ANZ Candidate Privacy Statement

1. Overview

This ANZ Candidate Privacy Statement (Statement) applies to Zip Co Limited (ACN 139 546 428) and subsidiary companies including ZipMoney Payments Pty Ltd (ACN 164 440 993), Zip Business Australia Pty Ltd (ACN 602 957 237), Zip Co NZ Limited (Company Number 6162932) and related companies located in Australia and New Zealand (collectively “Zip, we, us, our”).

By applying for a role with Zip or otherwise providing us with your personal information during the recruitment process, you acknowledge that Zip will collect, use, hold and disclose your personal information as described in this Statement. Where we are required to obtain your consent for particular types of information or processing, including biometric information or interview recording/transcription, we will ask for that consent separately or make this clear to you at the relevant point in the recruitment process.

In this Statement, “personal information” includes any information which identifies you or from which your identity is reasonably apparent. It may also include information that is generated or inferred about you during the recruitment process, such as screening results, fraud risk indicators, interview notes, assessment outcomes, AI-assisted match scores or background check results.

2. Your privacy is important to us

This Statement explains how Zip handles the personal information that we hold, use, collect, handle, share, retain and store for the purpose of processing a candidate’s job applications and recruitment process.

The Statement applies to all applications for positions including permanent, fixed term, casuals, contractors and interns. Some checks, tools or processes described in this Statement may only apply to particular roles, employment types, jurisdictions or stages of the recruitment process. For example, background screening and identity verification checks may only occur after an offer has been made or where they are relevant to the role. It also provides details about your privacy rights as an applicant for a role with us. Should you be successful, we will make available our information handling practices for all employees when you join Zip, including your responsibilities regarding privacy and data security with access to all relevant policies, procedures and guidelines that you are expected to follow.

Sometimes we update our Candidate Privacy Statement. You can always find the most up-to- date version on our websites.

This Statement does not apply to the extent that we handle your personal information as a customer of a Zip product. If you wish to understand how we handle Customer personal information, please read our Privacy Policy.

3. What personal information do we collect?

For application, recruitment and selection purposes

We may collect, use and disclose different types of personal information about you, when you start a job application with Zip and the types of personal information collected may change during the recruitment process.

The types of information we collect about you during the application, recruitment and selection process may include:

Contact details: such as your name, address, mobile and/or other phone numbers and email address;
Employment details and qualifications: such as information about your employment history, your curriculum vitae (CV) or cover letter, your qualifications such as university education, professional certification and licencing, portfolios (where relevant) and professional memberships (for certain positions);
Indicative salary expectations and previous salary package information
Identity information: such as your ID, passport information, birth certificates, driver license details, date of birth, pronouns and gender;
Identity verification information: such as copies or details from identity documents, document verification results, liveness or identity verification results, and other information needed to confirm your identity, work eligibility or suitability for employment;
Interview details: such as information you provide during interviews or assessments, whether face-to-face, by phone, email, online or otherwise;
Interview recordings, transcripts, summaries and notes: where we tell you in advance and where permitted by law, we may use recording, transcription or automated note-taking tools during interviews. This may include audio, video, transcripts, summaries, notes, scorecard entries or other records of the interview. You will be told when these tools are used and, where available, how to opt out or request an alternative process;
References: We may use a third party provider to conduct reference checks. You must obtain consent from any of your elected referees to provide their name and contact details to any named third party provider. Our third party providers may email or telephone your elected referee to ask about your skills, experience, qualifications and any other information that is relevant to the position working at Zip. This third party provider will then provide this information to our Talent Acquisition team.
Application review and assessment information: such as recruiter notes, hiring manager notes, interview scorecards, assessment outcomes, application status, job requirement matching information and other information generated during our recruitment process;
Online assessment and assessment integrity information: where you complete an online technical, coding or skills assessment, we may collect information about your assessment responses, code submissions, test results, time taken, platform activity and assessment integrity signals. This may include information about whether you leave the assessment platform, switch tabs or engage in activity that may indicate a breach of assessment rules. Where we use proctoring, recording, transcription or other assessment integrity tools, we will tell you before the assessment starts;
AI-assisted recruitment information: where we use AI-assisted recruitment tools, these tools may process your CV, application responses, technical assessment responses or outputs, experience, qualifications, skills and other information you provide to help compare your application against the role requirements selected by Zip. These tools may generate outputs such as a match score or summary. Zip recruiters and hiring managers review these outputs and make the final decision. AI-assisted tools do not automatically reject candidates or make final hiring decisions;
Fraud detection and recruitment integrity information: such as information used to help identify potential application fraud or protect the integrity of our recruitment process. This may include risk signals linked to an application, such as IP address, location indicators, phone number checks, email domain checks, duplicate application indicators or other information relevant to verifying the authenticity of an application. These signals are used to support recruiter review and do not automatically determine the outcome of an application.

We may also collect sensitive information, such as:

Diversity and inclusion information: such as gender identity, sexual orientation, pronouns, cultural or ethnic origin, ancestry, caring responsibilities, and disability information (all optional) to monitor our compliance with equal opportunities legislation and track progress towards our diversity, equity and inclusion goals. This will not be used to determine your suitability for your application to join Zip - at Zip we consciously build for inclusion and balance so we can bring out the best in everyone - because we know diverse teams lead to better outcomes for all.
Information about criminal convictions: where this is necessary for purposes of due diligence or compliance with our regulatory obligations.
Health information: such as any physical or mental condition that you choose to provide to us so that we can confirm your ability to perform a role and ensure that we make reasonable adjustments for any interviews and assessments where required. Biometric information: where required for identity verification, fraud prevention or background screening, and where permitted by law, we may ask you to complete a biometric identity verification check through a third-party verification provider. This may involve the collection or generation of biometric information, such as a facial image, selfie, liveness check, biometric template or biometric verification result. We will only collect and use biometric information where it is reasonably necessary for the recruitment, screening, identity verification or employment process, and we will provide additional information and seek your consent where required. If you do not complete a required identity verification or background screening step, we may be unable to progress your application or offer you employment. If you do not wish to complete biometric verification, cannot complete it, or require an adjustment or alternative process, you should contact us using the details in section 10 so we can consider an alternative identity verification process.

For employment purposes

Should you be successful in your application and formally accept a position with us, we may collect other information from you as is relevant, including:

Financial information: such as bank account details, Tax File Numbers, Superannuation Fund details;
Background check information: such as criminal history details, a pre-employment medical declaration, employment verification, APRA and ASIC regulatory checks, politically exposed persons (PEP’s) or sanctions checks, fraud and bankruptcy checks (where relevant to your role), your working rights and information about your work eligibility, and professional references.
Background screening and verification information: such as identity verification results, biometric verification results, right-to-work checks, reference check results, education and qualification verification, employment history verification, sanctions, politically exposed persons, criminal history, bankruptcy, directorship, regulatory, professional licensing or other checks relevant to the role. These checks may be conducted by Zip or by third-party screening and verification providers, including Xref, Certn or other providers appointed by Zip.

Note: Not all personal information types will be requested from every candidate - this may vary depending on the stage of the recruitment process and the information that is relevant for us to consider you for a position with us.

How do we collect personal information?

We may collect and retain your personal information in a number of ways, including;

from you directly (the information you provide throughout the application process verbally or in writing);
from third party service providers, including recruitment agencies, digital reference check providers, screening and verification service providers (i.e. for background check information) or specialist technical assessment solution providers where relevant to your role;
from recruitment technology, AI-assisted application review tools, fraud detection tools, interview recording, transcription or note-taking tools, online assessment platforms, proctoring or assessment integrity tools, and other systems used to support the recruitment process;
from background screening, identity verification and biometric verification providers, including Xref, Certn or other providers appointed by Zip;
government agencies;
from social media websites (such as LinkedIn) where you have publicly shared professional information which may be accessed by prospective employers.
We may also collect or generate information about you during the recruitment process, including recruiter notes, hiring manager notes, interview scorecards, AI-assisted match scores, fraud risk signals, verification results and other assessment or screening outputs.

4. How do we use your personal information?

Zip is committed to protecting your privacy and we recognise the importance of safeguarding your personal information. We collect, handle and use personal information so we can:

process and manage your application for employment with Zip;
Determine your eligibility for employment with Zip;
Communicate with you;
Enter a contract with you;
Manage our relationship with you;
Consider you for future applications (unless you request we do not consider you for future applications);
Protect our legal rights and to resolve disputes or complaints;
Comply with our legal obligations;
Manage our risks such as business continuity and security;
Use your personal information for analysing purposes (for example to monitor and report on diversity and equal opportunities or to analyse source of applications)
verify your identity and work eligibility;
conduct background screening, reference checks and other pre-employment checks relevant to the role;
prevent, detect and investigate suspected fraud, misrepresentation, duplicate applications, identity misuse or other activity that may affect the integrity of our recruitment process;
support recruiter, technical reviewer and hiring manager review of your application, including by using AI-assisted tools to compare your application against the requirements of the role;
assess your technical skills, role suitability and assessment integrity, including by using online assessment platforms, coding test providers, proctoring tools or assessment integrity tools;
generate candidate match scores, summaries, rankings, assessment commentary or recommendations to assist our recruiters, technical reviewers and hiring managers, subject to human review and oversight;
record, transcribe, summarise or take notes during interviews, where this has been disclosed to you;
make reasonable adjustments or provide support during the recruitment process where you request this;
maintain records of our recruitment process, including decisions, interview notes, assessment outcomes and compliance records; and
improve and administer our recruitment systems, processes, reporting and candidate experience.
Where we use AI-assisted recruitment tools, these tools assist our recruiters and hiring managers. They do not make final hiring decisions and do not automatically reject candidates. Recruiters and hiring managers remain responsible for reviewing candidate information and making decisions.
Where we use fraud detection or recruitment integrity tools, the outputs are used to support review by Zip personnel. A fraud or risk signal does not automatically determine the outcome of your application.
Where we use biometric identity verification, we do so to verify identity, support background screening and help prevent fraud or identity misuse. We will not use biometric information for unrelated purposes unless permitted by law and, where required, with your consent.

We will share your personal information internally within Zip to progress your job application and the recruitment process. Your personal information will only be shared with those people in Zip, on a need to know basis, in order to do their job.

We may also share your personal information with the following categories of third parties:

Background-checking organisations that verify employment history, and academic and professional achievements;
Third-party service providers that support the Zip recruitment process and organisations that assist us in collating and managing information about our employees;
Online assessment, coding test, proctoring and technical assessment providers;
Recruitment agencies;
Law enforcement agencies, regulators, court or tribunal, or to exercise, establish or defend legal claims (where their request is lawful);
Recruitment technology providers, applicant tracking system providers and AI-assisted recruitment providers, including Greenhouse or other providers appointed by Zip;
Fraud detection, recruitment integrity, identity verification and background screening providers, including Xref, Certn or other providers appointed by Zip;
Video conferencing, transcription, recording, automated note-taking or productivity tool providers, including Google or Greenhouse, where those tools are used in the recruitment process;
Professional advisers, insurers, auditors and service providers who support Zip’s recruitment, legal, compliance, risk, security or employment functions.

If we require third-party organisations to process data on our behalf, we instruct that your personal information is protected to the same standard as if Zip was processing your personal information. Zip does not sell personal information that we collect or handle as part of the recruitment process or any related processes.

We require our service providers to use candidate information only for authorised recruitment, verification, screening, fraud prevention, security, support or related purposes. Zip does not permit vendors to use candidate information to train or improve their own AI models unless we tell you otherwise and where permitted by law.

6. Sending information overseas

We may send your information overseas, including to:

Overseas businesses and/or subsidiaries of Zip;
Service providers or third parties who store data or operate outside Australia, or are involved in our recruitment process; and
Comply with laws, and assist with government or law enforcement agencies.

This may include countries where Zip group companies, recruitment systems, cloud hosting providers, applicant tracking systems, background screening providers, identity verification providers, video conferencing providers or other service providers are located or store information. For example, candidate information processed by background screening or identity verification providers may be stored or processed in Australia, New Zealand, Canada, the United Kingdom or other countries depending on the provider, the candidate’s location, the checks required and the third parties involved in completing those checks. This may include disclosures to approved subcontractors, government agencies, former employers, education providers or other verification sources located overseas.

Where candidate information is disclosed overseas, we take reasonable steps to ensure it is handled in accordance with applicable privacy requirements.

7. How do we keep your information secure?

Zip uses a range of security measures to ensure your personal information is protected from unauthorised access. We use industry standard levels of security to prevent loss or misuse of your personal information. Personal information is only accessible to relevant Zip personnel, or to authorised service providers and vendors who support or supply their services to us. We use relevant industry standards as guidance, including ISO 27001, SOC2, NIST CSF and NIST SP-800 series documents. Zip personnel are regularly trained on privacy standards in Australia.

We apply access controls so that candidate information is only available to people who need it for recruitment, screening, employment, legal, compliance, security or related purposes. Where we use third-party providers, we require appropriate security arrangements to protect candidate information.

Where biometric information, identity documents, interview recordings, transcripts, AI-assisted outputs or fraud risk signals are collected or generated, we treat that information as higher-risk information and apply additional controls where appropriate, including limiting access, retaining it only for as long as needed and deleting or de-identifying it where required.

8. How long do we keep your personal information for?

Zip retains personal information in accordance with our retention policy and to comply with relevant laws and regulations. The retention period may vary based on whether your application is successful or not, as above in “4. How do we use your personal information”.

In the event you are successful, the personal information we’ve collected will become part of your employee profile, or employee record with Zip. We have obligations relating to the retention of employee records. We will retain your data in accordance with the Australian privacy and employment laws, codes and standards. If your application is unsuccessful, we generally will not retain your personal information for more than 3 years from the date that we notified you of our decision unless there is a reason that we may need it (i.e. if it appears you may be considered for a separate relevant role at a future date).

Different retention periods may apply to different types of recruitment information. For example, temporary interview transcripts generated through Google Meet are generally deleted within 5 business days or at the next weekly deletion cycle, unless they are required for a specific recruitment, legal, compliance or dispute purpose. Interview notes, summaries or scorecard entries that are added to your candidate profile may be retained as part of your recruitment record in accordance with Zip’s retention practices.

Biometric information, identity verification information and background screening information will be retained only for as long as reasonably necessary for the relevant verification, screening, employment, legal, compliance, audit or dispute purpose, and in accordance with applicable laws and contractual arrangements with our providers. Where Zip receives only a verification result rather than the underlying biometric information, Zip will retain the result in accordance with our recruitment and employment record retention practices.

Fraud detection outputs, AI-assisted match scores and application review outputs may be retained as part of your candidate record where relevant to the recruitment process, auditability, legal, compliance or dispute purposes.

9. How can I access or correct my personal information?

You can request access or correction to your personal information at any time by contacting Zip’s Privacy Officer using the details below. The time we take to respond to your request will depend on the type of access or correction request you make. We usually reply within thirty (30) days of receiving your request. We will notify you if it takes longer and we will seek your written consent to an extension if we are required to do so by law.

We may contact you via phone to confirm your identity and the reason for the request before releasing or correcting any personal information about you. This is to protect your identity and ensure Zip does not disclose any personal information to persons who do not have the right to access or correct that information.

There may be times where we charge a small fee to cover our costs of providing you with access to, or supplying your information. We will inform you of this cost at the time you make a request. We will not charge you a fee for requesting that your personal information be corrected.

Zip may not always be required to provide access to, or correct, your personal information due to certain exceptions in the Privacy Act. This includes where:

It is unlawful to give you access;
Giving access would pose a serious threat to any person’s life, health or safety, or to public health or safety;
The information relates to existing or anticipated court or legal proceedings;
Giving access would have an unreasonable impact on other people’s privacy;
Giving access would reveal evaluative information in connection with a commercially sensitive decision-making process by Zip; or
Your request is vexatious.

We will write to you and explain why we cannot provide access or correct your information. In some cases, where we refuse to correct your information, you can ask us to include a statement attached to your personal information that says you believe it is inaccurate, incomplete, misleading or out of date.

You may also contact us if you would like more information about how we use AI-assisted recruitment tools, fraud detection tools, biometric identity verification, online assessment integrity tools or interview recording/transcription tools in the recruitment process. Where available and required by law, you may request an alternative review or assessment process. We will not retaliate against you for exercising any applicable privacy rights.

10. How to contact us

If you have a query or complaint about the way we have handled your personal information, or you would like to exercise your rights to correction or access of your personal information, please let us know.

You can contact our Privacy Officer at:

Mail: Zip Privacy Officer, Level 7/180 George Street Sydney, NSW 2000
Phone: 02 8294 2345
Email: privacy@zip.co

11. What if you do not want to provide us with your personal information?

If you do not agree to us collecting, using, holding or disclosing your personal information in accordance with this Statement, we may be unable to progress further with your application or offer you employment.

If you choose not to provide particular information, complete a required background check, complete a required identity verification step, or participate in a required screening process, we may be unable to assess your suitability for the role or offer you employment. If you do not wish to participate in interview recording, transcription, online assessment integrity monitoring or automated note-taking, or if you have concerns about AI-assisted review or biometric verification, please contact your Zip Talent Acquisition contact so we can consider your request and any available alternatives or adjustments.