INTRODUCTION

This document refers to personal data, which is defined as information concerning any living person (a natural person who hereafter will be called the Data Subject) that is not already in the public domain.

The General Data Protection Regulation (GDPR) seeks to protect and enhance the rights of data subjects. These rights cover the safeguarding of personal data, protection against the unlawful processing of personal data and the unrestricted movement of personal data within the EU. It should be noted that GDPR does not apply to information already in the public domain.

Boyd Recruitment Ltd is pleased to provide the following Privacy Notice:

WHAT KIND OF PERSONAL DATA DO WE COLLECT?

Candidate data

In order to provide the best possible employment opportunities that are tailored to you, we need to process certain information about you. We only ask for details that will genuinely help us to help you, such as your name, age, contact details, education details, employment history, emergency contacts, immigration status, financial information (where we need to carry out financial background checks), and national insurance number (and of course you may choose to share other relevant information with us). Where appropriate and in accordance with local laws and requirements, we may also collect information related to your health, diversity information or details of any criminal convictions.

Client data

If you are a customer of Boyd Recruitment, we need to collect and use information about you, or individuals at your organisation, in the course of providing you services such as: (i) finding Candidates who are the right fit for you or your organisation; (ii) providing you with a Managed Service Provider program (or assisting another organization to do so); (iii) providing you with Recruitment Process Outsourcing services (or assisting another organization to do so); and/or (iv) notifying you of content published by Boyd Recruitment which is likely to be relevant and useful to you

Supplier data

We need a small amount of information from our Suppliers to ensure that things run smoothly. We need contact details of relevant individuals at your organisation so that we can communicate with you. We also need other information such as your bank details so that we can pay for the services you provide (if this is part of the contractual arrangements between us). People whose data we receive from candidates and staff, such as referees and emergency contacts

In order to provide Candidates with suitable employment opportunities safely and securely and to provide for every eventuality for them and our Staff, we need some basic background information. We only ask for very basic contact details, so that we can get in touch with you either for a reference or because you’ve been listed as an emergency contact for one of our Candidates or Staff members.

Website users

We collect a limited amount of data from our Website Users which we use to help us to improve your experience when using our website and to help us manage the services we provide. This includes information such as how you use our website, the frequency with which you access our website, and the times that our website is most popular. A number of elements of the personal data we collect from you are required to enable us to fulfil our contractual duties to you or to others. Where appropriate, some, for example Candidates National Insurance Number and, religious affiliation, are required by statute or other laws. Other items may simply be needed to ensure that our relationship can run smoothly.

Depending on the type of personal data in question and the grounds on which we may be processing it, should you decline to provide us with such data, we may not be able to fulfil our contractual requirements or, in extreme cases, may not be able to continue with our relationship.

HOW DO WE COLLECT YOUR PERSONAL DATA?

Candidate data

There are two main ways in which we collect your personal data:

• Directly from you

• 3rd third parties

Client data

There are two main ways in which we collect your personal data:

• Directly from you

• From third parties (e.g. our Candidates) and other limited sources (e.g. online and offline media).

Supplier data

We collect your personal data during our work with you.

People whose data we receive from candidates and staff, such as referees and emergency contacts We collect your contact details only where a Candidate or a member of our Staff puts you down as their emergency contact or where a Candidate gives them to us in order for you to serve as a referee.

Website users

We collect your data automatically via cookies when you visit our website, in line with cookie settings in your browser.

HOW DO WE USE YOUR PERSONAL DATA?

Candidate data

The main reason for using your personal details is to help you find employment or other work roles that might be suitable for you. The more information we have about you, your skillset and your ambitions, the more bespoke we can make our service. Where appropriate and in accordance with local laws and requirements, we may also use your personal data for things like marketing, profiling and diversity monitoring. Where appropriate, we will seek your consent to undertake some of these activities.

Client data

The main reason for using information about Clients is to ensure that the contractual arrangements between us can properly be implemented so that the relationship can run smoothly. This may involve: (i) identifying Candidates who we think will be the right fit for you or your organization; (ii) providing you with an MSP Program (or assisting another organization to do so); and/or (iii) providing you with RPO services (or assisting another organization to do so). The more information we have, the more bespoke we can make our service.

Supplier data

The main reasons for using your personal data are to ensure that the contractual arrangements between us can properly be implemented so that the relationship can run smoothly, and to comply with legal requirements. People whose data we receive from candidates and staff, such as referees and emergency contacts We use referees’ personal data to help our Candidates to find employment which is suited to them. If we are able to verify their details and qualifications, we can make sure that they are well matched with prospective employers. We may also use referees’ personal data to contact them in relation to recruitment activities that may be of interest to them. We use the personal details of a Candidate or Staff member’s emergency contacts in the case of an accident or emergency affecting that Candidate or member of Staff. Please note that communications to and from Boyd Recruitment Staff including emails may be reviewed as part of internal or external investigations or litigation.

WHO DO WE SHARE YOUR PERSONAL DATA WITH?

Candidate data

We may share your personal data with various parties, in various ways and for various reasons. Primarily we will share your information with prospective employers to increase your chances of securing the job you want.

Client data

We will share your data: (i) primarily to ensure that we provide you with a suitable pool of Candidates; (ii) to provide you with an MSP program (or assist another organisation to do so); and/or (iii) to provide you with RPO services (or assist another organisation to do so). Unless you specify otherwise, we may share your information with any of our group companies and associated third parties such as our service providers to help us meet these aims.

Supplier data

Unless you specify otherwise, we may share your information with any of our associated third parties such as our service providers and organizations to whom we provide services. People whose data we receive from candidates and staff, such as referees and emergency contacts Unless you specify otherwise, we may share your information with any of our group companies and associated third parties such as our service providers and organizations to whom we provide services.

HOW DO WE SAFEGUARD YOUR PERSONAL DATA?

We care about protecting your information. That’s why we put in place appropriate measures that are designed to prevent unauthorized access to, and misuse of, your personal data.

HOW LONG DO WE KEEP YOUR PERSONAL DATA FOR?

If we have not had meaningful contact with you (or, where appropriate, the company you are working for or with) for a period of two years, we will delete your personal data from our systems unless we believe in good faith that the law or other regulation requires us to preserve it (for example, because of our obligations to tax authorities or in connection with any anticipated litigation).

HOW CAN YOU ACCESS, AMEND OR TAKE BACK THE PERSONAL DATA THAT YOU HAVE GIVEN TO US?

• Even if we already hold your personal data, you still have various rights in relation to it. To get in touch about these, please contact us We will seek to deal with your request without undue delay, and in any event in accordance with the requirements of any applicable laws. Please note that we may keep a record of your communications to help us resolve any issues which you raise.

• Right to object: If we are using your data because we deem it necessary for our legitimate interests to do so, and you do not agree, you have the right to object. We will respond to your request within 30 days (although we may be allowed to extend this period in certain cases). Generally, we will only disagree with you if certain limited conditions apply.

• Right to withdraw consent: Where we have obtained your consent to process your personal data for certain activities (for example, for profiling your suitability for certain roles), or consent to market to you, you may withdraw your consent at any time.

• Data Subject Access Requests (DSAR): Just so it’s clear, you have the right to ask us to confirm what information we hold about you at any time, and you may ask us to modify, update or delete such information. At this point we may comply with your request or, additionally do one of the followings:

• We may ask you to verify your identity, or ask for more information about your request; and

• Where we are legally permitted to do so, we may decline your request, but we will explain why if we do so.

• Right to erasure: In certain situations (for example, where we have processed your data unlawfully), you have the right to request us to “erase” your personal data. We will respond to your request within 30 days (although we may be allowed to extend this period in certain cases) and will only disagree with you if certain limited conditions apply. If we do agree to your request, we will delete your data but will generally assume that you would prefer us to keep a note of your name on our register of individuals who would prefer not to be contacted. That way, we will minimise the chances of you being contacted in the future where your data are collected in unconnected circumstances. If you would prefer us not to do this, you are free to say so.

• Right of data portability: If you wish, you have the right to transfer your data from us to another data controller. We will help with this – either by directly transferring your data for you, or by providing you with a copy in a commonly used machine-readable format.

• Right to lodge a complaint with a supervisory authority: You also have the right to lodge a complaint with the Information Commissioners Office.

• If your interests or requirements change, you can unsubscribe from part or all of our marketing content (for example job role emails or newsletters) by clicking the unsubscribe link in the email.

WHO IS RESPONSIBLE FOR PROCESSING YOUR PERSONAL DATA ON THE BOYD RECRUITMENT LTD WEBSITE?

Boyd Recruitment Ltd controls the processing of personal data on its website(s)

WHAT ARE COOKIES AND HOW DO WE USE THEM

A “cookie” is a bite-sized piece of data that is stored on your computer’s hard drive. They are used by nearly all websites and do not harm your system. We use them to track your activity to help ensure you get the smoothest possible experience when visiting our website. We can use the information from cookies to ensure we present you with options tailored to your preferences on your next visit. We can also use cookies to analyze traffic and for advertising purposes.

HOW TO REJECT COOKIES

• If you don’t want to receive cookies that are not strictly necessary to perform basic features of our site, you may choose to opt-out by changing your browser settings

• Most web browsers will accept cookies but if you would rather we didn’t collect data in this way you can choose to accept all or some or reject cookies in your browser’s privacy settings. However, rejecting all cookies means that you may not be able to take full advantage of all our website’s features. Each browser is different, so check the “Help” menu of your browser to learn how to change your cookie preferences.

• For more information generally on cookies, including how to disable them, please refer to aboutcookies.org. You will also find details on how to delete cookies from your computer.

OUR LEGAL BASES FOR PROCESSING YOUR DATA LEGITIMATE INTERESTS

• Article 6(1)(f) of the GDPR is the one that is relevant here – it says that we can process your data where it “is necessary for the purposes of the legitimate interests pursued by [us] or by a third party, except where such interests are overridden by the interests or fundamental rights or freedoms of [you] which require protection of personal data.”

• We don’t think that any of the following activities prejudice individuals in any way – in fact, they help us to offer you a more tailored, efficient service, so everyone’s a winner! However, you do have the right to object to us processing your personal data on this basis.

Candidate data:

• We think it’s reasonable to expect that if you are looking for employment or have posted your professional CV information on a job board or professional networking site, you are happy for us to collect and otherwise use your personal data to offer or provide our recruitment services to you, share that information with prospective employers and assess your skills against our bank of vacancies. Once it’s looking like you may get the job, your prospective employer may also want to double check any information you’ve given us (such as the results from psychometric evaluations or skills tests) or to confirm your references, qualifications and criminal record, to the extent that this is appropriate and in accordance with local laws. We need to do these things so that we can function as a profit-making business, and to help you and other Candidates get the jobs you deserve.

• We want to provide you with tailored job recommendations and relevant articles to read to help you on your job hunt. We therefore think it’s reasonable for us to process your data to make sure that we send you the most appropriate content.

• We have to make sure our business runs smoothly, so that we can carry on providing services to Candidates like you. We therefore also need to use your data for our internal administrative activities, like payroll and invoicing where relevant.

• We have our own obligations under the law, which it is a legitimate interest of ours to insist on meeting! If we believe in good faith that it is necessary, we may therefore share your data in connection with crime detection, tax collection or actual or anticipated litigation.

Client data:

• To ensure that we provide you with the best service possible, we store your personal data and/or the personal data of individual contacts at your organization as well as keeping records of our conversations, meetings, registered jobs and placements. From time to time, we may also ask you to undertake a customer satisfaction survey. We think this is reasonable – we deem these uses of your data to be necessary for our legitimate interests as an organization providing various recruitment services to you.

Supplier data:

• We use and store the personal data of individuals within your organization in order to facilitate the receipt of services from you as one of our Suppliers. We also hold your financial details, so that we can pay you for your services. We deem all such activities to be necessary within the range of our legitimate interests as a recipient of your services. People whose data we receive from candidates and staff, such as referees and emergency contacts:

• If you have been put down by a Candidate or a prospective member of Staff as one of their referees, we use your personal data in order to contact you for a reference. This is a part of our quality assurance procedure and so we deem this to be necessary for our legitimate interests as an organization offering recruitment services and employing people ourselves.

• If a Candidate or Staff member has given us your details as an emergency contact, we will use these details to contact you in the case of an accident or emergency. We are sure you will agree that this is a vital element of our people-orientated organization, and so is necessary for our legitimate interests.

Consent

• In certain circumstances, we are required to obtain your consent to the processing of your personal data in relation to certain activities. Depending on exactly what we are doing with your information, this consent will be opt-in consent or soft opt-in consent.

• Article 4(11) of the GDPR states that (opt-in) consent is “any freely given, specific, informed and unambiguous indication of the data subject’s wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her.” In plain language, this means that:

– you have to give us your consent freely, without us putting you under any type of pressure;

– you have to know what you are consenting to – so we’ll make sure we give you enough information;

– you should have control over which processing activities you consent to and which you don’t.

– you need to take positive and affirmative action in giving us your consent – we’re likely to provide a tick box for you to check so that this requirement is met in a clear and unambiguous fashion.

We will keep records of the consents that you have given in this way.

• We have already mentioned that, in some cases, we will be able to rely on soft opt-in consent. We are allowed to market products or services to you which are related to the recruitment services we provide as long as you do not actively opt-out from these communications.

• As we have mentioned, you have the right to withdraw your consent to these activities.

ESTABLISHING, EXERCISING OR DEFENDING LEGAL CLAIMS

• Sometimes it may be necessary for us to process personal data and, where appropriate and in accordance with local laws and requirements, sensitive personal data in connection with exercising or defending legal claims. Article 9(2)(f) of the GDPR allows this where the processing “is necessary for the establishment, exercise or defence of legal claims or whenever courts are acting in their judicial capacity”.

• This may arise for example where we need to take legal advice in relation to legal proceedings or are required by law to preserve or disclose certain information as part of the legal process.

YOUR RIGHTS AS A DATA SUBJECT

At any point whilst Boyd Recruitment is in possession of or processing your personal data, all data subjects have the following rights:

Right of access – you have the right to request a copy of the information that we hold about you. Right of rectification – you have a right to correct data that we hold about you that is inaccurate or incomplete. Right to be forgotten – in certain circumstances you can ask for the data we hold about you to be erased from our records. Right to restriction of processing – where certain conditions apply you have a right to restrict the processing. Right of portability – you have the right to have the data we hold about you transferred to another organization.

Right to object – you have the right to object to certain types of processing such as direct marketing. Right to object to automated processing, including profiling – you also have the right not to be subject to the legal effects of automated processing or profiling.

If Boyd Recruitment refuse your request under rights of access, we will provide you with a reason as to why, which you have the right to legally challenge.

If Boyd Recruitment refuses your request, they will confirm what information it holds about you and how it is processed.

YOU CAN REQUEST THE FOLLOWING INFORMATION:

• Identity and the contact details of the person or organisation Boyd Recruitment that has determined how and why to process your data.

• Contact details of the data protection officer, where applicable.

• The purpose of the processing as well as the legal basis for processing.

• If the processing is based on the legitimate interests of Boyd Recruitment a third party such as one of its clients, information about those interests.

• The categories of personal data collected, stored and processed.

• Recipient(s) or categories of recipients that the data is/will be disclosed to.

• How long the data will be stored.

• Details of your rights to correct, erase, restrict or object to such processing.

• Information about your right to withdraw consent at any time.

• How to lodge a complaint with the supervisory authority (Data Protection Regulator).

• Whether the provision of personal data is a statutory or contractual requirement, or a requirement necessary to enter into a contract, as well as whether you are obliged to provide the personal data and the possible consequences of failing to provide such data.

• The source of personal data if it wasn’t collected directly from you.

• Any details and information of automated decision making, such as profiling, and any meaningful information about the logic involved, as well as the significance and expected consequences of such processing.

TO ACCESS WHAT PERSONAL DATA IS HELD, IDENTIFICATION WILL BE REQUIRED

Boyd Recruitment will accept the following forms of ID when information on your personal data is requested: a copy of your national ID card, driving license, passport, birth certificate and a utility bill not older than three months. A minimum of one supporting document is required.

If Boyd Recruitment is dissatisfied with the quality, further information may be sought before personal data can be released. All requests should be made to datarequests@Boyd-recruitment.co.ukor writing to us at the address further below.

COMPLAINTS

If you wish to make a complaint about how your personal data is being processed by Boyd Recruitment and its partners, you have the right to complain to Boyd Recruitment Limited, MD. If you do not get a response within 30 days you can complain to the Data Protection Regulator. The details for each of these contacts are: Address Boyd Recruitment Ltd FAO the MD 4d Auchingramont Rd,
Hamilton ML3 6JT

Email: datarequests@Boyd-recruitment.co.uk Data Protection Regulator Your data protection regulator and address The Information Commissioner’s Office – Scotland 45 Melville Street Edinburgh EH3 7HL Telephone: 0303 123 1115