HAYS INTERNAL RECRUITMENT PRIVACY POLICY

Transcription

1 HAYS INTERNAL RECRUITMENT PRIVACY POLICY INTRODUCTION This Internal Recruitment Privacy Plicy applies t individuals wh are seeking emplyment with Hays. This Internal Recruitment Privacy Plicy describes hw we cllect, use and prcess yur persnal data, and hw, in ding s, we cmply with ur legal bligatins t yu. Yur privacy is imprtant t us, and we are cmmitted t prtecting and safeguarding yur data privacy rights. If yu indicate that yu wuld als like us t prcess yur persnal data t find yu suitable rles with Hays' clients r ther third parties, ur General Privacy Plicy will apply t yu in respect f this prcessing. This can be fund n ur website. Fr the avidance f dubt, this Internal Recruitment Privacy Plicy des nt apply t Hays' Staff when they apply fr internal rles if this is yu, please see the separate Staff Privacy Plicy which is accessible via the Hays Intranet. If yu accept an ffer f emplyment with Hays, yu shuld refer t the Staff Privacy Plicy fr infrmatin abut hw we prcess Staff persnal data, which will be prvided t yu during yur nbarding prcess. Fr the purpse f applicable data prtectin legislatin (including but nt limited t the General Data Prtectin Regulatin (Regulatin (EU) 2016/679) (the "GDPR"), the cmpany respnsible fr yur persnal data ("Hays" r "us") can be fund in Annex 1. This Internal Recruitment Privacy Plicy may be amended frm time t time. Please visit this page if yu want t stay up t date, as we will pst any changes in ur apprach t data privacy here. If yu are dissatisfied with any aspect f ur Internal Recruitment Privacy Plicy, yu may have legal rights and s, where relevant, we have described these as well. This Internal Recruitment Privacy Plicy applies in relevant cuntries thrughut ur internatinal netwrk. Different cuntries may apprach data privacy in slightly different ways and s we may als have cuntry-specific parts t this Internal Recruitment Privacy Plicy. Yu can find summaries f cuntry-specific terms in Annex 3. This allws us t ensure that we're cmplying with all applicable data privacy prtectins n matter where yu are. WHAT KIND OF PERSONAL DATA DO WE COLLECT ABOUT RECRUITMENT? We cllect data abut yu t enable the Recruitment prcess t run smthly, fr example where we have a legitimate interest when cnsidering yu fr a rle and t ensure that we are able t cmply with ur legal and regulatry bligatins. Depending n the relevant circumstances and applicable lcal laws and requirements, we may cllect sme r all f the infrmatin listed belw t help us with this, where apprpriate. This is an internatinal plicy and it is imprtant t nte that in sme jurisdictins, we are restricted frm prcessing sme f the data utlined belw. In such cases, we will nt prcess the data in thse jurisdictins. Fr ease f reference, the mst significant examples f data which we are permitted, r even bliged, t prcess in sme jurisdictins, but are prhibited frm prcessing in ther jurisdictins, are set ut in the secnd part f the list belw: name;

2 age/date f birth; cntact details, such as address, address and telephne number; birth identificatin number; sex/gender; phtgraph; marital status; CV; educatin details; emplyment histry and lcatins f previus emplyment; referee details; yur signature, including in electrnic frm; immigratin status (whether yu need a wrk permit); natinality/citizenship/place f birth; a cpy f yur driving licence and/r passprt/identity card; scial security number (r equivalent in yur cuntry) and any ther tax-related infrmatin; details abut yur current r frmer rle(s) including remuneratin, pensin and benefits arrangements; extra infrmatin that yu chse t tell us; extra infrmatin that yur referees chse t tell us abut yu; any additinal infrmatin required by lcal legislatin; and extra infrmatin that we find frm ther third party surces. As nted abve, sme f the mre significant examples f data which we prcess in sme jurisdictins, but are prhibited frm prcessing thers (and which we accrdingly d nt prcess in such jurisdictins) include: financial infrmatin (including where we need t carry ut financial backgrund checks); diversity infrmatin including racial r ethnic rigin, religius r ther beliefs, and physical r mental health, including disability-related infrmatin; sexual rientatin; bimetric infrmatin; CCTV ftage if yu attend ur premises; details f any criminal cnvictins; and cmmunicatins that yu send t Hays which pass thrugh Hays' Systems, including s, instant messages, scial media psts, text messages and appbased messages (such as WhatsApp). Please nte that the abve lists f the categries f persnal data which we cllect are nt exhaustive. We will prcess save r all f the abve items f persnal data t ensure the Recruitment

3 prcess can run smthly and s that we can make an infrmed decisin abut yur suitability fr the rle in questin (r ther apprpriate rles that may be available, depending n the circumstances). Depending n the type f persnal data in questin and the grunds n which we may be prcessing it, shuld yu decline t prvide us with such data, we may nt be able t cntinue with the Recruitment prcess. Fr details f the legal bases that we rely n t be able t use and prcess yur persnal data, please see the sectin belw entitled "Legal bases fr us prcessing yur data". HOW DO WE COLLECT YOUR PERSONAL DATA? We cllect yur persnal data in three primary ways: 1. Persnal data that yu give t us; 2. Persnal data that we receive frm ther surces; and 3. Persnal data we cllect autmatically. Belw are sme mre details abut each f these methds. Persnal data yu give t us Hays needs t knw certain infrmatin abut yu in rder t prperly cnduct the Recruitment prcess. There are numerus ways that yu can share yur infrmatin with us. Where apprpriate and in accrdance with any lcal laws and requirements, these may include: When yu make a jb applicatin t Hays via ur website r ther recruitment prtal; When yu make a jb applicatin t Hays via ; When yu make a jb applicatin t Hays via jb bards (such as Mnster and StepStne); When yu make a jb applicatin t Hays via netwrking websites (such as LinkedIn); When yu make a jb applicatin t Hays by submitting a CV r applicatin, whether in hard cpy r by electrnic means; When yu register t receive mre infrmatin frm us at a jb fair r ther Hays careers event, including requesting that we send yu a cpy f a presentatin we gave, where relevant; When yu apply fr ur mentring r schlarship prgrammes; When yu fill ut a candidate applicatin frm at the time f yur interview; When yu had previusly cntacted Hays as a candidate, seeking Hays' services in finding emplyment with a third party rganisatin; Infrmatin yu prvide t Hays' Staff in cmmunicatins during the Recruitment prcess; When yu fill ut ur matchmaker test n ur website (if available in yur jurisdictin). Persnal data we receive frm ther surces We als receive persnal data abut yu frm ther surces. Depending n the relevant circumstances and applicable lcal laws and requirements, these may include persnal data received in the fllwing situatins: infrmatin btained abut yu when we searched third party surces such as LinkedIn and ther jb sites fr ptential Recruitment fr rles at Hays;

4 when a member f Hays' Staff refers yu t us, fr example via ur internal recruitment teams, they will share persnal infrmatin abut yu with us; if yu were referred t us thrugh a recruitment agency r cnsultant, they may have shared persnal infrmatin abut yu with us; infrmatin btained by ne f ur internal recruitment teams wh received yur infrmatin, fr example, via a career website r graduate career bk; infrmatin btained via third parties such as frmer Hays emplyees wh recmmend yu fr a rle; infrmatin btained abut yu frm third party service prviders wh undertake backgrund checks abut yu n ur behalf; yur referees may disclse persnal infrmatin abut yu t us; and if yu 'like' ur page n Facebk r 'fllw' us n Twitter (r similar), we will receive yur persnal infrmatin frm thse sites. Persnal data we cllect autmatically Where apprpriate and in accrdance with any lcal laws and requirements, we may cllect yur persnal data autmatically the fllwing ways: cmmunicatins that yu send t Hays which pass thrugh Hays' Systems, including s, instant messages, scial media psts, text messages and appbased messages (such as WhatsApp). when yu visit ur website, yur IP address, the date and the times and frequency with which yu access the website and the way yu brwse its cntent. We will als cllect data frm yu when yu cntact us via the website, fr example by using the chat functin. via ckies when yu visit ur website, in line with ckie settings in yur brwser. We may use data frm yur use f ur websites t enhance ther aspects f ur cmmunicatins with yu. If yu wuld like t find ut mre abut ckies, including hw we use them and what chices are available t yu, please see ur General Privacy Plicy. HOW DO WE USE YOUR PERSONAL DATA? We generally use Recruitment' data in the fllwing ways: 1. T ensure the smth running f the Recruitment prcess 2. Assessing yur suitability fr jb rles; 3. T undertake equal pprtunities mnitring (where applicable and in accrdance with lcal law requirements); 4. T help us t establish, exercise r defend legal claims; and 5. T help us t help yu and t understand ur legal bligatins if yu suffer frm a health cnditin r disability. Belw are sme mre details abut each f these purpses. T ensure the smth running f the Recruitment prcess We have listed belw varius ways in which we may prcess r use yur persnal data fr this purpse, where apprpriate and in accrdance with any lcal laws and requirements: Cllecting yur data frm yu and ther surces, such as yur referees; Passing n yur details t recruiters wh assist us with finding new members f Staff;

5 Enabling recruiters t cntact yu abut the rle; Enabling ur hiring managers t decide whether t make yu a jb ffer; Determining the terms n which yu will wrk fr us; Internal recruiters passing yur details n t ur hiring managers, t discuss yur suitability fr a rle at Hays; Assessing yur qualificatins fr a particular jb r task, including decisins abut appintment; Infrming yu f the result f yur jb applicatin; Verifying infrmatin we have received, using third party resurces (such as psychmetric evaluatins r skills tests) r thrugh infrmatin requests (such as references, qualificatins and ptentially any criminal cnvictins, t the extent that this is apprpriate and in accrdance with lcal laws); String and transferring yur details (and updating them when necessary) n and between ur internal recruitment databases and applicant tracking systems; Cmplying with ur legal bligatins in cnnectin with the detectin f crime r the cllectin f taxes r duties; Keeping a recrd f when yu attend an interview r ther assessment; When making arrangements in rder t ffer yu a jb; Carrying ut satisfactin surveys n ur Recruitment prcess; Subject t specific lcal law requirements (acknwledging in sme f the jurisdictins in which we perate, the extent t which it is permissible t carry ut sme f these frms f prcessing is limited): mnitring cmmunicatins that yu send t Hays which pass thrugh Hays' Systems, including s, instant messages, scial media psts, text messages and app-based messages (such as WhatsApp); keeping a recrd f security data s that we can be sure wh is n ur premises at any given time; and running CCTV at ur premises t ensure the safety and security f ur Staff and prperty. Carrying ut any ther bligatins r necessary requirements arising frm the Recruitment prcess; If yu are successful in being appinted t a rle, transferring yur persnal data nt ur internal HR systems; and If yu are unsuccessful in yur applicatin fr a rle with Hays, we may prcess yur persnal data t intrduce yu t anther member f the Hays team t discuss whether yu wish fr us t cntinue t prcess yur persnal data t help yu t find a rle with ne f ur clients. In thse circumstances, yu wuld becme a 'candidate' and the terms f ur General Privacy Plicy wuld apply. Assessing yur suitability fr jb rles In additin t the usual human resurces prcesses, as technlgy advances, it may be pssible in the future fr us t use machine learning, prfiling and algrithms t help us t make Recruitment decisins and t mre accurately assess yur suitability fr jb rles and t help us make ther decisins in ur Recruitment prcesses. This is an exciting

6 pprtunity fr us t imprve ur business prcesses and t ensure that we all enjy a successful wrkplace. In relevant circumstances, and where legally permissible, we may require yur cnsent t carry ut sme f these activities. T undertake equal pprtunities mnitring We are cmmitted t ensuring that ur Recruitment prcesses are aligned with ur apprach t equal pprtunities. In sme jurisdictins, where the prcessing f such data is permissible in accrdance with lcal law requirements, sme f the data we may cllect abut yu cmes under the umbrella f "diversity infrmatin". This culd be infrmatin abut yur ethnic backgrund, gender, disability, age, sexual rientatin, religin r ther beliefs, child care / carer arrangements and/r scial-ecnmic backgrund. Where apprpriate and nly in accrdance with lcal law and requirements, we'll use this infrmatin n an annymised basis t mnitr ur cmpliance with equal pprtunities requirements. T help us t establish, exercise r defend legal claims In mre unusual circumstances, we may use yur persnal data t help us t establish, exercise r defend legal claims. T help us t help yu and t understand ur legal bligatins if yu suffer frm a health cnditin r disability If yu suffer frm any health cnditins r disabilities, we may, subject t lcal laws and requirements, recrd details f them s that we can make reasnable adjustments t interview and ther Recruitment prcedures if required. Please nte that the abve list f the ways in which we use yur persnal data fr this purpse is nt exhaustive. We will nly use yur persnal data fr the purpses fr which we cllect it, unless we reasnably cnsider that we need t use it fr anther reasn, and that reasn is cmpatible with the riginal purpse. If we need t use yur persnal data fr an unrelated purpse, we will ntify yu and we will explain the legal basis which allws us t d s. T find ut mre abut the legal bases that we rely n t be able t use and prcess yur persnal data in the abve ways, please see the sectin belw entitled "Legal bases fr us prcessing yur data". Please nte that in certain f the jurisdictins in which we perate, additinal rules may apply in respect f hw we use yur persnal data. Fr mre infrmatin in relatin t any such additinal rules in yur jurisdictin, please see Annex 3. WHO DO WE SHARE YOUR PERSONAL DATA WITH? Where apprpriate and in accrdance with lcal laws and requirements, we may share certain f yur persnal data, in varius ways and fr varius reasns, with the fllwing categries f peple: any f ur grup cmpanies (this may include thse in ur verseas ffices); yur family and persnal representatives; external third party rganisatins (fr example thse which carry ut psychmetric testing), business assciates and prfessinal advisers, t enable us t assess yur suitability fr the rle; where relevant, recruiters wh will help us t find the right rle fr yu; individuals and rganisatins wh hld infrmatin related t yur reference r

7 applicatin t wrk with us, such as current, r past emplyers, educatrs and examining bdies, immigratin agencies and emplyment and recruitment agencies; third parties, in rder t cmply with ur legal bligatins, fr example in relatin t immigratin requirements; third parties wh hld infrmatin related t yur financial recrd such as financial rganisatins, credit reference agencies and debt cllectin and tracing agencies; where apprpriate, medical prfessinals such as yur GP r an ccupatinal health specialist; third party service prviders wh perfrm functins n ur behalf (including external cnsultants, business assciates and prfessinal advisers such as lawyers, auditrs, accuntants, technical supprt functins and IT cnsultants carrying ut testing and develpment wrk n ur business technlgy systems; third party utsurced IT and dcument strage prviders where we have an apprpriate prcessing agreement (r similar prtectins) in place; third parties invlved in, r assisting with, litigatin (including legal advisers, witnesses, experts and judicial and quasi-judicial authrities); third parties wh we have retained t prvide services such as reference, qualificatin and criminal cnvictins checks, t the extent that these checks are apprpriate and in accrdance with lcal laws; and if Hays merges with r is acquired by anther business r cmpany in the future, (r is in meaningful discussins abut such a pssibility) we may share yur persnal data with the (prspective) new wners f the business r cmpany. HOW DO WE SAFEGUARD YOUR PERSONAL DATA? We care abut prtecting yur infrmatin. That's why we put in place apprpriate measures that are designed t prevent unauthrised access t, and misuse f, yur persnal data. These include measures t deal with any suspected data breach. We are cmmitted t taking all reasnable and apprpriate steps t prtect the persnal data that we hld frm misuse, lss, r unauthrised access. We d this by having in place a range f apprpriate technical and rganisatinal measures. If yu suspect any misuse r lss f r unauthrised access t yur persnal data please let us knw immediately. Details f hw t cntact us can be fund in Annex 1. HOW LONG DO WE KEEP YOUR PERSONAL DATA FOR? Subject t yur rights (as explained in this Internal Recruitment Privacy Plicy) we will rdinarily prcess yur data frm when yu first cntact us and retain it fr a perid until after the Recruitment prcess ends. The precise length f time will depend the type f data, ur legitimate business needs and ther legal r regulatry rules that may require us t retain it fr certain minimum perids. Fr example, we may retain it fr a certain perid t cmply with lcal law requirements in relatin t immigratin checks, r t enable us t respnd t any queries yu may have abut the Recruitment prcess in the future. In determining the apprpriate retentin perid fr different types f persnal data, we always cnsider the amunt, nature, and sensitivity f the persnal data in questin, the ptential risk f harm frm unauthrised use r disclsure f that persnal data, the purpses fr which we need t prcess it and whether we can achieve thse purpses by

8 ther means (in additin f curse t ensuring that we cmply with ur legal, regulatry and risk-management bligatins, as described abve). Once we have determined that we n lnger need t hld yur persnal data, we will Delete it frm ur Systems. HOW CAN YOU ACCESS, AMEND OR TAKE BACK THE PERSONAL DATA THAT YOU HAVE GIVEN TO US? One f the GDPR's main bjectives is t prtect and clarify the rights f EU citizens and individuals in the EU with regard t data privacy. Even if we already hld yur persnal data, yu still have varius rights in relatin t it, which we have set ut belw. T get in tuch abut these rights (including if yu wish t exercise any f them), please cntact us using the details listed in Annex 1. We will seek t deal with yur request withut undue delay, and in any event within ne mnth (subject t any extensins t which we are lawfully entitled). Please nte that we may keep a recrd f yur cmmunicatins t help us reslve any issues which yu raise. The GDPR gives yu the fllwing rights in relatin t yur persnal data: Right t bject This right enables yu t bject t us prcessing yur persnal data where we d s fr ne f the fllwing fur reasns: (i) because it is within ur legitimate interests (ii) t enable us t perfrm a task in the public interest r exercise fficial authrity; (iii) t send yu direct marketing materials; and (iv) fr scientific, histrical, research, r statistical purpses. The "legitimate interests" categry abve is the ne mst likely t apply in relatin t ur Recruitment prcesses, and if yur bjectin relates t us prcessing yur persnal data because we deem it necessary fr ur legitimate interests, we must act n yur bjectin by ceasing the activity in questin unless: we can shw that we have cmpelling legitimate grunds fr prcessing which verrides yur interests; r Right t withdraw cnsent we are prcessing yur data fr the establishment, exercise r defence f a legal claim. Where we have btained yur cnsent t prcess yur persnal data fr certain activities (fr example, fr autmatic prfiling), yu may withdraw this cnsent at any time and we will cease t carry ut the particular activity that yu previusly cnsented t unless we cnsider that there is an alternative legal basis t justify ur cntinued prcessing f yur data fr this purpse, in which case we will infrm yu f this cnditin. Right t submit a data subject access request (DSAR) Yu may ask us t cnfirm what infrmatin we hld abut yu at any time, and request us t mdify, update r Delete such infrmatin. We may ask yu fr mre infrmatin abut yur request. If we prvide yu with access t the infrmatin we hld abut yu, we will nt charge yu fr this unless yur request is "manifestly unfunded r excessive". If yu request further cpies f this infrmatin frm us, we may charge yu a reasnable administrative cst, where legally permissible. Where we are legally permitted t d s, we may refuse yur request. If we refuse yur request we will tell yu the reasns fr ding s. Please nte that in certain f the jurisdictins in which we perate, we cmply with additinal lcal law requirements regarding data subject access requests and may refuse

9 yur request in accrdance with such laws. Fr mre infrmatin in relatin t any such additinal requirements in yur jurisdictin, please see Annex 3. Right t erasure Yu have the right t request that we "erase" yur persnal data in certain circumstances. Nrmally, the infrmatin must meet ne f the fllwing criteria: the data are n lnger necessary fr the purpse fr which we riginally cllected and/r prcessed them; where previusly given, yu have withdrawn yur cnsent t us prcessing yur data, and there is n ther valid reasn fr us t cntinue prcessing; the data has been prcessed unlawfully (i.e. in a manner which des nt cmply with the GDPR); it is necessary fr the data t be erased in rder fr us t cmply with ur bligatins as a data cntrller under EU r Member State law; r if we prcess the data because we believe it necessary t d s fr ur legitimate interests, yu bject t the prcessing and we are unable t demnstrate verriding legitimate grunds fr ur cntinued prcessing. Please nte that in certain f the jurisdictins in which we perate, we cmply with additinal lcal law requirements regarding the data subject right t erasure and may refuse yur request in accrdance with lcal laws. Fr mre infrmatin in relatin t any such additinal requirements in yur jurisdictin, please see Annex 3. We wuld nly be entitled t refuse t cmply with yur request fr erasure fr ne f the fllwing reasns: t exercise the right f freedm f expressin and infrmatin; t cmply with legal bligatins r fr the perfrmance f a public interest task r exercise f fficial authrity; fr public health reasns in the public interest; fr archival, research r statistical purpses; r t exercise r defend a legal claim. When cmplying with a valid request fr the erasure f data, we will take all reasnably practicable steps t Delete the relevant data. Right t restrict prcessing Yu have the right t request that we restrict ur prcessing f yur persnal data in certain circumstances. This means that we can nly cntinue t stre yur data and will nt be able t carry ut any further prcessing activities with it until either: (i) ne f the circumstances listed belw is reslved; (ii) yu cnsent; r (iii) further prcessing is necessary fr either the establishment, exercise r defence f legal claims, the prtectin f the rights f anther individual, r reasns f imprtant EU r Member State public interest. The circumstances in which yu are entitled t request that we restrict the prcessing f yur persnal data are: where yu dispute the accuracy f the persnal data that we are prcessing abut yu. In this case, ur prcessing f yur persnal data will be restricted fr the perid during which the accuracy f the data is verified;

10 where yu bject t ur prcessing f yur persnal data fr ur legitimate interests. Here, yu can request that the data be restricted while we verify ur grunds fr prcessing yur persnal data; where ur prcessing f yur data is unlawful, but yu wuld prefer us t restrict ur prcessing f it rather than erasing it; and where we have n further need t prcess yur persnal data but yu require the data t establish, exercise, r defend legal claims. If we have shared yur persnal data with third parties, we will ntify them abut the restricted prcessing unless this is impssible r invlves disprprtinate effrt. We will, f curse, ntify yu befre lifting any restrictin n prcessing yur persnal data. Right t rectificatin Yu als have the right t request that we rectify any inaccurate r incmplete persnal data that we hld abut yu, including by means f prviding a supplementary statement. If we have shared this persnal data with third parties, we will ntify them abut the rectificatin unless this is impssible r invlves disprprtinate effrt. Yu may als request details f the third parties that we have disclsed the inaccurate r incmplete persnal data t. Where we think that it is reasnable fr us nt t cmply with yur request, we will explain ur reasns fr this decisin. Right f data prtability If yu wish, yu have the right t transfer yur persnal data between data cntrllers. In effect, this means that yu are able t transfer the details we hld n yu t anther ptential emplyer r a third party. T allw yu t d s, we will prvide yu with yur data in a cmmnly used machine-readable frmat s that yu can transfer the data t anther ptential emplyer. Alternatively, we may directly transfer the data fr yu. This right f data prtability applies t: (i) persnal data that we prcess autmatically (i.e. withut any human interventin); (ii) persnal data prvided by yu; and (iii) persnal data that we prcess based n yur cnsent r in rder t fulfil a cntract. Right t ldge a cmplaint with a supervisry authrity Yu als have the right t ldge a cmplaint with yur lcal supervisry authrity. Details f hw t cntact them can be fund in Annex 2. If yu wuld like t exercise any f these rights, r withdraw yur cnsent t the prcessing f yur persnal data (where cnsent is ur legal basis fr prcessing yur persnal data), details f hw t cntact us can be fund in Annex 1. Please nte that we may keep a recrd f yur cmmunicatins t help us reslve any issues which yu raise. It is imprtant that the persnal infrmatin we hld abut yu is accurate and current. Please keep us infrmed if yur persnal infrmatin changes during the perid fr which we hld yur data. WHO IS RESPONSIBLE FOR PROCESSING YOUR PERSONAL DATA? Yu can find ut which Hays entity is respnsible fr prcessing yur persnal data and where it is lcated in Annex 1. If yu have any cmments r suggestins cncerning this Internal Recruitment Privacy Plicy please cntact us using the details in Annex 1. We take privacy seriusly s we'll get back t yu as sn as pssible. HOW DO WE STORE AND TRANSFER YOUR DATA INTERNATIONALLY? Hays is a glbal recruiter this is what enables us t ffer the level f services that we d.

11 In rder fr us t cntinue perating in this way and t carry ut the purpses described in this Internal Recruitment Privacy Plicy, yur data may be transferred t the fllwing recipients lcated utside f yur jurisdictin: between and within Hays entities; t a clud-based strage prvider; and t ther third parties, as referred t abve under "Wh d we share yur persnal data with?" We want t make sure that yur data are stred and transferred in a way which is secure. We will therefre nly transfer data utside f the Eurpean Ecnmic Area r EEA (i.e. the Member States f the Eurpean Unin, tgether with Nrway, Iceland and Liechtenstein) where it is cmpliant with data prtectin legislatin and the means f transfer prvides adequate safeguards in relatin t yur data, fr example: by way f data transfer agreement, incrprating the current standard cntractual clauses adpted by the Eurpean Cmmissin fr the transfer f persnal data by data cntrllers in the EEA t data cntrllers and prcessrs in jurisdictins withut adequate data prtectin laws; by signing up t the EU-U.S. Privacy Shield Framewrk fr the transfer f persnal data frm entities in the EU t entities in the United States f America r any equivalent agreement in respect f ther jurisdictins; where we are transferring yur data t a cuntry where there has been a finding f adequacy by the Eurpean Cmmissin in respect f that cuntry's levels f data prtectin via its legislatin; where it is necessary fr the cnclusin r perfrmance f a cntract between urselves and a third party and the transfer is in yur interests fr the purpses f that cntract (fr example, if we need t transfer yur data t a benefits prvider based utside the EEA); r where yu have cnsented t the data transfer. T ensure that yur persnal infrmatin receives an adequate level f prtectin, we have put in place apprpriate prcedures with the third parties we share yur persnal data with t ensure that yur persnal infrmatin is treated by thse third parties in a way that is cnsistent with and which respects the law n data prtectin. LEGAL BASES FOR US PROCESSING YOUR DATA There are a number f different ways that we are lawfully able t prcess yur persnal data. We have set these ut belw. Where prcessing yur persnal data is within ur legitimate interests Article 6(1)(f) f the GDPR is relevant here it says that we can prcess yur data where it "is necessary fr the purpses f the legitimate interests pursued by [us] r by a third party, except where such interests are verridden by the interests r fundamental rights r freedms f [yu] which require prtectin f persnal data." We cnsider the fllwing t be nn-exhaustive examples f prcessing activities that are in ur legitimate interests t carry ut s that we can run a successful Recruitment prcess: assessing yur suitability fr a rle at Hays; infrming yu f the result f yur jb applicatin;

12 fr ur internal administrative purpses; t make apprpriate backgrund checks; and t assist us with establishing, exercising r defending legal claims. Yu can find further examples f ways in which we prcess yur persnal data fr the purpses f ur legitimate interests in the nn-exhaustive list abve under the heading, "T ensure the smth running f ur recruitment prcess". Where prcessing yur persnal data is necessary fr us t carry ut ur legal bligatins As well as ur bligatins t yu that arise in cnnectin with ur Recruitment prcesses, we als have ther legal bligatins that we need t cmply with. Article (6)(1)(c) f the GDPR states that we can prcess yur persnal data where this prcessing "is necessary fr cmpliance with a legal bligatin t which [we] are subject". Examples f ur legal bligatins can be fund in the nn-exhaustive list set ut abve under the heading, "T ensure the smth running f ur recruitment prcesses". Where prcessing yur Sensitive Persnal Data is necessary fr us t exercise ur rights r carry ut ur emplyment and scial security law bligatins Smetimes it will be necessary fr us t prcess yur Sensitive Persnal Data during the curse f the Recruitment prcess. Article 9(2)(b) f the GDPR allws us t d this where the prcessing is "necessary fr the purpses f carrying ut the bligatins and exercising [ur r yur] specific rights in the field f emplyment and scial security and scial prtectin law", as lng as this is allwed by law. We prcess yur Sensitive Persnal Data fr the purpse f ensuring ur cmpliance with ur equal pprtunities bligatins where this in accrdance with lcal law, but we may als prcess ther elements f yur Sensitive Persnal Data during the curse f the Recruitment prcess fr ther reasns. Yu can find ut hw we prcess yur Sensitive Persnal Data in the cntext f the Recruitment prcess in the nn-exhaustive list under "T ensure the smth running f the Recruitment prcess". Where apprpriate and in accrdance with any lcal laws and requirements, we may als prcess yur medical data t enable us t prvide yu with adequate supprt if yu suffer frm a health cnditin r disability, in rder t determine any reasnable adjustments t interview r ther Recruitment prcedures. Yu can find ut mre abut this here. Please nte that in certain f the jurisdictins in which we perate, additinal rules apply t hw we prcess yur Sensitive Persnal Data. Fr mre infrmatin in relatin t any such additinal requirements in yur jurisdictin, please see Annex 3. Where prcessing yur persnal data is necessary fr us t establish, exercise r defend legal claims Smetimes it may be necessary fr us t prcess persnal data and Sensitive Persnal Data in cnnectin with exercising r defending legal claims. Article 9(2)(f) f the GDPR allws this where the prcessing "is necessary fr the establishment, exercise r defence f legal claims r whenever curts are acting in their judicial capacity". This may arise fr example where we need t take legal advice in relatin t legal prceedings r are required by law t preserve r disclse certain infrmatin as part f the legal prcess. Where yu give us yur cnsent t prcess yur persnal data In very limited circumstances, we are required t btain yur pt-in cnsent befre we can

13 undertake certain prcessing activities with yur persnal data. Article 4(11) f the GDPR states that pt-in cnsent is "any freely given, specific, infrmed and unambiguus indicatin f the data subject's wishes by which he r she, by a statement r by a clear affirmative actin, signifies agreement t the prcessing f persnal data relating t him r her." In plain language, this means that: yu have t give us yur cnsent freely, withut us putting yu under any type f pressure; yu have t knw what yu are cnsenting t s we'll make sure we give yu enugh infrmatin; yu shuld nly be asked t cnsent t ne prcessing activity at a time we therefre avid "bundling" cnsents tgether s that yu dn't knw exactly what yu're agreeing t; and yu need t take psitive and affirmative actin in giving us yur cnsent we're likely t prvide a tick bx fr yu t check s that this requirement is met in a clear and unambiguus fashin. As and when we intrduce these prcessing activities requiring yur cnsent, we will prvide yu with mre infrmatin s that yu can decide whether yu want t pt-in. Please nte that in certain f the jurisdictins in which we perate, we cmply with additinal lcal law requirements regarding btaining cnsent. Fr mre infrmatin in relatin t any such additinal requirements in yur jurisdictin, please see Annex 3. Yu have the right t withdraw yur cnsent t these activities. Yu can d s at any time, and details f hw t d s can be fund abve in the sectin entitled, "Right t withdraw cnsent". We dn't think that any f the abve activities prejudice yu in any way. Hwever, yu d have the right t bject t us prcessing yur persnal data in certain circumstances. If yu wuld like t knw mre abut these circumstances and hw t bject t ur prcessing activities, please see the subsectin entitled "Right t bject".

14 ANNEX 1 HOW TO CONTACT US Cuntry in which yu apply t becme a member f Hays' Staff The Hays entity respnsible fr prcessing yur persnal data will depend n which f the belw cmpanies is the cunterparty assciated with the relevant arrangement Hw yu can get in tuch with us: t access, amend r take back the persnal data that yu have given t us; if yu suspect any misuse r lss f r unauthrised access t yur persnal infrmatin; t withdraw yur cnsent t the prcessing f yur persnal data (where cnsent is the legal basis n which we prcess yur persnal data); with any cmments r suggestins cncerning this Internal Recruitment Privacy Plicy Switzerland Hays (Schweiz) AG, Zurich Hays Talent Slutins (Schweiz) GmbH, Zurich Yu can write t us at the fllwing address: Hays (Schweiz) AG, Sihlstrasse 37, 8001 Zurich, Switzerland Alternatively, yu can send an t: datenschutz@hays.ch

15 ANNEX 2 HOW TO CONTACT YOUR LOCAL SUPERVISORY AUTHORITY Cuntry in which yu apply t becme a member f Hays' Staff Switzerland Details f yur lcal supervisry authrity Office f the Federal Data Prtectin and Infrmatin Cmmissiner. Yu can cntact them in the fllwing ways: Phne: (+41) (0) Pst: Feldeggweg 1, CH Berne Fax: (+41) (0)

16 ANNEX 3 COUNTRY-SPECIFIC VARIATIONS TO OUR INTERNAL RECRUITMENT PRIVACY POLICY JURISDICTION Switzerland COUNTRY SPECIFIC LEGAL REQUIREMENT Nthing in this Internal Recruitment Privacy Plicy shall authrise Hays t cllect and prcess yur persnal data in breach f the lcal data prtectin laws and regulatins in this jurisdictin and the specific requirements set ut by the lcal Data Prtectin Authrity cncerning the cllectin r prcessing f specific types f data, including sensitive persnal data. NOTE: THIS APPENDIX WILL BE UPDATED WHEN LOCAL IMPLEMENTING LAW HAS BEEN FINALISED

17 GLOSSARY Delete In this day and age, it is virtually impssible t guarantee the permanent and irretrievable deletin f electrnic data. In additin, as we have explained t yu in this Internal Recruitment Privacy Plicy, smetimes we may be bliged by law r regulatin, r need fr risk-management reasns, t retain the ability t access certain elements f persnal data. Hwever, ur cmmitment t yu is that nce yur persnal data reaches the end f its nminal retentin perid, r where we receive a valid request frm yu t erase it, we will put in place specific peratinal and Systems measures t ensure that yur data is "put beynd use". By this we mean that while the data will still technically exist n an archive system, we will ensure that it cannt be accessed by any f ur peratinal Systems, prcesses r Staff. Only a very (and we mean exceptinally) small number f senir Staff, in very (and, again, we mean exceptinally) limited and carefully prescribed situatins, be able t restre yur persnal data s that it can be viewed fr thse legitimate purpses. Once we are clear that all relevant legally mandated retentin perids have expired (which, fr present purpses, we expect t be the perid f up t nine mnths, unless we are legally required t hld yur persnal data fr lnger than this), we will g the additinal final step f undertaking a "hard delete", whereby nt even that very limited number f senir Staff wuld be able t restre yur persnal data. General Data Prtectin Regulatin (the "GDPR") a Eurpean Unin statutry instrument which aims t harmnise Eurpean data prtectin laws. It has an effective date f 25 May 2018, and any references t it shuld be cnstrued t include any natinal legislatin implementing it. Recruitment this refers t individuals wh are seeking emplyment as members f Hays' Staff. It des nt apply t candidates, that is applicants and ptential applicants fr all rles advertised r prmted by Hays n behalf f its clients r ther third parties. Sensitive Persnal Data this is persnal data cnsisting f infrmatin such as yur racial r ethnic rigin, yur plitical pinins r religius beliefs, whether yu are a trade unin member, yur physical and mental health, yur genetic and bimetric data, data relating t yur sex life and sexual rientatin, and whether yu have r are alleged t have cmmitted a criminal ffence. Due t the nature f Sensitive Persnal Data, data prtectin legislatin is much stricter abut hw such data shuld be held and prcessed. We will nly prcess yur Sensitive Persnal Data where apprpriate and in accrdance with lcal law requirements. Staff includes current and frmer emplyees and interns engaged (r wh have accepted an ffer t be engaged) directly in the business f Hays as well as certain ther wrkers wh are r were engaged in the business f prviding services t Hays (even thugh they are nt classed as emplyees). Fr these purpses we als include emplyees f Hays wh are engaged t wrk n client premises under the terms f a Recruitment Prcess Outsurcing (RPO) r Managed Service Prvider (MSP). Fr illustrative purpses, it is generally the case that if an individual is granted access t the Hays Intranet, they will be cvered by the terms f the Staff Privacy Plicy, rather than this Internal Recruitment Privacy Plicy. Systems include telephne, cmputer, internet and Wi-Fi systems, sftware and prtals, accunts and/r netwrks belnging, cntrlled r used by Hays that are used t transmit, undertake and/r receive cmmunicatins r are therwise used in the curse f Hays' business, including candidate prtal sftware and CRM systems.