Question 1

Privacy Policy

Accepted Answer

This Privacy Policy outlines Robinson Grace Consultancy Limited’s, trading as Robinson Grace HR Consultancy ("we", "our" or "the Company"), practices with respect to information collected from users who access our website or sign up to our mailing list, at www.robinsongracehr.com or otherwise share personal information with us such as prospective clients and clients, (collectively: "Users").
 
We are committed to protecting your personal information and handling it responsibly in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. This Notice explains what personal data we collect, why we collect it, how we use it, and the rights available to you. We collect and process your personal information only where we have a valid lawful basis for doing so, as set out below.
 
Collection of information
We process your Personal Information where one or more of the following legal bases apply:
it is necessary for the performance of a contract with you or to take steps at your request before entering into a contract;
it is necessary for our legitimate interests in operating and improving our business and services, provided that these interests are not overridden by your rights and interests;
it is necessary for us to comply with our legal and regulatory obligations; and
where required, you have given your consent (for example, for certain types of marketing or non-essential cookies).

Privacy by design
We embed privacy into our business processes and systems from the outset rather than as an afterthought. Our approach to privacy by design means that we:
take a proactive approach to data protection — we prevent privacy risks before they arise rather than reacting after the fact;
keep your data secure throughout its entire lifecycle, from collection through to deletion;
operate with visibility and transparency — we are open about how and why we use your personal data; and
put your interests first — your rights and interests are considered in everything we do.

What information do we collect?
We collect two types of data and information from Users.
 
The first type of information is un-identified and non-identifiable information pertaining to a User(s), which may be made available or gathered via your use of the site (“Non-personal Information”). We are not aware of the identity of a User from which the Non-personal Information was collected. This type of information may include your aggregated usage information and technical information transmitted by your device, including certain software and hardware information (e.g., the type of browser and operating system your device uses, language preference, access time, etc.) in order to enhance the functionality of our site. We may also collect information on your activity on the site (e.g., pages viewed, online browsing, clicks, actions, etc.).
 
The second type of information - Personal Information which is individually identifiable information, namely information that identifies an individual or may with reasonable effort identify an individual. Such information includes:
Device Information: We collect Personal Information from your device. Such information includes geolocation data, IP address, unique identifiers (e.g., MAC address and UUID) and other information which relates to your activity through the site.
Registration information: When you register to our site you will be asked to provide us certain details such as: full name; e-mail or physical address, and other information.
 
How do we receive information about you?
We receive your Personal Information from various sources:
When you voluntarily provide us your personal details in order to register on our site;
When you use or access our site in connection with your use of our services;
From third party providers, services, and public registers (for example, traffic analytics vendors).
 
What do we do with information we collect?
We do not rent, sell, or share Users’ information with third parties except as described in this Privacy Policy.
 
We may use the information for the following:
Conducting statistical and analytical purposes, intended to improve the site;
Communicating with you – sending you notices regarding our services, providing you with technical information and responding to any customer service issue you may have;
To communicate with you and to keep you informed of our latest updates and services;
To serve you advertisements when you use our site (see more under "Advertisements");
To market our websites and products (see more under "Marketing");

In addition to the different uses listed above, we may transfer or disclose Personal Information to our subsidiaries, affiliated companies, and subcontractors.
 
We use trusted third party service providers who may be located in different jurisdictions across the world, to help us operate our business and deliver our services. These providers act as our data processors and may process Personal Information on our behalf for purposes such as:
hosting and operating our Site;
storing and processing such information on our behalf;
performing research, technical diagnostics, or analytics;
providing you with our services, including providing a personalised display of our Site;
serving you with advertisements and assisting us in evaluating the success of our advertising campaigns and helping us retarget any of our users;
providing you with marketing offers and promotional materials related to our Site and services.
 
For example, we use Asana, and Sintra.ai as a business productivity and knowledge management platform to help us organise client information, templates, and internal documentation, solely for the purposes of providing our HR Consultancy services and managing our relationship with you.
We may also disclose information if we have good faith to believe that disclosure of such information is helpful or reasonably necessary to: (a) comply with any applicable law, regulation, legal process or governmental request; (b) enforce our policies (including our Agreement), including investigations of potential violations thereof; (c) investigate, detect, prevent, or take action regarding illegal activities or other wrongdoing, suspected fraud or security issues; (d) to establish or exercise our rights to defend against legal claims; (e) prevent harm to the rights, property or safety of us, our users, yourself or any third party; or (f) for the purpose of collaborating with law enforcement agencies and/or in case we find it necessary in order to enforce intellectual property or other legal rights.
 
Special categories of personal data
Certain categories of personal data are considered particularly sensitive under UK GDPR and are subject to additional protections. These "special categories" include information relating to health, racial or ethnic origin, religious beliefs, sexual orientation, and criminal records.
 
In the course of providing HR consultancy services, we may on occasion process special category data on behalf of or in relation to our clients. Where we do so, we will always ensure that:
there is a valid legal basis and an additional condition under UK GDPR Schedule 1 of the Data Protection Act 2018 for processing such data;
such data is treated as strictly confidential and shared only where there is a specific and legitimate purpose to do so; and
appropriate physical, technical, and organisational security measures are in place to protect the data against accidental loss and unauthorised access, use, alteration, or disclosure.
 
If you have any questions about how we handle special category data, please contact us using the details provided below.
 
User Rights
Under UK GDPR and Data Protection Act 2018, you may request to:
Receive confirmation as to whether or not personal information concerning you is being processed, and access your stored personal information, together with supplementary information (commonly known as a ‘data subject access request’).
Receive a copy of personal information you directly volunteer to us in a structured, commonly used, and machine-readable format (right to data portability).
Request rectification of your personal information that is in our control.
Request erasure of your personal information.
Object to the processing of personal information by us.
Request to restrict processing of your personal information by us.
Lodge a complaint with the Information Commissioner's Office (ICO), the UK's supervisory authority for data protection matters. The ICO can be contacted at: www.ico.org.uk, helpline 0303 123 1113, or by post at Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF.
 
However, please note that these rights are not absolute, and may be subject to our own legitimate interests and regulatory requirements.
 
We may need to verify your identity before acting on a request to ensure that personal information is not disclosed to any person who has no right to receive it.
 
No fee usually required
You will not have to pay a fee to exercise any of the above rights. However, we may charge a reasonable fee if your request is clearly unfounded, repetitive, or excessive. Alternatively, we may refuse to comply with your request in such circumstances.
 
If you wish to exercise any of the aforementioned rights, please use the details provided below:
Louise Skittrall
Email: louise@robinsongracehr.com
Tel: 01793 311937

Retention
We will retain your personal information for as long as necessary to provide our services, and as necessary to comply with our legal obligations, resolve disputes, and enforce our policies. Retention periods will be determined considering the type of information that is collected and the purpose for which it is collected, bearing in mind the requirements applicable to the situation and the need to destroy outdated, unused information at the earliest reasonable time.
 
As a general guide, we apply the following retention periods:
Client and prospective client records: retained for up to 7 years following the end of the business relationship, or from the date of the last contact, to comply with legal and contractual obligations.
HR documentation and correspondence processed on behalf of clients: retained in line with the relevant employment law requirements, typically up to 7 years following the end of the employment relationship to which the data relates.
Health and safety records: retained for as long as required by applicable regulations, which in some cases may be up to 40 years.
Website usage and analytics data: retained for as long as necessary for the operational purposes for which it was collected.
 
Under applicable regulations, we will keep records containing client personal data, account opening documents, communications, and anything else as required by applicable laws and regulations.
 
We may rectify, replenish, or remove incomplete or inaccurate information, at any time and at our own discretion. Once the applicable retention period has expired, we will securely destroy personal information in accordance with our data retention procedures.
 
Cookies
We and our trusted partners use cookies and other technologies in our related services, including when you visit our site or access our services.
 
A "cookie" is a small piece of information that a website assign to your device while you are viewing a website. Cookies are helpful and can be used for various different purposes. These purposes include allowing you to navigate between pages efficiently, enable automatic activation of certain features, remembering your preferences and making the interaction between you and our Services quicker and easier. Cookies are also used to help ensure that the advertisements you see are relevant to you and your interests and to compile statistical data on your use of our Services.
The site uses the following types of cookies:
'session cookies' which are stored only temporarily during a browsing session in order to allow normal use of the system and are deleted from your device when the browser is closed;
'persistent cookies' which are read only by the site, saved on your computer for a fixed period and are not deleted when the browser is closed. Such cookies are used where we need to know who you are for repeat visits, for example to allow us to store your preferences for the next sign-in;
'third party cookies' which are set by other online services who run content on the page you are viewing, for example by third party analytics companies who monitor and analyse our web access.
 
Cookies do not contain any information that personally identifies you, but Personal Information that we store about you may be linked, by us, to the information stored in and obtained from cookies. You may remove the cookies by following the instructions of your device preferences; however, if you choose to disable cookies, some features of our Site may not operate properly, and your online experience may be limited.
 
We also use a tool called “Google Analytics” to collect information about your use of the site. Google Analytics collects information such as how often users access the site, what pages they visit when they do so, etc. We use the information we get from Google Analytics only to improve our site and services. Google Analytics collects the IP address assigned to you on the date you visit sites, rather than your name or other identifying information. We do not combine the information collected through the use of Google Analytics with personally identifiable information. Google’s ability to use and share information collected by Google Analytics about your visits to this site is restricted by the Google Analytics Terms of Use and the Google Privacy Policy.
 
Third-party collection of information
Our policy only addresses the use and disclosure of information we collect from you. To the extent you disclose your information to other parties or sites throughout the internet, different rules may apply to their use or disclosure of the information you disclose to them. Accordingly, we encourage you to read the terms and conditions and privacy policy of each third party that you choose to disclose information to.
 
This Privacy Policy does not apply to the practices of companies that we do not own or control, or to individuals whom we do not employ or manage, including any of the third parties which we may disclose information as set forth in this Privacy Policy.
 
How do we safeguard your information?
We take great care in implementing and maintaining the security of the site and your information. We employ industry standard procedures and policies to ensure the safety of the information we collect and retain, and prevent unauthorized use of any such information, and we require any third party to comply with similar security requirements, in accordance with this Privacy Policy.
 
Although we take reasonable steps to safeguard information, we cannot be responsible for the acts of those who gain unauthorized access or abuse our site, and we make no warranty, express, implied, or otherwise, that we will prevent such access.
 
We have procedures in place to deal with any suspected personal data security breach and will notify you and any applicable regulator (including the ICO) of a suspected breach where we are legally required to do so.

Transfer of data outside the UK
Please note that some data recipients such as note transcribing apps or Sintra.ai, may be located outside the UK. In such cases we ensure that appropriate safeguards are in place and will transfer your data only to countries that benefit from a UK adequacy decision under UK GDPR, or where we have put in place appropriate alternative safeguards (such as standard contractual clauses or equivalent transfer mechanisms) to ensure your personal data receives an adequate level of protection. Where we transfer personal data to countries outside the UK that were previously recognised under EU adequacy decisions, we will also ensure compliance with UK GDPR transfer requirements.
 
Advertisements
We may use a third-party advertising technology to serve advertisements when you access the site. This technology uses your information with regards to your use of the Services to serve advertisements to you (e.g., by placing third-party cookies on your web browser).
 
You may opt-out of many third-party ad networks, including those operated by members of the Network Advertising Initiative ("NAI") and the Digital Advertising Alliance ("DAA"). For more information about this practice by NAI and DAA members, and your choices regarding having this information used by these companies, including how to opt-out of third-party ad networks operated by NAI and DAA members, please visit their respective websites: http://optout.networkadvertising.org/#!/ and http://optout.aboutads.info/#!/.
 
Marketing
We may use your Personal Information, such as your name, email address, telephone number, etc. ourselves or by using our third-party subcontractors for the purpose of providing you with promotional materials, concerning our services, which we believe may interest you. 
 
Out of respect to your right to privacy we provide you within such marketing materials with means to decline receiving further marketing offers from us. If you unsubscribe, we will remove your email address or telephone number from our marketing distribution lists.
 
Please note that even if you have unsubscribed from receiving marketing emails from us, we may send you other types of important e-mail communications without offering you the opportunity to opt out of receiving them. These may include customer service announcements or administrative notices.
 
Corporate transaction
We may share information in the event of a corporate transaction (e.g., sale of a substantial part of our business, merger, consolidation, or asset sale). In the event of the above, the transferee or acquiring company will assume the rights and obligations as described in this Privacy Notice.
 
Minors
We understand the importance of protecting children’s privacy, especially in an online environment. The site is not designed for or directed at children. Under no circumstances shall we allow use of our services by minors without prior consent or authorization by a parent or legal guardian. We do not knowingly collect Personal Information from minors. If a parent or guardian becomes aware that his or her child has provided us with Personal Information without their consent, he or she should contact us at: louise@robinsongracehr.com
 
Complaints
We take any complaints about how we collect, use, store, and retain personal information very seriously.
 
If you have any concerns about how we handle your personal data, we ask that you raise these with us in the first instance using the contact details below. We would welcome the opportunity to address your concern directly.
 
Upon receiving a complaint, we will:
acknowledge receipt of the complaint within 30 days of receiving it;
without undue delay, take appropriate steps to investigate and respond to the complaint;
keep you informed on the progress of the investigation; and
inform you of the outcome of the investigation without undue delay.
 
You also have the right to complain directly to the Information Commissioner's Office (ICO) at any time. The ICO is the UK's supervisory authority for data protection issues and can be contacted at: www.ico.org.uk, helpline 0303 123 1113, or by post at Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF.
 
Updates or amendments to this Privacy Policy
We reserve the right to periodically amend or revise the Privacy Notice; material changes will be effective immediately upon the display of the revised Privacy Notice. The last revision will be reflected in the "Last reviewed" date at the top of this Notice. Your continued use of the Platform, following the notification of such amendments on our website, constitutes your acknowledgment of such amendments to the Privacy Notice.

Question 2

Privacy Policy for Job Applicants

Accepted Answer

This privacy notice advises job applicants of the organisation’s commitment to data protection responsibilities of privacy and confidentiality relating to the collection and processing of their personal data.
 
Robinson Grace Consultancy Ltd (trading as Robinson Grace HR Consultancy) collects and processes an applicant’s personal data as part of the recruitment process in relation to the role they are applying for to assess skills, qualifications and suitability, to communicate with you about the recruitment process, to carry out background and reference checks, and to comply with legal and regulatory requirements.
 
All Managers have responsibility for ensuring that applicants’ personal data is held and processed in the correct way.
 
What is personal data?
Personal data is any information that relates to an applicant and can be used directly or indirectly to identify them, such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person (UK GDPR article 4).
 
Special categories of personal data means information about an individual’s racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, health, sex life or sexual orientation and biometric/genetic data (UK GDPR article 9).
 
Privacy by design
At the heart of the UK GDPR is the concept of "privacy by design" — an in-built accommodation of privacy in the organisation's systems and processes. This means:
a proactive rather than reactive approach — preventing privacy risks before they arise;
security as an integral part of the organisation's systems throughout their whole lifecycle, from active use through to archive and deletion;
visibility and transparency — being open about how and why personal data is used; and
·a user-centric approach — applicants' interests must be considered at all times.
 
Legal basis for using personal data
Robinson Grace Consultancy Ltd (trading as Robinson Grace HR Consultancy) collects personal data only for specified, explicit and legitimate purposes, whether or not by automated means, such as collection, recording, storage, retrieval, use, disclosure, dissemination, erasure or destruction (UK GDPR article 4).
 
The organisation processes personal data lawfully, only where it is adequate, relevant and limited to what is necessary for the purposes of processing.
 
The organisation keeps accurate personal data, only for the period necessary for processing, and takes all reasonable steps to ensure that inaccurate personal data is rectified or deleted without delay.
 
The organisation adopts appropriate measures to make sure that personal data is secure, and protected against unauthorised or unlawful processing, accidental loss, destruction or damage.
 
This is done to ensure a candidate is suitable for the role and to make sure reasonable adjustments can be made for those applicants who have a disability.
 
Processing of personal data ensures that a fair recruitment process has taken place.
 
The organisation will not process personal data of applicants for reasons other than the recruitment and selection process.  Where special categories of personal data or criminal records data are processed to perform obligations, this is done for legal reasons. Personal data will be updated promptly if an applicant advises that their information has changed or is inaccurate.
 
To operate an effective recruitment process, the organisation will collect and store personal data an applicant submits as part of the application process. 
 
The organisation processes applicants’ personal data primarily based on its legitimate interests in managing effective recruitment and selection process and to take steps at the request of the applicant prior to entering into a contract of employment.
 
In some cases, the organisation will also process personal data to comply with its legal obligations (such as checking entitlement to work in the UK).
 
Where we process any special category data (such as health information or equal opportunities monitoring) we will do so based on employment, social security and social protection law or substantial public interest in accordance with Uk data protection legislation. Applicants are not obliged to provide all the personal data requested, but if they chose not to do so, the organisation may be unable to properly assess their application or proceed with the recruitment process.
 
In some cases, the organisation will need to process data to ensure that it is complying with its legal obligations. For example, an applicant’s entitlement to work in the UK must be checked.
 
Data held on applicants
The personal data held regarding applicants can include, but is not limited to, information such as:
Name and address.
Email address and telephone number.
Date of birth if it appears on the application.
Equal opportunities monitoring information.
Nationality and entitlement to work in the UK.
National Insurance number if it appears on the application.
Information about current salary and benefits.
Qualifications and skills.
Work experience and employment history.
Information applicants may have disclosed about their criminal record.
Disability status to enable the organisation to make any reasonable adjustments throughout the recruitment process.
 
We may collect this information from you or indirectly from third parties such as recruitment agencies, online job boards, where this is relevant to your application. Any applicant wishing to see a copy of the information about them that the organisation holds should contact the organisation.
 
The organisation may collect and process special category data about applicants where this is necessary (such as health, or disability to consider reasonable adjustments during the recruitment process, or equal opportunities monitoring). This processing is carried out in accordance with Article 9 UK GDPR and the relevant conditions in Schedule 1 of The Data Protection Act 2018.
 
Where a role requires it, the organisation may also collect information about criminal convictions and offences (such as DBS checks). This will only be done where it is lawful, necessary and proportionate for the role in question.
 
Who has access to an applicant’s personal data?
Personal data may be shared internally with other members of staff involved in the recruitment process for them to perform their roles. The organisation may also share an applicant’s data with a client’s Hiring Manager who has specific responsibility for the recruitment of the vacancy/vacancies advertised, and relevant third parties such as Applicant Tracking System providers.
 
Throughout the recruitment process the organisation maintains strict confidentiality and only processes and retains personal data of unsuccessful applicants for up to 12 months before being deleted or destroyed so that we can demonstrate that we have conducted a fair and non-discriminatory process. Equal Opportunities Monitoring may be retained beyond 12 months, but in an anonymised format.
 
For successful applicants, data is moved into our systems used for employee records, and the employee Privacy Notice should be referred to.
 
How is an applicant’s personal data protected?
Robinson Grace Consultancy Ltd (trading as Robinson Grace HR Consultancy)’s servers and storage systems are based within the UK. Where personal data is transferred to a country outside the UK, the organisation will ensure that appropriate safeguards are in place in accordance with UK GDPR transfer requirements, for example, by transferring only to countries that benefit from a UK adequacy decision, or by putting in place appropriate transfer mechanisms such as standard contractual clauses.
 
The organisation takes the security of personal data very seriously. Internal policies and controls are in place to try to ensure that data is not lost, accidentally destroyed, misused or disclosed, and is not accessed except by employees in the performance of their duties.
 
Where the organisation engages third parties to process personal data on its behalf, they do so based on written instructions, are under a duty of confidentiality and are obliged to implement appropriate technical and organisational measures to ensure the security of data. For example, the organisation ensures that it uses encrypted devices, uses passwords, virus protection and has appropriate firewalls.
 
The organisation has procedures in place to deal with any suspected personal data security breach and will notify affected individuals and the Information Commissioner's Office (ICO) where required to do so by law.
 
What rights does an applicant have in relation to their information?
Applicants will have the following rights in relation to their personal data:
The right of access to the personal data and supplementary information. This right is to enable applicants to be aware of and verify the lawfulness of the personal data being processed.
The right to rectification. This right allows applicants to have personal data rectified if it is inaccurate or incomplete.
The right to erasure. This is also known as the ‘right to be forgotten’. This is not an absolute right and applies in specific circumstances.
The right to restrict processing. This right applies in circumstances where, for example, the data subject contests the accuracy of the data or challenges the public interest or legitimate interest basis. Further guidance can be obtained from the ICO’s website.
The right to data portability. This allows individuals to obtain and reuse their personal data for their own purposes.
The right to object. Individuals have the right to object to:
Processing based on legitimate interests or the performance of a task in the public interest/exercise of official authority.
Direct marketing.
Processing for scientific/historical research and statistics.
Rights in relation to automated decision making and profiling.
 
Applicants have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal or similarly significant effects. Where automated decision making is used in the recruitment process, applicants will be informed and have the right to request human review of the decision.
 
These rights are not absolute and may be subject to certain conditions and exemptions. If you wish to exercise these rights, please contact the Data Privacy Manager. The organisation will respond to any such request without undue delay and in any event within one month of receipt. This period may be extended by a further two months where requests are complex or numerous, in which case the organisation will inform the applicant within one month of receiving the request.
 
No fee usually required
Applicants will not usually have to pay a fee to exercise any of the rights listed above. However, the organisation may charge a reasonable fee if a request is clearly unfounded, repetitive, or excessive. Alternatively, the organisation may refuse to comply with the request in such circumstances.
 
Further guidance and advice on the above rights can be obtained from the ICO’s website https://ico.org.uk/for-organisations/guide-to-the-general-data-protection-regulation-gdpr/individual-rights/.
 
This notice may be updated from time to time. The version in force at the time you submit your application will apply to our use of your personal data.
 
Complaints
The organisation takes complaints about how it collects, uses, stores and retains personal data very seriously.
 
If an applicant has a concern about the way personal data is being collected or used, the organisation asks that they raise their concern in the first instance by contacting the Data Privacy Manager [insert contact name, address and email details].
 
Upon receiving a complaint, the organisation will:
acknowledge receipt of the complaint within 30 days of receiving it;
without undue delay, take appropriate steps to investigate and respond to the complaint, including making appropriate enquiries based on the circumstances;
keep the applicant informed of the progress of the investigation; and
inform the applicant of the outcome of the investigation without undue delay.
 
Alternatively, an applicant has the right to lodge a complaint directly with the Information Commissioner's Office (ICO), the UK's supervisory authority for data protection matters, at any time. The ICO can be contacted as follows:
Website: https://ico.org.uk/concerns
Telephone: 0303 123 1113
Post: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

Privacy Policies

Privacy Policy

Privacy Policy for Job Applicants