Privacy Policy - HBD Partners

Hotel Recruitment Services Ltd. trading as HBD Partners Privacy Policy

This privacy policy applies to any individual visitors to, and users of, our website whose personal data is collected by us during its use; applicants for any type of job or engagement via us whose personal data is collected during our services; referees of Candidates whose personal data is collected in the course of our verification of a Candidate; individuals who work for, or are engaged by, our customers, clients or suppliers whose personal data is collected in the course of our work with them. We refer to the above groups of individuals collectively as “you” unless the context dictates otherwise. We may change this privacy policy from time to time to reflect changes in the law and/or our personal data handling activities and data protection practices.

It is important that the personal data we hold about you is accurate and current. Please keep us informed if your personal data changes during your relationship with us.

Hotel Recruitment Services Limited trading as HBD Partners (HBD) is a specialist professional recruitment consultancy placing candidates on a permanent, contract and interim basis in the hospitality, travel and leisure sectors internationally.

HBD will be the primary data controller of your personal data. The applicable data controller will be referred to as “we”, “us”, “our” from now on within this privacy policy.

When this privacy policy does not apply

There are instances where HBD act on behalf of a client to process personal data rather as the data controller. For example, where processing interview feedback or timesheets. The privacy policy or privacy notice of the client will apply in those instances and NOT this privacy policy. Where we are a data processor, we will refer you to the applicable data controller and their privacy policy if you have any data protection-related queries.

Do we have a Data Protection Officer?

We have appointed a Data Protection Officer (DPO) who is responsible for overseeing questions in relation to this privacy policy. If you have any questions about this privacy notice, including any requests to exercise your legal rights relating to your personal data, please contact the DPO using the details set out below.

How to get hold of us and our DPO

You can contact us and our DPO for any data related query or make a complaint about how your personal data is being handled using the details below:

Email address: mark@hbdpartners.co.uk;
Telephone number: +44 (0) 20 3771 9822;
Postal address: Ground Floor, Prospect House, 30 St George’s Road, London SW19 4BD, marking it for the attention of the “Data Protection Officer.”

The applicable data controller will largely be the entity involved in the collection and handling of your personal data. The following other parties may be involved, however we may instruct third parties to assist us to collect and handle your personal data on our behalf. Those third parties will carry out those activities in accordance with this policy.

Personal Data

Personal data means “any information relating to an identified or identifiable individual”.

It does not, therefore, include data where the identity has been removed (anonymous data).

We will collect and handle, process, use, store, share and transfer (generically referred to as handling) the different kinds of personal data about you that is listed under the name of the category of individual that applies to you. Please note, that even though a type of data may be collected, it does not mean that it is collected or retained.

Candidate Data:

Identity Data, which includes your title, first name, last name, maiden name, date of birth, gender, photograph, national insurance number (or equivalent in your country), nationality and other information relating to residency and citizenship which may be required to establish a right to work in a given country, marital status and number of dependents;
Contact Data, which includes your billing address, delivery address, email address and telephone numbers, emergency contact details and contact details history;
Historical Data, which includes educational history and credentials, employment history, skills and qualifications, and results from any other background and disclosure checks in countries where it is lawful to carry out such checks;
Employment-related Data, which includes your current remuneration, pension and benefits, what role you are looking for, what work-related areas interest you, third party references (if taken) and interview and assessment feedback created by us;
Verification Data, which includes a copy of your driving licence, passport, identity card or another form of identification and referee details; and
Other Data– The above list of personal data is not exhaustive. You, your referees or third-party sources may tell us extra information that we have not listed above.

Referees and Corporate Staff:

Identity Data
Contact Data

We do not intentionally collect personal data relating to children.

In respect of Candidates only, we also handle the following types of data:

Aggregated Data, such as statistical or demographic data for any purpose. Aggregated Data may be derived from your personal data but is not considered personal data in law as this data does notdirectly or indirectly reveal your identity. However, if we combine or connect Aggregated Data with your personal data so that it can directly or indirectly identify you, we treat the combined data as personal data which will be used in accordance with this privacy policy; and
Anonymised Data, which is data created from your personal data where your identity has been removed.

Personal Data Sourcing

CANDIDATES: we generally collect your personal data directly from you. If you don’t provide certain information to us, we may not be able to carry out the services for you. We’ll make it clear to you which personal data is optional to provide and which personal data without which we cannot work with you.

For example, we collect your personal data when you:

Deal with us in person, by telephone, letter, fax, email or via our website
Register with us
Submit any other information to us, such as a CV
If you complete psychometric assessments or other assessments
Subscribe to job alerts emails
Give us feedback

We also use the following channels to collect your personal data:

Third parties –
Your Identity and Historical Data from:

Your referees;
Your past educators and employers and relevant education authorities
- We will obtain your consent to contact such third parties to collect this type of your personal data.
Third party suppliers, including other recruitment and employment agencies, job board providers and job aggregators;

All of your personal data where you were referred to us through a third-party employment agency;

Publicly available sources –we may receive personal data about you from public sources as set out below:
Your Identity and Historical Data from social media sites, such as LinkedIn, Twitter and Facebook;
Your Identity, Contact Data from company and commercial registrars or electoral registers based inside the EU; and
Your Identity, from qualification and membership lists of professional bodies.

REFEREES: we will collect all of your personal data from a Candidate.

What do we do with your personal data?

We will only use your personal data when the law allows us to. Most commonly, we will use your personal data in the following circumstances:

where we need to perform the contract, we are about to enter or have entered into with you;
where it is necessary for our legitimate interests (or those of a third party), and your interests and fundamental rights do not override those interests; and
where we need to comply with a legal or regulatory obligation.

We set out below some general examples of what we do with your personal data.

CANDIDATES: your personal data will be collected and handled by us in order to:

Provide recruitment and/or related intermediary services to or for you;
Match your details against job vacancies which we feel may be appropriate for you in order to assess your suitability for them;
Allow you to submit your CV, apply for specific jobs or to subscribe to our job alerts so that we can notify you when relevant job vacancies arise;
Apply for jobs on your behalf by sending your data to clients;
Facilitate the recruitment process from there, if the client wishes to progress with you;
Inform you about any relevant industry developments, send you details of any events, promotions and competitions, and to communicate any other relevant information;
Answer your enquiries or questions;
Statistical analysis;
Diversity monitoring;
Comply with our regulatory commitments;
Pursue or defend a legal claim; and
To provide you with further information which may be of interest to you in regard to the employment market and opportunities.

Marketing preferences – where you tell us you are happy to receive information from us or have purchased products or services from us, we will send you communications which may include the following:

E-newsletters and hard copy newsletters;
Emails about the services we offer; and
Opportunities to participate in market research.

Depending on the contact preferences you select, we will communicate with you by post, telephone, SMS, email or other electronic means such as via social and digital media.

REFEREES: we will use your personal data purely to verify a Candidate.

Other use related information

Opting out/withdrawing consent – you can ask us to stop sending you promotional or marketing messages at any time by contacting us at any time.

Change of purpose – we will only use your personal data for the purposes for which we collected it unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose. If you would like us to explain how the handling of the new purpose is compatible with the original purpose, please contact us.
If we need to use your personal data for an unrelated purpose, we will notify you, and we will explain the legal basis which allows us to do so.

Who do we share your personal data with?

We may share your personal data with the following entities:

Prospective employers or engagers;
Other recruitment companies or intermediaries involved in managing the supply of personnel;
Your referees;
Your past educators and employers and relevant education authorities;
Your professional bodies;
The third-party suppliers, including other recruitment and employment agencies, job board providers and job aggregators and our managed service providers who are within our supply chain;
Those types of entities listed in Appendix 1; and
Third parties to whom we may choose to sell, transfer, or merge parts of our business or our assets. Alternatively, we may seek to acquire other businesses or merge with them. If a change happens to our business, then the new owners may use your personal data in the same way as set out in this policy.

We do not allow our third-party service providers to use your personal data for their own purposes and only permit them to process your personal data for specified purposes and in accordance with our instructions, which includes this privacy policy.

What are the legal grounds for our collection, handling, use and sharing of your personal data?

COLLECTION, HANDLING AND USAGE:

Purpose/Activity:

Background Checks, Job Search and placement.

Type of Personal Data:

Personal data described in Section 4 above.

Legal Basis for collection, handling and usage:

Legitimate Interest. We believe it is reasonable to expect that if you are looking for employment or have posted your professional CV information on a job board or professional networking site, you are happy for us to collect and otherwise use your personal data to offer or provide our recruitment services to you, share that information with prospective employers and assess your skills against our bank of vacancies. Once it’s looking like you may get the job, your prospective employer may also want to double check any information you’ve given or to confirm your references, qualifications and criminal record, to the extent that this is appropriate and in accordance with local laws. We also believe that you will expect us to have an ongoing relationship over a number of years and will continue to hold your data providing that we retain reasonable periodic contact with you or until you inform us otherwise. We need to do these things so that we can function as a profit-making business, and to help you and other Candidates get the jobs you deserve.

SHARING

Third Entity with whom personal data is shared:

Third Party Service Providers to us including without limitation:
·         External consultants, professional advisors and business associates
·         Outsourced IT and document storage providers
·         Software as a services providers
·         Job board and aggregators
What personal data is shared:
Personal data described in Section 4 above.
Purpose of sharing:
In connection with our recruitment service provision.
Legal Basis for sharing:
Legitimate Interest.

Entity with whom personal data is shared:

Referees and other individuals and organisations who hold information related to reference or application to work.
What personal data is shared:
Verification Data.
Purpose of sharing:
Verification of information provided to ensure you are successful in any roles that our candidates are successful in obtaining.
Legal Basis for sharing:
Legitimate Interest.

Entity with whom personal data is shared:

If our group merges with or is acquired by another business or company in the future, (or is in meaningful discussions about such a possibility), we may share your personal data with the (prospective) new owners of the business or company.
What personal data is shared:
Personal data described in Section 4 above.
Purpose of sharing:
To ensure continued provision of recruitment and associated services to you.
Legal Basis for sharing:
Legitimate Interest.

Entity with whom personal data is shared:
Marketing technology platforms and suppliers.
What personal data is shared:
Personal data described in Section 8 above.
Purpose of sharing:
In connection with our recruitment service provision.
Legal Basis for sharing:
Legitimate Interest.

Entity with whom personal data is shared:
Potential employers and other clients of ours who can offer your role within their organisation.
What personal data is shared:
Personal data described in Section 4 above.
Purpose of sharing:
To assist you in gaining a new role.
Legal Basis for sharing:
Legitimate Interest.

Where do we send your personal data to for storage or other specific purposes?

We will not typically transfer your personal data outside the EEA. The personal data we collect from you may be transferred outside the EEA either by us and/or by any of the third parties to whom your personal data may be disclosed to as listed in Section 9. Such transfers will occur only where they are necessary as part of the recruitment and/or related intermediary services we provide, e.g. where you apply for a vacancy or position outside the EEA, or where the transfer is authorised by law.

We, our third party data storage providers and/or the third parties to whom we may disclose your personal data may store your personal data on a server overseas.

If we do transfer your personal data outside the EEA, we’ll make sure that suitable safeguards are in place, for example by using approved contractual agreements, unless certain exceptions apply, or we are authorised to do so.

How will we look after your personal data?

We hold your personal data in a combination of secure computer storage facilities and paper-based files. We put in place an appropriate level of security around your personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage to it.

We shall implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk of harm that might result from, unauthorised or unlawful processing accidental or unlawful loss, destruction or alteration, unauthorised (or disclosure of) access or damage to your personal data including:

Locks and security systems;
Usernames and passwords; and
Virus checking;

We limit access to your personal data to those employees, agents, contractors and other third parties who have a business need to know. They will only process your personal data on our instructions and via the access controls listed above. They are also subject to a duty of confidentiality.

We have agreed on security-related measures with the third parties we share your personal data with to ensure that it is treated by those third parties in a way that is consistent with how we safeguard your personal data.

We have also put in place procedures to deal with any suspected personal data breach and will notify you and any applicable supervisory authority where we are legally required to do so. If you suspect any misuse or loss of or unauthorised access to your personal data, please let us know immediately by contacting us.

How long will we keep your personal data for?

We will only retain your personal data for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements.

We will appropriately and securely dispose of your personal data when it is no longer required.

To determine the appropriate retention period for personal data, we consider the following factors:

Amount and nature of the personal data;
It’s sensitivity;
The potential risk of harm from unauthorised use or disclosure of the personal data;
The purposes for which we handle your personal data;
Whether we can achieve those purposes through other means; and
The applicable legal requirements.

Based on those factors, we have determined that the following retention periods should apply in respect of personal data of the following categories of individuals (unless the law or any data supervisory authority or regulator requires otherwise):

Placed Candidates – where we placed you with one of our clients, we will keep your personal data for as long as you continue your placement or are actively looking for another one through us.

We will stay in regular contact with you. However, if this is not possible, we will continue to process your personal data in the usual manner for up to 2 years from the last meaningful contact we had with you (or such longer period which we believe in good faith circumstances and the law allows for legitimate interest to continue). Meaningful contact may include a consultant contacting you directly by phone or you may receive an email from us reminding you that we hold your personal information and asking you to let us know if you are no longer interested in hearing about new opportunities.

After this time your personal data will no longer be immediately accessible from our live systems or will be archived. If after a further year you or we have not re-established communication your personal data that we hold will be deleted other than basic identification information and information relating to placements which you have been engaged on through us. We hold this information for 7 years from the end of the last time we placed you. We hold this information in case there is a legal claim.

Non-placed Candidates –If we did not manage to place you we will continue to process your personal data in the usual manner for up to 2 years from the last meaningful contact we had with you (or such longer period which we believe in good faith circumstances and the law allows for legitimate interest to continue).

After this time your personal data will no longer be accessible from our live systems. If after a further year you or we have not re-established communication your personal data that we hold will be deleted.

In either of the case where we have placed a candidate or not, where we believe that the holding of your personal data no longer constitutes a legitimate interest, we will delete it to the extent necessary.

Referees – we will keep your personal data for as long as the Candidate for whom you were a referee is placed with one of our customers. If they move on from that position, we will keep your personal data for a further 2 years after that date.

Corporate Staff –we will keep your personal data for as long as the entity that you work for is connected to us in any way. Where we end our relationship with that entity for any reason, we will keep your personal data for a further 7 years after that date.

We will keep and use Anonymised Data indefinitely without further notice to you.

Keeping your personal data up to date

We take reasonable steps to ensure that your personal data is accurate, complete and up to date.

We may contact you from time to time to check that the personal data is still correct.

Please let us know of any changes to your details as soon as you reasonably can so that we can uphold our commitment to accuracy, completeness and currency.

What are your legal rights in respect of your personal data that we handle?

We set out below a list of the legal rights that all individuals have under data protection laws in relation to our handling of your personal data. They don’t apply in all circumstances:

Right to be informed– about your personal data and details of the handling and processing of that personal data and information, including the safeguards used to protect any of your personal data if we transfer it outside the EEA;
Right of access– to your personal data and to obtain information about how we handle and process it;
Right to have inaccuracies corrected – this is a right to have your personal data corrected if it is inaccurate and to have incomplete personal data completed;
Right of erasure– of your personal data, which is also known as the “right to be forgotten”;
Right to restrict handling and processing– of your personal data, which includes requesting us to suppress your personal data file;
Right to move, copy or transfer – your personal data to another organisation, also known as “data portability”;
Right to object– to the handling and processing of your personal data for certain purposes, to personal data processed for direct marketing purposes and to personal data that is handled and processed for certain reasons based on our legitimate interests;
Right to withdraw consent– you may withdraw any consent or permission that you have previously provided to us in relation to our handling and processing of your personal data, such as for the purposes of marketing by electronic means;
Rights in relation to automated decision making– where such automated decision making has a legal effect on you or otherwise significantly affects you; and
Right to complain– in all circumstances, you may complain to:
us in relation to the handling of your personal data; or
the regulatory body which enforces data protection law in your locality.

Procedure to exercise your legal rights

Contact us– if you wish to exercise any of your legal rights, please contact us. In this instance, we’ll explain first whether or not the right you wish to exercise applies. We will then facilitate your request in accordance with the procedure below if it does apply.
Fees– you will not have to pay a fee to access your personal data or to exercise any other rights that apply. We may, however, charge a reasonable fee if your request is clearly unfounded, repetitive or excessive. Alternatively, we may refuse to comply with your request in these circumstances.
Our request for further information– we may need to request certain information from you to help us confirm your identity and ensure that your right to access your personal data (or to exercise any of your other rights that apply). This is a security measure to ensure that any personal data is not disclosed to any person who has no right to receive it. We may also contact you to ask you for further information in relation to your request to speed up our response.
Response time– we will respond to all legitimate requests as soon as we can. It should not take longer than a month to do so. Occasionally, it may take us longer than a month if your request is particularly complex or you have made a number of requests. In this case, we will notify you and keep you updated.

Appendix 1 – Third party service providers

Data storage providers – we store our data with a data storage provider