ICF Global Applicant Privacy Statement
Effective Date: December 2025
This privacy statement describes how ICF International, Inc. and its affiliate and/or subsidiaries (collectively, “ICF,” "we", "us" and "our") will collect and process personal data of applicants/candidates who apply for employment at ICF and its affiliated companies.
All personal data you submit with your application to ICF is collected by ICF International, Inc. in the United States and also in the jurisdiction where the job you are applying for is located. The company you apply to will be the primary “controller” of your personal data. For a list of ICF offices, locations and contact details, see this link.
If you are a candidate or applicant in the UK or EEA, please read the Appendix: GDPR Disclosure.
If you are a candidate or applicant from California, please read the Addendum: Additional Information for California Residents.
Your use of ICF’s website is governed by ICF’s website privacy statement privacy statement.
How do we collect your personal data?
ICF may collect this information in a variety of ways.
Directly from you: For example, data might be contained in application forms, CVs or resumes, obtained from your passport or other identity documents, or collected through interviews or other forms of assessment. If you provide information about your family or any other third party to us (for example emergency contacts or referees) then, before providing us with such information, you must inform the relevant individuals and provide a copy of this privacy statement to them.
From third parties: We also may collect personal data about you from third parties, such as recruitment agencies, job boards, publicly available sources such as LinkedIn, third party platforms that you use to apply for a position or submit your CV/resume. These third parties may be acting as an independent controller/PI handler of your personal data and therefore we advise you to read their respective privacy notice and/or data protection policy for information on how they process your data.
For internal applications: from the candidate or applicant himself, and ICF’s internal HR systems (e.g., Workday). We may also collect personal data from other sources in order to verify the information you have provided as a part of your application (such as your education and references supplied by former employers) or to conduct background checks and screenings, where permitted or required by applicable law. We will seek information from background checks and the references you supplied only once a job offer to you has been made and will inform you that we are doing so.
What information do we collect?
ICF collects information from and about you in connection with your employment application as part of the recruiting and hiring process in connection with available employment opportunities at ICF. The information that we collect, the manner in which it is used, and the time in which it is gathered, varies depending on the country-specific regulatory and operational requirements. This includes:
- Basic candidate profile information, including full name, location/address, contact details such as email address and telephone number, resume/CV, work experience, languages spoken, geographic preferences, area of interest; candidate information in home account in Workday (email address, password, candidate activities in the account, IP address, logins and application status changes).
- Information required to consider the candidate for a specific job requisition including the candidate profile information above plus interview information, offer details. Other data elements collected based on country specific regulatory or operational requirements, may include:
- Social Security Number, tax ID, or other similar identifiers
- Personal characteristics, such as age, gender/gender identity, race, ethnicity, disability status, and other demographic data
- Audio, voice, electronic, visual, or similar information, such as photographs or videos;
- Details of your qualifications, skills, experience, education, employment history, tax information, background check information, information provided by you in your application, resume, and cover letter;
- Information about your current level of remuneration, including benefit entitlements;
- Information about your entitlement to work in the jurisdiction of the position for which you are applying; and
- Other publicly available data found on professional social links, e.g. contact information and work experience.
Why does ICF process personal data?
The primary purpose of processing your personal data is to enable you to go through the application process, including the search, maintaining contact with candidates, selection and hiring of new employees. Where permitted by applicable laws, we may use your applicant data to process background checks. If your application is successful, you will be provided with a privacy statement applicable to ICF employees which will describe how ICF processes your data as an employee.
Where required by applicable data protection laws, we will only process your personal data where we have a lawful basis to do so (including, where appropriate, where we have obtained your consent). In relation to data collected in the United Kingdom (UK) or in the European Economic Area (EEA) or which relates to individuals in the UK/ EEA, please read the Appendix: GDPR disclosure.
Who has access to personal data?
All personal data you submit with your application on ICF’s career portal is collected by ICF Inc. in the United States.
Your personal data and sensitive information or special categories of personal data may be shared internally to ICF Group companies or with our service providers for the purposes related to the recruitment process. This includes members of the HR and recruitment team, interviewers involved in the recruitment process, managers in the business area with a vacancy, and IT staff if access to the data is necessary for the performance of their roles.
ICF may also share your information (including the categories identified in the table above) with our third party service providers or vendors in the performance of their services to us and limited to the purposes below:
- Background/credit check providers, where required under applicable laws. Purpose for disclosure: to allow our providers to carry out and provide us with the results of, background/credit checks.
- Global IT service providers, Workday portal and internal support staff. Purpose for disclosure: to support, maintain and host our information systems, including the software and hardware infrastructure required to operate, be accessible online and to keep a backup of your personal data.
- Legal and other professional advisors (e.g., auditors, consultants). Purpose for disclosure: to provide us with advice in relation to our business, including our legal, financial and other obligations and claims.
We will not share your data with third parties that are not service providers, vendors, or affiliates, unless your application for employment is successful and we make you an offer of employment. We will then share your data with former employers to obtain references for you, employment background check providers to obtain necessary background checks. ICF does not sell our applicants’ personal information.
International transfers of personal data
ICF corporate group is a global group of companies, and accordingly we may transfer your personal data to, or access it in, jurisdictions (including in the United States and other jurisdictions where we, our affiliates and service providers have operations) that do not include equivalent levels of data protection as the country you are based in.
Where we transfer personal data outside of the country you are based in, we will take organizational, contractual and technical measures to safeguard your personal data as required by applicable data protection laws. Where required by applicable local laws, we will obtain separate consent.
How does ICF protect data?
We take the security of your data seriously. We have internal policies and controls in place to ensure that your data is not lost, accidentally destroyed, misused or disclosed, and is not accessed except by our employees in the proper performance of their duties.
For how long does ICF keep data?
We keep your personal data (including any sensitive personal data) for as long as is necessary for the purposes it was collected for including for any legal, accounting, or reporting requirements, where legally required.
If your application for employment is unsuccessful, ICF will hold your data on file for up to 6(months) months (for applicants from the EEA and UK ), after the end of the relevant recruitment process, unless you give consent to be considered for future employment opportunities.
If your application for employment is unsuccessful, ICF may hold your data for 4 (four) years (for non-EEA applicants) after the end of the relevant recruitment process for consideration for future employment opportunities.
At the end of that period, or once you withdraw your consent, your data is deleted or destroyed.
If your application for employment is successful, personal data gathered during the recruitment process will be transferred to your Human Resources file (electronic and paper based) and retained during your employment. The periods for which your data will be held will be provided to you in a new privacy statement.
Your rights
Residents of certain jurisdictions have additional rights as a data subject. Depending on where you reside or are a citizen, you have one or more of the following rights with respect to your personal data:
- access and obtain a copy of your personal information on request;
- require us to change incorrect or incomplete personal information;
- require us to delete or stop processing your personal information;
- limit the use of your sensitive personal information;
- the right to opt out of the sale of your personal information or automated decision making;
- object to the processing of your personal information where ICF is relying on its legitimate interests as the legal ground for processing;
- withdraw your consent, where the processing of your data is based on consent, and
- to not be retaliated against for exercising any of these rights.
If you would like to exercise any of these rights, please contact us via the Data Subject Request Form or via the methods identified below and specify your request.
We may need to request specific information from you to help us confirm your identity and ensure your right to access the information (or to exercise any of your other rights). This is another appropriate security measure to ensure that personal information is not disclosed to any person who has no right to receive it.
What if you do not provide personal data?
You are under no statutory or contractual obligation to provide data to ICF during the recruitment process. However, if you do not provide the information, we may not be able to process your application properly or at all.
Privacy questions and how to contact us
Please click Contact Us or use one of the contact methods below if you:
- have questions about this Applicant Privacy Statement or how we process or protect your personal data,
- have questions regarding exercising your personal data rights,
- like a copy of the full version of our data protection policy,
- wish to make a complaint about our use of your personal data,
- have questions or concerns about this Applicant Privacy Statement, our Sites, or email marketing practices.
Data Protection Officer: Geraldine Henbest
E-mail: dataprotection@icf.com
Phone (Toll free): 1.800.661.2164
Mail:
Residents of the U.S. and Canada
ATTN: Data Protection Officer
ICF
1902 Reston Metro Plaza
Reston, VA 20190
Residents of the EEA, UK, and Switzerland
ATTN: Data Protection Officer
ICF, 62 Threadneedle Street London, UK
Raising a complaint
- We encourage you to contact us first at dataprotection@icf.com with a view to letting us help in resolving any queries or questions.
- If you believe that ICF has not complied with your data protection rights, you have the right to complain to the applicable data protection authority in your jurisdiction (e.g., in the country where you work or live).
Updates to this policy
Our business changes constantly, and our Applicant Privacy Statement will change also. You should check this statement frequently to see recent changes. Unless stated otherwise, our current statement applies to all information that we have about you.
Appendix: GDPR Disclosure
This appendix should be read in conjunction with ICF’s Global Applicant Privacy Statement, and in case of any conflict, the information in this appendix shall prevail.
When you are applying for a position with ICF, we process your personal data in the following manner:
Controller of your personal data
ICF refers to one or more of the member firms of ICF group, each of which is a separate legal entity and can determine the purposes and means for data processing in its own right (i.e. act as data controller).
The entity that is acting as data controller is:
- The ICF entity to which you are applying to. You can find a list if ICF local offices/locations here: One ICF Around the World | ICF
- ICF International, Inc., in the United States, when you are applying for an open position at careers.icf.com.
Purposes of processing
- Processing, evaluating, and managing of applications, candidate profile and Workday account
- Evaluating your suitability for employment (including for conducting a pre-employment screening/background checks)
- Maintaining contact with applicants
- Scheduling and conducting (online) interviews
- Making an offer to successful candidates
Personal data being processed
The following categories of personal data will be processed, at different stages in the application process:
- Basic candidate profile information, including full name, location/address, contact details such as email address and telephone number, resume/CV upload, work experience, languages spoken, geographic preferences, area of interest;
- Candidate profile information when candidate creates a home account in Workday (email address, password, candidate activities in the account, IP address, logins and application status changes).
- Other information required to consider the candidate for a specific job requisition, includes the profile information, plus interview information, assessment and offer details. Other data elements, including sensitive data, are collected when permitted by specific country laws or operational requirements. These may include:
- ID number, or other similar identifiers
- Personal characteristics, such as age, gender/gender identity, race, ethnicity, disability status, and other demographic data
- Audio, voice, electronic, visual, or similar information, such as photographs or videos;
- Details of your qualifications, skills, experience, education, employment history, tax information, background check information, information provided by you in your application, resume, and cover letter; other data provided by the applicant as requested by ICF and/or on a voluntary basis, such as references from previous employers, information about your current level of remuneration, including benefit entitlements;
- Information about your entitlement to work in the jurisdiction of the position for which you are applying; and
- Other publicly available data found on professional social links, e.g. contact information and work experience.
Special categories of personal data
Special categories of personal data reveals your racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data, data concerning health or data concerning sex life or sexual orientation. We only collect special categories of personal data where the local laws require or permits to do so in the applications and / or job offer. For example, in some countries some special categories of data may be collected for equal opportunities and diversity monitoring purposes.
Legal Bases for Processing
The legal basis for processing the personal data you provide in the course of submitting your application is ICF’s legitimate interest in being able to decide on assessing your application and to select the most suitable candidate for the position. In some contexts, more than one legal ground applies, such as:
- Contractual Obligations / Pre-Contractual Steps: when we need to process your personal data to take steps at your request prior to offering you employment;
- EEA/UK Legal/ statutory Obligations: when we need to process your personal data to verify your identity, eligibility for employment or comply with employment, equality and health and safety laws; comply with other legal or regulatory obligations such as a relevant background check, law enforcement requests, or where we consider disclosure is necessary or required by law, to exercise, establish, or defend our legal rights, or to protect your vital interests or those of third parties, including our employees, users or the public.
- Consent: In certain narrow circumstances, we may process your personal data with your voluntarily and freely given and explicit consent.
Sharing and providing access to your personal data
If and to the extent necessary for the purpose of processing, and if we are entitled to do so under applicable law and regulations, we may grant internal or external access to your personal data, or transfer it to other third party service providers for purposes related to the selection and hiring process, namely:
- Authorized persons working for ICF and/or affiliated entities within the global ICF group. This includes members of the HR and recruitment team, interviewers involved in the recruitment process, managers in the business area with a vacancy, and IT staff if access to the data is necessary for the performance of their roles. All ICF entities and employees are required to comply with data protection and confidentiality policies, which require them to treat, secure, and protect personal data and other information confidentially.
- Background/credit check providers (Hireright), where required under applicable laws. Purpose for disclosure: to allow our providers to carry out and provide us with the results of, background/credit checks.
- Service providers of IT and HR software/platforms (such as Workday). Purpose for disclosure: to support, maintain and host our information systems, including the software and hardware infrastructure required to operate, be accessible online and to keep a backup of your personal data.
- Legal and other professional advisors or providers who support ICF’s internal processes (e.g., accounting, finance functions, auditors, consultants). Purpose for disclosure: to provide us with advice in relation to our business, including our legal, financial and other obligations and claims.
We only share your personal data with third parties if necessary and relevant for the application process. These parties must treat your data confidentially and must comply with applicable privacy regulations. They are also required to take appropriate measures to protect your data. Where necessary, we have made contractual agreements with these parties.
Transferring personal data outside of the EEA/UK
All personal data you submit with your application on ICF’s career portal is collected by ICF Inc. in the United States.
As a global company, certain aspects of ICF infrastructure are centralised, including information technology systems provided to ICF group companies (e.g., Workday portal used to enrol candidates). In addition, our engagements with ICF clients span more than one jurisdiction, therefore certain information will need to be accessed by individuals in ICF organisation who are working on related matter.
Therefore, your personal data will be transferred to and stored outside the country in which you are located. This includes countries outside the UK, the European Economic Area (EEA) and countries with laws that have not necessarily been not be recognized by the European Commission and/or the U.K. (or other relevant regulatory body) as providing an adequate level of protection for the processing of personal data under the laws of the EU or other jurisdictions.
For all such transfers, we take steps to ensure that appropriate safeguards are in place and your privacy rights continue to be protected. For example, such safeguards include the EU Standard Contractual Clauses based on the European Commission’s model clauses (available here) and the U.K. Addendum thereto( available here). If you would like to see a copy of any relevant provisions, please contact us (see the “Questions and queries” section).
For how long does ICF keep your personal data?
We keep your personal data (including any sensitive personal data) for as long as is necessary for the purposes it was collected for including for any legal, accounting, or reporting requirements, where legally required.
If your application for employment is unsuccessful, ICF will hold your data on file for up to 6(months) months (for applicants from the EEA and UK ), after the end of the relevant recruitment process, unless you give consent to be considered for future employment opportunities.
At the end of that period, or once you withdraw your consent, your data is deleted or destroyed.
If your application for employment is successful, personal data gathered during the recruitment process will be transferred to your Human Resources file (electronic and paper based) and retained during your employment. The periods for which your data will be held will be provided to you in a new privacy statement.
Your rights
You have certain rights under the General Data Protection Regulation and other applicable legislation in relation to the personal data we process about you. In this context, you have the right to:
- access and obtain a copy of your personal information on request, in a machine-readable format (e.g. as an email attachment or on a data carrier) or request that it be transferred to a third party (right to data portability);
- ask that we update the personal data we hold about you, or correct it if you think is incorrect or incomplete;
- ask us to delete or stop processing your personal information;
- the right to opt out of the sale of your personal information or automated decision making;
- object to the processing of your personal information where ICF is relying on its legitimate interests as the legal ground for processing;
- withdraw your consent, where the processing of your data is based on consent, and
- to not be retaliated against for exercising any of these rights.
If you would like to exercise any of these rights, please contact us via the Data Subject Request Form or via the methods identified below and specify your request.
We may need to request specific information from you to help us confirm your identity and ensure your right to access the information (or to exercise any of your other rights). This is another appropriate security measure to ensure that personal information is not disclosed to any person who has no right to receive it.
What if you do not provide personal data?
You are under no statutory or contractual obligation to provide data to ICF during the recruitment process. However, if you do not provide the information, we may not be able to process your application properly or at all.
Privacy questions and how to contact us
If you have a question or comment, or wish to make a complaint about our use of personal data, please send an email with the details of your request or complaint to:
Data Protection Officer: Geraldine Henbest
E-mail: dataprotection@icf.com
ATTN: Data Protection Officer
ICF 62 Threadneedle Street London, UK
Raising a complaint
- You also have the right under applicable legislation to lodge a complaint with your local supervisory authority responsible for data protection matters. For the RU please find the list of EU data protection authorities here: Our Members | European Data Protection Board; for the UK:, you may turn to ICO at: https://ico.org.uk/
- We encourage you to contact us first at dataprotection@icf.com with a view to letting us help in resolving any queries or questions.
Addendum: Additional Information for California Residents
What is this addendum?
This Additional Information for California Residents (Addendum) provides additional information for California residents designed to meet the obligations under California Consumer Privacy Act (CCPA). It supplements the ICF Global Applicant Privacy Statement, which is still applicable to you. We are committed to properly handling the personal information collected or processed in connection with your employment relationship with us. ICF collects and uses your personal information, including sensitive personal information, for the purposes of recruiting, processing your application, completing the hiring process and legal compliance.Non-Applicability
This Addendum Notice does not apply to our consumer-facing website(s), which are addressed in our general privacy notice available here, except when you submit a job application to us. It also does not apply to our current or former employees or independent contractors. If you are later employed by ICF, we will process your personal information, including sensitive personal information according to ICF’s Global Employee Privacy Statement.
Does ICF sell or share personal information?
Please note that we don’t sell (as “sell” is traditionally defined) your personally identifiable information to anyone else. However, please be aware that certain “cookies” deployed on some ICF consumer-facing website(s) may constitute a “share” under CCPA. To opt-out of personal information sales or sharing from those website(s), please click the “Cookie Settings” displayed on the site to ensure that you are opted out of “Targeting Cookies.” Otherwise, we do not sell or share applicant data as those terms are defined under CCPA.What types of personal information does ICF collect?
We may collect the personal information and sensitive personal information categories listed in the tables below. The tables also list, for each category, collection and use purposes with our retention policies below.
| Personal Information Category | Business Purpose |
| Identifiers, such as your full name, contact information, gender, date of birth, signature, Social Security number, driver's license or state identification numbers, or similar information for your dependents and beneficiaries. |
|
| California Customer Records employment and personal information, such as your name, signature, Social Security number, physical characteristics or description, photograph, address, telephone number, passport number, driver’s license or state identification card number, insurance policy number, education, current employment, employment history, membership in professional organizations, licenses and certifications, bank account number, credit card number, debit card number, or any other financial, medical or health insurance information. |
|
| Protected classification characteristics under California or federal law, such as age (40 years or older), race, color, ancestry, national origin, citizenship, religion or creed, marital status, medical condition, physical or mental disability, sex (including gender, gender identity, gender expression, pregnancy or childbirth and related medical conditions), sexual orientation, reproductive health decision-making, military and veteran status, or genetic information (including familial genetic information). |
|
| Internet or other similar network activity information, including all activity on and interacting with ICF information systems (such as internet browsing history, search history, intranet activity, email communications, social media postings, stored documents and emails, usernames, and passwords) and all activity on communications systems (such as phone calls, call logs, voicemails, text messages, chat logs, app use, mobile browsing and search history, mobile email communications, and other information regarding an employee's use of ICF-issued devices). |
|
| Geolocation data, such as the time and physical location related to use of an internet website, application, or device, and GPS location data from mobile devices of employees who participate in our vehicle reimbursement program. |
|
| Surveillance data, such call monitoring and video surveillance. |
|
| Professional or employment-related information, such as employment application information (work history, academic and professional qualifications, educational records, references, and interview notes, background check, drug testing results, work authorization, performance and disciplinary records, salary, bonus, commission, and other similar compensation data, benefit plan enrollment, participation, and claims information, leave of absence information including religious, military and family obligations, health data concerning employee and their family members. |
|
| Non-public education information, such as education records, degrees and vocational certifications obtained, report cards, and transcripts. |
|
| Inferences drawn from other personal information to create a profile or summary, for example, an individual's preferences, abilities, aptitudes, and characteristics. |
|
Sensitive personal information is a subtype of personal information consisting of specific information categories. We may collect or use information that falls within the sensitive personal information categories listed in the table below.
| Sensitive Personal Information Category | Business Purpose |
| Government identifiers, such as your Social Security number, driver's license, state identification card, passport and visa information, or immigration status and documentation. |
|
| Precise geolocation, such as your physical access to an ICF office location, or the location of a delivery, sales, or other employee in the field. |
|
| Racial or ethnic origin. |
|
| Citizenship or immigration information. |
|
| Religious or philosophical beliefs. |
|
| Sex life or sexual orientation information. |
|
What rights do I have over my data?
California job applicants have the same rights to know/access, delete, correct, limit, and opt-out as traditional Consumers and may learn more about these rights and how to exercise them by referring to Section 8 of the ICF Global Applicant Privacy Statement.
How long does ICF keep data?
We keep your personal data (including any sensitive personal data) for as long as is necessary for the purposes it was collected for including for any legal, accounting, or reporting requirements, where legally required.
If your application for employment is unsuccessful, ICF will hold your data for 4 (four) years after the end of the relevant recruitment process for consideration for future employment opportunities.
At the end of that period, or once you withdraw your consent, your data is deleted or destroyed.
If your application for employment is successful, personal data gathered during the recruitment process will be transferred to your Human Resources file (electronic and paper based) and retained during your employment. The periods for which your data will be held will be provided to you in a new privacy statement.
How do I contact ICF if I have questions?
If you have any questions about this Addendum, need to access this Addendum in an alternative format due to having a disability, or need to exercise any of your rights as stated in ICF Global Applicant Privacy Statement, please contact the ICF Data Protection Team by utilizing one of the following methods:
Data Protection Officer: Geraldine Henbest
E-mail: dataprotection@icf.com
Phone (Toll free): 1.800.661.2164
Mail:
ATTN: Data Protection Officer
ICF
1902 Reston Metro Plaza
Reston, VA 20190