A&M Recruitment Privacy Notice (Europe)

Last Modified: October 10, 2022

1. PURPOSE

Alvarez & Marsal Holdings, LLC and its subsidiaries and affiliates respects your privacy. This A&M Recruitment Privacy Notice for Applicants for Employment or Partnership with A&M's European Entities (“Recruitment Privacy Notice”) is provided to you in compliance with the EU General Data Protection Regulation (“GDPR”), the GDPR as transposed into UK data protection law together with the UK Data Protection Act of 2018 (“UK GDPR”), the Swiss Federal Act on Data Protection (“FADP”), and any other implementing or supplementary laws, rules or regulations pertaining to the processing of personal data (collectively, “Data Protection Laws”).

This Recruitment Privacy Notice applies to applicants for employment or partnership with A&M’s European entities who are resident within the European Union (“EU”), European Economic Area (“EEA”), United Kingdom or Switzerland (“A&M Applicants”). This Recruitment Privacy Notice does not concern the personal data of employees, partners, or other personnel of A&M. If you enter into an employment, partnership or other agreement with A&M, a separate Workplace Privacy Notice will apply to A&M’s processing of your personal data.

This Recruitment Privacy Notice explains:

what personal data we hold during the application process and why we process it;
the legal grounds which allow us to process your personal data;
where the data comes from, who gets to see it and how long we keep it;
how to access your personal data and other rights; and
how to contact us.

In particular, Section 4 identifies categories of personal data we may process; Annex 1 describes our purposes for processing, the types of data that may be processed for each purpose, and our legal bases for processing; and, Annexes 2 – 17 provide additional, country-specific information, including the relevant data protection Supervisory Authority and information about how we may process sensitive personal.

This Recruitment Privacy Notice does not constitute or form any part of an employment, partnership, or any other contract, or confer any contractual right on you or place any contractual obligations on us.

2. DATA CONTROLLER

2.1 Depending on the nature of the processing activity, the data controller of your Personal Data will be the local employing A&M entity to which you are applying for a role, our top-level entity within the country of your residence, if different, and/or our top-level parent, Alvarez & Marsal Holdings, LLC. As used in this Recruitment Privacy Notice, the terms “A&M”, “we”, “us” or “our” will refer to the relevant data controller.

3. SCOPE

3.1 Definitions

“Data subject” means an identified or identifiable natural person; an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identify of that natural person.

“Personal data” means any information relating to a Data Subject.

“Processing” means any action that is performed on personal data, whether in whole or in part by automated means, such as collecting, recording, organizing, storing, modifying, using, disclosing or deleting such data.

“Sensitive personal data” is personal data that (i) reveals racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data (for the purpose of uniquely identifying you), or concerns health (physical, mental or disability), or sex life or sexual orientation; or (ii) relates to criminal convictions or offenses.

3.2 Data Protection Principles. Data Protection Laws require that A&M processes personal data according to the following principles.

Lawfulness, fairness and transparency. Processing of personal data must be lawful, which means that processing is prohibited unless there is a specific legal basis to do so. A&M’s legal bases to process personal data are set out in the Appendix to this Recruitment Privacy Notice. A&M must be transparent, which means A&M must provide data subjects with information about the processing.
Purpose limitation. Personal data must be collected for specific, explicit and legitimate purposes, and cannot be further processed in any manner incompatible with those purposes.
Data minimization. Personal data must be adequate, relevant and limited to what is necessary to achieve the purpose of the processing.
Accuracy. Personal data must be accurate, and where necessary, kept up to date. Data that is inaccurate or incomplete should be deleted, corrected, supplemented or updated.
Storage limitation. Personal data must be kept in a form that permits identification of data subjects no longer than is necessary for the purposes for which the personal data is processed.
Integrity and confidentiality. Personal data must be protected against unauthorized or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organizational measures.

Data Protection Laws also provide data subjects with certain rights, as outlined at Section 7 (Your Rights in Relation to Your Personal Data) below.

4. CATEGORIES AND SOURCES OF PERSONAL DATA

4.1 Categories of personal data. In connection with your application to work with us, the categories of personal data we process may include the following, in each case in accordance with applicable Data Protection Laws.

Personal Details – e.g., name, contact details (address, telephone, email), age, date of birth, gender, passport or other government ID, proof of eligibility to work and details of any work permit application.
Photographs – e.g., your “headshot” and other photographs (including those incorporated into other documents).
Education and Professional Qualifications – e.g., resume/CV and any cover letter, professional history, education, qualifications, references, licences and certifications, language skills, professional affiliations, and other information you provide as part of the recruitment process.
Work Experience – e.g., business contact details (address, telephone, email), job title, office (country, city), business unit, job description, dates of service, category (e.g., full/part-time), reporting lines, travel, relocations, and terms and conditions of your employment, partnership, or other agreement, each in relation to your current and prior employer(s).
Background Checks – e.g., education, employment, government sanctions and enforcement, identify verification, adverse media, conduct, address verification, directorships, professional qualifications, credit history, and civil litigation and criminal records, including sensitive personal data relating to criminal convictions or offences where and to the extent the law allows us to do so.
Demographic, Family and Household Data – e.g., marital status, dependent information, language, family composition, and family education, employment, and income history.
Interview or Assessment Data – e.g., any information you provide to us or generated during an interview or assessment, such as recordings made or taken during live or online interviews, responses to online or written tests, and business plans.
Compensation, Benefits and Other Financial Data – e.g., information relating to your compensation and benefits with prior employers, and to your expectations at A&M.
Health and Medical Data – e.g., sensitive personal data relating to physical / mental health status or condition, disability, vaccination status, or meal preferences and food allergies.
Building and Office Access Control Systems and CCTV Data – e.g., logs and security camera footage relating to building and office access.

4.2 Sources of personal data. Where legally permitted, we collect personal data about you from multiple sources, including:

Directly from you: We collect information directly from you during the recruiting process. Please inform us of any changes to your information (see Section 8 (Your Obligations in Relation to Personal Data) below for more details).
From our external suppliers (or prospective suppliers): Information may be provided to us by recruitment agencies or background check and credit reference providers.
Online test providers: Information may be provided to us by test consultants relating to online tests we may ask you to complete.
From other third parties: Information may be provided by your former employers, named referees, universities, government and regulatory agencies, and others. If you cause your job application or other personal data to be shared with us through a third-party application (e.g., LinkedIn or a job board), we consider that information as having come from a third party.
By electronic means: Information collected by electronic means is as described above in the paragraph titled “Building and Office Access Control Systems and CCTV Data”.
From the public domain: Information that might originate from your public social media profile(s), websites, publications, government records, and other sources.

4.3 Consequences of not providing us with personal data. You do not have to provide information when requested. However, if you do not provide information that is necessary for us to consider your application, such as evidence of qualifications, right to work in the relevant location, or references for the applicable role, we may not be able to process your application successfully.

5. USE AND RETENTION OF PERSONAL DATA

5.1 We process personal data for the purposes of our business, including management, administrative, employment and legal purposes. Annex 1 to this Recruitment Privacy Notice provides more specific information on these purposes, on the type of data that may be processed and on the grounds on which we process data.

5.2 Your personal data will be processed in accordance with the data processing principles set out in Section 3 (Scope) of this Notice.

5.3 A&M does not use your personal data for automated decision making, including profiling.

5.4 Change of purpose. We will only use your personal data for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose. Please note that we may process your personal data without your knowledge or consent where this is required or permitted by law.

5.5 Your personal data will be retained by A&M in accordance with our policies. Retention periods may vary depending on both (i) the country in which you reside (or of the office to which you applied), and (ii) the type of record and the personal data contained therein. In the following circumstances, your personal data may be retained for longer than the specified periods:

to consider you for subsequent roles that may arise in the future; provided, we will send you periodic reminders that we are retaining your personal data and, where legally required to do so we will obtain your prior consent;
as required by law or court order, or as otherwise necessary to comply with a legal obligation;
as necessary to establish, exercise or defend against legal claims; or
as required for legitimate business purposes.

6. DISCLOSURE AND OVERSEAS TRANSFER OF PERSONAL DATA

6.1 Disclosures and transfers within A&M

A&M is a global company with offices around the world and with its parent company located in the United States. Your personal data will be accessible from and will be transferred to the United States, and other countries, for the purpose of internal centralisation and administration. Your personal data will only be accessible on a need-to-know basis.
When your personal data is transferred within the A&M group to a country outside the EU, EEA, UK or Switzerland that has not been determined to provide an adequate level of protection in regard to applicable Data Protection Laws, the transfers will be made pursuant to an intra-company data transfer agreement that incorporates Standard Contractual Clauses approved by the European Commission, UK Information Commissioner’s Office, and Swiss Federal Data Protection and Information Commissioner.

6.2 Disclosures and transfers to third parties

Your personal data will, in certain circumstances, be disclosed to third parties, including service providers supporting A&M’s EMEA Talent Acquisition activities.

A&M takes measures to ensure that its service providers protect your personal data with appropriate security measures and do not use your personal data except as instructed by us. When your personal data is processed by service providers outside the EU, EEA, UK or Switzerland in a country that has not been determined to provide an adequate level of protection in regard to applicable Data Protection Laws, the transfers will be pursuant to an agreement that incorporates standard contractual clauses approved by the European Commission, UK Information Commissioner’s Office, and Swiss Federal Data Protection and Information Commissioner.

6.3 Where A&M is under an obligation to do so by law, it will disclose your personal data to regulators, courts, the police or tax authorities, or in the course of litigation. In some cases, in accordance with applicable law, it may not be possible to notify you in advance about the details of such disclosures. A&M will use reasonable efforts to disclose the minimum personal data necessary in such cases.

7. YOUR RIGHTS IN RELATION TO YOUR PERSONAL DATA

7.1 You have certain rights in relation to the personal data we hold about you. Your rights to your personal data may include access, rectification, erasure, restriction of processing, portability, objection, and rights in relation to automated decision making and profiling. These rights are as generally described below; however, in each case your rights are subject to the specific requirements of Data Protection Laws and any exemptions that may apply including, but not limited to, disproportionality and our compliance with a legal obligation or as necessary to establish, exercise or defend against legal claims:

Access: to receive copies of your personal data and information about how we use and share it.
Rectification: to correct any inaccurate or incomplete personal data. Please note, while we assess your rectification request, you may also seek to exercise your right to restrict our processing of the personal data, as described below.
Erasure (“the right to be forgotten” or “right of deletion”): to erase your personal data in the following circumstances:
1. 1. the personal data is no longer necessary for the purpose for which we originally collected or processed it;
  2. we are relying on your consent as our lawful basis for processing, and you withdraw your consent;
  3. we are relying on legitimate interests as our lawful basis for processing, you object to the processing of your data, and there is no overriding legitimate interest to continue this processing;
  4. we are processing the personal data for direct marketing purposes and you object to that processing;
  5. we have processed the personal data unlawfully; or
  6. we must erase the data in order to comply with a legal obligation.
    Please note, while we assess your erasure request, you may also seek to exercise your right to restrict our processing of the personal data, as described below.
Restriction of Processing to Storage Only: to require us to stop processing the personal data we hold about you other than for storage purposes in certain circumstances. You may request that we stop processing and just store the personal data we hold about you where:
1. 1. you believe the personal data is not accurate for the period it takes for us to verify whether the data is accurate;
  2. we wish to erase the personal data as the processing we are doing is unlawful but you want us to simply restrict the use of that data;
  3. we no longer need the personal data for the purposes of the processing but you require us to retain the data for the establishment, exercise or defence of legal claims; or
  4. you have objected to us processing personal data we hold about you on the basis of our legitimate interests and you wish us to stop processing the personal data whilst we determine whether there is an overriding interest in us retaining such personal data.
Portability: to receive or ask us to provide your personal data to a third party in a structured, commonly used and machine-readable format. We are not responsible for the security of the personal data or its processing once received by the third party.
Objection: to stop or prevent us from processing your personal data. You have an absolute right to object to our processing for direct marketing purposes, and you may object to our processing on the basis of our legitimate interests. Please note, while we assess your objection request, you may also seek to exercise your right to restrict our processing of the personal data, as described above.
Rights with Respect to Automated Decision-Making: to have us not process your personal data solely by automated means, including profiling, in a manner that produces legal or similarly significant effects on you, except where the processing is either necessary for entering into or performing a contract between us and you, authorized by law (e.g., for purposes of detecting fraud or tax evasion), or based on your explicit consent. Automated decision-making with legal or similarly significant effects on the basis of sensitive personal data is permissible only with your explicit consent or where necessary for reasons of substantial public interest. Note, as specified in Paragraph 5.3 above, A&M does not use your personal data for automated decision making, including profiling.

To exercise any of the above rights, please contact our EMEA Talent Acquisition team directly at tacquisition@alvarezandmarsal.com. You may also exercise your rights by completing our online Data Subject Access Request form (available here) or by emailing our Data Protection Office at data.protection.office@alvarezandmarsal.com. Please note we may require you to verify your identity before responding to any requests to exercise your rights.

7.2 Where our processing of your personal data is on the basis of your consent, you have the right to withdraw your consent at any time. Please note, any such withdrawal of consent will not affect the lawfulness of our processing based on consent before such withdrawal.

7.3 You have the right to lodge a complaint with the relevant supervisory authority.

7.4 In the event that you wish to make a complaint to us about how we process your personal data, please use the above email address and we will endeavour to deal with your request as soon as possible. Please note the above rights are not absolute, and we may be entitled to refuse requests where exceptions apply.

8. YOUR OBLIGATIONS IN RELATION TO PERSONAL DATA

8.1 You are required to keep information that you provide to us accurate and up to date. This includes changes to your name, contact details (home address, phone number(s), email address(es)), employment history, and professional and educational qualifications.

9. CONTACT INFORMATION

If you have questions about the recruitment process or your application, please contact our EMEA Talent Acquisition team directly at tacquisition@alvarezandmarsal.com.

Questions regarding this Recruitment Privacy Notice or A&M’s processing of your personal data may be sent to our EMEA Talent Acquisition team at tacquisition@alvarezandmarsal.com or our Data Protection Office at data.protection.office@alvarezandmarsal.com. You may also contact us as specified in the country-specific Annexes to this Privacy Notice.

10. CHANGES TO THIS RECRUITMENT PRIVACY NOTICE

This Recruitment Privacy Notice may be amended from time to time at our discretion.

ANNEX 1

Legal Grounds for Processing Personal Data

Under Data protection Laws, there are various grounds on which we can rely when processing your personal data. In some contexts, more than one ground applies. We have summarised these grounds as “Contract,” “Legal obligation,” “Legitimate Interests” and “Consent” and outline what those terms mean in Table 1 (below).

TABLE 1

Term	Lawful basis for processing	Explanation
Contract	Processing is necessary to take steps at your request to enter into a contract with you, or for the performance of a contract with you.	The “contract” refers to your employment, partnership or other agreement with us regarding your working relationship. It covers carrying out our contractual duties and exercising our contractual rights.
Legal obligation	Processing is necessary to comply with our legal obligations.	This refers to our legal, compliance and regulatory obligations. For example, for the prevention and detection of crime, reporting to taxing authorities, providing a safe place of work, and avoiding unlawful discrimination.
Legitimate Interests	Processing is necessary for our or a third party’s legitimate interests.	We or a third party have legitimate interests in carrying on, managing, and administering our respective businesses effectively and properly, and in connection with those interests processing your data. Your data will not be processed on this basis if our or a third party’s interests are overridden by your own interests, rights, and freedoms.
Consent	You have given consent to processing your data. Where consent is relied upon, it is specific (i.e., it relates only to the data that is being provided), informed (given the information that is provided in this notice), unambiguous (as you will be choosing to provide the data) and can be withdrawn at any time.	In general, A&M does not rely on your consent to process your data in connection with recruitment. However, there may be occasions where we do specific things that rely on your consent such as running a criminal records check.

INFORMATION ON THE DATA WE PROCESS AND OUR PURPOSES

Table 2 (below) provides examples of the personal data we process and the lawful basis on which we process the data. The examples in the table cannot, of course, be exhaustive.

A note about processing your Sensitive Personal Data: Processing sensitive personal data about you may be necessary in your jurisdiction (e.g., processing personal data relating to diversity monitoring) or we may process information about your disability status to consider whether we need to provide appropriate adjustments during the recruitment process. If we process your sensitive personal data, we will also make sure that one or more of the grounds for processing sensitive personal data applies. In outline, these include:

You have given your explicit consent;
Processing being necessary for the purposes of your or our obligations and rights in relation to employment, in so far as it is authorised by law or collective agreement;
Processing relating to data about you that you have made public (e.g., posted to social media);
Processing is necessary for the purpose of establishing, making or defending legal claims;
Processing being necessary for the assessment of your working capacity; and
Processing is necessary for reasons of substantial public interest, e.g., equality and diversity purposes to the extent permitted by law. You may be asked to provide diversity or other equal opportunities employment information as part of your application; however, you are not required to provide any such information, and should you decide not to provide such information your application will not be affected in any way. Any information you do provide will be used only to produce and monitor equal opportunities statistics.

In certain countries, our processing of your sensitive personal data is also subject to special conditions in addition to the requirement that we have a lawful basis. For more information about how we process sensitive personal data in your jurisdiction, please see our additional country Annexes (which follow alphabetically).

TABLE 2

Purpose	Categories of Personal Data (Refer to Section 4 of the Recruitment Privacy Notice)	Lawful Basis for Processing
Recruiting / Talent Acquisition - Including job seekers creating a profile on our Careers platform, job applicants, candidate shortlisting, holding interviews, and ongoing recruitment (i.e., where we retain a candidate’s application for future positions).	Personal details Education and professional qualifications Work experience Photographs Compensation, benefits and other financial data Demographic, family and household data Interview or assessment data Sensitive personal data, including health and medical data (*)	Contract Legal obligation Legitimate interests (in carrying out informed recruiting decisions, and administering the job offer process) (*) NOTE – Please refer to the Country Annexes for details.
Background and reference checks (pre-hire)	Personal details Background checks, including criminal records (*) Information from referees	Legal obligation (to the extent applicable law requires us to perform a background check based on your role) Legitimate interests (in verifying the truthfulness of the information contained in your job application) Consent (where required under local law) (*) NOTE – This processing activity may be subject to additional restrictions under local laws. Please refer to the Country Annexes for details, including whether we undertake this activity in your country.
Diversity and inclusion, including: non-discrimination in hiring equality of opportunity or treatment promoting and maintaining a diverse workforce reporting statistics to government agencies	Personal details Demographic, family and household data Sensitive personal data, including: (*) race or ethnicity religious / philosophical beliefs health sexual orientation	Legitimate interest (in monitoring diversity and equal opportunities, and ensuring we have a diverse workforce) (*) NOTE – This processing activity may be subject to additional restrictions under local laws. Please refer to the Country Annexes for details, including whether we undertake this activity in your country.
Establishment, exercise, or defence of legal claims involving you or others.	Any information relevant or potentially relevant to a dispute or legal proceeding affecting us Personal details including (potentially) sensitive personal data (*)	Legal obligation Legitimate interests (to establish, exercise or defend legal claims) (*) NOTE – Processing sensitive personal data for this purpose may be subject to additional local laws – please refer to the Country Annexes.
Managing and monitoring access to A&M offices	Personal details Building and office access control systems and CCTV data	Legal obligation Legitimate interests (our ability to keep our locations secure)

ANNEX 2

Czech Republic Notice – Applicable to Applicants resident in the Czech Republic

The supervisory authority in your jurisdiction is the Office for Personal Data Protection (Úřad pro ochranu osobních údajů (ÚOOÚ)).

Where we rely on legitimate interests, we have set out above the purposes for processing such data and why such processing is necessary. This Recruitment Privacy Notice sets out the steps that we take to keep your data safe, and as such we have adequately balanced your data subject rights, with the needs of the business to process this data. The Recruitment Privacy Notice also serves as our legitimate interests assessment in relation to the processing herein that relies on legitimate interests.

Where permitted based on the nature of your role, and subject to the requirements of Data Protection Laws and applicable local laws, including where applicable with respect to your prior consent, A&M and/or a third party acting on our behalf may process personal data relating to criminal convictions and offences in connection with a pre-hire background check.

ANNEX 3

Finland Notice – Applicable to Applicants resident in Finland

The supervisory authority in your jurisdiction is The Office of the Data Protection Ombudsman (Tietosuojavaltuutetun Toimisto).

ANNEX 4

France Notice – Applicable to Applicants resident in France

The supervisory authority in your jurisdiction is the Commission nationale de l'informatique et des libertés (CNIL).

You have a right to data portability, where we are relying on your consent or performance of a contract: you may request to receive, in a structured and commonly used format, all your personal data processed by automated means. You may also request that we transfer these data directly to another organization.

You also have the right to give us specific instructions on what to do with your personal data after your death.

We will keep your personal data for no longer than is necessary for the purposes for which it is processed (or as otherwise required by law). A&M maintains record retention schedules that set out the criteria used to determine the period for which personal data is stored. You may request information concerning these retention periods, as set out in the main body of the Recruitment Privacy Notice.

ANNEX 5

Germany Notice – Applicable to Applicants resident in Germany

The supervisory authority at a federal level for your jurisdiction is The Federal Commissioner for Data Protection and Freedom of Information (BfDI). Please find here a list of all German data protection authorities: Data protection supervisory authorities of the federal states.

A&M’s German external data protection officer (DPO) is as follows:

Dr. Felix Wittern
Fieldfisher Tech Rechtsanwaltsgesellschaft mbh
Am Sandtorkai 68
20249 Hamburg
Germany
felix.wittern@fieldfisher.com
Tel: +49 (0)40 878 869 81 14

Please note that the legal basis for the “Performance of a contract” is – in Germany – § 26 (1) German Federal Data Protection Act (Bundesdatenschutzgesetz).

The lawful basis for processing background check data is your consent.

Application data will be deleted after 6 months ((i) if you have not given consent for a longer storage period or (ii) unless we need the data for legal proceedings).

Equal opportunities monitoring does not take place in your country.

ANNEX 6

Greece Notice – Applicable to Applicants resident in Greece

The supervisory authority in your jurisdiction is The Hellenic Data Protection Authority (DPA).

ANNEX 7

Ireland Notice – Applicable to Applicants residing in Ireland

The supervisory authority in your jurisdiction is the Data Protection Commissioner (DPC).

ANNEX 8

Italy Notice – Applicable to Applicants residing in Italy

The supervisory authority in your jurisdiction is the Garante per la protezione dei dati personali (GPDP).

ANNEX 9

Netherlands Notice – Applicable to Applicants residing in The Netherlands

The supervisory authority in your jurisdiction is the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).

ANNEX 10

Norway Notice – Applicable to Applicants residing in Norway

The supervisory authority in your jurisdiction is The Norwegian Data Protection Authority (Datatilsynet).

ANNEX 11

Poland Notice – Applicable to Applicants residing in Poland

The supervisory authority in your jurisdiction is The Office for Personal Data Protection (UODO).

ANNEX 12

Romania Notice – Applicable to Applicants residing in Romania

The supervisory authority in your jurisdiction is the National Supervisory Authority for Personal Data Processing (ANSPDCP).

ANNEX 13

Spain Notice – Applicable to Applicants residing in Spain

The supervisory authority in your jurisdiction is the Spanish Data Protection Agency (AEPD).

Data processing may only be carried out when covered by EU Law, Spanish Data Protection Organic Law or in other rules of legal rank.

This Recruitment Privacy Notice may vary over time due to possible changes in criteria followed at any time by the Spanish Agency for Data Protection or other control authorities, the legislative changes that may take place and the resulting jurisprudential pronouncements applicable to this Recruitment Privacy Notice. We therefore reserve the right to modify this Recruitment Privacy Notice in order to adapt it to said criteria, as well as to new jurisprudence or legislation.

ANNEX 14

Sweden Notice – Applicable to Applicants residing in Sweden

The supervisory authority in your jurisdiction is The Swedish Data Protection Agency (IMY)

ANNEX 15

Switzerland Notice – Applicable to Applicants residing in Switzerland

The supervisory authority in your jurisdiction is The Federal Data Protection and Information Commissioner (FDPIC). Please find here a list of the Swiss cantonal and municipal data protection authorities: Data protection authorities.

Please note that payroll data may also consist of data about your religious belief. The lawful basis for processing is compliance with Swiss statutory law (FADP Art. 4, 12, 13, 14).

ANNEX 16

UK Notice – Applicable to Applicants residing in the UK

The supervisory authority in your jurisdiction is the Information Commissioner’s Office (“ICO”)

We carry out equal opportunities monitoring in the UK in connection with talent acquisition and human resources, and we may report our statistics to government agencies. The lawful basis for processing equal opportunities data is that it is in the substantial public interest to monitor equality. It is in A&M’s legitimate interests to ensure that we have a diverse workforce and that there is no discrimination in hiring.

Our Appropriate Policy Document, setting out how sensitive personal data is processed, follows at Annex 17.

ANNEX 17

UK Appropriate Policy Document – Applicable to Applicants residing in the UK

Please note that this Recruitment Privacy Notice (including the information detailed below), along with other related policies and/or protocols, shall form our policy for processing special categories of personal data and criminal convictions data as required by the UK Data Protection Act 2018 (Schedule 1 Part IV).

Description of special data processed:

Nationality, racial and ethnic origin, gender, sexual orientation, religion, disability age, and data concerning health.
Criminal convictions data, as part of the hiring process for certain roles.

Schedule 1 conditions for processing:

Processing is necessary for the purposes of performing or exercising obligations or rights which are imposed or conferred by law on the controller in connection with employment (Schedule 1, Part I, section 1 UK Data Protection Act 2018);
Processing is necessary for reasons of substantial public interest relating to equality of opportunity or treatment (Schedule 1, Part II, section 8(1) UK Data Protection Act 2018); and
Processing is necessary for reasons of substantial public interest relating to racial and ethnic diversity at senior levels (Schedule 1, Part II, section 9(1) UK Data Protection Act 2018).

Procedures for ensuring compliance with the principles:

Accountability principle:
- We maintain appropriate documentation of our processing activities, as set out in our Article 30 record of processing.
- We have appropriate data protection policies in place, such as the Global Data Protection Policy, Workforce Security Policy, and related policies, guidelines and documents.
- We carry out data protection impact assessments (DPIA) for uses of personal data that are likely to result in high risk to individuals’ interests.
Principle (a): lawfulness, fairness and transparency:
- We identify an appropriate lawful basis for processing and a further Schedule 1 condition for processing special data, as set out in this Recruitment Privacy Notice.
- We make appropriate privacy information available with respect to the special data, as set out in this Recruitment Privacy Notice.
- We are open and honest when we collect the special data and we ensure we do not deceive or mislead people about its use, by making this Recruitment Privacy Notice available.
Principle (b): purpose limitation:
- We have clearly identified our purposes for processing the special data, as set out in this Recruitment Privacy Notice.
- We have included appropriate details of these purposes in our privacy information for individuals, as set out in this Recruitment Privacy Notice.
- If we plan to use personal data for a new purpose (other than a legal obligation or function set out in law), we either check that this is compatible with our original purpose or where we have another lawful basis, be transparent about this new processing or get specific consent for the new purpose.
Principle (c): data minimisation:
- We are satisfied that we only collect special data that we actually need for our specified purposes.
- We are satisfied that we have sufficient special data to properly fulfil those purposes.
- We periodically review this data and delete anything we don’t need.
Principle (d): accuracy:
- We have appropriate processes in place to check the accuracy of the special data we collect, and we record the source of that data.
- We have a process in place to identify when we need to keep the special data updated to properly fulfil our purpose, and we update it as necessary.
Principle (e): storage limitation:
- We carefully consider how long we keep the special data, and we can justify this amount of time.
- We regularly review our information and erase or anonymise this special data when we no longer need it.
Principle (f): integrity and confidentiality (security):
- We have analysed the risks presented by our processing and used this to assess the appropriate level of security we need for this data.
- We have policies maintained by the Global Security Office, Information Technology (HRIS), Human Resources and Talent Acquisition, regarding this special data, and we take steps to make sure these policies are implemented. Each is reviewed regularly.
- We have put other technical measures or controls in place because of the circumstances and the type of special data we are processing.

Retention and erasure policies

We are committed to the security of special categories of personal data and criminal convictions data that we hold. We have administrative, physical, and technical safeguards in place to protect personal data against unlawful or unauthorised processing, or accidental loss or damage. We will ensure where special categories of personal data or criminal convictions data are processed that:

The processing is recorded, setting out, where possible, a suitable time period for the safe and permanent erasure of the different categories of data in accordance with our data retention policy.
Where we no longer require special categories of personal data or criminal convictions data for the purpose for which it was collected, we will delete it or render it permanently anonymous as soon as practicable.
Where records are destroyed, we will ensure that they are safely and permanently disposed of.
A&M maintains record retention schedules that set out the criteria used to determine the period for which personal data is stored. You may request information concerning these retention periods, as set out in the main body of the Recruitment Privacy Notice.