PRIVACY POLICY & GDPR CANDIDATE AGREEMENT

Updated: April 2018

Thomson Legal Recruitment Company Limited is committed to protecting and respecting your privacy. This policy sets out the basis on which any data we collect from you (or that you provide directly to us) will be processed. 

Definitions

In this policy the following terms have the following meanings:

• ‘Consent’ means any freely given, specific, informed and unambiguous indication of an individual’s wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of persona data relating to him or her.
• ‘Data controller’ means an individual or organisation which, alone or jointly with others, determines the purposes and means of the processing of personal data.
• ‘Data processor’ means an individual or organisation which processes personal data on behalf of the data controller.
• ‘Personal data’ means any information relating to an individual who can be identified, such as by a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.
• ‘Personal data breach’ means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data.
• ‘Processing’ means any operation or set of operations performed on personal data, such as collection, recording, organisation, structuring, storage (including archiving), adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.
• ‘Profiling’ means any form of automated processing of personal data consisting of the use of personal data to evaluate certain personal aspects relating to an individual, in particular to analyse or predict aspects concerning that natural person’s performance at work, economic situation, health, personal preferences, interests, reliability, behaviour, location or movements.
• ‘Pseudonymisation’ means the processing of personal data in such a manner that the personal data can no longer be attributed to an individual without the use of additional information, provided that such additional information is kept separately and is subject to technical and organisational measures to ensure that the personal data are not attributed to an identified or identifiable individual.
• ‘Sensitive personal data’ means personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data, data concerning health, an individual’s sex life or sexual orientation and an individual’s criminal convictions.
• ‘Supervisory authority’ means an independent public authority which is responsible for monitoring the application of data protection. In the UK the supervisory authority is the Information Commissioner’s Office (ICO).

Data Protection Principles Explained 

 The Data Protection Laws require Thomson Legal Recruitment Company acting as either data controller or data processor to process data in accordance with the principles of data protection under GDPR. These require that personal data is:

• Processed lawfully, fairly and in a transparent manner.
• Collected for specified and legitimate purposes and not further processed in a manner that is incompatible with those purposes.
• Adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed.
• Accurate and kept up to date- every reasonable step must be taken to ensure that personal data that are inaccurate, having regard to the purposes for which they are processed, are erased or rectified without delay.
• Kept for no longer than is necessary for the purposes for which the personal data are processed.
• Processed in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures.
• The data controller shall be responsible for, and be able to demonstrate, compliance with these principles.

All organisations that process personal data are required to comply with data protection legislation.  This includes in particular the Data Protection Act 1998 (or its successor) and the EU General Data Protection Regulation (together the ‘Data Protection Laws’).  The Data Protection Laws give individuals (known as ‘data subjects’) certain rights over their personal data whilst imposing certain obligations on the organisations that process their data.

The General Data Protection Regulation (GDPR) (Regulation (EU) 2016/679) replaces the Data Protection Regulation (Directive 95/46/EC) The Regulation covers data protection legislation across the EU and priorities privacy rights for individuals via a strict framework.

About Thomson Legal Recruitment Company Limited

Thomson Legal Recruitment Company Limited (company registration SC483816) is a specialist legal recruitment agency/business as defined in the Employment Agencies and Employment Businesses Regulations 2003. We are a data controller for the purposes of the Data Protection Laws. Thomson Legal Recruitment Company Limited takes privacy very seriously and we are registered with the Information Commissioner’s Office.

We collect personal data of the following types of individuals to allow us to undertake our core recruitment business activities. 

• Prospective & placed candidates for permanent or fixed-term positions/ appointments. 
• Prospective and existing live client contacts (predominately supporting them on resourcing requirements and market sector information).
• Thomson Legal Recruitment Company Limited’s employees. 

Information We Collect on You

We collect data that you have provided us via correspondence with us. This may be by telephone, email, social media or registering/ signing up for our newsletter on our website: www.thomsonlrc.com. 

This information you provide to us or we collect about you may include:

• Name.
• Address.
• Job position and employer.
• Qualification details. 
• Personal telephone number.
• Personal & professional email address and telephone number.
• Employment preferences.
• Compliance documentation.
• Your professional profile that are available in the public domains such as corporate websites and social media. 

When you visit our website we automatically collect the following information:

• Internet protocol (IP) address, login information if applicable, browser type and version.
• Information about your visit, including the full Uniform Resource Locators (URL), vacancies or articles you viewed or searched for.
• Page response times, errors, length of visits to pages, page interaction information methods used to browse away from the page. 

If you require further information on our website terms of use or services, please email us at: info@thomsonlrc.com.

Information Obtained from Other Sources

This is information we obtain about you from other sources such as social media websites such as LinkedIn, corporate websites, job board websites, online CV libraries, your business card, presentations and recommendations. In this case we will inform you, by sending you this privacy notice, within a month of collecting the data of the fact we hold personal data about you, the source the personal data originates from and whether it came from publicly accessible sources, and for what purpose we intend to retain and process your personal data.

Thomson Legal Recruitment Company Limited has implemented measures with the aim of adequately protect the privacy of individuals and ensures that data protection is integral to all processing activities. This includes:

• Data minimisation (we endeavour not to keep data for longer than is necessary).
• Pseudonymisation (where requested).
• Anonymisation (where requested). 
• Cyber security and protection. 

Purposes of the Processing/ Legal Basis for the Processing

The core service we offer to our candidates and clients is the introduction of candidates to our clients for the purpose of permanent or fixed-term recruitment engagement.  However, our services also include advising on strategy, advising candidates on career development and providing up to date and relevant market information (such as remuneration, rankings and structure) on the legal sector to both candidates and clients. 

Our legal basis for the processing of personal data is our legitimate business interests, described in more detail below. However, we will also rely on contract, legal obligation and consent for specific uses of data as detailed below:

Contract

We will rely on contract if we are negotiating or have entered into a placement agreement with you or your organisation or any other contract to provide services to you or receive services from you or your organisation.

Legal Obligation

We will rely on legal obligation if we are legally requires to hold information on to you to fulfil our legal obligations.

Consent 

We will in some circumstances rely on consent for particular uses of your data and you will be asked for your express consent, if legally required.  Consent may be the lawful basis for processing when we request your permission as a candidate to introduce you to a client.

Legitimate Business Interests

As a legal recruitment agency or core business function is introducing candidates to clients for permanent or fixed-term employment. The exchange of personal data (such as your CV or your profile) of our candidates and our client contacts is a fundamental, essential part of our process and services.

• Thomson Legal Recruitment Company Limited uses a database of candidate and client personal data containing historical information (such as placement details) as well as the active resourcing requirements of our clients. 
• To maintain, expand and develop our business we need to record the personal data of prospective candidates and client contacts.
• To deliver our services we need to contact candidates on a regular basis, through various routes such as email, phone, social media, job alerts and other relevant notifications.

Should we want or need to rely on consent to lawfully process your data we will request your consent orally, by email or by an online process for the specific activity we require consent for and record your response on our system. Where consent is the lawful basis for our processing you have the right to withdraw your consent to this particular processing at any time.

Other Uses we will Make of Your Data:

• Analysis of visits to our website and activity. For website administration including troubleshooting, data analysis, testing, research, statistical, website safety, security and survey data.
• Accounts and records.
• Advertising, marketing and PR. 
• To notify you about changes to our services.
• To allow you to participate in any interactive features of our website should you choose to participate (for example, candidate portals or job alerts).
• For Job advertisement response analysis and to make recommendation to our website user about our services. 

Cookies

Our website uses cookies to distinguish you from other users of our website. This helps us to provide you with a good experience when you browse our website and also allows us to improve our website. We use these to identify and track visitors, their usage of the website, their access preferences and for advertising. 

Disclosure of Your Information Inside and Outside of the EEA

As part of our core recruitment business function we may disclose your information to selected third parties which may include:

• Candidates- for example, providing vacancy information, setting up interviews and communication of offers. 
• Clients- for example, introducing candidates to our clients for the purposes of assisting with their resourcing needs.
• Clients, business partners, suppliers and sub-contractors for the performance and compliance obligations of any contract we enter into with them or you.
• Analytics and search engine providers that assist us in the improvement and optimisation of our website. 
• If we are under a duty to disclose or share your personal data in order to comply with any legal obligation, or in order to enforce or apply our terms of use or terms and conditions of supply of services and other agreements; or to protect the rights, property, or Thomson Legal Recruitment Company Limited and/or our clients and candidates. This may include exchanging information with other companies and organisations for the purposes of fraud protection and credit risk reduction. 

The lawful basis for the third-party processing will include:

• Legitimate business interests in processing your personal data such as fulfilling clients resourcing requirements. 
• Satisfaction of their contractual obligations to us as our data processor.
• For the purpose of a contract in place or in contemplation.
• To fulfil their legal obligations.

Where we Store and Process Your Personal Data

All information you provide to us is stored on our secure servers. Where we have given you (or where you have chosen) a password which enables you to access our candidate portal, you are responsible for keeping this password confidential. 

Thomson Legal Recruitment Company Limited aims to always protect your personal data, however we cannot guarantee the security of your data transmitted to our site; any transmission is at your own risk. Once we have received your information, we will use strict procedures and security features to try to prevent unauthorised access.

Retention of Your Data

We understand our legal duty to retain accurate data and only retain personal data for as long as we need it for our legitimate business interests and that you are happy for us to do so.  Accordingly, we have a data retention notice and run data routines to remove data that we no longer have a legitimate business interest in maintaining.

We do the following to try to ensure our data is accurate:

• Our website enables you to manage your data and to review whether the details we hold about you are accurate.
• Prior to making an introduction (to a client or a candidate) we check that we have accurate information about you.
• We aim to keep in touch with you so you can let us know of changes to your personal data.
• We segregate our data so that we keep different types of data for different time periods. 

The criteria we use to determine whether we should retain your personal data includes:

• The nature of the personal data.
• Its perceived accuracy.
• Our legal obligations.
• Whether an interview or placement has been arranged; and
• Our recruitment expertise and knowledge of the industry by country, sector and job level/role.

We may archive part or all of your personal data or retain it on our financial systems only, deleting all or part of it from our main Customer Relationship Manager (CRM) system. We may pseudonymise parts of your data, particularly following a request for suppression or deletion of your data, to ensure that we do not re-enter your personal data on to our database, unless requested to do so. For your information, Pseudonymised Data is created by taking identifying fields within a database and replacing them with artificial identifiers, or pseudonyms. Our current retention notice is available upon request.  

Automated Decision-Making

Thomson Legal Recruitment Company do not subject individuals to decisions based on automated processing that produce a legal effect or a similarly significant effect on the individual, except where the automated decision:

• Is necessary for the entering into or performance of a contract between the data controller and the individual.
• Is authorised by law.
• The individual has given their explicit consent.

Thomson Legal Recruitment Company Limited use recruitment software to search and identify personal data in accordance with parameters set by a person.  A person will always be involved in the decision-making process and we do not use automated selection tools. 

Your Rights 

You have the right to ask us not to process your personal data for marketing purposes. We will usually inform you (before collecting your data) if we intend to use your data for such purposes or if we intend to disclose your information to any third party for such purposes and we will collect express consent from you if legally required prior to using your personal data for marketing purposes.

You can exercise your right to accept or prevent such processing by checking certain boxes on the registration forms we use to collect your data. You can also exercise the right at any time by contacting us at: info@thomsonlrc.comor calling us on +44 (0) 141 244 0260 or +353 (0) 1 699 1360. 

Our site may, from time to time, contain links to and from the websites of our partner networks, advertisers and affiliates. If you follow a link to any of these websites, please note that these websites have their own privacy policies and that we do not accept any responsibility or liability for these policies. Please check these policies before you submit any personal data to these websites.

GDPR provides you with the following rights:

• Request correction of the the personal information that we hold about you. This enables you to have any incomplete or inaccurate information we hold about you corrected.
• Request erasure of your personal information. This enables you to ask us to delete or remove personal information where there is no good reason for us continuing to process it. We cannot keep a record of individuals whose data it has erased so the individual may be contacted again by us come into possession of the individual’s personal data at a later date.
• You also have the right to ask us to delete or remove your personal information where you have exercised your right to object to processing:
• Object to processing of your personal information where we are relying on a legitimate interest (or those of a third party) and there is something about your particular situation which makes you want to object to processing on this ground. You also have the right to object where we are processing your personal information for direct marketing purposes.
• Request the restriction of processing of your personal information. This enables you to ask us to suspend the processing of personal information about you, for example if you want us to establish its accuracy or the reason for processing it.

If Thomson Legal Recruitment Company Limited has given the personal data to any third parties it will inform those third parties that it has received a request to erase the personal data unless this proves impossible or involves disproportionate effort. Those third parties should also rectify the personal data they hold - however we will not be in a position to audit those third parties to ensure compliance.

Data Breaches

 All data breaches should be referred to Mary Ann Thomson, Director & Data Protection Officer (maryann@thomsonlrc.com) 

Data breaches where Thomson Legal Recruitment Company is acting as the data controller:

• We will take steps to contain and recover the breach. Where a personal data breach is likely to result in a risk to the rights and freedoms of any individual, we will also notify the ICO (Where the personal data breach happens outside the UK, DPS shall alert the relevant supervisory authority for data breaches in the effected jurisdiction).

Data breaches where Thomson Legal Recruitment Company Limited is the data processor:

• We will alert the relevant data controller as to the personal data breach as soon as they are aware of the breach- in the event of any breach resulting in a high risk to the rights and freedoms of any individual all affected individuals will be contacted without undue delay.

Thomson Legal Recruitment Company Limited will not be required to tell individuals about the personal data breach in circumstances where:

• We have implemented appropriate technical and organisational protection measures to the personal data affected by the breach, in particular to make the personal data unintelligible to any person who is not authorised to access it, such as encryption.
• We have taken subsequent measures which ensure that the high risk to the rights and freedoms of the individual is no longer likely to materialise.
• It would involve disproportionate effort to tell all affected individuals. In this situation we would endeavour to make a public communication or similar measure to tell all affected individuals.

The Human Rights Act 1998

 All individuals have the following rights under the Human Rights Act 1998 and in dealing with personal data these should be respected at all times:

• Right to respect for private and family life (Article 8).
• Freedom of thought, belief and religion (Article 9).
• Freedom of expression (Article 10).
• Freedom of assembly and association (Article 11).
• Protection from discrimination in respect of rights and freedoms under Act (Article 14).

Complaints Process

To make a complaint to Thomson Legal Recruitment Company Limited you may contact the Data Protection Officer: Mary Ann Thomson, Director and DPO: Telephone +44 (0) 141 244 0260 or email: maryann@thomsonlrc.com.  You can also make a complaint to a supervisory body which in the United Kingdom is the Information Commissioner’s Office. The ICO can be contacted through this link:  https://ico.org.uk/concerns/or alternatively you can contact them on: +44 0303 123 1113.

Response Timing

It is Thomson Legal Recruitment Company Limited’s intention to act upon any subject access request or a request relating to rectification, erasure, restriction, data portability or objection or automated decision-making processes or profiling within one month of receipt of the request. We may opt extend this by a reasonable period where necessary, taking into account the investigation complexity and the volume of requests.  Where we consider that a request under this section is of an unfounded or excessive nature, we may choose to refuse to act on the request or to charge a reasonable fee taking into account relevant administrative costs involved.

Access to Information  

The Data Protection Act 1998 and the GDPR give you the right to access information held about you.  A subject access request should be submitted to info@thomsonlrc.com. 

Changes to our Privacy Policy 

Any changes we make to our privacy policy in the future will be posted on the privacy page on our website and, where appropriate, notified to you by e-mail. 

Contact 

If you have any questions and/ or requests regarding our privacy policy, these should be emailed to: David Thomson, Director, Thomson Legal Recruitment Company Limited: +44 (0) 141 244 0260 or +353 (0) 1 699 1360 or email: david@thomsonlrc.com.