1. Who we are and what we do
Who we are
We are Empresaria Group plc (“us”, “we”, “our”). We are a public limited company registered in England and Wales under registration number 09946765 with a registered office at Old Church House, Sandy Lane, Crawley Down, Crawley, West Sussex, England RH10 4HS. We are registered with the Information Commissioner’s Office (“ICO”), the UK supervisory office under registration number Z124495X.
What we do
We are a specialist staffing provider, matching quality candidates to our clients’ available roles in the in diverse sectors across, the globe, including IT, professional services and healthcare across the globe. We and our affiliates, subsidiaries and related entities are committed to protecting the privacy and security of the Personal Data we process.
Controller
Unless we notify you otherwise, we are the Controller of the Personal Data we process, jointly with Empresaria. This means that we, together with Empresaria, jointly decide what Personal Data to collect and how to process it.
2. Purpose of this privacy notice
The purpose of this privacy notice is to explain what Personal Data we collect about you and how we process it. This privacy notice also explains your rights, so please read it carefully. If you have any questions, you can contact us using the information provided below under the ‘Contact Us’ section.
3. Who this privacy notice applies to
This privacy notice applies to you if:
You visit our website
You or the company you work for enters into a contract with us to provide recruitment related services
You make enquires about our services
You register with us
You are a business associate of ours
You sign up for job alerts
You are a candidate to whom we provide work-finding services
You are a client to whom we provide recruitment and staffing services
You are referee who we contact about a former employee of yours
We contact you to promote our services. For example, we send you newsletters and/or other promotional communications.
4. What Personal Data is
The definition of ‘Personal Data’ varies slightly from country to country but generally means any information from which someone can be identified either directly or indirectly. For example, you can be identified by your name or an online identifier. However, in America ‘Personal Information’ includes information that could reasonably be linked, either directly or indirectly, to a particular consumer or household.
In some cases, we also process more sensitive Personal Data such as information revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data for the purposes of uniquely identifying someone, data concerning physical or mental health or data concerning someone’s sex life or sexual orientation and criminal offence data. For the purposes of this privacy notice, we shall refer to this data as ‘Sensitive Personal Data’.
5. Interpretation & Definitions
APA means the Australian Privacy Act 1988 (Cth).
APPI means Japan’s Act on the Protection of Personal Information (Act No. 57 of 2003 as amended in 2020).
Business means the legal entity that determines the purposes and means of processing of Personal Data about residents of California in accordance with the California Consumer Privacy Act (CCPA) and/or the California Privacy Rights Act (CPRA).
Business Associates means a representative of a former, existing or potential client of ours.
Controller means, for the purposes of this privacy notice, the legal entity or natural person that determines the means and purposes of processing of Personal Data and includes the definition of Data User under Hong Kong’s PDPO and Malaysia’s PDPA, a Personal Information Handler under China’s PIPL, an Organisation under Singapore’s PDPA, a Business under California’s CPPA, an agency under New Zealand’s Privacy Act and a Data Processor under Vietnam’s LCS.
Chile’s PPLL means Chile’s Protection of Private Life Law 19, 628/1999.
CCPA means the California Consumer Privacy Act, California Civil Code sections 1798.100 et seq, and its implementing regulations.
“CDPA” means the Virginia Consumer Data Protection Act.
“CPA” means the Colorado Privacy Act.
CPRA means the California Privacy Rights Act.
“CTDPA” means the Connecticut Act Concerning Personal Data Privacy and Online Monitoring.
DPA means the Philippines’ Data Privacy Act of 2012 (Republic Act No. 10173)
EU GDPR means the EU’s the General Data Protection Regulation (EU) 2016/679.
IT Law means India’s Information Technology Law 2000.
Kominfo Regulation 20 means Regulation No.20 of 2016 on Personal Data Protection in Electronic Systems.
LCS means the Law on Cyber Information Security No.86/2015/QH13 (19 November 2015) in Vietnam.
Malaysia’s PDPA means Malaysia’s Personal Data Protection Act (“Malaysia’s PDPA”).
Peru’s PDPL means Peru’s Personal Data Protection Law (N° 29733 (PDPL)) and its Regulation (N° 003-2013-JUS-Regulation of the PDPL).
PDPO means Hong Kong’s Personal Data (Privacy) Ordinance (Cap.486) as amended.
Personal Data means information which can be used directly or indirectly to identify you and which relates to you (and shall be deemed to include “Personal Data” and “Personal Information” as defined in the various data protection laws referred to in this privacy notice.
PIPL means China’s Personal Information Protection Law.
Privacy Act 2020 means New Zealand’s Privacy Act 2020.
Processor means the legal entity or natural person that processes Personal Data on behalf of and under the strict instructions of a Controller and includes ‘Entrusted Parties’ under China’s Personal Information Protection Law.
Sensitive Personal Data – Sensitive personal data may be defined differently under different data protection laws but for the purposes of this privacy notice Sensitive Personal Data means Personal Data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, the processing of biometric data for the purpose of uniquely identifying someone, health data, sex life or sexual orientation and Personal Data relating to criminal convictions or offences.
Singapore’s PDPA means Singapore’s Personal Data Protection Act 2012.
SPDI Rules means India’s Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules 2011.
Thailand’s PDPA means Thailand’s Personal Data Protection Act 2019.
UK GDPR means the General Data Protection Regulation (EU) 2016/679 as it forms part of the law of the United Kingdom by virtue of section 3 of the European Union (Withdrawal) Act 2018.
“UCPA” means the Utah Consumer Privacy Act.
6. Personal Data we collect
The type of Personal Data we collect about you is set out in the table below in the section entitled ‘Purposes, lawful bases and retention periods’.
7. How we collect your Personal Data
We collect most of the Personal Data directly from you in person, by telephone, text, video call or email and/or via our website. We may record our telephone calls and video calls in order to refer back to them at a later date.
However, we may also collect your Personal Data from third parties such as:
Job Boards
Third Party CV Databases
Company Websites
General Enquiries
Publicly available sources such as social media platforms including but not limited to LinkedIn, Facebook, Github
Reputable companies who provide lead generation such as Lusha
Reputable companies who provide data enrichment services such as ContactOut and Caypro
Referrals/recommendations
Referees
Referencing agencies
Other organisations within the Empresaria Group
Our clients
Intermediaries such as MSPs, umbrella companies and management companies
Government agencies such as HMRC
Credit referencing agencies
Disclosure and Barring Service (DBS) or non-UK equivalent providing criminal record checks
Companies House (or non-UK equivalent)
Electoral registers
Others to whom you have provided consent
8. Purposes, lawful bases and retention periods
| Categories of Personal Data | Purpose of Processing | Lawful Basis | Retention Period |
Business Associates |
|
|
|
|
All Candidates |
|
|
|
|
Successful Candidates and Placed Candidates |
|
|
|
|
Successful Candidates and Placed Candidates |
|
|
|
|
Successful Candidates |
|
|
|
|
Placed Candidates |
|
|
|
|
Placed Candidates |
|
|
|
|
Website visitors |
|
|
|
|
Business Associates, Candidates and website visitors |
|
|
|
|
Where Personal Data is processed because it is necessary for the performance of a contract to which you are a party, we will be unable to provide our services without the required information.
9. Sharing your Personal Data
Internal Sharing within the Empresaria Group
We may share your Personal Data with other organisations within the Empresaria Group as appropriate in order to provide an efficient service to both our clients and candidates in finding the right candidates for the right the roles.
Marketing
In order to deliver our e-newsletters and email campaigns, we use third-party providers.
We will ensure that we have entered into data processing agreements with the third-party providers which means that they can only process your Personal Data in accordance with our instructions and the applicable data protection legislation and they will not be able to use it for their own purposes.
Authorized Third-Party Providers
We may share Personal Data with third-party providers that provide business services to us or on our behalf, such as IT services, hosting services. Payment information will be used and shared only to process your order and may be stored by a service provider for purposes of future transactions. We prohibit our third-party providers from using or sharing your Personal Data except as necessary to perform the contracted services on our behalf or to comply with applicable legal requirements.
As mentioned above, we use Google Analytics. For more information about Google Analytics, please visit www.google.com/policies/privacy/partners. You can opt out of Google’s collection and processing of data generated by your use of our services by going to http://tools.google.com/dlpage/gaoptout.
Please see our cookie policy on our website for more information on our use of cookies and similar technologies.
Other External Sharing
We may share Personal Data with banks, referencing agencies, DBS, credit referencing agencies and government agencies such as tax an immigration authorities and pension providers.
We may share the personal data of clients with candidates and vice versa. Also, we may (occasionally) share the personal data we collect with others such as professional advisers, insurers etc.
We will only share personal data when it is necessary, fair, lawful, justified and proportionate to do so.
10. International Transfers
Your Personal Data may be transferred to and processed in a country different to that in which you reside. This is because:
We share your Personal Data with other organisations within the Empresaria Group, as necessary, some of which are based outside your country of residence
Some of the organisations we use to provide our service to you (such as our processors) are based outside your country of residence
If you are a candidate, we may share your Personal Data with a client based outside your country of residence
If you are a client, we may share your Personal Data with a candidate outside your country of residence.
If you are in any country not listed below, we confirm that we take reasonable steps to protect any Personal Data transferred to any countries outside your country of residence and ensure that it is lawful to do so
If you are in a country which is the subject to US, EU or UK sanctions, we will not knowingly process your Personal Data.
If you are in Australia
We confirm that we will take reasonable steps to protect any Personal Data transferred to any countries outside Australia.
If you are in China
We will not transfer your Personal Data to any countries outside China.
If you are in Chile
We confirm that we take reasonable steps to protect any Personal Data transferred to any countries outside Chile.
If you are in the EEA
We confirm that we take appropriate steps to ensure that any Personal Data transferred outside the EEA has an essentially equivalent level of protection to that guaranteed in the EEA. We do this by ensuring that:
Your Personal Data is only processed in a country which the European Commission has confirmed has an adequate level of protection (an adequacy decision); or
We enter into Standard Contractual Clauses (“SCCs”) with the receiving organisations and adopt supplementary measures, where necessary. (A copy of the SCCs can be found here Standard Contractual Clauses (SCCs)).
If you are in Hong Kong
We confirm that we take reasonable steps to protect any Personal Data transferred to any countries outside Hong Kong.
If you are in India
We confirm that we take reasonable steps to protect any Personal Data transferred to any countries outside India. If the data to be transferred includes 'sensitive personal information or data' as defined under India’s SPDI Rules, we will ensure that the same standards of data protection required in India are adhered to in the destination country, and that the transfer is necessary for the performance of a lawful contract or you have consented to the transfer. Please note that the definition of ‘sensitive personal information or data’ used in the SPDI Rules is different to that listed above in the definitions section of this privacy notice. Under the SPDI Rules ‘sensitive personal information or data’ includes passwords, financial information such as bank account or credit card or debit card information, physical, physiological, and mental health condition, sexual orientation, medical records and history, and biometric information)
If you are in Indonesia
We confirm that we take appropriate steps to ensure that any Personal Data transferred outside Indonesia has at least an equivalent level of protection to that guaranteed in Indonesia and if not, we will ensure we obtain adequate and binding protection for the Personal Data or we will obtain your consent.
If you are in Japan
We confirm that we take appropriate steps to comply with Japan’s APPI and to protect any Personal Data transferred to any countries outside Japan.
If you are in Malaysia
We confirm that we will obtain your consent before transferring your Personal Data outside Malaysia or otherwise ensure that it is lawful to do so, in accordance with Malaysia’s PDPA.
If you are in New Zealand
We confirm that we take appropriate steps to protect any Personal Data transferred to any countries outside New Zealand.
If you are in Peru
We confirm that we take appropriate steps to ensure that any Personal Data transferred outside Peru has an essentially equivalent level of protection to that guaranteed in Peru or we will obtain your consent for the transfer or ensure that it is otherwise lawful to make the transfer.
If you are in the Philippines
We confirm that we take appropriate steps to ensure that any Personal Data transferred to any countries outside the Philippines has a comparable level of protection to that guaranteed in the Philippines.
If you are in Singapore
We confirm that we take appropriate steps to ensure that any Personal Data transferred to any countries outside Singapore has a comparable level of protection to that guaranteed in Singapore.
If you are in Thailand
We confirm that we will not transfer any Personal Data outside Thailand unless the destination country has an essentially equivalent level of protection to that guaranteed in the Thailand or it is otherwise lawful to do so.
If you are in the UK
We confirm that we take appropriate steps to ensure that any Personal Data processed outside the UK has an essentially equivalent level of protection to that guaranteed in the UK. We do this by ensuring that:
Your Personal Data is only processed in a country which the Secretary of State has confirmed has an adequate level of protection (an adequacy regulation) or
We enter into an International Data Transfer Agreement (“IDTA”) with the receiving organisation and adopt supplementary measures, where necessary. (A copy of the IDTA can be found here international-data-transfer-agreement.pdf (ico.org.uk))
If you are in the United States of America
There are no restrictions relating to cross border transfers but we, nonetheless, take appropriate steps to ensure that your Personal Data is suitable protected when it is transferred outside of America.
If you are in Vietnam
We confirm that we will obtain your consent before transferring your Personal Data outside Vietnam or otherwise ensure that it is lawful to do so.
11. Your rights and how to complain
You have rights in respect of your Personal Data. The specific rights available to you depend on your country of residence.
If you are in any country not listed below, we confirm that we will process your Personal Data in accordance with the applicable law.
If you are in a country which is the subject to US, EU or UK sanctions, we will not knowingly process your Personal Data.
To exercise your rights, please contact us using the details set out in the ‘Contact Us’ section below.
How to exercise your rights
You will not usually need to pay a fee to exercise any of the above rights. However, we may charge a reasonable fee if your request is clearly unfounded or excessive. Alternatively, we may refuse to comply with the request in such circumstances.
If you wish to exercise your rights, you may contact us using the details set out below within the section called ‘How to contact us and our Data Protection Officer’. We may need to request specific information from you to confirm your identity before we can process your request. Once in receipt of this, we will process your request without undue delay. Complex requests may take some time to process but we will keep you updated.
Australia
If you live in Australia, we comply with the Australian Privacy Act 1988 (Cth) and you have the following rights in relation to the processing of your Personal Data, including to:
Right to be informed
You have the right to know details such as what personal data we collect about you, who we share it with, how we use it, for what purpose and how long we keep it. We use our privacy notice to explain this.
Right of access (commonly known as a “Subject Access Request”)
You have the right to access and receive a copy of the Personal Data we hold about you.
Right to rectification
You have the right to have any incomplete or inaccurate information we hold about you corrected.
Right to object to processing
You have the right to object to us processing your Personal Data and to stop receiving unwanted direct marketing.
Right to withdraw consent
If you have provided your consent for us to process your Personal Data for a specific purpose, you have the right to withdraw your consent at any time. If you do withdraw your consent, we will no longer process your information for the purpose(s) you originally agreed to, unless we are permitted by law to do so.
Right to complain
You have the right to complain about us to the Office of the Australian Information Commissioner (“OAIC”), if you think we have mishandled your Personal Data whose contact details are: Contact us - Home (oaic.gov.au)
China
If you live in China, we comply with China’s Personal Information Protection Law (“PIPL”).
You have the following rights in relation to the processing of your Personal Data, including to:
Right to be informed
You have the right to know details such as what personal data we collect about you, who we share it with, how we use it, for what purpose and how long we keep it. We use our privacy notice to explain this.
Right of access (commonly known as a “Subject Access Request”)
You have the right to access and receive a copy of the Personal Data we hold about you.
Right to rectification
You have the right to have any incomplete or inaccurate information we hold about you corrected.
Right to erasure (commonly known as the right to be forgotten)
You have the right to ask us to delete or de-identify your Personal Data.
Right to object to processing
You have the right to object to us processing your Personal Data.
Right to restrict processing
You have the right to restrict our use of your Personal Data.
Right to portability
You have the right to ask us to transfer your Personal Data to another party.
Automated decision-making.
You have the right not to be subject to a decision based solely on automated processing which will significantly affect you. We may use software to screen CVs and search applications for key words. You have the right to object to this if you consider that your CV or application has been unfairly rejected as a result of the automated decision-making.
Right to withdraw consent
If you have provided your consent for us to process your Personal Data for a specific purpose, you have the right to withdraw your consent at any time. If you do withdraw your consent, we will no longer process your information for the purpose(s) you originally agreed to, unless we are permitted by law to do so.
Complaints
If you are concerned about the way in which we are handling your Personal Data, you can complain to the Cyberspace Administration of China, relevant State Council departments or relevant departments of local governments.
Chile
If you live in Chile, we comply with Chile’s Protection of Private Life Law 19, 628/1999.
You have the following rights in relation to the processing of your Personal Data, including to:
Right to be informed
You have the right to know details such as what personal data we collect about you, who we share it with, how we use it, for what purpose and how long we keep it. We use our privacy notice to explain this.
Right of access (commonly known as a “Subject Access Request”)
You have the right to access and receive a copy of the Personal Data we hold about you.
Right to rectification
You have the right to have any incomplete or inaccurate information we hold about you corrected.
Right to blocking
You have the right to ask us to block your Personal Data.
Right to cancellation or elimination of processing
You have the right to cancellation or elimination of your Personal Data.
Right to erasure (commonly known as the right to be forgotten)
You have the right to ask us to erase your Personal Data.
If you are in Hong Kong
If you live in Hong Kong, we comply with the Personal Data (Privacy) Ordinance (Cap.486) (“PDPO”)
You have the following rights in relation to the processing of your Personal Data:
Right to be informed
You have the right to know details such as what personal data we collect about you, who we share it with, how we use it, for what purpose and how long we keep it. We use our privacy notice to explain this.
Right of access (commonly known as a “Subject Access Request”)
You have the right to access and receive a copy of the Personal Data we hold about you.
Right to rectification
You have the right to have any incomplete or inaccurate information we hold about you corrected.
Right to cease using your Personal Data for marketing
You have the right to ask us to stop using your Personal Data for marketing purposes.
Complaints
If you are concerned about the way in which we are handling your Personal Data, you can contact the supervisory authority for Hong Kong whose contact details are:
Office of the Privacy Commissioner for Personal Data (the “Privacy Commissioner”)
Room 1303, 13/F, Dah Sing Financial Centre, 248 Queen's Road East
Wanchai, Hong Kong.
Telephone: +852 2827 2827
If you are in India
If you live in India, we comply with the Information Technology Act 2000 (“IT Law”), the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules 2011 (“SPDI Rules”) and all other relevant legislation.
You have the following rights in relation to the processing of your Personal Data, including to:
Right to be informed
You have the right to know details such as what personal data we collect about you, who we share it with, how we use it, for what purpose and how long we keep it. We use our privacy notice to explain this.
Right of access (commonly known as a “Subject Access Request”)
You have the right to access and receive a copy of the Personal Data we hold about you.
Right to rectification
You have the right to have any incomplete or inaccurate information we hold about you corrected.
Right to erasure (commonly known as the right to be forgotten)
You have the right to ask us to delete or de-identify your Personal Data.
Right to withdraw consent
If you have provided your consent for us to process your Personal Data for a specific purpose, you have the right to withdraw your consent at any time. If you do withdraw your consent, we will no longer process your information for the purpose(s) you originally agreed to, unless we are permitted by law to do so.
Complaints
If you are concerned about the way in which we are handling your Personal Data, you can seek clarification from the MEIT (Ministry of Electronics and Information Technology).
If you are in Indonesia
If you live in Indonesia, you have the following rights under Regulation No.20 of 2016 on Personal Data Protection in Electronic Systems (“Kominfo Regulation 20”)
Right to be informed
You have the right to know details such as what personal data we collect about you, who we share it with, how we use it, for what purpose and how long we keep it. We use our privacy notice to explain this.
Right of access (commonly known as a “Subject Access Request”)
You have the right to access and receive a copy of the Personal Data we hold about you.
Right to rectification
You have the right to have any incomplete or inaccurate information we hold about you corrected.
Right to erasure (commonly known as the right to be forgotten)
You have the right to ask us to delete or de-identify your Personal Data.
Right to object
You have the right to object to us processing your Personal Data in certain circumstances.
Complaints
The data protections laws pertaining to data held electronically are mainly enforced by the Ministry of Communication and Information
("Menkominfo").
Jl. Medan Merdeka Barat No. 9,
Jakarta 10110,
Indonesia
If you are in Japan
If you live in Japan, we comply with the Act on the Protection of Personal Information (Act No. 57 of 2003 as amended in 2020) (“APPI”).
You have the following rights in relation to the processing of your Personal Data, including to:
Right to be informed
You have the right to know details such as what personal data we collect about you, who we share it with, how we use it, for what purpose and how long we keep it. We use our privacy notice to explain this.
Right of access (commonly known as a “Subject Access Request”)
You have the right to access and receive a copy of the Personal Data we hold about you.
Right to rectification
You have the right to have any incomplete or inaccurate information we hold about you corrected.
Right to erasure (commonly known as the right to be forgotten)
You have the right to ask us to delete or de-identify your Personal Data.
Right to cease processing
You have the right to request that we cease processing your Personal Data.
Complaints
If you are concerned about the way in which we are handling your Personal Data, you can contact the Personal Information Protection Commission for Japan whose contact details are:
Personal Information Protection Commission
Kasumigaseki Common Gate West Tower 32nd Floor,
3-2-1, Kasumigaseki,
Chiyoda-ku,
Tokyo, 100-0013,
Japan
TEL: +81-(0)3-6457-9680
If you are in Malaysia
If you live in Malaysia, we comply with Malaysia’s Personal Data Protection Act (“Malaysia’s PDPA”).
You have the following rights in relation to the processing of your Personal Data, including to:
Right to be informed
You have the right to know details such as what personal data we collect about you, who we share it with, how we use it, for what purpose and how long we keep it. We use our privacy notice to explain this.
Right of access (commonly known as a “Subject Access Request”)
You have the right to access and receive a copy of the Personal Data we hold about you.
Right to correction
You have the right to have any incomplete or inaccurate information we hold about you corrected.
Right to object
You have the right to object to us processing your Personal Data for direct marketing purposes.
Right to prevent processing
You have the right to prevent processing likely to cause damage or distress.
Right to withdraw consent
If you have provided your consent for us to process your Personal Data for a specific purpose, you have the right to withdraw your consent at any time. If you do withdraw your consent, we will no longer process your information for the purpose(s) you originally agreed to, unless we are permitted by law to do so.
Right to complain
You have the right to complain to the to the Personal Data Protection Commissioner (“PDP Commissioner”) for Malaysia if the data user does not cease processing your Personal Data for direct marketing purposes following your request. The PDP Commissioner contact details are:
Aras 6, Kompleks Kementerian Komunikasi dan Multimedia
Lot 4G9, Persiaran Perdana, Presint 4,
Pusat Pentadbiran Kerajaan Persekutuan,
62100 Putrajaya,
Malaysia
www.pdp.gov.my
If you are in New Zealand
If you live in the New Zealand, we comply with New Zealand’s Privacy Act 2020.
You have the following rights in relation to the processing of your Personal Data, including to:
Right to be informed
You have the right to know details such as what personal data we collect about you, who we share it with, how we use it, for what purpose and how long we keep it. We use our privacy notice to explain this.
Right of access (commonly known as a “Subject Access Request”)
You have the right to access and receive a copy of the Personal Data we hold about you.
Right to rectification
You have the right to have any incomplete or inaccurate information we hold about you corrected.
Complaints
If you are concerned about the way in which we are handling your Personal Data, you can contact the Office of the Privacy Commissioner of New Zealand (OPC”) whose contact details are:
Office of the Privacy Commissioner
Level 8,
109-111 Featherston Street,
Wellington 6143
www.privacy.org.nz
If you are in Peru
If you live in Peru, we comply with the PDPL and you have the following rights in relation to the processing of your Personal Data:
Right to be informed
You have the right to know details such as what personal data we collect about you, who we share it with, how we use it, for what purpose and how long we keep it. We use our privacy notice to explain this.
Right of access (commonly known as a “Subject Access Request”)
You have the right to access and receive a copy of the Personal Data we hold about you.
Right to rectification
You have the right to have any incomplete or inaccurate information we hold about you corrected.
Right to erasure (commonly known as the right to be forgotten)
You have the right to ask us to delete or de-identify your Personal Data.
Right to object to processing
You have the right to object to us processing your Personal Data.
Right to portability
You have the right to ask us to transfer your Personal Data to another party.
Automated decision-making.
You have the right not to be subject to a decision based solely on automated processing which will significantly affect you. We may use software to screen CVs and search applications for key words. You have the right to object to this if you consider that your CV or application has been unfairly rejected as a result of the automated decision-making.
Right to withdraw consent
If you have provided your consent for us to process your Personal Data for a specific purpose, you have the right to withdraw your consent at any time. If you do withdraw your consent, we will no longer process your information for the purpose(s) you originally agreed to, unless we are permitted by law to do so.
Right to complain
If you are concerned about the way in which we are handling your Personal Data, you have the right to complain to the National Data Protection Authority within the Ministry of Justice.
If you are in the Philippines
If you live in the Philippines, we comply with the Data Privacy Act of 2012 (Republic Act No. 10173) (“DPA”).
You have the following rights in relation to the processing of your Personal Data, including to:
Right to be informed
You have the right to know details such as what personal data we collect about you, who we share it with, how we use it, for what purpose and how long we keep it. We use our privacy notice to explain this.
Right of access (commonly known as a “Subject Access Request”)
You have the right to access and receive a copy of the Personal Data we hold about you.
Right to rectification
You have the right to have any incomplete or inaccurate information we hold about you corrected.
Right to erasure (commonly known as the right to be forgotten)
You have the right to ask us to delete or de-identify your Personal Data.
Right to object to processing
You have the right to object to us processing your Personal Data.
Right to portability
You have the right to ask us to transfer your Personal Data to another party.
Automated decision-making
You have the right not to be subject to a decision based solely on automated processing which will significantly affect you. We may use software to screen CVs and search applications for key words. You have the right to object to this if you consider that your CV or application has been unfairly rejected as a result of the automated decision-making.
Right to complain
You have the right to complain to the relevant supervisory authority, if you are concerned about the way in which we are handling your Personal Data.
The National Privacy Commission is the supervisory authority for the Philippines. They can be contacted at:
5th Floor, Delegation Building
PICC Complex,
Roxas Boulevard, Manila
Metro Manila
If you are in Singapore
If you live in Singapore, we comply with Singapore’s Personal Data Protection Act 2012 (“Singapore’s PDPA”)
You have the following rights in relation to the processing of your Personal Data, including to:
Right to be notified
You have the right to be notified of the purpose for which we intend to collect, use, or disclose your Personal Data and you are also entitled to be provided with information about the ways in which your Personal Data has been used or disclosed during the past year.
Right of access (commonly known as a “Subject Access Request”)
You have the right to access and receive a copy of the Personal Data we hold about you.
Right to rectification
You have the right to have any incomplete or inaccurate information we hold about you corrected.
Right to withdraw consent
If you have provided your consent for us to process your Personal Data for a specific purpose, you have the right to withdraw your consent at any time. If you do withdraw your consent, we will no longer process your information for the purpose(s) you originally agreed to, unless we are permitted by law to do so.
Complaints
If you are concerned about the way in which we are handling your Personal Data, you can contact the Personal Data Protection Commission for Singapore whose contact details are:
The Personal Data Protection Commission
10 Pasir Panjang Road #03-01
Mapletree Business City
Singapore
117438
The Infocomm Media Development Authority of Singapore supports the Commission in administering compliance with the PDPA.
Thailand, United Kingdom and European Union
If you live in Thailand, we comply with Thailand’s Personal Data Protection Act 2019 (“Thailand’s PDPA”).
If you live in the UK, we comply with the UK General Data Protection Regulation (“UK GDPR”).
If you live in the EU, we comply with the EU General Data Protection Regulation (“EU GDPR”).
You have the following rights in relation to the processing of your Personal Data, including to:
Right to be informed
You have the right to know details such as what personal data we collect about you, who we share it with, how we use it, for what purpose and how long we keep it. We use our privacy notice to explain this.
Right of access (commonly known as a “Subject Access Request”)
You have the right to access and receive a copy of the Personal Data we hold about you.
Right to rectification
You have the right to have any incomplete or inaccurate information we hold about you corrected.
Right to erasure (commonly known as the right to be forgotten)
You have the right to ask us to delete or de-identify your Personal Data.
Right to object to processing
You have the right to object to us processing your Personal Data.
Right to restrict processing
You have the right to restrict our use of your Personal Data.
Right to portability
You have the right to ask us to transfer your Personal Data to another party.
Automated decision-making
You have the right not to be subject to a decision based solely on automated processing which will significantly affect you. We may use software to screen CVs and search applications for key words. You have the right to object to this if you consider that your CV or application has been unfairly rejected as a result of the automated decision-making.
Right to withdraw consent
If you have provided your consent for us to process your Personal Data for a specific purpose, you have the right to withdraw your consent at any time. If you do withdraw your consent, we will no longer process your information for the purpose(s) you originally agreed to, unless we are permitted by law to do so.
Right to complain
You have the right to complain to the relevant supervisory authority, if you are concerned about the way in which we are handling your Personal Data.
Thailand’s national supervisory authority is the Personal Data Protection Committee who can be contacted at:
7th Floor, Ratthaprasasanabhakti Building
Government Complex
Chaengwattana Road
Thung Song Hong Sub-District, Lak Si District
Bangkok, Thailand 10210
www.mdes.go.th/mission/82
E-mail: pdpc@mdes.go.th
Tel: +662-142-1033 and +662-141-6993
The UK’s supervisory authority is the Information Commissioner’s Office who can be contacted online at:
Or by telephone on 0303 123 1113
For EU supervisory authorities see the link below:
https://edpb.europa.eu/about-edpb/about-edpb/members_en
If you are in the United States of America
If you are in California
If you live in California, you have the following rights under the California Consumer Privacy Act (“CCPA”), as amended by the California Privacy Rights Act (“CPRA”).
The CCPA (as amended) provides California residents certain rights related to their Personal Data, namely:
Right to know
You have the right to know details such as what Personal Data we collect about you, who we share it with, how we use it, for what purpose and how long we keep it. We use our privacy notice to explain this.
Right of access (commonly known as a “Subject Access Request”)
You have the right to access and receive a copy of the Personal Data we hold about you.
Right to rectification
You have the right to have any incomplete or inaccurate information we hold about you corrected.
Right to erasure (commonly known as the right to be forgotten)
You have the right to ask us to delete or de-identify your Personal Data.
Right to object
You have the right to object to the sale of your Personal Data.
Right to restrict processing
You have the right to request that we limit the use and disclosure of Personal Data that we have about you which is sensitive (as defined in the CPRA).
Rights regarding the sale and sharing of your Personal Data
You have the right to know whether we sell your Personal Data and whether we disclose your data to anyone.
Right against discrimination
You have the right not to be discriminated against for exercising your privacy rights.
Right to portability
You have the right to ask us to transfer your Personal Data to another party.
We do not sell or disclose your Personal Data for monetary gain or any valuable consideration.
The Personal Data we collect about you is set out above under ‘Personal Data we collect’.
Complaints
If you are concerned about the way in which we are handling your Personal Data, you can submit a complaint to your supervisory authority, the California Privacy Protection Agency who can be contacted online at:
California Privacy Protection Agency (CPPA)
Contact Us - California Privacy Protection Agency (CPPA)
If you are in Virginia
If you live in Virginia, from 1st January 2023 you have the following rights under the Consumer Data Protection Act (“CDPA”):
Right to be informed
You have the right to know details such as what personal data we collect about you, who we share it with, how we use it, for what purpose and how long we keep it. We use our privacy notice to explain this.
Right of access (commonly known as a “Subject Access Request”)
You have the right to access and receive a copy of the Personal Data we hold about you.
Right to rectification
You have the right to have any incomplete or inaccurate information we hold about you corrected.
Right to erasure (commonly known as the right to be forgotten)
You have the right to ask us to delete or de-identify your Personal Data.
Right to opt out
You have the right to opt out of us processing your Personal Data for the purposes of targeted advertising and the sale your Personal Data.
Right to portability
You have the right to ask us to transfer your Personal Data to another party.
Automated decision-making
You have the right not to be subject to a decision based solely on automated processing which will significantly affect you. We may use software to screen CVs and search applications for key words. You have the right to object to this if you consider that your CV or application has been unfairly rejected as a result of the automated decision-making.
Right not to be discriminated against for exercising your rights.
Right to appeal if we refuse to process your request to exercise your rights.
Complaints
If you are concerned about the way in which we are handling your Personal Data, you can submit a complaint to the Office of the Attorney General for Virginia who can be contacted at:
202 North Ninth Street
Richmond
VA 23219
Phone: (804) 786-2071
Email: oag@oag.state.va.us
If you are in Colorado
If you live in Colorado, from 1st July 2023 you have the following rights under the Colorado Privacy Act (“CPA”):
Right to be informed
You have the right to know details such as what personal data we collect about you, who we share it with, how we use it, for what purpose and how long we keep it. We use our privacy notice to explain this.
Right of access (commonly known as a “Subject Access Request”)
You have the right to access and receive a copy of the Personal Data we hold about you.
Right to rectification
You have the right to have any incomplete or inaccurate information we hold about you corrected.
Right to erasure (commonly known as the right to be forgotten)
You have the right to ask us to delete or de-identify your Personal Data.
Right to opt out
You have the right to opt out of us processing your Personal Data for the purposes of targeted advertising and for the sale of your Personal Data.
Right to portability
You have the right to ask us to transfer your Personal Data to another party.
Automated decision-making
You have the right not to be subject to a decision based solely on automated processing which will significantly affect you. We may use software to screen CVs and search applications for key words. You have the right to object to this if you consider that your CV or application has been unfairly rejected as a result of the automated decision-making.
Right not to be discriminated against for exercising your rights.
Right to appeal if we refuse to process your request to exercise your rights.
Complaints
If you are concerned about the way in which we are handling your Personal Data, you can submit a complaint to the Office of the Attorney General for Colorado who can be contacted at:
https://coag.gov
Department of Law
Ralph L. Carr Judicial Building
1300 Broadway
10th Floor Denver
CO 80203
Phone: +1 720-508-6000
If you are in Connecticut
If you live in Connecticut, from 1st July 2023 you have the following rights under the Connecticut Act Concerning Personal Data Privacy and Online Monitoring (“CTDPA”):
Right to be informed
You have the right to know details such as what personal data we collect about you, who we share it with, how we use it, for what purpose and how long we keep it. We use our privacy notice to explain this.
Right of access (commonly known as a “Subject Access Request”)
You have the right to access and receive a copy of the Personal Data we hold about you.
Right to rectification
You have the right to have any incomplete or inaccurate information we hold about you corrected.
Right to erasure (commonly known as the right to be forgotten)
You have the right to ask us to delete or de-identify your Personal Data.
Right to opt out
You have the right to opt out of us processing your Personal Data for the purpose of targeted advertising and the sale of your Personal Data.
Right to portability
You have the right to ask us to transfer your Personal Data to another party.
Automated decision-making
You have the right not to be subject to a decision based solely on automated processing which will significantly affect you. We may use software to screen CVs and search applications for key words. You have the right to object to this if you consider that your CV or application has been unfairly rejected as a result of the automated decision-making.
Right not to be discriminated against for exercising your rights.
Right to appeal if we refuse to process your request to exercise your rights.
Complaints
If you are concerned about the way in which we are handling your Personal Data, you can submit a complaint to the Office of the Attorney General for Connecticut who can be contacted at:
Connecticut Office of the Attorney General
165 Capitol Avenue
Hartford, CT 06106
Email: Attorney.General@ct.gov
Phone: 860-808-5318.
If you are in Utah
If you live in Utah, from 31st December 2023 you have the following rights under the Utah Consumer Privacy Act (“UCPA”):
Right to be informed
You have the right to know details such as what personal data we collect about you, who we share it with, how we use it, for what purpose and how long we keep it. We use our privacy notice to explain this.
Right of access (commonly known as a “Subject Access Request”)
You have the right to access and receive a copy of the Personal Data we hold about you.
Right to erasure (commonly known as the right to be forgotten)
You have the right to ask us to delete or de-identify your Personal Data.
Right to opt out to processing
You have the right to opt out of us processing your Personal Data for the purposes of targeted advertising or sale of Personal Data.
Right to portability
You have the right to ask us to transfer your Personal Data to another party.
Automated decision-making.
You have the right not to be subject to a decision based solely on automated processing which will significantly affect you. We may use software to screen CVs and search applications for key words. You have the right to object to this if you consider that your CV or application has been unfairly rejected as a result of the automated decision-making.
Right not to be discriminated against for exercising your rights.
Complaints
If you are concerned about the way in which we are handling your Personal Data, you can submit a complaint to the Office of the Attorney General for Utah who can be contacted at:
Consumer Protection (utah.gov)
Phone: (801) 530-6601
Toll-Free in UT:
(800) 721-7233
Email: consumerprotection@utah.gov
Mailing Address:
PO Box 146704
Salt Lake City, UT 84114-6704
Physical Address:
160 East 300 South
Salt Lake City, UT 84111
If you are in Vietnam
If you live in the Vietnam, we comply with the Law on Cyber Information Security No.86/2015/QH13 (19 November 2015) (“LCS”) and all other applicable Vietnamese laws on data protection.
You have the following rights in relation to the processing of your Personal Data, including to:
Right to be informed
You have the right to know details such as what personal data we collect about you, who we share it with, how we use it, for what purpose and how long we keep it. We use our privacy notice to explain this.
Right of access (commonly known as a “Subject Access Request”)
You have the right to access and receive a copy of the Personal Data we hold about you.
Right to rectification
You have the right to have any incomplete or inaccurate information we hold about you corrected.
Right to erasure (commonly known as the right to be forgotten)
You have the right to ask us to delete your Personal Data.
Right to object/opt-out
You have the right ask us to stop providing your Personal Data to a third party.
Complaints
If you are concerned about the way in which we are handling your Personal Data, you can contact the Ministry of Information and Communications for Vietnam whose contact details are:
Ministry of Information and Communications
18 Nguyen Du Street
Hang Bai Ward
Hoan Kiem District
Hanoi
Vietnam
12. Children’s Privacy
We do not offer our services to children and we do not knowingly collect Personal Data of children without parental consent, unless permitted by law.
13. How to contact us and our Data Protection Officer
If you wish to contact us or our Data Protection Officer (“DPO”) in relation to this privacy notice or if you wish to exercise any of your rights outlined above, please contact us as follows:
FAO the ‘Data Protection Officer’, Old Church House, Sandy Lane, Crawley Down, Crawley, West Sussex, England RH10 4HS.
Email dataprotection@empresaria.com
Please mark your communications FAO the ‘Data Protection Officer’.
14. Changes to this privacy notice
We may update this notice (and any supplemental privacy notice), from time to time as shown below. We will notify of the changes where required by applicable law to do so.
Last modified May 2024
Previous versions of this notice are available upon request as per the contact details above.
If you wish to exercise any of the rights set out above, please contact us at dataprotection@empresaria.com