with one of our consultants

• complete a website form

• attend an interview

• provide information during a recruitment process

​

We may also obtain professional information about candidates from other sources, including:

• LinkedIn and other professional networking platforms

• job boards

• CV databases where we are authorised to search for candidates

• referrals and recommendations

• former employers and referees

• clients

• professional directories

• company websites

• publicly available professional information

• recruitment partners and service providers

​

Recruitment often involves identifying people who have not directly applied for a vacancy. Where we obtain your personal data from another source, GDPR requires us to provide appropriate information about that processing in accordance with Article 14. 

​

We will normally do this when we first meaningfully contact you or within the period required by law.

​

6. How we use candidate information

We may use candidate personal data to:

• identify potentially suitable employment opportunities

• assess your suitability for roles

• understand your experience, skills and career objectives

• contact you regarding potential opportunities

• manage applications

• arrange and coordinate interviews

• provide clients with candidate information

• obtain and record client feedback

• support offer and salary negotiations

• conduct reference checks where appropriate

• assist with onboarding or placement

• maintain records of previous recruitment activity

• provide career or market information

• identify future opportunities that may be relevant to you

• prevent duplicate or inappropriate candidate submissions

• administer contract or temporary assignments

• meet legal and regulatory requirements

• establish, exercise or defend legal claims

• operate and improve our recruitment services

We will normally discuss an opportunity with you before submitting your identifiable CV or candidate profile to a prospective employer.

We do not sell candidate personal data.

​

7. How we use client and business information

We may process client and business contact data to:

• provide recruitment and talent services

• understand hiring requirements

• source and introduce candidates

• manage recruitment assignments

• administer client relationships

• communicate about active or prospective assignments

• prepare proposals and contracts

• provide market information

• manage invoices and payments

• maintain records of business relationships

• develop our services

• identify prospective business opportunities

• send relevant business communications where permitted by law

• comply with legal obligations

• establish, exercise or defend legal claims

​

8. Our lawful bases for processing

GDPR requires us to have a lawful basis for processing personal data. Depending on the circumstances, Fortis may rely on one or more of the following bases.

​

Legitimate interests

Much of our recruitment activity is conducted on the basis of our legitimate interests.

These interests may include:

• operating a professional recruitment business

• identifying candidates for relevant opportunities

• contacting individuals about roles that appear relevant to their professional experience

• maintaining relationships with candidates and clients

• maintaining an effective recruitment database

• identifying potential clients and hiring requirements

• managing and developing our business

• protecting the security and integrity of our systems

• establishing or defending legal claims

Where we rely on legitimate interests, we consider whether those interests are overridden by your rights, interests or freedoms.

Legitimate interests are one of the lawful bases expressly recognised by GDPR.

​

Contract

We may process personal information where necessary:

• to take steps at your request before entering into a contract

• to perform a contract with you

• to administer an employment, contract or placement relationship

• to provide recruitment services that you have asked us to provide

 

Legal obligation

We may process information where necessary to comply with legal obligations relating to areas such as:

• taxation

• employment law

• immigration or work authorisation

• accounting

• regulatory obligations

• court orders or lawful requests from authorities

 

Consent

We may rely on consent in certain circumstances where the law requires it or where consent is the most appropriate legal basis.

Where we rely on consent, you may withdraw that consent at any time. Withdrawal does not affect processing lawfully carried out before consent was withdrawn.

We do not rely on a blanket consent simply because someone has registered with Fortis. Different processing activities may rely on different lawful bases.

​

9. Recruitment communications

If you are a candidate, we may contact you about roles or professional opportunities that we reasonably believe may be relevant to your skills, experience or stated interests.

Not every recruitment communication constitutes general marketing. However, where a communication falls within electronic direct marketing rules, we will comply with the applicable GDPR and ePrivacy requirements.

You may ask us at any time not to contact you about opportunities or certain types of opportunities.

​

10. Direct marketing

Where Fortis sends electronic direct marketing, we will comply with the GDPR and the Irish ePrivacy Regulations.

The general rule in Ireland is that electronic direct marketing requires affirmative consent unless a specific legal exception applies. Individuals also have an absolute right under GDPR to object to the use of their personal data for direct marketing. 

​

You may unsubscribe or object to direct marketing at any time.

​

Where an unsubscribe facility is included in an email, you can use that facility. You may also contact us directly at info@fortis.ie.

We may retain a minimal suppression record after you unsubscribe so that we can ensure we do not contact you again for the same marketing purpose.

​

11. Sharing your personal data

We may share personal data where necessary with:

• prospective employers

• existing clients

• organisations to which you have agreed to be introduced

• companies involved in a recruitment process

• recruitment and technology service providers

• our recruitment CRM and software providers

• website hosting and infrastructure providers

• email and communications providers

• IT support providers

• analytics providers

• background screening or reference-checking providers where appropriate

• payroll or contractor administration providers where applicable

• accountants, auditors, insurers and professional advisers

• legal advisers

• regulators, courts, law enforcement bodies or public authorities where required by law

• other parties where necessary in connection with a sale, merger, restructuring or transfer of our business

Where another organisation processes personal data on our behalf, we require appropriate contractual and data protection safeguards.

We do not sell or broker personal information.

​

12. Candidate information sent to clients

A core part of our recruitment service involves introducing candidates to prospective employers.

Candidate information shared with a client may include:

• CV

• professional experience

• qualifications

• skills

• remuneration information

• availability

• location

• work authorisation

• interview information

• consultant commentary or candidate summaries

• information directly relevant to the recruitment process

We will normally discuss the particular opportunity with you before making an identifiable introduction.

Once a prospective employer receives your information, that organisation may process your data as a separate data controller in accordance with its own privacy obligations.

​

13. International recruitment and transfers

Fortis may support recruitment assignments in Ireland and internationally.

This means your personal data may occasionally be shared with clients, technology providers or other recipients located outside the European Economic Area (EEA).

Where personal data is transferred outside the EEA, we will ensure that an appropriate transfer mechanism is used where required by GDPR.

This may include:

• a European Commission adequacy decision

• the EU Standard Contractual Clauses

• another transfer mechanism recognised by applicable data protection law

• supplementary safeguards where appropriate

Standard Contractual Clauses are one of the principal safeguards available for transfers to countries that do not benefit from an EU adequacy decision.

Where you are being considered for an international role, the location of the prospective employer may itself mean that candidate information needs to be transferred outside the EEA.

​

14. Recruitment technology, matching and AI

Fortis uses technology to help manage recruitment processes, candidate information, searches and potential matches.

Technology may assist our consultants by:

• searching candidate records

• identifying potentially relevant candidates

• organising recruitment information

• generating search results

• supporting candidate-to-role matching

• improving administrative efficiency

However, our recruitment decisions involve human judgement.

​

Fortis does not intend to make decisions about candidates solely by automated means where those decisions produce legal effects or similarly significant effects, unless such processing is lawful and the individual has been given the information and protections required by GDPR.

​

15. References and third-party information

Candidates may provide us with contact details for referees or other third parties.

If you provide another person's personal information to us, you should only do so where you have a legitimate reason to provide it and where appropriate you should make that person aware that their information has been supplied to Fortis.

Information received through references will be used for legitimate recruitment purposes and handled confidentially where appropriate.

​

16. Website forms and job applications

When you complete a form or apply for a role through fortis.ie, we use the information you provide for the purpose indicated by that form.

For example:

• a job application will be used to assess and manage your candidacy

• a CV submission may be used to identify suitable current and future opportunities

• a hiring enquiry will be used to respond to your recruitment requirement

• a general contact form will be used to respond to your enquiry

Information submitted through the website may be transferred into our recruitment or client management systems.

​

17. Cookies and similar technologies

Our website may use cookies and similar technologies.

Some cookies are strictly necessary for the website to operate and do not require consent.

Other technologies, including analytics, advertising, tracking and certain third-party technologies, generally require consent before being placed or accessed on your device.

The Irish Data Protection Commission specifically confirms that analytics cookies require consent, including first-party analytics cookies.

​

The DPC also makes clear that consent is normally required for cookies and similar tracking technologies unless a specific strictly necessary or communications exemption applies. 

You should therefore be given the opportunity to:

• accept cookies

• reject non-essential cookies

• choose categories of cookies

• change your preferences later

Withdrawing consent should be as easy as giving it. 

More detailed information about the cookies used on fortis.ie should be provided in our Cookie Policy and through our website cookie preference tool.

​

18. Analytics

Subject to your cookie choices, we may use analytics technologies to understand how visitors use our website.

This may include information such as:

• pages viewed

• visitor numbers

• traffic sources

• interaction patterns

• browser and device information

• approximate geographic information

Analytics information is used to understand and improve website performance and user experience.

Non-essential analytics technologies will not be intentionally activated before the consent required under applicable law has been obtained.

​

19. External websites and social media

Our website may contain links to:

• LinkedIn

• job platforms

• client websites

• social media platforms

• other third-party websites

Fortis is not responsible for the privacy practices of third-party websites.

When you leave fortis.ie, the privacy policy of the third party will apply to information processed by that organisation.

​

20. How long we keep personal data

We retain personal data only for as long as reasonably necessary for the purposes for which it was collected and for any period required by law.

GDPR does not prescribe a single retention period for recruitment data. Organisations must determine periods based on the purpose of processing and applicable legal obligations. Once the purpose has ended and there is no continuing lawful reason to retain the information, it should be deleted or securely disposed of. 

Our retention periods take into account:

• the nature of our relationship with you

• whether you remain interested in recruitment services

• whether we have had meaningful contact with you

• the sensitivity of the information

• contractual requirements

• potential legal claims

• statutory obligations

• the legitimate value of maintaining recruitment records

• your rights and reasonable expectations

​

Candidate records

Candidate information may be retained while we are actively representing you or while we reasonably believe our recruitment services may remain relevant to you.

We periodically review candidate records and remove, anonymise or update information that is no longer required.

Before publishing this policy, Fortis should insert its agreed candidate CRM retention period here, for example:

Candidate records are normally reviewed after [24/36] months without meaningful engagement. Where there is no continuing recruitment relationship or other lawful reason for retention, records may be deleted or anonymised.

​

Placement records

Where Fortis successfully places a candidate, certain records may be kept for longer where necessary for:

• contractual records

• placement guarantees

• financial records

• client relationship records

• legal claims

• compliance requirements

​

Client records

Client records may be retained throughout the business relationship and afterwards where reasonably required for business, contractual, financial and legal purposes.

​

Financial and statutory records

Information required for accounting, taxation or other statutory purposes may be retained for the period required by applicable law.

​

Marketing records

Marketing preferences and suppression information may be retained for as long as necessary to respect your communication choices.

We may retain anonymised information for statistical and business analysis where it can no longer identify you.

​

21. Data accuracy

We take reasonable steps to keep personal information accurate and up to date.

Recruitment information can become outdated quickly. We therefore encourage candidates and clients to let us know where information such as:

• contact details

• employment

• job title

• salary

• availability

• location

• work authorisation

• career preferences

has changed.

You have the right to ask us to correct inaccurate personal data.

​

22. Security

Fortis uses appropriate technical and organisational measures designed to protect personal data against:

• unauthorised access

• accidental loss

• alteration

• misuse

• disclosure

• destruction

Access to personal information is restricted to people who have a legitimate business need to access it.

No method of electronic transmission or storage can be guaranteed to be completely secure, but we take reasonable steps appropriate to the nature of the information we process.

​

23. Your data protection rights

Depending on the circumstances, GDPR gives you a number of rights in relation to your personal data.

These include:

​

Right of access
You can ask whether we process your personal data and request a copy of the personal data we hold about you.

​

Right to rectification
You can ask us to correct personal data that is inaccurate or incomplete.

​

Right to erasure
In certain circumstances, you may ask us to delete personal data.

This right is not absolute. We may retain information where we have a lawful reason or legal obligation to do so.

​

Right to restriction
In certain circumstances, you can ask us to restrict how we use your personal data.

​

Right to data portability
Where the legal requirements are met, you may request certain personal data in a structured, commonly used and machine-readable format or request that it be transferred to another controller.

​

Right to object
Where processing is based on legitimate interests, you may object to that processing in certain circumstances.

You have an absolute right to object to processing for direct marketing purposes.

​

Rights relating to automated decision-making
You have rights relating to decisions based solely on automated processing where those decisions have legal or similarly significant effects.

​

Right to withdraw consent
Where processing is based on consent, you may withdraw that consent at any time.

The DPC provides further guidance on these rights. 

​

24. How to exercise your rights

To exercise a data protection right, contact:

Email: info@fortis.ie

Please state that your request relates to your personal data.

We may need to request enough information to confirm your identity before releasing personal data. However, we will not routinely demand copies of passports or other identity documents where less intrusive verification is sufficient.

Data protection requests are generally free of charge.

We will respond without undue delay and normally within one month of receiving a valid request. In certain complex circumstances, GDPR permits this period to be extended by up to two additional months, but we must tell you within the first month if an extension is required and explain why. 

​

25. Complaints

If you have concerns about how Fortis processes your personal data, we encourage you to contact us first so that we can try to resolve the issue.

You also have the right to raise a concern with the Data Protection Commission, Ireland's supervisory authority for data protection.

Data Protection Commission
6 Pembroke Row
Dublin 2
D02 X963
Ireland

​

The DPC recommends using its online contact process for data protection concerns. 

​

26. Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect:

• changes to our services

• changes to our technology

• changes to the way we process personal data

• changes in applicable law or regulatory guidance

​

The most recent version will always be published on fortis.ie and the date at the top of the policy will indicate when it was last updated.

Where a change materially affects the way we process existing personal data, we will take additional steps to bring that change to the attention of affected individuals where required.