1. Who we are and who controls your data
This notice explains how uniQure processes the personal data of individuals who apply for a role with us, or who are otherwise considered as candidates, through our applicant tracking system. It applies to applications made through our careers site, through our recruitment platform, through external job boards, and to candidates added to our system by our recruiters or approved sourcing partners.
The uniQure entity that acts as the controller of your personal data depends on the role you apply for:
- Roles in the United States (including California): uniQure, Inc., 1 Hartwell Pl, Lexington, MA, acting as a business under the California Consumer Privacy Act (CCPA/CPRA).
- Roles in the Netherlands and the rest of the EU/EEA: uniQure biopharma B.V., Paasheuvelweg 25a, 1105 BP Amsterdam, the Netherlands, acting as controller under the EU GDPR and the Dutch UAVG.
- Roles in the United Kingdom: uniQure United Kingdom Ltd, Office 147 Spaces, UXBRIDGE, The Charter Building, Uxbridge UB8 1JG, acting as controller under the UK GDPR.
2. How to contact us
For any question about this notice or to exercise your rights, contact us at privacy@uniqure.com.
3. What personal data we collect
We collect the following categories of personal data during recruitment:
Category | Examples |
|---|---|
Identity & contact | Name, email, phone, postal address, and links you provide (e.g. LinkedIn). |
Application details | CV/resume, cover letter, work history, education, qualifications, current/most recent title and employer, and any information you include in your application or interviews. |
Assessment records | Interview notes, interviewer scorecards, assessment results, and correspondence with our recruiters. |
Right-to-work / screening | Information necessary to verify your eligibility to work, such as nationality, immigration or work-authorisation status, and, where appropriate and permitted by applicable law, information obtained through pre-employment screening or background checks. |
Special-category data | Where relevant and permitted by law, information concerning health or disability, racial or ethnic origin, or other information treated as sensitive or special-category data under applicable law. Most of this information is provided directly by you. We may also receive personal data from other sources, including recruitment agencies, professional networking or recruitment platforms, publicly available professional sources, references you nominate, and, where appropriate and permitted by law, screening providers. Where we identify potential candidates who have not applied directly to us, we may collect professional information that is reasonably relevant to recruitment, such as information available through professional networking platforms or other legitimate professional sources. |
4. Why we use your data and our legal basis (EU/EEA and UK)
Under the EU and UK GDPR, we must have a lawful basis for using your personal data.
The lawful basis depends on the purpose for which we use the information:
Processing an application you submit, assessing your suitability for the relevant role, conducting interviews and assessments, and communicating with you about your application
Legal basis: Taking steps at your request before potentially entering into an employment contract – Article 6(1)(b) GDPR.
- Identifying and contacting potential candidates who have not applied directly to us
Legal basis: Our legitimate interests – Article 6(1)(f) GDPR – in identifying and recruiting suitable candidates. - Managing and administering our recruitment process, including scheduling, internal coordination, maintaining appropriate recruitment records, and ensuring an effective and accountable recruitment process
Legal basis: Our legitimate interests – Article 6(1)(f) GDPR – in operating an effective, consistent and accountable recruitment process. - Carrying out right-to-work checks or other checks that we are legally required to perform
Legal basis: Compliance with a legal obligation – Article 6(1)© GDPR. - Carrying out additional recruitment or pre-employment checks that are not legally required but are appropriate and permitted for the relevant role
Legal basis: Where applicable, our legitimate interests – Article 6(1)(f) GDPR – in assessing candidates and protecting our business, personnel and operations, subject to applicable employment and other laws. - Maintaining records where necessary to establish, exercise or defend legal claims or otherwise protect our legal position
Legal basis: Our legitimate interests – Article 6(1)(f) GDPR – in protecting and exercising our legal rights. - Keeping your information after the recruitment process so that we may consider and contact you about future opportunities
Legal basis: Your consent – Article 6(1)(a) GDPR, where we ask you to join our talent pool. See Section 7.
Where we rely on legitimate interests, we consider whether those interests are necessary and proportionate and balance them against your interests, rights and freedoms.
5. AI-assisted tools and automated decision-making
Our applicant tracking system and other technologies used in the recruitment process may include artificial intelligence (“AI”) or other automated features designed to assist our recruitment team.
Depending on the features we use, these tools may, for example, extract information from CVs/resumes and populate relevant fields, organize or summarize application information, assist with administrative recruitment tasks, or otherwise help our recruiters manage candidate information more efficiently.
Where AI-assisted features process applicant personal data on our behalf, we require the relevant service providers to process that information in accordance with our instructions and applicable contractual and data protection requirements. Where applicable to the services we use, our arrangements prohibit providers from using applicant personal data to train their general-purpose or shared AI models.
We do not use AI or automated tools to make final hiring decisions. AI-assisted outputs are intended to support our recruitment personnel and do not replace human review and judgment.
Unless we inform you otherwise, we do not make decisions about your application that produce legal effects or similarly significantly affect you based solely on automated processing within the meaning of Article 22 of the EU or UK GDPR.
If we introduce AI or automated technology that materially changes how candidates are evaluated or selected (for example, technology used to score, rank, recommend or screen candidates) we will assess the applicable legal, employment and data protection requirements and provide any additional information, notices or safeguards required by applicable law.
Where third-party AI or technology providers process applicant personal data on our behalf, we require appropriate contractual, confidentiality, security and data protection safeguards.
We periodically review the recruitment technologies and features we use and will update this notice where their use materially changes the way we process applicant personal data.
6. Special-category (sensitive) data
Certain personal data is subject to additional protection under applicable data protection law. Under the EU and UK GDPR, this includes information concerning health or disability, racial or ethnic origin, religious or philosophical beliefs, political opinions, trade union membership, genetic or biometric information used for identification, and information concerning a person’s sex life or sexual orientation.
We do not ask candidates to provide special-category personal data unless there is an appropriate reason for doing so. However, such information may arise during recruitment, including where you voluntarily include it in your application or provide it in connection with an accommodation request.
Where we process special-category personal data, we will do so only where we have both an appropriate lawful basis under Article 6 GDPR and an applicable condition under Article 9 GDPR and applicable national law.
Depending on the circumstances, this may include:
Employment and social-protection obligations and rights: Where processing is necessary to carry out obligations or exercise rights in the field of employment or social-protection law, including, where applicable, in connection with reasonable accommodations – Article 9(2)(b) GDPR, together with applicable national law.
Legal claims: Where processing is necessary for the establishment, exercise or defense of legal claims – Article 9(2)(f) GDPR.
Information you have manifestly made public: In limited circumstances, where the relevant information has clearly been made public by you – Article 9(2)(e) GDPR.
Explicit consent: Where appropriate and legally permissible, we may ask for your explicit consent to process particular special-category information – Article 9(2)(a) GDPR. Where we rely on consent, providing the information is voluntary and you may withdraw your consent at any time with future effect.
If we collect optional diversity, equal-opportunity or demographic information, we will explain why we are collecting it, whether providing it is voluntary, how it will be used, and the applicable legal basis and special-category processing condition.
Information provided for reasonable accommodations or, where applicable, diversity monitoring will not be used to assess your professional suitability for a role except to the extent that the information is legitimately relevant, and its use is permitted or required by applicable law.
You may withdraw your consent at any time with future effect by contacting privacy@uniqure.com.
7. Keeping you in mind for future roles
If you agree, we may retain relevant details from your application after the recruitment process has ended so that we can consider and contact you about other roles that may be suitable for you.
Participation in our talent pool is entirely optional. Your decision whether to participate will not affect your current application or any future application you may choose to submit.
For EU/EEA and UK candidates, where we rely on consent for this purpose, you may withdraw your consent at any time by contacting privacy@uniqure.com or through any other withdrawal mechanism we make available to you.
Withdrawal of consent does not affect the lawfulness of processing carried out before your consent is withdrawn.
8. How long we keep your data
We retain applicant personal data only for as long as reasonably necessary for the purposes for which it was collected, including applicable legal, regulatory and record-keeping requirements and the establishment, exercise or defense of legal claims. Our general retention periods for unsuccessful applications are:
Where the role is | How long we keep unsuccessful applications |
|---|---|
Netherlands / EU/EEA | Up to 12 months if you consent to the talent pool |
United Kingdom | Up to 12 months, or longer talent-pool period with consent |
United States (incl. California) | 12–24 months, consistent with US practice and any record-keeping obligations |
Different retention periods may apply where required or permitted by law, for example where information must be retained in connection with an actual or anticipated legal claim.
If you are hired, relevant information collected during recruitment may become part of your employee record and will thereafter be processed in accordance with our employee privacy notice and applicable retention requirements.
9. Who we share your data with, and international transfers
We share applicant personal data only where appropriate for the recruitment process or otherwise permitted or required by law.
This may include:
- uniQure personnel involved in recruitment, HR, hiring decisions, IT, compliance and legal matters, on a need-to-know basis;
- other uniQure affiliates where relevant to the recruitment process;
- our recruitment platform provider, Greenhouse Software, Inc. (Greenhouse), which processes applicant data on our behalf, together with its authorised sub-processors;
- recruitment agencies, assessment, screening or other service providers involved in the recruitment process;
- professional advisers, including lawyers, accountants and auditors; and
- public authorities, regulators, law-enforcement bodies or courts where disclosure is required or permitted by law or necessary for the establishment, exercise or defense of legal claims.
Greenhouse stores EU applicant data in a data centre in the EU. Applicant information may nevertheless be transferred to or accessed from countries outside the EEA or UK, including the United States.
Where personal data is transferred internationally, we use an appropriate transfer mechanism as required by applicable law. Depending on the recipient and circumstances, this may include an applicable adequacy decision, the EU‑U.S. Data Privacy Framework where the recipient is appropriately certified and the framework applies, the European Commission’s Standard Contractual Clauses, and, for UK transfers, an applicable UK transfer mechanism such as the UK Addendum.
10. Your rights
Depending on where you are located and subject to applicable legal conditions and exceptions, you may have rights in relation to your personal data.
Under the EU and UK GDPR, these may include the right to:
- obtain confirmation as to whether we process your personal data and request access to it;
- ask us to correct inaccurate or incomplete personal data;
- ask us to delete your personal data in certain circumstances;
- ask us to restrict certain processing;
- object to processing based on our legitimate interests;
- receive certain personal data in a portable format where the right to data portability applies; and
- withdraw consent at any time where processing is based on your consent, without affecting processing carried out before withdrawal.
To exercise your rights, please contact privacy@uniqure.com.
You also have the right to lodge a complaint with the competent data protection supervisory authority. EU/EEA candidates may contact the supervisory authority in their country of residence, place of work or where an alleged infringement occurred. In the Netherlands, this is the Autoriteit Persoonsgegevens. UK candidates may lodge a complaint to the Information Commissioner’s Office (ICO).
California applicants
If you are a California resident, this section applies to you to the extent the CCPA/CPRA applies, and uniQure, Inc. is the business responsible for your personal information.
We collect the categories of personal information described in Section 3 for recruitment and related purposes, including evaluating candidates, administering the recruitment process, communicating with applicants, carrying out appropriate checks, maintaining recruitment records, complying with legal requirements and protecting our legal rights.
We do not sell or share applicant personal information as those terms are defined under the CCPA/CPRA, and we do not use or disclose sensitive personal information for purposes that require us to provide a right to limit its use or disclosure.
Subject to applicable exceptions, California residents may have the right to:
- request information about the personal information we collect, use and disclose;
- access specific pieces of personal information;
- request correction of inaccurate personal information;
- request deletion of personal information; and
- exercise their privacy rights without unlawful discrimination or retaliation.
To submit a request, contact privacy@uniqure.com.
We retain applicant personal information in accordance with the retention principles and periods described in Section 8.
11. Representatives and changes to this notice
We may update this notice from time to time. The current version is always available on our careers site. This version is dated 16 September 2026.