Articles

Privacy Policy

Calibre Search Ltd & Calibre Search (Manchester) Ltd (‘the Company’)

Data Protection Policy

11/04/18

Version 1

Contents

• Introduction
• Definitions
• Data processing under the Data Protection Laws

1. The data protection principles
2. Legal bases for processing
3. Privacy by design and by default

• Rights of the Individual
  1. Privacy notices
  2. Subject access requests
  3. Rectification
  4. Erasure
  5. Restriction of processing
  6. Data portability
  7. Object to processing
  8. Enforcement of rights
  9. Automated decision making
• Personal data breaches
  1. Personal databreaches where the Company is the data controller
  2. Personal databreaches where the Company is the data processor
  3. Communicating personal data breaches to individuals
• The Human Rights Act 1998
• How we collect and use your data at calibresearch.co.uk
• Complaints or suggestions

Introduction

At Calibre Search, protecting your privacy is very important to us. Our goal is to treat the personal information you provide to us with the utmost respect, and in accordance with this Privacy Policy. This Privacy Policy explains how personal information about you may be collected, used, or disclosed as a consequence of your activities on this Site. We urge you to read it carefully.

All organisations that process personal data are required to comply with data protection legislation. This includes in particular the Data Protection Act 1998 (or its successor) and the EU General Data Protection Regulation (together the ‘Data Protection Laws’). The Data Protection Laws give individuals (known as ‘data subjects’) certain rights over their personal data whilst imposing certain obligations on the organisations that process their data.

As a recruitment business the Company collects and processes both personal data and sensitive personal data. It is required to do so to comply with other legislation. It is also required to keep this data for different periods depending on the nature of the data.

This policy sets out how the Company implements the Data Protection Laws. It should be read in conjunction with the Data Protection Procedure.

Definitions

In this policy the following terms have the following meanings:

‘consent’ means any freely given, specific, informed and unambiguous indication of an individual’s wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her;

‘data controller’ means an individual or organisation which, alone or jointly with others, determines the purposes and means of the processing of personal data;

‘data processor’ means an individual or organisation which processes personal data on behalf of the data controller;

‘personal data’* means any information relating to an individual who can be identified, such as by a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.

‘personal data breach’ means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data;

‘processing’ means any operation or set of operations performed on personal data, such as collection, recording, organisation, structuring, storage (including archiving), adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.

‘profiling’ means any form of automated processing of personal data consisting of the use of personal data to evaluate certain personal aspects relating to an individual, in particular to analyse or predict aspects concerning that natural person’s performance at work, economic situation, health, personal preferences, interests, reliability, behaviour, location or movements;

‘pseudonymisation’ means the processing of personal data in such a manner that the personal data can no longer be attributed to an individual without the use of additional information, provided that such additional information is kept separately and is subject to technical and organisational measures to ensure that the personal data are not attributed to an identified or identifiable individual;

‘sensitive personal data’* means personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data, data concerning health, an individual’s sex life or sexual orientation and an individual’s criminal convictions.

* For the purposes of this policy we use the term ‘personal data’ to include ‘sensitive personal data’ except where we specifically need to refer to sensitive personal data.

‘Supervisory authority’ means an independent public authority which is responsible for monitoring the application of data protection. In the UK the supervisory authority is the Information Commissioner’s Office (ICO).

Data processing under the Data Protection Laws

All of these definitions are italicised throughout this policy to remind the reader that they are defined terms.

The Company processes personal data in relation to its own staff, work-seekers and individual client contacts and is a data controller for the purposes of the Data Protection Laws. The Company has registered with the ICO and its registration numbers are Z215933X (Calibre Search Ltd) & Z3541172 (Calibre Search (Manchester) Ltd.

The Company may hold personal data on individuals for the following purposes:

• Staff administration;
• Advertising, marketing and public relations;
• Accounts and records;
• Administration and processing of work-seekers’ personal data for the purposes of providing work-finding services, including processing using software solution providers and back office support.
• Administration and processing of clients’ personal data for the purposes of supplying/introducing work-seekers.

1. The data protection principles

The Data Protection Laws require the Company acting as either data controller or data processor to process data in accordance with the principles of data protection. These require that personal data is:

1. Processed lawfully, fairly and in a transparent manner;
2. Collected for specified and legitimate purposes and not further processed in a manner that is incompatible with those purposes;
3. Adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed;
4. Accurate and kept up to date; every reasonable step must be taken to ensure that personal data that are inaccurate, having regard to the purposes for which they are processed, are erased or rectified without delay;
5. Kept for no longer than is necessary for the purposes for which the personal data are processed;
6. Processed in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures; and that
7. The data controller shall be responsible for, and be able to demonstrate, compliance with the principles.

2. Legal bases for processing

The Company will only process personal data where it has a legal basis for doing so. Where the Company does not have a legal reason for processingpersonal data any processing will be a breach of the Data Protection Laws.

The Company will review the personal data it holds on a regular basis to ensure it is being lawfully processed and it is accurate, relevant and up to date and the company shall be responsible for doing this.

Before transferring personal data to any third party (such as past, current or prospective employers, suppliers, customers and clients, intermediaries such as umbrella companies, persons making an enquiry or complaint and any other third party (such as software solutions providers and back office support)), the Company will establish that it has a legal reason for making the transfer.

3. Privacy by design and by default

The Company has implemented measures and procedures that adequately protect the privacy of individuals and ensures that data protection is integral to all processing activities. This includes implementing measures such as:

• data minimisation (i.e. not keeping data for longer than is necessary);
• pseudonymisation;
• anonymization
• cyber security

For further information please refer to the Company’s Information Security Policy.

Rights of the individual

The Company shall provide any information relating to data processing to an individual in a concise, transparent, intelligible and easily accessible form, using clear and plain language. The information shall be provided in writing, or by other means, including, where appropriate, by electronic means. The Company may provide this information orally if requested to do so by the individual.

1. Privacy notices

Where the Company collects personal data from the individual, the Company will give the individual a privacy notice at the time when it first obtains the personal data.

Where the Company collects personal data other than from the individual directly, it will give the individual a privacy notice within a reasonable period after obtaining the personal data, but at the latest within one month. If the Company intends to disclose the personal data to a third party then the privacy notice will be issued when the personal data are first disclosed (if not issued sooner).

Where the Company intends to further process the personal data for a purpose other than that for which the data was initially collected, the Company will give the individual information on that other purpose and any relevant further information before it does the further processing.

2. Subject access requests

The individual is entitled to access their personal data on request from the data controller.

3. Rectification

The individual or another data controller at the individual’s request, has the right to ask the Company to rectify any inaccurate or incomplete personal data concerning an individual.

If the Company has given the personal data to any third parties it will tell those third parties that it has received a request to rectify the personal data unless this proves impossible or involves disproportionate effort. Those third parties should also rectify the personal data they hold - however the Company will not be in a position to audit those third parties to ensure that the rectification has occurred.

4. Erasure

The individual or another data controller at the individual’s request, has the right to ask the Company to erase an individual’s personal data.

If the Company receives a request to erase it will ask the individual if s/he wants his personal data to be removed entirely or whether s/he is happy for his or her details to be kept on a list of individuals who do not want to be contacted in the future (for a specified period or otherwise). The Company cannot keep a record of individuals whose data it has erased so the individual may be contacted again by the Company should the Company come into possession of the individual’s personal data at a later date.

If the Company has made the data public, it shall take reasonable steps to inform other data controllers and dataprocessors processing the personal data to erase the personal data, taking into account available technology and the cost of implementation.

If the Company has given the personal data to any third parties it will tell those third parties that it has received a request to erase the personal data, unless this proves impossible or involves disproportionate effort. Those third parties should also rectify the personal data they hold - however the Company will not be in a position to audit those third parties to ensure that the rectification has occurred.

5. Restriction of processing

The individual or a data controller at the individual’s request, has the right to ask the Company to restrict its processing of an individual’s personal data where:

• The individual challenges the accuracy of the personal data;
• The processing is unlawful and the individual opposes its erasure;
• The Company no longer needs the personal data for the purposes of the processing, but the personal data is required for the establishment, exercise or defence of legal claims; or
• The individual has objected to processing (on the grounds of a public interest or legitimate interest) pending the verification whether the legitimate grounds of the Company override those of the individual.

If the Company has given the personal data to any third parties it will tell those third parties that it has received a request to restrict the personal data, unless this proves impossible or involves disproportionate effort. Those third parties should also rectify the personal data they hold - however the Company will not be in a position to audit those third parties to ensure that the rectification has occurred.

6. Data portability

The individual shall have the right to receive personal data concerning him or her, which he or she has provided to the Company, in a structured, commonly used and machine-readable format and have the right to transmit those data to another data controller in circumstances where:

• The processing is based on the individual’s consent or a contract; and
• The processing is carried out by automated means.

Where feasible, the Company will send the personal data to a named third party on the individual’s request.

7. Object to processing

The individual has the right to object to their personal data being processed based on a public interest or a legitimate interest. The individual will also be able to object to the profiling of their data based on a public interest or a legitimate interest.

The Company shall cease processing unless it has compelling legitimate grounds to continue to process the personal data which override the individual’s interests, rights and freedoms or for the establishment, exercise or defence of legal claims.

The individual has the right to object to their personal data for direct marketing. Please refer to the Company’s Marketing Policy for further information.

8. Enforcement of rights

All requests regarding individual rights should be sent to the person whose details are listed in the Appendix.

The Company shall act upon any subject access request, or any request relating to rectification, erasure, restriction, data portability or objection or automated decision making processes or profiling within one month of receipt of the request. The Company may extend this period for two further months where necessary, taking into account the complexity and the number of requests.

Where the Company considers that a request under this section is manifestly unfounded or excessive due to the request’s repetitive nature the Company may either refuse to act on the request or may charge a reasonable fee taking into account the administrative costs involved.

9. Automated decision making

The Company will not subject individuals to decisions based on automated processing that produce a legal effect or a similarly significant effect on the individual, except where the automated decision:

• Is necessary for the entering into or performance of a contract between the data controller and the individual;
• Is authorised by law; or
• The individual has given their explicit consent.

The Company will not carry out any automated decision-making or profiling using the personal data of a child.

Personal data breaches

All data breaches should be referred to the persons whose details are listed in the Appendix.

1. Personal data breaches where the Company is the data controller:

Where the Company establishes that a personal databreach has taken place, the Company will take steps to contain and recover the breach. Where a personal databreach is likely to result in a risk to the rights and freedoms of any individual the Company will notify the ICO.

Where the personal databreach happens outside the UK, the Company shall alert the relevant supervisory authority for data breaches in the effected jurisdiction.

2. Personal data breaches where the Company is the data processor:

The Company will alert the relevant data controller as to the personal data breach as soon as they are aware of the breach.

3. Communicating personal data breaches to individuals

Where the Company has identified a personal data breach resulting in a high risk to the rights and freedoms of any individual, the Company shall tell all affected individuals without undue delay.

The Company will not be required to tell individuals about the personal databreach where:

• The Company has implemented appropriate technical and organisational protection measures to the personal data affected by the breach, in particular to make the personal data unintelligible to any person who is not authorised to access it, such as encryption.
• The Company has taken subsequent measures which ensure that the high risk to the rights and freedoms of the individual is no longer likely to materialise.
• It would involve disproportionate effort to tell all affected individuals. Instead, the Company shall make a public communication or similar measure to tell all affected individuals.

Human Rights Act 1998

All individuals have the following rights under the Human Rights Act 1998 (HRA) and in dealing with personal data these should be respected at all times:

• Right to respect for private and family life (Article 8).
• Freedom of thought, belief and religion (Article 9).
• Freedom of expression (Article 10).
• Freedom of assembly and association (Article 11).
• Protection from discrimination in respect of rights and freedoms under the HRA (Article 14).

How we collect and use your data at www.calibresearch.co.uk

By accessing, using and/or downloading materials from or sending or posting materials to, this Site, you agree on your own behalf and on behalf of each entity on whose behalf you act, to the terms of this Privacy Policy and to the practices for the collection, use or disclosure of your personal information as described here.

Please note that this Site is also governed by the Terms and Conditions of Use. We urge you to review the Terms and Conditions of Use before proceeding further on this Site.

What Information Do We Collect? Anonymous browsing

You can visit this Site without telling us who you are or revealing any information about yourself, including your email address. In this case, our Web server may collect the name, address, the IP address and domain you used to access this Site, the type and version of browser and operating system you are using, and the web site you came from and visit next. This information is used by us and our business partners to measure the number of visits, average time spent, page views, and other statistics about visitors to this Site in general. We may also use this data to monitor site performance for systems administration purposes, to make this Site easier and more convenient to use and to report information in aggregate form to our advisers (e.g. how many visitors log in to this Site).

Cookies

Cookies are small pieces of data stored by your Internet browser on your computer's hard drive, which permits us to recognize you when you access this Site. If you are browsing, a cookie is used to help us measure the number of visits, average time spent, page views, and other statistics relating to your use of this Site. If you are searching, a cookie is used to carry the search request data from the request page to the results page. This cookie, by itself, doesn't tell us your email address or who you are. If you decide to register on-line with us, we may collect additional information to provide tailored job opportunities or other information to you (see Personal Information Collection below). In this case, we use cookies to recognize you on subsequent visits and make your on-line experience more convenient, unless prohibited by law. Please note portions of this Site will not function if you do not accept cookies. 

Tracking user preferences also helps us serve you targeted advertising. Targeted advertisements are probably more interesting for you and are more productive for our advertisers.

Personal Information Collection, Use And Distribution To Third Parties Generally

There are times when we may ask you for or you may choose to provide information about yourself or your business to assist us in meeting your various needs. This information may be used for the following purposes: answering your questions, providing you with services you have requested, giving producers and developers of the Site information that is useful in determining appropriate new features, content and services, to provide advertisers with aggregate, not individual, information about our customers, or informing you of additional services or job opportunities provided by Calibre Search or by our business partners, that may interest you.

To provide these services, we may need to ask you directly to provide, among other things, your name, mailing address, postal code, email address and phone number ("Registration Information"). You may also elect to apply on-line to a job posting (free of charge) OR to purchase one of our services. Purchasing services with us may require us to gather additional personal information (including credit or debit card information, where appropriate).

At times, we also conduct on-line surveys to better understand the needs, profiles, and experience of our visitors. You will be given the option to participate in such surveys. Unless you request to receive the results of the survey via email, no personal information is requested during such surveys and all information is used on an aggregated basis only. If, during the registration process, you indicate you would like us to keep you updated on new site developments and information about our services or about offerings from Calibre Search, we will send you these updates by email.

If you contact Calibre Search we may keep a record of that correspondence. We do not collect the email addresses of those who communicate with Calibre Search via email. We use the information provided only so that we may respond to the email. We do not knowingly solicit information from children and we do not knowingly market our services to children.

When you provide personal information to us, we may communicate and disclose it to third parties for the purpose of fulfilling, servicing and completing your requests and the transactions related to it. These third parties may be in the UK or in other parts of the world. By registering with Calibre Search, you agree that your information may be shared with third parties for the purpose of fulfilling, servicing and completing your requests and transactions related to it.

We may also aggregate statistics that we gather about the visitors to the Site, sales, traffic patterns, and services and provide these statistics to third parties; however, when we do, these statistics will not include any personal information that identifies individuals.

We may also use, disclose and communicate your personal information if required to do so by law including by an order of any court. Although we use all reasonable means to ensure that the information you provide to us is not used by third parties for purposes other than those described in this Privacy Policy, Calibre Search is not responsible for any improper use of your personal information that is beyond our reasonable control.

CV Collection

As part of the services we provide, you may choose to provide us with your CV, to be viewed by our consultants and staff members who access this Website. In addition to the provisions of this Privacy Policy, the collection, use and distribution of your CV is governed by the Terms & Conditions of Use.

How Do You Access And Update Your Personal Information?

Your personal information is located on a server(s) operated by Purple Penguin Media Limited. Calibre Search provides you with the means to access, update, edit or delete the Registration Information and other personal information you have provided to us at any time on your own by going to your user account and changing or deleting your Registration Information and other personal information as desired. If you decide at any time that you do not want to receive any updates you have subscribed for just send an email message to dataprotection@calibresearch.co.uk indicating your preference not to receive updates. If you are unsure whether we have a record containing your personal information and would like to confirm whether or not we do, please send an email to dataprotection@calibresearch.co.uk indicating all email addresses which you may have given us.

How Is Your Personal Information Secured And Protected?

Where Calibre Search considers it appropriate, Calibre Search uses encryption and/or authentication tools among other methods to protect certain web-based personal information. E-mails you send us are not necessarily secure when they are transmitted to us. If your communication is sensitive or includes confidential information such as a credit card number, you may want to provide it by post or via the telephone instead.

We instruct our employees with access to your personal information that it is to be used only in adherence with the principles set forth in this Privacy Policy and the laws applicable to each specific business. The only employees who have access to your personal information are administrative personnel. Employees who misuse customer personal information may be subject to disciplinary action.

What If We Change Our Privacy Policy?

Calibre Search reserves the right to modify or supplement this Privacy Policy statement at any time. If we make any material change to this Privacy Policy, we will update this Site to include such changes and post a notice on our home page, for a period of 30 days, with a link to the updated Privacy Policy. Please read any such notice and the new policy statement. If you return to this Site after a period of more than 30 days, please check this Privacy Policy to confirm that you are aware of the details of the most recent update. Please look at the top of this Privacy Policy to check the date that it was updated and to confirm that you are familiar with the terms of the most recent update. Your continued use of this Site after we post such notice will constitute your acceptance of the new terms and their application to your use of this Site and the personal information disclosed for such use, including personal information previously furnished us, as if they were the initial terms, and your consent to the use of your personal information as described in this privacy policy and elsewhere at our Website. However, we will seek your consent if we want to use your personal information for purposes other than those you have agreed to previously.

Website Links

This Site may contain links to other sites, including those of our business partners, vendors and advertisers. While we try to link only to sites that share our high standards and respect for privacy, please understand that we are not responsible for the content of, or the privacy practices employed by, other sites.

Privacy Policy With Respect To Use Of CVs

As part of the services Calibre Search provides, you are able to post your CV on our website. This section of Calibre Search's general Privacy Policy applies to the use of your CV by Calibre Search.

CVs are accessed by our consultants who seek to find you employment with third parties ("Third Parties"). Consultants are not permitted to disclose information outside our organisation or beyond the Third Party, as applicable. Recruiters are also required to have entered into an agreement with Third Parties that requires such Third Parties to use your CV solely for the purpose of filling a job within the Third Party for which the information was provided and not disclosing your CV outside the organisation. However, although Calibre Search deals only with reputable organisations, we cannot guarantee that all Employers and Third Parties will adhere to the limitations we impose on them. If at any time you would like your CV removed from our Website, you may do so by using the "delete CV" function.

Some job postings which are posted on the Calibre Search Site allow you to follow links to where you can apply, and provide your CV, for a specific job posting. In some cases, such applications are still within the Calibre Search Site and it's control. If you are not asked to login using your Calibre Search Registration User ID and password, however, then both the application process, and your CV are outside the Calibre Search Site and Calibre Search's control. In such cases you will be providing your CV directly to the Employer or Recruiter and your CV will be subject to their privacy policy. Calibre Search is not responsible for the privacy practices of such Employer or Recruiter. In such cases, we encourage you to review the Employer or Recruiter's privacy policy.

Although we use all reasonable means to protect your personal information, Calibre Search is not responsible for any improper use of your personal information that is beyond our reasonable control.

• Your CV when uploaded is converted in to various formats for our use only. These conversions are handled by an external datacentre server stack. Once conversion is complete your CV is then automatically deleted from that service. We are committed to ensuring that your information is secure. In order to prevent unauthorised access or disclosure, the data company have put in place suitable physical, electronic and managerial procedures to safeguard and secure the information. We may disclose your information if necessary to protect our legal rights or if the information relates to actual or threatened harmful conduct or potential threats to the physical safety of any person. Disclosure may be required by law or if we receive legal process. If these servers are breached we are not responsible for this and cannot be held liable.

Account Removal from www.calibresearch.co.uk

You can remove your www.calibresearch.co.uk account, simply login and click here. Should you have an enquiry relating to your data held on our CRM then please contact our Compliance Team at dataprotection@calibresearch.co.uk 

Complaints or Suggestions

If you have a complaint or suggestion about the Company’s handling of personaldata then please contact our Data Protection officer at dataprotection@calibresearch.co.uk.

Alternatively you can contact the ICO directly on 0303 123 1113 or at https://ico.org.uk/global/contact-us/email/