EEA Applicant Privacy Notice

We process your personal data on the following legal bases under Article 6 of the GDPR:

• Steps taken at your request before entering into a contract, where we evaluate your application, communicate with you about it, arrange interviews and assessments, and make and negotiate an offer of employment or engagement.
• Our legitimate interests, where we assess your suitability for a position, verify the information you provide, conduct recruiting and workforce analytics in aggregated or de-identified form, administer and secure our recruiting systems, and detect and prevent fraud and misrepresentation. We take reasonable measures to ensure the interests we pursue are balanced against your interests, rights, and freedoms, and we can explain that balancing on request.
• Compliance with a legal obligation, where we verify your eligibility to work, carry out screening required of financial services or education services providers, meet equal opportunity and regulatory reporting obligations, and retain records as required by law.
• Your consent, where we ask for it — for example, to keep your details on file for future opportunities after we have finished considering you for the position you applied for, to contact the references you identify, or to collect information that is not necessary for us to assess your application. You may withdraw your consent at any time, without affecting the lawfulness of processing carried out before you withdrew it.

Special categories of personal data. Where we process special categories of personal data, we rely on Article 9(2)(b) of the GDPR, because the processing is necessary to carry out our obligations and exercise our rights in the field of employment, or on your explicit consent under Article 9(2)(a). This includes health information you provide in support of a request for an accommodation, and any demographic information you choose to provide for equal opportunity monitoring. Providing demographic information is voluntary, it is not used to make hiring decisions, and declining to provide it will not affect your application.

Criminal convictions and offences. We process personal data relating to criminal convictions and offences only where the processing is authorized by applicable Member State law, subject to appropriate safeguards, and only where a check is relevant to the position you have applied for.

Information you are required to provide. Where we need personal data in order to assess your application or to meet a legal obligation, we will tell you and explain the consequences of not providing it. Providing anything else is optional.

We do not make decisions about your application based solely on automated processing, including profiling, that produce legal effects concerning you or otherwise significantly affect you. Automated tools may assist our recruiters in reviewing applications, but a person reviews each application and decides which candidates move forward.

If this changes, we will tell you before the tool is used in connection with your application, explain the logic involved and the significance and envisaged consequences of the processing, and honors your right to obtain human intervention, to express your point of view, and to contest the decision. Our Notice of Use of Artificial Intelligence and Automated Tools in Hiring describes the tools we use in more detail.

If we do not offer you a position, we retain your application data for three years to respond to inquiries about your application and to meet our legal record-keeping obligations, after which we delete or anonymize it. Where you have consented to us keeping your details on file for future opportunities, we retain them for three years or until you withdraw your consent, whichever occurs first.

Nelnet is headquartered in the United States, and your personal data will be transferred to and processed in the United States and other countries outside the EEA. Where we transfer personal data to a country that has not been recognized by the European Commission as providing an adequate level of data protection, we put appropriate safeguards in place, including the Standard Contractual Clauses adopted by the European Commission, together with supplementary technical and organizational measures where our assessment indicates they are needed.

Subject to applicable law, you may obtain a copy of these safeguards by contacting us using the information below.

If you are located in the EEA, you have the following rights in relation to the personal data we hold about you:

• to request confirmation of whether we process personal data about you and, if so, to request a copy of that data;
• to request that we rectify or update personal data that is inaccurate, incomplete, or outdated;
• to request that we erase your personal data in certain circumstances;
• to request that we restrict the processing of your personal data in certain circumstances, such as while we consider another request you have submitted;
• to object to our processing of personal data on grounds relating to your particular situation, including where we rely on our legitimate interests;
• to request that we provide a copy of the personal data you provided to us in a structured, commonly used, and machine-readable format, and where technically feasible to transmit it to another controller; and
• where you have given us consent, to withdraw that consent at any time.

To exercise these rights, please email [email protected]. We respond within one month of receiving your request, which we may extend by up to two further months for complex or numerous requests, in which case we will tell you and explain why. We do not charge a fee unless your request is manifestly unfounded or excessive.

You also have the right to lodge a complaint with the supervisory authority in the Member State of your habitual residence, place of work, or the place of the alleged infringement. Applicants in Romania may contact the National Supervisory Authority for Personal Data Processing (ANSPDCP) at www.dataprotection.ro.

The following additional information applies to applicants in Romania, where Law No. 190/2018 implements the GDPR.

National identification number.

Where we process your personal numeric code (cod numeric personal), a copy of an identity document, or another national identification number, we do so only where permitted by law and with appropriate safeguards, including limiting access to authorized personnel, applying retention periods proportionate to the purpose, and training our personnel on their obligations.

Monitoring.

We do not monitor applicants by means of electronic communications or video surveillance as part of the recruiting process. Where an assessment or interview is recorded or proctored, we will tell you before the recording begins and obtain your consent. The additional conditions that Law No. 190/2018 places on workplace monitoring — including prior information, consultation of employee representatives, use only where less intrusive means have not proven effective, and a limit on how long monitoring data may be stored — apply once a working relationship begins, and are described in the privacy notice we provide to our personnel.