Candidate Privacy Statement
This Candidate Privacy Statement explains how Rio Tinto collects, uses, stores and shares personal data about people who apply for roles with us, create or update a candidate profile, join our Talent Community, or otherwise take part in a Rio Tinto recruitment process. It also explains the choices and rights you may have, and how to contact us if you have questions or concerns.
This Candidate Privacy Statement explains how Rio Tinto collects, uses, stores and shares personal data about people who apply for roles with us, create or update a candidate profile, join our Talent Community, or otherwise take part in a Rio Tinto recruitment process.
It also explains the choices and rights you may have in relation to your personal data, and how to contact us if you have questions or concerns.
In this statement, “Rio Tinto”, “we”, “us” and “our” means the Rio Tinto Group company that is recruiting for the role you apply for, and other Rio Tinto Group companies where they are involved in handling your personal data.
For the purposes of applicable privacy laws, the Rio Tinto Group company recruiting for the role is usually the controller of your personal data. Other Rio Tinto Group companies may also be controllers where they decide why and how your personal data is used, either independently or together with the recruiting entity.
Where Rio Tinto uses service providers to process personal data on our behalf, those service providers act as processors or service providers, depending on the laws that apply. We describe the types of service providers we use in the section “Who we share your data with” below.
This statement applies to candidates, applicants and prospective candidates for roles at Rio Tinto.
It also applies if you create or update a profile on a Rio Tinto careers site, join our Talent Community, are referred for a role, take part in an interview or assessment, or otherwise interact with us as part of a recruitment process.
When we refer to “you” or “your”, we mean the person whose personal data we collect and use.
If you are successful in your application and become an employee or contractor, the Rio Tinto Employee Privacy Statement will apply to the personal data we collect and use about you in connection with your employment or engagement.
This statement applies alongside any information provided to you during the recruitment process, including application forms, consent notices, careers site terms, cookies notices, assessment notices, background check notices, and any local privacy notice that applies to you.
Depending on where you live, where the role is located, or the recruitment process you participate in, additional privacy notices or local notices may also apply. These notices may provide extra information about how your personal data is collected, used, stored or shared in a particular location or context. They may also explain country-specific or region-specific requirements, including local legal bases, consent requirements, local identifiers, cross-border transfer requirements, service provider or delegate disclosures, retention rules, and rights available under local privacy laws.
For example:
- If you are a California resident, you should also read the
California Employee, Contractor and Applicant Privacy Notice
. - If you live in, apply from, or apply for a role in a country where a local candidate privacy notice applies, including APAC jurisdictions where local privacy requirements apply, you should also read that local notice.
If there is any inconsistency between this statement and an additional or local privacy notice that applies to you, the additional or local notice will apply to the extent of the inconsistency.
You can contact recruitment.support@riotinto.com for information about any additional or local privacy notice that applies to you.
In this statement, “personal data” means information about an identified or identifiable person. In some countries, this is called “personal information”. We use “personal data” to include both terms.
Some types of personal data receive extra protection under privacy laws. We call this “sensitive data”. Sensitive data may include information about health, race or ethnic origin, religious or philosophical beliefs, political opinions, trade union membership, genetic data, biometric data, sexual orientation, criminal convictions, and other information that receives special protection under applicable law.
“Applicable laws” means the privacy and data protection laws that apply to the way we collect and use your personal data.
“Privacy regulator” means the authority responsible for supervising or enforcing privacy or data protection laws in a particular country or region.
We collect personal data that we need to manage your application, assess your suitability for roles, communicate with you, support the recruitment process, meet our legal obligations, keep our people and sites safe, and operate our business.
The types of personal data we collect will depend on the role you apply for, where you live, where the role is located, the recruitment process you participate in, the systems or sites you use, and the legal requirements that apply. We do not collect every type of personal data about every candidate.
The personal data we may collect includes:
-
- contact and communications information, such as your address, email address, phone number, records of communications with you, and interactions we have with you, including chat, SMS, chatbot, conversational assistant or recruitment platform interactions;
-
- identity, background and eligibility information, such as your name, title, signature, date of birth, nationality, citizenship, residency, immigration status, work authorisation, government-issued identifiers and right-to-work documents;
-
- application, education and professional information, such as your CV or resume, application materials, education history, academic records, achievements, qualifications, skills, professional memberships, work history, references, and information from previous employers or educational institutions;
-
- recruitment and assessment information, such as interview notes, assessment results, personality assessment information, application status, role preferences, willingness to relocate, current or desired salary, pre-screening responses, interview availability, scheduling information, recruitment reminders, candidate query responses, and other information relevant to assessing your suitability for a role;
-
- background check and reference information, such as information about your performance, skills, attitude, personal attributes, criminal records where relevant and permitted, credit checks where required, and biometric face match information where required or permitted in certain jurisdictions;
-
- digital, systems and careers site information, such as visits to Rio Tinto careers sites, IP address, device information, pages viewed, browsing behaviour, interaction with forms and applications, username and log-in credentials, geolocation information where enabled in your device settings, timestamps, delivery or read status, and related interaction metadata; and
-
- audio, visual or similar information, such as photographs, interview recordings, CCTV footage, or other audio, electronic or visual information collected as part of recruitment, site access, interviews or assessments.
Some personal data receives extra protection under privacy laws. We call this “sensitive data”.
Depending on the role, location and recruitment process, we may collect sensitive data such as:
-
- health or disability information, including information needed to consider reasonable adjustments for the recruitment process, assess fitness for work, conduct pre-employment medical checks, or support health and safety requirements;
-
- criminal convictions or offence information, where checks are relevant for certain roles and permitted by applicable law;
-
- race, ethnicity, gender identity, sexual orientation, religious or philosophical beliefs, genetic information or similar information, where this is voluntarily provided by you, needed for equal opportunity, diversity and inclusion monitoring, or otherwise permitted or required by law;
-
- trade union membership, where relevant and permitted;
-
- biometric information, such as biometric face match information where required or permitted in certain jurisdictions; and
-
- other information that receives special protection under applicable law.
We only collect and use sensitive data where we have a lawful basis to do so. This may include your consent, where consent is appropriate and required, or another lawful basis such as meeting legal obligations, supporting equal opportunity obligations, considering reasonable adjustments, protecting health and safety, assessing suitability for certain roles, responding to emergencies, or protecting Rio Tinto’s legitimate interests.
We explain our legal reasons for using personal data and sensitive data in the section “Our legal reasons for using your data” below.
We use your personal data to manage your application, assess your suitability for roles, communicate with you, support the recruitment process, meet our legal obligations, keep people and sites safe, and operate our business.
The purposes for which we may use your personal data include the following.
Recruitment, application review and suitability checks
We use personal data to review and manage your application, assess your skills, qualifications and suitability for roles, identify candidates, shortlist candidates, arrange and conduct interviews, and support recruitment decisions.
This may include reviewing your CV or resume, application materials, work history, qualifications, skills, references, assessment results, interview feedback, right-to-work information, and other information relevant to the role.
Where we use AI-assisted tools, conversational AI or automated processes to support application screening, prioritisation, candidate engagement, interview scheduling or recruitment workflow management, we explain this in the section “AI-assisted tools and automated decision-making” below.
Interviews, assessments and candidate communications
We use personal data to communicate with you, arrange interviews, conduct in-person or online interviews, administer assessments, manage candidate queries, ask pre-screening questions, schedule interviews, send reminders, provide updates about your application, and keep records of recruitment-related communications. This may include communications through email, phone, SMS, chat, recruitment platforms, conversational assistants or similar channels.
Background checks, references and pre-employment checks
Where relevant for the role and permitted by applicable law, we use personal data to carry out background checks, reference checks, right-to-work checks, criminal history checks, credit checks, biometric face matching, pre-employment medical checks, health checks, drug and alcohol testing, or other checks required for the role, location or site.
Reasonable adjustments, health and safety
We use personal data, including health or disability information where permitted, to consider reasonable adjustments for the recruitment process, assess fitness for particular roles or sites, address health and safety requirements, respond to emergencies, and protect the health and safety of candidates, employees, contractors and others.
Diversity, equity, inclusion and equal opportunity
Where permitted by applicable law, we use personal data to support diversity, equity, inclusion, equal opportunity and anti-discrimination obligations. This may include monitoring and reporting on recruitment processes, fostering equal opportunity, and complying with legal obligations relating to protected characteristics.
Where possible and appropriate, reporting will use aggregated or de-identified information.
Talent Community and future opportunities
Where you ask us to do so, or where we have another legal reason, we may use your personal data to consider you for future opportunities at Rio Tinto and its affiliates, including by adding you to a Talent Community or candidate pool.
You may opt out of future recruitment communications or ask us to remove your candidate profile, as described in the section “How to unsubscribe or remove your profile” below.
Access, systems and site security
We use personal data to create and manage candidate accounts, log-in credentials and access to recruitment systems, assessment platforms, Rio Tinto systems, premises or sites where relevant.
We may also use personal data to monitor access to and use of Rio Tinto systems, devices, premises and sites for safety, security, compliance and investigation purposes.
Onboarding after offer acceptance
If you accept an offer, we may use personal data to support onboarding, human resources planning and management, creation of an employee or contractor profile, and preparation for your employment or engagement with Rio Tinto.
Legal, regulatory and governance purposes
We use personal data to comply with laws, regulatory obligations, court orders, search warrants, subpoenas, government or regulator requests, health and safety obligations, anti-discrimination laws, sanctions, financial crime laws, corporate governance obligations, reporting obligations and other legal requirements.
We may also use personal data to obtain professional advice, respond to legal claims, protect our rights, property and interests, protect the rights, property and interests of others, and prevent or respond to dishonesty, misconduct, fraud, crime, malpractice, unfitness, incompetence or serious improper conduct.
Business planning, analytics and recruitment improvement
We use personal data for recruitment administration, workforce planning, talent planning, management reporting, data analytics, recruitment analytics, business improvement, systems administration, and improving the recruitment process.
We do not use every type of personal data for every purpose. The personal data we use will depend on the role, location, recruitment process, systems and sites involved, and the laws that apply.
Privacy laws require us to have a legal reason for collecting, using and sharing personal data. The legal reason we rely on will depend on the purpose, the type of data, your location, the role you apply for, and the laws that apply.
Where applicable, we may rely on one or more of the following legal reasons.
Consent
We may rely on your consent where we ask for your clear agreement to use your personal data for a specific purpose.
When we ask for consent, we will explain what we are asking you to agree to. Depending on the circumstances, consent may be given by signing a consent form, clicking an opt-in button or link, selecting a yes/no option, choosing settings in a system or preference dashboard, responding to a request, answering yes to an oral request where permitted, or voluntarily providing information for a specific purpose.
Where we rely on consent, you may withdraw your consent. Withdrawing consent may affect our ability to process your application, consider you for a role, provide a recruitment service, include you in future recruitment opportunities, or carry out checks or assessments required for the role, site or location.
Steps before entering into a contract
We may use your personal data where this is needed to take steps at your request before entering into an employment contract or contractor agreement. This may include reviewing your application, assessing your suitability, communicating with you, arranging interviews, making an offer, carrying out pre-employment checks, and preparing onboarding after offer acceptance.
Where we use sensitive data in connection with your application, we will also identify and rely on an additional legal reason where required by applicable law.
Legal obligations
We may use your personal data where this is needed to comply with laws, regulations, court orders, regulator requests or other legal processes.
This may include right-to-work obligations, immigration requirements, employment, tax, corporate, health and safety, anti-discrimination, equal opportunity, anti-bribery and corruption, sanctions, financial crime, reporting and record-keeping obligations.
We may also use your personal data to meet legal and regulatory obligations, provide support required by equal opportunity or discrimination laws, address health and safety requirements, respond to legal claims, or protect our rights, property, people, systems or assets.
Vital interests
We may use your personal data where this is needed to protect someone’s life or respond to an emergency. This may include contacting you or your family members, providing or arranging urgent medical care, responding to a workplace incident, or managing an emergency affecting health or safety.
Legitimate interests
We may use your personal data where Rio Tinto, or a third party, has a legitimate business or operational reason to do so, and we have assessed that this is not overridden by your interests, rights or freedoms.
Our legitimate interests may include managing recruitment, reviewing applications, identifying candidates, arranging interviews and assessments, protecting our people, premises, systems, devices and assets, maintaining network and information security, preventing and detecting misconduct, fraud or crime, conducting recruitment analytics, improving recruitment processes, supporting workforce planning, managing our business, defending legal claims, and protecting our rights and interests or those of third parties.
When we rely on legitimate interests, we consider the purpose of the processing, whether the processing is necessary for that purpose, and whether your interests, rights or freedoms override our interests.
Sensitive data and specially protected data
Where we use sensitive data, criminal records information, biometric information, health information or other specially protected data, we will only do so where permitted by applicable law and where any additional legal requirements are met.
AI-assisted tools may generate grades, scores, match indicators, rankings, recommendations, alerts, suggested responses, workflow actions or similar outputs. These outputs may be used to support recruitment activity, but AI-assisted tools are not intended to make final recruitment or hiring decisions without human involvement. Final recruitment and hiring decisions should involve meaningful human review by a recruiter, hiring manager or other appropriate person.
Where an AI-assisted tool materially influences how applications are screened, prioritised, shortlisted, progressed, reviewed, contacted, scheduled or escalated, Rio Tinto will assess the process by reference to its practical effect, including whether meaningful human review and override are available in practice.
Spotlight – AI-assisted candidate screening
Where Spotlight or another AI-assisted screening tool is used, it may assist with screening and prioritising review of job applications.
The tool may assess information in your application and assign a grade, score, match indicator or similar output based on how closely your application appears to match the stated requirements of the role.
The personal data used may include your CV or resume, application responses, work history, skills, qualifications, education, certifications, language proficiency, role preferences, application history, job requisition information, role requirements, application stage or status, and recruiter actions or outcomes.
Spotlight does not make a final hiring decision or predict future job performance. It may, however, assist with screening, grading, scoring, matching or prioritising applications by comparing application information with stated role requirements. Its output is used to support recruiter review and recruitment workflow management. Spotlight is not intended to be used to automatically reject or exclude candidates without meaningful human review.
Paradox – recruitment conversations and scheduling
Paradox may be used to support recruitment-related communications, candidate engagement, pre-screening, interview scheduling, reminders and recruitment workflow management. This may include use of conversational AI, chat, SMS or similar channels to ask or answer recruitment-related questions, collect responses, assist with scheduling, send reminders, provide application or interview updates, and help recruiters manage applications.
Paradox may process information provided by you during a recruitment process, including application information, pre-screening responses, interview availability, scheduling information, communication preferences, message content, conversation transcripts, timestamps and related interaction metadata.
Paradox does not make a final recruitment or hiring decision or predict future job performance. It may, however, assist with candidate engagement, screening, scheduling, prioritisation, progression, escalation or recruitment workflow management. Workday Paradox is not intended to be used to automatically reject or exclude candidates without meaningful human review.
Where Paradox is used for AI-assisted screening or other processing that materially influences whether a candidate is progressed, shortlisted, escalated or prioritised, we will provide additional information about the process and any consent, opt-out, withdrawal or review options available, where required by applicable law.
Fetch Capabilities – candidate matching and future opportunities
Where Fetch Capabilities or another AI-assisted matching tool is used, it may assist with identifying possible matches between candidates, candidate profiles, Talent Community members, previous applicants, prospects or warm leads and current or future role opportunities.
The tool may assess information in your candidate profile, application history, CV or resume, work history, skills, qualifications, education, certifications, language proficiency, location, role preferences, previous application status, and job requisition information. It may generate a match indicator, ranking, recommendation or similar output to help recruiters identify candidates or opportunities that may be relevant.
Fetch Capabilities do not make a final recruitment or hiring decision or predict future job performance. They may, however, assist with sourcing, matching, ranking, surfacing or prioritising candidates or opportunities. Their output is used to support recruiter review and recruitment workflow management. Fetch Capabilities are not intended to be used to automatically reject or exclude candidates without meaningful human review.
Where we rely on your consent for future opportunity matching or AI-assisted matching, you may withdraw your consent or opt out at any time. You may also ask us to stop considering you for future opportunities or remove your candidate profile, as described in the section “How to unsubscribe or remove your profile” below.
Kinds of decisions or processes assisted
AI-assisted tools or automated processes may assist with:
-
- screening or prioritising review of applications;
-
- identifying information relevant to role requirements;
-
- assessing whether application information appears to match stated role criteria;
-
- supporting shortlisting recommendations for human review;
-
- identifying possible matches for future opportunities, where applicable;
-
- communicating with candidates through chat, SMS, conversational assistants or similar channels;
-
- asking or recording pre-screening responses;
-
- scheduling interviews, sending reminders and managing recruitment updates;
-
- supporting candidate engagement and recruitment workflow management; and
-
- generating recruitment analytics or insights.
Consent, opt-out and manual review
Before you begin an application where AI-assisted screening is used, we will ask for your separate express consent, unless applicable law provides another lawful basis.
We will explain how the AI-assisted tool may be used, the types of personal data it may use, the output it may generate, and how that output may be used in the recruitment process.
You do not have to consent to AI-assisted screening. If you do not consent, or if you later withdraw your consent or opt out, your application will be processed through an equivalent manual review pathway without practical disadvantage.
You may also ask us to correct personal data used in connection with AI-assisted screening, conversational recruitment tools or automated recruitment processes, including information in your candidate profile, application, CV or resume, application responses, pre-screening responses, interview availability, scheduling records, recruitment communications, work history, qualifications, skills, role preferences or questionnaire responses. If Workday or another recruitment system does not allow you to amend a submitted response directly after submission, you may speak to your recruiter or contact recruitment.support@riotinto.com.
Other automated tools and assessments
We may also use other digital or automated tools to support recruitment activities. For example, we may use tools to manage applications, assess role eligibility, support interview scheduling, confirm work authorisation, conduct online assessments, support background checks, or help identify whether reasonable adjustments may be needed for the recruitment process.
Some online assessments or tests may use automated scoring or evaluation. Where this applies, we will provide information about the assessment and how its results may be used.
Human review and review options
A recruiter, hiring manager or other appropriate person should review relevant information before a final recruitment or hiring decision is made. This may include reviewing your application, assessment results, interview feedback, role requirements, AI-assisted outputs, and other relevant information.
You may request more information about AI-assisted tools or automated decision-making, withdraw consent, opt out of AI-assisted screening or matching where applicable, or ask for a decision to be reviewed by contacting recruitment.support@riotinto.com or another contact point notified to you.
Where automated decision-making laws apply, we will provide information about the kinds of personal data used in automated decision-making and the kinds of decisions made or substantially assisted by automated decision-making.
We collect most personal data directly from you. This may happen when you apply for a role, create or update a candidate profile, join our Talent Community, communicate with us, take part in interviews or assessments, complete forms, or use Rio Tinto careers sites or recruitment platforms.
We may also collect personal data through recruitment chatbots, SMS, messaging tools, conversational assistants or scheduling platforms used in connection with recruitment, candidate engagement, interview scheduling, onboarding or future opportunities.
We may also collect personal data from the systems, sites and services you use as part of the recruitment process. This may include careers sites, recruitment platforms, assessment platforms, interview tools, background check platforms, access systems, security systems, and other tools used to manage recruitment, safety, security, compliance or business operations.
In some circumstances, we may infer or generate personal data about you from other information we hold. For example, we may generate information through application review, assessment results, interview notes, recruitment analytics, reporting, system logs, or AI-assisted tools where these are used.
We may collect some personal data from other people or organisations where this is permitted by applicable law, where it is not reasonably practical to collect it directly from you, or where this is needed for recruitment, verification, safety, legal, compliance, investigation or business purposes. We give examples in the section “When we collect your data from others” below.
We do not collect or use every type of personal data or sensitive data about every candidate. The information we need will depend on the role you apply for, where you live, where the role is located, the recruitment process you participate in, the systems or sites you use, and the laws that apply.
In some cases, we need certain personal data to manage your application, assess your suitability for a role, communicate with you, carry out checks or assessments, meet our legal obligations, provide reasonable adjustments, give you access to recruitment systems or sites, or protect health, safety and security.
You do not have to provide personal data unless you choose to do so or are required to do so by law, by a recruitment process, or by requirements that apply to the role, site or location. However, if you choose not to provide information that we need, this may affect our ability to process your application, assess your suitability, communicate with you, make or progress an offer, carry out required checks, provide reasonable adjustments, or allow you to access a site, system, interview, assessment or recruitment process.
Where we rely on your consent to collect, use or share personal data, including sensitive data, you may withdraw your consent at any time. You can do this by contacting recruitment.support@riotinto.com, using a button or preference setting where one is provided, or using another method we tell you about.
Withdrawing consent will not affect the lawfulness of any processing that occurred before the withdrawal. However, it may affect what we can do after you withdraw consent. For example, it may affect our ability to include you in our Talent Community, consider you for future opportunities, process certain checks or assessments, or continue with a recruitment process where the information is required for the role, site, location, health and safety, legal or operational reasons.
If we rely on your consent for AI-assisted screening and you do not consent, withdraw your consent, or opt out, your application will be processed through an equivalent manual review pathway without practical disadvantage. More information is set out in the section “AI-assisted tools and automated decision-making” above.
Sometimes you may give us personal data about another person. For example, you may provide details for a referee, reference, emergency contact, family member, dependant, beneficiary, representative, or someone else connected with your application or recruitment process.
Before you give us another person’s personal data, you should make them aware that:
-
- you are providing their personal data to Rio Tinto;
-
- Rio Tinto will collect, use, store and share their personal data as described in this statement and any other privacy notice that applies; and
-
- they can contact us if they have questions about how we handle their personal data.
Where required by applicable law, you should also obtain their consent before providing their personal data to us.
Most of the personal data we collect comes directly from you. Sometimes, however, we may collect personal data about you from other people or organisations where this is permitted by applicable law.
For example, we may collect personal data from recruitment agencies, internal recruiters, background check providers, candidate assessment providers, named referees, previous employers, educational institutions, publicly available sources, health care professionals, service providers, regulators, public authorities, or Rio Tinto employees who refer you for a role.
We may do this where it is not reasonably practical to collect the information directly from you, where we need the information for recruitment, verification, safety, legal, compliance, investigation or business purposes, or where we consider it necessary to protect your interests, Rio Tinto’s interests, or the interests of another person.
We may share your personal data, including sensitive data where permitted, for the purposes described in this statement and where we have a legal reason to do so.
We may share your personal data with:
-
- Rio Tinto Group companies and related entities, including other Rio Tinto companies, affiliates and, where relevant, managed or non-managed joint venture partners involved in recruitment, hiring, onboarding, workforce planning or related business activities;
-
- people who need the information for recruitment or business purposes, such as recruiters, hiring managers, interviewers, assessment reviewers, human resources personnel, site access personnel, security personnel, and other Rio Tinto employees, agents or contractors who need access to perform their role or provide services to us;
-
- service providers who support recruitment and candidate management, such as recruitment agencies, recruitment platforms, candidate engagement providers, conversational AI or chatbot providers, interview scheduling providers, candidate assessment providers, interview technology providers, background check providers, reference check providers, occupational health and medical providers, drug and alcohol testing providers, right-to-work or identity verification providers, travel providers and relocation providers;
-
- technology, systems and security providers, such as providers of network services, cloud storage, hosting, IT support, recruitment systems, workplace platforms, access systems, CCTV, security and monitoring equipment;
-
- professional advisers and insurers, such as legal advisers, auditors, financial advisers, consultants, brokers, insurers, health and medical advisers, global mobility advisers and other recruitment or employment-related advisers;
-
- operational partners and business service providers, where relevant to the role, site or recruitment process, such as facilities providers, transport providers, site access providers, medical providers, accommodation providers and other parties that help our sites and operations function;
-
- regulators, government agencies, courts, law enforcement bodies and other public authorities, where required or permitted by law, court order, regulatory process or legal obligation;
-
- actual or potential purchasers, investors, lenders or other parties involved in business change, such as a proposed or actual acquisition, divestment, investment, debt or loan sale, business transfer, restructuring or change in ownership; and
-
- other recipients with your permission or where required or permitted by applicable law.
In some jurisdictions, we may disclose information to law enforcement or regulatory bodies without a formal notice where we are legally permitted to do so, for example in connection with suspected serious crimes or offences.
We will only share personal data where it is appropriate for the relevant purpose and subject to applicable legal requirements.
Rio Tinto operates globally, so your personal data may be transferred to, stored in, or accessed from countries outside your home jurisdiction.
For example, your personal data may be accessed by Rio Tinto Group companies, affiliates, joint venture partners, recruiters, hiring managers, service providers or advisers involved in recruitment, hiring, onboarding, workforce planning, technology support, legal compliance or business administration.
Rio Tinto uses a centralised global recruitment function, which allows candidates to apply for roles in different countries. Any hiring or employment-related decision will be made by the relevant hiring entity in accordance with the laws that apply to the role and the country where the role is located.
Where we transfer personal data internationally, we will do so in accordance with applicable law. Depending on the circumstances and the laws that apply, this may include transferring personal data where:
-
- you have given consent, where consent is required;
-
- the transfer is subject to appropriate safeguards, such as standard contractual clauses or other contractual, technical and organisational protections;
-
- the transfer is to a country recognised by the relevant privacy regulator as providing adequate protection for personal data; or
-
- the transfer is otherwise permitted under applicable law.
Where required, we put in place safeguards designed to protect personal data transferred internationally. These may include contractual obligations requiring recipients to protect personal data, and technical and organisational security measures designed to keep personal data secure.
Rio Tinto careers sites and recruitment platforms may use cookies and similar technologies to operate the site, remember your preferences, support security, understand how candidates use the site, and improve the recruitment process.
Cookies and similar technologies may collect information such as device information, browser information, IP address, pages viewed, links clicked, forms completed, and dates and times of visits.
Where required by applicable law, we will ask for your consent before using non-essential cookies or similar technologies.
You can manage cookies through your browser settings or through any cookie preference tool made available on the relevant site. More information may be provided in the applicable cookies notice or website privacy notice.
We use technical, organisational and physical measures designed to protect personal data from unauthorised access, use, disclosure, alteration, loss or destruction.
These measures may include access controls, system security controls, monitoring, encryption or other protective technologies where appropriate, confidentiality obligations, staff training, internal policies, vendor due diligence, contractual protections, and physical security measures.
We limit access to personal data to people who need it for their role or to provide services to us, such as recruiters, hiring managers, interviewers, human resources personnel, service providers and advisers involved in the recruitment process.
We require service providers to protect personal data they handle on our behalf.
No system or method of transmission is completely secure. However, we take steps designed to protect personal data in accordance with applicable laws and Rio Tinto security requirements.
We keep personal data only for as long as we need it for the purposes described in this statement, or for as long as we are required or permitted to keep it by law.
How long we keep particular records will depend on the type of information, the reason we collected it, the role you applied for, where you live, where the role is located, applicable legal or regulatory requirements, and whether the information is needed for recruitment, onboarding, talent community, background checks, site access, health and safety, legal, audit, investigation, dispute, insurance, reporting or business purposes.
We may keep candidate personal data after a recruitment process ends where this is required or permitted by law, including to comply with record-keeping obligations, respond to queries, manage legal claims, consider you for future opportunities where appropriate, improve recruitment processes, or maintain business records.
We may remove personal data for inactive candidate accounts or profiles from our systems, subject to applicable legal or regulatory obligations and Rio Tinto retention requirements.
Where we no longer need personal data, we will delete it, de-identify it, or securely archive it where retention is required or permitted by applicable law and Rio Tinto retention requirements.
You can contact recruitment.support@riotinto.com if you need more information about retention of your candidate personal data.
Depending on where you live, where the role is located, and subject to applicable laws, you may have rights in relation to your personal data. These rights are not absolute, and exceptions may apply.
Your rights may include the right to:
-
- be informed about how we collect and use your personal data;
-
- request access to, or a copy of, personal data we hold about you;
-
- ask us to correct personal data that is inaccurate, incomplete or out of date, including candidate profile information, application information, application responses, pre-screening responses, scheduling records, recruitment communications, questionnaire responses, assessment information or other recruitment information where correction is permitted by applicable law;
-
- ask us to delete personal data in certain circumstances;
-
- ask us to restrict how we use personal data in certain circumstances;
-
- object to certain uses of your personal data, including certain automated decision-making or profiling where applicable;
-
- receive personal data you have provided to us in a reasonable format, where applicable;
-
- withdraw consent where we rely on consent, without affecting the lawfulness of processing before consent was withdrawn;
-
- ask for information about safeguards used for international transfers, where applicable;
-
- ask for human review or further information about automated decision-making, where applicable; and
-
- nominate another person to exercise your rights in the event of your death or incapacity, where applicable.
If you register on a Rio Tinto careers site, you may be able to access, review and update some of your personal data by logging into your account and updating your profile.
Some submitted application information, including pre-screening responses, scheduling records, recruitment communications and questionnaire responses, may not be capable of being amended directly in Workday or another recruitment system after submission. If you need to correct information that you cannot update yourself, you may use Rio Tinto’s manual candidate data correction form at [insert link] or contact recruitment.support@riotinto.com. We will assess the request and, where appropriate, apply the correction to your candidate profile, application record or related recruitment information.
To make a request, contact recruitment.support@riotinto.com or use another contact point or process we tell you about.
We may need to verify your identity before responding to a request. This helps us protect personal data and prevent unauthorised access or fraudulent requests.
We will respond to your request within a reasonable period and in accordance with applicable law. Where possible, we aim to respond to access and correction requests within 30 calendar days. If we cannot comply with your request, or can only comply in part, we will explain why, unless we are legally prevented from doing so.
Where local law requires additional information about your rights, including access, correction or automated decision-making transparency rights, we will provide that information in this statement, a local privacy notice, or another notice made available to you.
You can opt out of receiving information from us about future opportunities at any time by using the unsubscribe function in emails you receive from us, by updating your preferences where this option is available, or by contacting recruitment.support@riotinto.com.
If you have registered on a Rio Tinto careers site, you may be able to delete or update some of your personal data by logging into your account and updating or deleting your profile.
If you need to correct submitted application information, pre-screening responses, scheduling records, recruitment communications or questionnaire responses that cannot be amended directly through the careers site or Workday, please use the manual candidate data correction form at [insert link] or contact recruitment.support@riotinto.com.
You may also ask us to remove your candidate profile or stop considering you for future opportunities by contacting recruitment.support@riotinto.com.
In some cases, we may need to keep certain personal data after you unsubscribe, delete your profile, or ask us to remove your profile. For example, we may need to keep information where required or permitted by law, for recruitment records, legal or regulatory obligations, security, audit, dispute, claims management or business purposes.
Where we no longer need personal data, we will delete it, de-identify it, or securely archive it in accordance with applicable law and Rio Tinto retention requirements.
If you have a question, concern or complaint about how we handle your personal data, please contact recruitment.support@riotinto.com or the data protection officer responsible for your country or region, if applicable.
We will review your concern and respond in accordance with applicable law.
If you are not satisfied with our response, you may have the right to make a complaint to the privacy regulator or data protection authority in your country or region.
UK data protection complaints
If UK data protection law applies to the way we handle your personal data, you may make a data protection complaint to us if you think we have not complied with applicable data protection law. You can do this by contacting recruitment.support@riotinto.com or another contact point notified to you.
We will acknowledge receipt of your complaint within 30 days of receiving it. We will take appropriate steps to consider and respond to your complaint, including making enquiries where needed, keeping you informed, and telling you the outcome without undue delay.
You also have the right to complain to the UK Information Commissioner’s Office. Where applicable, you may be asked to raise your complaint with us first so that we have an opportunity to consider and respond to it.
We may update this statement and any additional or local privacy notices from time to time.
Where required, we will provide you with a new or updated Statement.
If we want to use personal data we have already collected for a new purpose that is not compatible with the purpose we originally told you about, we will provide additional notice and, where required by applicable law, seek your consent before using the personal data for that new purpose.
Translations of this statement may be available on request.
If there is any inconsistency between a translated version of this statement and the English version, the English version will apply, unless applicable law requires otherwise.
In this statement, “Rio Tinto Group” means all companies or businesses wholly or majority owned or managed by Rio Tinto plc or Rio Tinto Limited, whether directly or indirectly.
Additional Information for California Residents
This section applies, generally, to California Personal Data, referred to in this section as “Personal Information”, that we collect and otherwise process about California residents, in accordance with the California Consumer Privacy Act (CCPA), in the context of managing, storing, or processing your Application and the use of our career site. This section does not address or apply to our collection of Personal Information that is not subject to the CCPA, such as consumer credit reports and background checks, publicly available data, or other information that is exempt under the CCPA.
the categories of third parties to whom we disclosed the information for a business or commercial purpose.
| Categories | Examples | Categories of Third Parties and Other Recipients to Whom We Disclosed It |
|---|---|---|
| Government-issued Identifiers | Such as Social Security number, driver’s license, state identification card, passport number, and other government identifiers. |
|
| Other Identifiers | Such as name and contact information. |
|
| Internet or Other Electronic Network Activity Information | Internet or other electronic network activity information, such as information regarding your interactions with our recruiting website. |
|
| Characteristics of Protected Classifications Under California and Federal Law | Such as race or ethnicity, gender, sexual orientation, religion, health information, genetic information, trade union membership, and philosophical beliefs. |
|
| Audio, Electronic, Visual, Thermal, or Similar Information | Audio, electronic, visual, or similar information, such as CCTV or video footage, photographs, call recordings, and other audio recordings, including recorded interviews. |
|
| Professional or Employment-related Information | Such as performance information, professional membership records, references, assessment records, resumes, cover letters, work history, conduct information, and termination data. |
|
| Education Information | Such as degrees earned, educational institutions attended, transcripts, training records, and other information about your educational history or background. |
|
We do not “sell” or “share” Personal Information or Sensitive Personal Information related to California residents, as those terms are defined by the CCPA.
Subject to applicable legal restrictions, generally, we collect, use, disclose, and otherwise process California residents’ Personal Information as further described in the “Why is your Personal Data Processed?” section above. For your convenience, we have listed those purposes again here:
- To assess your suitability to undertake certain positions or activities. For example, to record your disclosed medical or physical conditions, limitations, pre-employment or medical and health checks and assessments, and alcohol and drug testing;
- Application review, including assessing your skills, qualifications, and suitability for applicable roles and opportunities;
- Facilitating in-person or online interviews and assessments;
- Future recruitment with your consent to add you to our Talent Community to be considered for other opportunities at Rio Tinto and Affiliates beyond the one(s) for which you apply;
- To carry out background checks, which can include background, credit, and criminal checks;
- To check references you provide to us in relation to your employment history;
- For diversity and inclusion, such as monitoring and fostering equal opportunity in recruitment processes;
- To ascertain whether a potential candidate with a health condition needs reasonable adjustments to be made to the recruitment process (not the role) to allow them to participate;
- To facilitate access or logins;
- Onboarding, human resources planning and management, and creating an Employee Profile after offer acceptance;
- To provide additional assistance and support to you under Equal Opportunity or Discrimination laws (or equivalent);
- To address, manage, and mitigate health and safety at our workplace;
- To take action to protect and defend our rights or property and/or the rights or property of third parties or to protect the public against dishonesty, malpractice or seriously improper conduct, unfitness or incompetence, mismanagement or failures in services provided;
- To meet our legal and regulatory obligations, such as compliance with applicable global laws and regulations;
- Pre-employment medical screening or health checks;
- Drug and alcohol testing;
- Identifying candidates, including by recruiters;
- To monitor access and/or use of Rio Tinto systems and devices, premises, and sites for safety and security;
- Effective management of our business and providing our employees with opportunities;
- For conducting and processing data analytics and/or generating insights for the benefit of Rio Tinto;
- To protect your and someone else’s life. For example, if you are involved in an emergency and you require emergency care or medical treatment or you witness an emergency situation and are able to provide information to us about it;
- To contact you or your family members where appropriate, for compliance with health and safety requirements or during medical emergencies;
- For other activities that further our legitimate interests.
We retain Personal Information until after we determine that its retention no longer is necessary for the processing purposes described in this notice. Because we may collect and use the same category of Personal Information for different purposes and in different contexts, there is not typically a fixed retention period that always will apply to a particular category of Personal Information. Examples of how long we normally intend to retain California Personal Information for which we are subject to the CCPA in certain situations are set forth below. Data about individuals who reside outside California is handled differently and may be subject to different retention periods.
| Categories of Personal Information Collected About California Residents | Examples of How Long We Plan to Retain Certain Copies of This Data |
|---|---|
| Government-issued Identifiers | For California candidates we chose not to hire, we normally plan to retain their job application, which may contain this kind of Personal Information, for at least four years for compliance purposes. |
| Other identifiers, such as a real name and contact info | For California candidates we chose not to hire, we normally plan to retain their job application, which would contain this kind of Personal Information, for at least four years for compliance purposes. |
| Internet or other electronic networking activity information, such as details about your interaction with our recruiting website. | We may retain server logs reflecting California traffic to our recruiting pages for several years for security purposes. |
| Characteristics of protected classifications under California and federal law | For California candidates we chose not to hire, we normally plan to retain responses to equal employment opportunity questions in job applications for four years. |
| Audio, electronic, visual, thermal, or similar information | We typically delete voicemails soon after responding to them or resolving the matter under discussion. |
| Professional or employment related information | For California candidates we chose not to hire, we normally plan to retain their job application, which would contain this kind of Personal Information, for at least four years for compliance purposes. |
| Education information | For California candidates we chose not to hire, we normally plan to retain their job application, which would contain this kind of Personal Information, for at least four years for compliance purposes. |
| Biometric information | Typically deleted as soon as the identity authentication is performed. |
You have certain rights under the CCPA with respect to your Personal Information, subject to certain limitations and exceptions:
- The right to delete your Personal Information;
- Know/access: the right to know what Personal Information we have collected about you, including the categories of Personal Information in the last 12 months, the categories of sources from which the Personal Information is collected, the business or commercial purpose for collecting, selling, or sharing Personal Information, the categories of third parties to whom we disclose Personal Information, and the specific Personal Information we have collected about you;
- Correct the information we hold about you;
- Opt out of “sales” and “sharing” as defined in the CCPA; however, as discussed above, we do not “sell” or “share” California residents’ Personal Information.
- Limit use/disclosure of Sensitive Personal Information: the right to request to limit certain use and disclosure of Sensitive Personal Information. However, as discussed above, we do not use or disclose California residents’ Personal Information in a manner that would trigger this right.
- Non-discrimination: not to be subject to discriminatory treatment (as defined by the CCPA), including an employee’s or contractor’s right not to be retaliated against for the exercise of their rights under the CCPA.
Please note that the CCPA or other laws may sometimes allow or require us to deny certain requests to exercise CCPA rights. For example, we need to retain certain information to evaluate your application and thus cannot delete it if you want us to continue evaluating your application.
Submitting a CCPA Request
You may submit a request to us at recruitment.support@riotinto.com, or by phoning our free toll number on +1 800 872 6729.
We will take steps to verify your request by matching the information provided by you with the Information we have on our records. Your request must provide sufficient information that allows us to reasonably verify you are the person about whom we collected Personal Information, or an authorized representative, and describe your request with sufficient details that allows us to properly understand, evaluate, and respond to it. If you are an agent making a request on behalf of an individual covered by this notice, you should follow the submission steps mentioned above, and we reserve the right to take steps to verify that you are authorized to make that request, which may include requiring you to provide us with written proof such as a notarized authentication letter or a legally sufficient power of attorney signed by the data subject pursuant to California Probate Code sections 4121 to 4130, or other written authorization acceptable to us. We also may require the individual to verify their identity directly with us where permitted.