Global Applicant Data Privacy Policy

Arch may collect certain personal data or personal information with respect to Applicants throughout the application and recruitment process, including:

• Contact information — including name, postal address, phone numbers, personal email addresses, geolocation data, online identifiers).
• Identification and background information — including date of birth, gender, nationality, visual images from video or in-person interviews.
• Employment, experience and education history — including information in a curriculum vitae (CV), current and past employment positions, education history (including internal and external employment history), references and professional qualifications.
• Financial information — including your previous salary where permitted by law and your desired salary, bonus and other compensation information.
• Special categories information or sensitive personal information/workforce sustainability — including your ethnic background, age, gender identity, marital status, sexual orientation, pronoun preference, veteran or military duty status, details of any disabilities you have, and socio-economic factors.
• Employment screening, right to work and background check information — if you receive an offer of employment with Arch (or in some cases before), we may separately ask your specific consent to conduct background and pre-employment screening checks, which may include confirmation of items on your background check, right to work status and/or visa/immigration information, criminal background data and financial solvency data. 
• Other information — we may also collect any other information which may be voluntarily disclosed by you to Arch in the course of the application process or which you posted publicly on social media (such as LinkedIn) or information you provided to a third-party recruitment firm or employment agency.

Arch may use your personal information for the following purposes:

• Managing your application, including evaluating your candidacy, qualifications and experience, interviews with you, consultation with recruitment firms and references you have provided to us as part of the application process.
• Creating records in our Human Resources and recruitment systems to manage our recruitment process.
• Ensuring our compliance with laws and regulations, including verifying your right to work.
• Furthering our commitment to our people and creating a welcoming workplace.
• If you receive an offer from us, we may conduct a background check using a third party only to the extent permitted by law.
• Analytics purposes to improve our recruitment and hiring process and augment our ability to attract successful candidates to Arch.
• To identify and source talent, including by searching our talent pool and publicly available sources (such as LinkedIn).
• To process and manage applications for roles at Arch, evaluate you for open positions that match your interests and experiences across Arch and manage your candidate profile.
• Organize an interview, and to make you aware of employee benefits you may elect to receive or to determine any accommodations you may require (if you are required to travel to us to interview, we may use a subset of this information to arrange your travel).
• We may process personal information to the extent necessary for the establishment, exercise and defense of legal claims, including the management of legal claims and the investigation and establishment of relevant facts.

Arch processes the categories of personal information set out in Section 1 above for the purposes set out in Section 2 above, in reliance on the following legal bases:

If you do not provide us with certain personal information, Arch may not be able to process your job application or determine your suitability for a role at Arch, comply with our legal obligations or manage our business.

Arch may disclose certain personal information for the purposes listed in this Notice to the following recipients:

• To our affiliated companies, which include Arch Capital Group Ltd. and its subsidiaries, so they can help us manage your application.
• To our third-party service providers to facilitate the services they provide to us (e.g., IT security service providers, background screening providers, employment benefit providers, or recruitment-related providers) so we can process your application. To fraud prevention agencies, law enforcement agencies, public and governmental and regulatory authorities to meet our security and other legal obligations.
• As required or permitted by law, including to comply with a subpoena or similar legal process or government and ombudsman request, to entities or persons when Arch reasonably believes that disclosure is legally required.
• Any relevant party, regulatory body, governmental authority, law enforcement agency or court, to the extent necessary for the establishment, exercise, or defense of legal claims.
• Any relevant third party acquirer(s) or successor(s) in title, in connection with a sale, merger or acquisition or any portion of our business or assets. that disclosure is legally required. 
• In connection with a sale, merger or acquisition.

We may receive your personal data from the following sources:

• Directly from yourself.
• External recruitment agencies.
• Employment screening and background check providers.
• Publicly available sources such as LinkedIn.
• Employment references you provide.
• Regulatory or governmental bodies/organizations.

Transfer of Personal Data Outside the EEA, the UK, Bermuda, Australia, Canada, Gibraltar and Switzerland. Arch may disclose Applicant personal data for the above listed purposes to recipients as described above (including affiliates of the Arch) located in countries outside of the European Economic Area (“EEA”), the UK, Bermuda, Australia, Canada, Gibraltar and Switzerland to locations including the US, Philippines, Bermuda, the EEA, UK, Canada, Gibraltar and Australia, which may not have data protection laws equivalent to the country you reside in. In such a case, Arch will take all necessary steps to ensure the safety of Applicant personal data in accordance with applicable data protection laws. Where transfers are made intra-group, these will be covered by data transfer agreements designed to ensure the protection of your personal data when it is transferred outside of the country you reside in. You may request a copy of our transfer mechanisms using the contact details provided in Section 8 below.

Arch takes proactive measures to protect Applicant personal information against loss or theft, as well as from unauthorized access, disclosure, copying, use or modification, regardless of the format in which it is held.

Arch retains your personal information for as long as it is necessary for the purposes we originally collected it for, or for as long as we are allowed to keep it under data protection laws. For example, if you accept a job offer from us, we will keep personal information collected about you during the application process and your CV in your personnel file. If we do not employ you, we may nevertheless continue to retain and use your personal information for a period of time (which may vary depending on your country), to consider you for future employment opportunities at Arch. We may also retain personal information to the extent necessary for the establishment, exercise, or defense of legal claims.

Rights of Applicants under European and UK Data Protection Laws. Under applicable European and UK data protection laws, Applicants may have one or more of the following rights:

• If the processing of your personal data was undertaken with your consent, you may withdraw such consent (noting that such withdrawal does not affect the lawfulness of any processing performed prior to the date on which we receive notice of such withdrawal, and does not prevent the processing of your Personal Data in reliance upon any other available legal bases).
• A right to request access to your personal data, together with information regarding the nature, processing, and disclosure of those personal data.
• A right to restrict or object to the use of your personal data.
• A right to have certain personal data transferred to another Controller, in a structured, commonly used and machine-readable format.
• A right to complain to us via the contact details in Section 8.
• A right to complain to the relevant Data Protection Authority about the use of your personal data:
  • For UK residents: the Information Commissioner’s Office.
• • For EU residents, the Data Protection Authority for EU Member State in which you live, or in which you work, or in which the alleged infringement occurred.

Subject to applicable law, you may also have the following additional rights regarding the processing of your personal data:

• The right to object, on grounds relating to your particular situation, to the processing of your personal data by us or on our behalf, where such processing is based on Article 6(1)(f) (legitimate interests) of the GDPR / UK GDPR; and
• The right to object to the processing of your personal data by us or on our behalf for direct marketing purposes.

If you would like to exercise any of these rights, please contact us via the contact details listed in Section 8. Please note that in some cases, it will be necessary to provide evidence of your identity before we can give effect to these rights.

We will respond to you within one month of receiving your request, unless you make several or particularly complicated requests, in which case we may extend this time by a further two months. We will tell you if we need to use this extra time and will explain why.

Rights of Applicants under Bermuda Data Protection Laws. Under applicable laws, Applicants may have one or more of the following rights:

• A right to request access to your personal information.
• A right to rectification or erasure of your personal information.
• A right to object to the use of your personal information for direct marketing purposes.

We will respond to you within forty-five days of receiving your request.

If you are not satisfied with our response, you may be entitled to make a complaint with the applicable data protection authority.

Rights of Applicants under Bermuda Data Protection Laws. Under applicable laws, Applicants may have one or more of the following rights:

• A right to request access to your personal data.
• A right to rectification or erasure of your personal data.
• A right to object to the use of your personal data for direct marketing purposes.

We will respond to you within forty-five days of receiving your request.

If you are not satisfied with our response, you may be entitled to make a complaint with the applicable data protection authority.

Rights of Applicants under Canada Data Protection Laws. Under applicable laws, Applicants may have one or more of the following rights:

• A right to request access to your personal data.
• A right to rectification of your personal data.

We will respond to you within thirty calendar days of receiving your request.

If you are not satisfied with our response, you may be entitled to make a complaint with the applicable data protection authority.

The information in this Section 7 applies solely to individual residents of the State of California who are Applicants and serves as our notice at collection. This Section 7 describes how we collect, use, disclose and otherwise process personal information of individual residents of the State of California who are Applicants within the scope of the California Consumer Privacy Act of 2018, as amended by the California Consumer Privacy Rights Act (“CCPA”). This section includes the disclosures required by the CCPA, and describes the rights afforded to California Residents. We also describe the methods by which a California Resident may exercise these rights and some of the statutory exceptions that may apply.

In the event of a conflict between the terms of this Section 7 and the rest of the Global Applicant Data Privacy Notice, this Section 7 shall take precedence for Applicants who are residents of California.

Sources. We collect this personal information (or a subset of this personal information) directly from you, our service providers or job references; we may also collect it from other publicly available sources.

Collection and Use of Personal Information. Arch has collected the categories of personal information set out in this Section 7 from Applicants within the last 12 months. Note that the categories listed below are defined by California state law. Inclusion of a category in the list below indicates only that we may collect some information within that category. It does not necessarily mean that we collect all information listed in a particular category for all of our Applicants.