Effective Date: November 1, 2023
Alvarez & Marsal Holdings, LLC, together with its subsidiaries (together, "A&M", "we", "our" , "us"), is providing this Recruitment Privacy Notice for the PRC ("PRC Recruitment Privacy Notice").
This PRC Recruitment Privacy Notice applies solely to residents of PRC ( "personnel" or "you") with respect to the collection, use, storage, transmission, disclosure, and/or disposal of personal information by the personal information processor ("data controller") described in Section 1 below about you in the context of your role as a job applicant (collectively, "application-related information"). For purposes of this PRC Recruitment Privacy Notice, the term "job applicant" include individuals who (i) apply for a position with A&M, (ii) join our Talent Network without applying for a specific position, (iii) are recruited by A&M, or (iv) contact A&M to enquire about potential roles. For purposes of this PRC Recruitment Privacy Notice, “PRC” excludes Hong Kong SAR and Macau SAR.
If you enter into a relationship with us as an employee, owner, director, officer, partner, or independent contractor, then a separate Workplace Privacy Notice for People's Republic of China will be provided to you.
This PRC Recruitment Privacy Notice describes:
- The identity of the data controller.
- The categories of personal information we collect.
- The categories of sources from which we collect personal information.
- Our use of personal information.
- Our disclosure of personal information.
- Transfers of personal information outside of PRC.
- Confidentiality and security of personal information.
- Your privacy rights to your personal information.
- Retention of personal information.
- Changes to this notice.
- How to contact us.
This PRC Recruitment Privacy Notice does not constitute or form any type of agreement with us, or confer any contractual right on you or place any contractual obligations on us.
1. Data Controller
Depending on the nature of the processing activity, the data controller of your personal information will be (i) Alvarez & Marsal Consulting (Shanghai) Limited , which is our top-level entity within People's Republic of China, (ii) our affiliate in the United Kingdom, Alvarez & Marsal Europe LLP , (iii) our affiliate in Hong Kong SAR, Alvarez & Marsal Asia Limited , and/or (iv) our top-level parent in the United States, Alvarez & Marsal Holdings, LLC . Where more than one A&M entity jointly acts as the controller of your personal information, we will have entered into an appropriate intra-group joint controller agreement among our entities. For ease of reading, as used in this PRC Recruitment Privacy Notice, the terms "A&M", "we", "us" or "our" will refer to the relevant data controller.
2. Categories of Personal Information We Collect
As used in this PRC Recruitment Privacy Notice, the following definitions shall apply:
- "Personal information" means any information relating to a Data Subject. Reference to the term "personal information" in this PRC Recruitment Privacy Notice is deemed to include reference to "sensitive personal information" unless the context otherwise requires. Personal information does not include anonymized information.
- "Data subject" means an identified or identifiable natural person; an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identify of that natural person.
- "Sensitive personal information" means personal information that, once leaked or illegally used, may easily lead to infringement of the personal dignity of a natural person or may endanger the personal safety or property of a natural person, including (but not limited to): (i) biometric data; (ii) religion; (iii) specific social status; (iv) medical health information; (v) financial accounts; (vi) tracking/location information; and (vii) minors data (aged under 14).
- "Process" or "Processing" means any action that is performed on personal information, whether in whole or in part by automated means, such as collecting, recording, organizing, storing, modifying, using, disclosing, transferring or deleting such data.
Except where prohibited by (and subject to the requirements of) applicable PRC data protection and other laws, rules, and regulations, with your consent (or in accordance with the other lawful bases for processing set out in Annex 1) we may collect the following categories of personal information:
- Personal Details - e.g., name, contact details (address, telephone, email), age, date of birth, gender, passport or other government ID, proof of eligibility to work and details of any work permit application.
- Photographs- e.g., your "headshot" and other photographs (including those incorporated into other documents).
- Education and Professional Qualifications - e.g., resume/CV and any cover letter, professional history, education, qualifications, references, licences and certifications, language skills, professional affiliations, and other information you provide as part of the recruitment process.
- Work Experience - e.g., business contact details (address, telephone, email), job title, office (country, city), business unit, job description, dates of service, category (e.g., full/part-time), reporting lines, travel, relocations, and terms and conditions of your employment, partnership, or other agreement, each in relation to your current and prior employer(s), as the context requires.
- Background Checks - e.g., education, employment, government sanctions and enforcement, identify verification, adverse media, conduct, address verification, directorships, professional qualifications, credit history, and civil litigation and criminal records, including sensitive personal information relating to criminal convictions or offences where and to the extent the law allows us to do so.
- Interview or Assessment Data - e.g., any information you provide to us or generated during an interview or assessment, such as recordings made or taken during live or online interviews, responses to online or written tests, and business plans.
- Compensation, Benefits and Other Financial Data - e.g., information relating to your compensation and benefits with prior employers, and to your expectations at A&M.
- Building and Office Access Control Systems and CCTV Data - e.g., logs and security camera footage relating to building, office and restricted zone access, and use of A&M IT Assets and other resources.
3. Sources of Personal Information
Except where prohibited by (and subject to the requirements of) data protection laws and other applicable PRC laws, rules, and regulations, with your consent (or in accordance with the other lawful bases for processing set out in Annex 1) we may collect personal information about you from multiple sources, including:
- Directly from you: We collect information directly from you during the recruiting processes (including if you apply for a position with A&M, join our Talent Network without applying for a specific role, contact A&M to enquire about potential roles, or are otherwise recruited by A&M), and throughout the course of your candidacy or application to A&M.
- External parties: We collect information from our suppliers (e.g., recruitment / staffing agencies, qualifications testing consultants, criminal and credit background check providers, clients, former employers, universities, named referees, and others. If you cause your job application or other personal information to be shared with us through a third-party application (e.g., LinkedIn or a job board), we consider that information as having come from an external party.
- Electronic means: We collect information from logs and security camera footage relating to A&M's offices and restricted zones; and, from operating systems and platforms.
- Government entities: We collect information from courts, regulators, and other government agencies.
4. Use of Personal Information
Except where prohibited by (and subject to the requirements of) applicable PRC data protection and other laws, rules, and regulations, with your consent (or in accordance with the other lawful bases for processing set out in Annex 1) we may use personal information for the purposes set forth below. Our use includes disclosure to, and access by, authorized employees, owners, directors, officers, partners, or independent contractors of A&M.
- Recruiting / talent acquisition (including managing our talent network; managing the application, interview, candidate assessment, and job offer processes; maintaining a pool of qualified candidates; and, maintaining a record of our recruitment decisions).
- Background and reference checks.
- Diversity and inclusion, including non-discrimination in hiring, equality of opportunity or treatment, promoting and maintaining a diverse workforce, and reporting statistics to government agencies.
- Ensuring compliance with laws and A&M policies, including but not limited to non-discrimination and equal opportunity employment.
- Establishment, exercise, or defence of legal claims.
- Managing and monitoring access to A&M offices and restricted zones.
- In connection with the sale of all or a part of our business, our assets, or a reorganization or combination of our organization with another organization.
- Any other lawful purpose reasonably related to your role as a job applicant.
A&M does not use your personal information for automated decision makin , including profiling.
If we intend to use your previously collected personal information for a new purpose that is incompatible with the purposes described in this PRC Recruitment Privacy Notice or at the time of collection, we will provide you with additional notice and, if legally required, seek your consent.
5. Disclosure of Personal Information
(a) Disclosure to Other Data Controllers. Except where prohibited by (and subject to the requirements of) applicable PRC data protection and other laws, rules, and regulations, we may disclose your personal information to the following separate categories of data controllers, who each have independent purposes and means of processing the received personal information, as follows:
|
Controller |
Personal Information |
Purpose of Disclosure |
|
Our accountants, lawyers, and other professional advisors, who are not otherwise acting as "entrusted parties" . |
Potentially, any categories listed in Section 2. |
As necessary to obtain professional advice. |
(b) Disclosure to Data Processors / "Entrusted Parties" . Except where prohibited by (and subject to the requirements of) applicable PRC data protection and other laws, rules, and regulations, we may disclose your personal information to the following categories of data processors (also referred to as "entrusted parties"):
- Our service providers, including but not limited to information technology / operating systems and platforms (e.g., Microsoft, Box, Workday, Salesforce, ServiceNow, SAP/Concur, Adobe, Mimecast, etc.); job application / recruiting platforms; background screening providers; etc.
Disclosures to data processors are made pursuant to written agreements that set out the purposes, period and means of processing, and prohibit the data processor from processing personal information beyond such purposes, means and other conditions as agreed upon; the categories of personal information to be processed; protection measures; the rights and obligations of both parties, including A&M's right to supervise the personal information processing activities of the data processor and the data processor's ability to sub-contract the processing of personal information to any other party.
(c) Disclosure to Other Third Parties. Except where prohibited by (and subject to the requirements of applicable PRCdata protection and other laws, rules, and regulations, we may disclose your personal information to the following additional categories of recipients:
- Government entities, including courts, regulators, law enforcement, or tax authorities, or to other constituents in a litigation. In some cases, in accordance with applicable law, it may not be possible to notify you in advance about the details of such disclosures. A&M will use reasonable efforts to disclose the minimum personal information necessary in such cases.
- Other third parties where reasonably related to your role as a job applicant.
6. Transfers of Personal Information Outside of PRC
Where necessary, and with your consent (as required by applicable laws) we may transfer your personal information outside of the PRC, and disclose it with data controllers, entrusted parties, and third parties, as described in Section 1, above and in Section 5, above. Transfers are made to the following jurisdictions:
- United States
- United Kingdom
- Hong Kong SAR
Where required by applicable data protection laws, we take relevant steps to ensure that your personal information is protected to a comparable standard as required by such laws, including without limitation where required entering into contractual assurances and/or standard contractual clauses with the overseas data recipient.
7. Confidentiality and Security
We have implemented appropriate physical, technical, and organizational security measures reasonably designed to limit access to your personal information to only those A&M personnel and third parties who have a legitimate need to know and use your personal information, and to protect your personal information against accidental loss and unauthorized access, use, alteration, or disclosure.
8. Your Privacy Rights
You have certain rights in relation to the personal information we hold about you. Where we process your personal information on the basis of your consent, you have the right to withdraw your consent at any time. (Note, any such withdrawal of consent will not affect the lawfulness of our processing based on consent before such withdrawal.)
In addition, you may have rights including those as generally described below; however, in each case your rights are subject to the specific requirements of applicable data protection laws and any exemptions that may apply including, but not limited to, disproportionality and our compliance with a legal obligation or as necessary to establish, exercise or defend against legal claims.
- Access: The right to receive copies of your personal information and information about how we use and share your personal information.
- Rectification: The right to correct any inaccurate or incomplete personal information. ( Note , while we assess your rectification request, you may also seek to exercise your right to restrict our processing of the personal information, as described below.)
- Erasure ("the right to be forgotten" or "right of deletion"): The right to request deletion of your personal information where: (1) the personal information is no longer necessary for the purpose for which we originally collected or processed it; (2) we are relying on your consent as our lawful basis for processing, and you withdraw your consent; (3) the data retention period has expired; (4) we are processing the personal information for direct marketing purposes and you object to that processing; (5) we have processed the personal information unlawfully; or (6) we must erase the data in order to comply with a legal obligation. ( Note , while we assess your deletion request, you may also seek to exercise your right to restrict our processing of the personal information, as described below.)
- Objection: The right to stop or prevent us from processing your personal information. You have an absolute right to object to our processing if the processing is based on your consent. You may also object our processing if we rely on other lawful bases for the processing.(Note, while we assess your objection request, you may also seek to exercise your right to restrict our processing of the personal information, as described below.)
- Portability: The right to ask us to provide your personal information to another data controller where the conditions set out in the applicable data protection laws are satisfied. ( Note, we are not responsible for the security of the personal information or its processing once received by the third party.)
- Automated Decision-Making: The right to have us not process your personal information solely by automated means, including profiling, in a manner that produces legal or similarly significant effects on you, except where the processing is either necessary for entering into or performing a contract between us and you, authorized by law (e.g., for purposes of detecting fraud or tax evasion), or based on your explicit consent. Automated decision-making with legal or similarly significant effects on the basis of sensitive personal information is permissible only with your explicit consent or where necessary for reasons of substantial public interest. (Note, as specified in Section 4, above, A&M does not use your personal information for automated decision making, including profiling.)
- Complaint: the right to complain to us or a relevant authority about how we process your personal information,
To exercise your rights, you can contact us by any of the following methods:
|
Data Controller |
Alvarez & Marsal Consulting (Shanghai) Limited |
|
North Asia HR |
|
|
Data Protection Office |
|
|
Online / webform |
Click here |
9. Retention of Personal Information
We may retain your personal information for as long as reasonably necessary to fulfil the purposes for which we collected it or for such longer periods as required or permitted by applicable laws. Typically, we will retain your personal information for the duration we are considering your candidacy or application. If your candidacy or application is successful, we will retain and use your personal information in accordance with any employment-related privacy notices we provide to you. If your candidacy or application is unsuccessful for any reason, we will retain your personal information for purposes of maintaining a record of our recruitment decision, and to consider you for future opportunities (provided you may request deletion from our candidate pool at any time by contacting us as specified below).
Under some circumstances, we may anonymize your personal information so that it can no longer be associated with you. We reserve the right to use such anonymous and de-identified data for any legitimate business purpose without further notice to you or your consent.
10. Changes
We may update this PRC Recruitment Privacy Notice from time to time at our discretion, but where required by applicable law or regulations, we will provide you with notice of such changes and seek your consent.
11. Contact Us
For any questions or concerns about this PRC Recruitment Privacy Notice, you may contact us by any of the following methods:
|
Data Controller |
Alvarez & Marsal Consulting (Shanghai) Limited Unit 1911-1916, Level 19 |
|
North Asia HR |
|
|
Data Protection Office |
|
|
Online / webform |
Click here |
ANNEX 1
Legal Grounds for Processing Personal information
Under applicable data protection laws, there are various grounds on which we can rely when processing your personal information. In some contexts, more than one ground applies. We have summarised these grounds and outline what those terms mean, below.
|
Term |
Lawful basis for processing |
Explanation |
|
Consent |
You have given consent to processing your data. |
This is the primary basis for processing of personal information under PRC data protection laws. |
|
Legal obligation |
Processing is necessary to perform our legal duties or obligations. |
This refers to our legal, compliance and regulatory obligations. For example (but without limitation), for the prevention and detection of crime. |
|
Emergency |
Processing is necessary to respond to public health emergencies, or to protect life, health or property safety of an individual. |
This refers to situations such as natural disasters, public health outbreaks or an emergency situation, for example (without limitation) if we have to call an ambulance. |
|
Other |
Processing is necessary in circumstances provided by applicable laws and regulations. |
This refers to circumstances where other laws may require us to process your personal information. |
