Privacy Policy – United Kingdom & Europe

FUTURELINK GLOBAL RECRUITMENT LTD

PRIVACY POLICY – UNITED KINGDOM AND EUROPE

Last updated: March 2024

This Privacy Policy may change from time to time based on the structure of our business and changes in the applicable law. Any changes to the Privacy Policy will be reflected on our web page.  Therefore, should you wish to stay up to date with regards to our Privacy Policy, please visit our web page regularly.

INTRODUCTION

Futurelink Global Recruitment Ltd, registration number 13926332 (UK) (‘Futurelink’) is a Recruitment Agency, operating under the Employment Agencies Act 1973. We offer job placement services to both our employer clients and candidates. Futurelink handles personal data, including sensitive personal data, when required, in order to deliver these services. In this role, Futurelink operates as a data controller.

At Futurelink, protecting the privacy of our candidates, employer clients, suppliers and website users is one of our main concerns. This Privacy Policy sets out how we collect, use and process your personal data in compliance with our legal obligations. By engaging with Futurelink, whether as a candidate, employer client, supplier or website user, you are entrusting us with your personal information, and we are committed to keeping that confidence.

We are dedicated to safeguarding the personal data from misuse, damage, loss, or unauthorised access by implementing suitable technical and organisational measures, including but not limited to actions to address any suspected data breach.

Futurelink functions under applicable data protection legislation, including the General Data Protection Regulation (‘GDPR’) and the UK GDPR.

WHO CONTROLS YOUR DATA

The data controller is Futurelink. Futurelink is registered as a data controller with the Information Commissioner’s Office. Certificate number: ZB501919.

You can write to us at the following address: 71-75 Shelton Street, Covent Garden, London, United Kingdom, WC2H 9JQ c/o Data Controller. Alternatively, you can email us at: futurelink@futurelink.co.za.

The Information Commissioner’s Office can be contacted through their website.

WHAT IS PERSONAL DATA

Personal data is any information which is related to an identified or identifiable individual. Personal data is split into the following two categories:

General Personal Data 

General personal data includes the following information concerning a data subject:

  • name;
  • identification number;
  • location data;
  • telephone number; and
  • online identifiers.

Sensitive Personal Data

Sensitive personal data includes the following information concerning a data subject:

  • genetic, biometric and health data;
  • racial and ethnic origin;
  • political opinions;
  • religious or ideological convictions;
  • trade union membership; and
  • criminal records.

DATA PROTECTION PRINCIPLES

The data protection laws and regulations require that Futurelink protect data subjects (employer clients, candidates and in certain instances website users) with regard to the processing of their personal data by:

  • processing personal data lawfully and fairly, on the basis of the data subject’s consent or another specified basis;
  • conferring rights on the data subject to obtain information about Futurelink’s processing of personal data;
  • ensuring that personal data is collected for a disclosed and legitimate purpose;
  • ensuring that personal data is accurate and ensuring that information which is inaccurate is erased or rectified immediately;
  • ensuring that personal data is retained by Futurelink only for the period which is necessary for the purpose for which the personal data is processed; and
  • ensuring that the manner in which the personal data is processed has been properly secured including utilising the proper organisational or technical safeguards to provide protection against accidental loss, damage, or destruction as well as against unauthorised or unlawful handling.

PRIVACY NOTICES

A Privacy Notice shall be provided to a data subject if Futurelink:

  • collects personal data directly from individuals;
  • collects personal data from third parties (in which case the Privacy Notice will be provided to the data subject timeously);
  • intends disclosing the data subject’s personal data to a third party (in which case the Privacy Notice will be provided at or before the time of disclosure);
  • intends using the data subject’s personal data for an alternative purpose which has not been disclosed to the data subject (in which case the new purpose will be communicated to the data subject before proceeding with further processing.

WHAT KIND OF PERSONAL DATA DO WE COLLECT

Subject to consideration of the circumstances surrounding the collection of personal data, Futurelink may collect a selection of the following information:

Identification and Contact Details

  • full name;
  • address;
  • contact information (email address and mobile number);
  • age or date of birth;
  • gender identity and preferred pronouns;
  • photograph (optional and if required for specific purposes);
  • next of kin (emergency contact) and family details (if necessary for emergency purposes);
  • nationality, citizenship, or place of birth;
  • copy of identification documents such as passport, identity card, and / or National Insurance number;
  • copy of your driver’s license (if relevant);

Education and Employment Details

  • education details and qualifications attained;
  • employment history, including previous roles and responsibilities;
  • current job title, specialisation, or industry sector;
  • current job title / specialism / industry sector;
  • skills and languages spoken;
  • details of referees who can provide information about your work experience;
  • information obtained from pre-employment checks conducted by third parties;
  • immigration status, including whether you require a work permit and relevant documentation;
  • start date or availability date, including any notice period required to be served at your current job;
  • details about your previous and current remuneration, pension contributions, and benefits arrangements; and
  • your interests and preferences regarding future employment opportunities;

Financial Information

  • bank details for payment purposes; and
  • financial information necessary for conducting background checks, if applicable;

Sensitive Information

for purposes of diversity and inclusion monitoring, Futurelink may collect details including but not limited to:

  • racial and ethnic origin;
  • sexual orientation;
  • religious beliefs; and
  • physical or mental health, including disability-related information;

Criminal Conviction Data

  • details of any criminal convictions, if these are required for the role that you are interested in;

Automatically Collected Information

  • email engagement history with Futurelink; and
  • location information (inferred from jobs, application history or system stored data);

Information that Others Provide About You

  • additional information that your references may elect to disclose about you; and
  • additional information that we find from third party sources to which you have voluntarily uploaded information;

Additional Information that You Elect to Disclose

  • any other information that you may disclose to Futurelink when communicating via interview, email or otherwise.

The above list of categories of personal data we collect is not exhaustive.

HOW DO WE COLLECT YOUR PERSONAL DATA

Personal Data Provided by You

  • completing the Futurelink registration form, as part of our application process;
  • submitting your curriculum vitae (cv), whether in hardcopy or electronically;
  • providing copies of other documents like education certificates, in hardcopy or electronically;
  • sharing information via email with Futurelink;
  • providing information during interviews (phone, video, or in-person) with Futurelink; and
  • engaging in telephone conversations with Futurelink;

Personal data received from other sources

  • obtaining personal data from sources such as our clients, suppliers, candidates, and colleagues within Futurelink;
  • collecting information from third-party sources such Linkedin and other job sites or boards when searching for candidates;
  • receiving personal information from your referees;
  • obtaining your personal data from Futurelink’s social media platforms (e.g., Linkedin, Facebook, Instagram) if you interact with us by ‘liking’ or ‘following’ our pages; and
  • gathering information from the public domain.

THE USE AND PROCESSING OF PERSONAL DATA

Futurelink’s right to process personal data is based on one or more of the following legal grounds concerning data processing:

Consent

The data subject has given consent to the processing of his or her personal data for one or more specific purposes;

Contractual Obligation

Processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract;

Legal Obligation

Processing is necessary for compliance with a legal obligation to which the controller is subject;

Vital Interests

Processing is necessary in order to protect the vital interests of the data subject or of another natural person;

Performance

Processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the data controller;

Legitimate Interests

Processing is necessary for the purposes of the legitimate interests pursued by the data controller or by a third party (such as protecting our business interests, marketing, addressing complaints, preventing and detecting fraud, etc.)  provided that the legitimate interests of Futurelink are not outweighed by the interests or fundamental rights and freedoms of the data subject.

HOW FUTURELINK WILL USE AND PROCESS YOUR PERSONAL DATA

Futurelink will use the data subject’s personal data to facilitate the following business activities and/or obligations as they may arise:

Pre-Recruitment Activities

Personal data including during the pre-recruitment phase shall be used to evaluate the candidate’s particular interests and to assess the way in which Futurelink might be able to assist the candidate. Once establishing this, Futurelink will then contact the candidate directly to offer its services. Below are the various ways Futurelink may utilise and process the data subject’s personal data for purposes of its pre-recruitment activities:

  • collecting and processing data to assess interest in recruitment services (collecting data from candidates and third-party sources and appropriately storing the collected data and reviewing data in comparison to vacancies);
  • collecting and processing data to identify how Futurelink services may assist; and/or
  • collecting and processing data for communication purposes.

The processing of personal data obtained by virtue of the above activities is permitted by the applicable data protection laws and regulations as it is necessary for Futurelink’s legitimate interests in pursuing the purposes set out above, and such interests in each case are not outweighed by your privacy interests or fundamental rights; or necessary for compliance with certain legal obligations.

Recruitment Activities

Below are the various ways Futurelink may utilise and process the data subject’s personal data for purposes of its recruitment activities:

  • collection and processing of data for recruitment services (collecting data from candidates and other third-party sources, storing and reviewing the collected data in comparison to vacancies, sending candidates’ information to clients for job applications or eligibility assessments and enabling candidates to submit CVs, apply online for jobs, or subscribe to job alerts);
  • processing data for payroll and invoicing purposes;
  • communicating with candidates for support purposes (addressing issues and improving recruitment services based on feedback);
  • fulfilling obligations arising from contracts (meeting obligations under agreements with third parties, such as potential employers); and/or
  • verifying details provided by candidates (obtaining references, qualifications, and potentially criminal conviction information).

The processing of personal data obtained by virtue of the above activities is permitted by the applicable data protection laws and regulations as it is necessary for Futurelink’s legitimate interests in pursuing the purposes set out above, and such interests in each case are not outweighed by your privacy interests or fundamental rights; necessary for compliance with certain legal obligations; and/or necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract.

Equal Opportunity Monitoring

Futurelink is responsible for ensuring that our recruitment processes align with equal opportunities standards. Futurelink processes certain sensitive data in order to facilitate the above obligation as follows:

  • collecting and analysing candidates’ data for equal opportunities compliance (this information includes details of racial or ethnic origin, sexual orientation, religious or other similar beliefs, physical or mental health, including disability-related information);
  • where required in terms of a contractual obligation, the sharing of candidates’ data for equal opportunities compliance with clients (this may be required by the client in order to comply with their own internal policy in which case, the candidate’s express consent is required before sharing this data);
  • processing medical history/health-related data to make reasonable adjustments during the recruitment process including circumstances when we need to use or offer occupational health to candidates in the context of certain types of roles;
  • processing criminal convictions data for background checks (the data subject’s express consent is requirement provided that the background check is required by law in which case the process may be carried out without consent);
  • processing certain types of personal data to calculate entitlement to annual leave (this includes medical history and may in some cases include religious affiliations); and/or
  • processing sensitive/special category personal data of individuals connected with candidates (this includes details of sexual orientation, physical or mental health, including disability-related information).

The processing of personal data obtained by virtue of the above activities is permitted by the applicable data protection law as it is necessary for Futurelink’s legitimate interests in pursuing the purposes set out above, with a specific focus on equal opportunities monitoring, and such interests in each case are not outweighed by your privacy interests or fundamental rights; and should local laws and regulations require Futurelink to obtain consent, Futurelink shall obtain consent accordingly.

To Help Us Establish, Exercise or Defend Legal Claims

Futurelink, as data controller, has the right to process personal data relating to sensitive data, if said processing is necessary for the establishment, exercise or defence of legal claims or whenever courts are acting in their judicial capacity.

Futurelink may be required to enforce the above right when seeking legal counsel for legal proceedings or when required by law to disclose specific information as part of the legal procedure.

SHARING OF PERSONAL DATA

While Futurelink may share a data subject’s personal data in in numerous ways, Futurelink shall mainly provide details to potential employers to enhance a candidate’s opportunity of getting the desired job. The purpose of processing and disclosing the candidate’s data to third party recipients is permitted by the applicable data protection law as it is:

  • necessary to conclude and perform any contracts entered into with you, such as sharing information with potential employers;
  • necessary for compliance with legal obligations, such as providing data to tax authorities or other regulatory bodies;
  • necessary to help establish, exercise, or defend legal claims, such as sharing information with professional advisors;
  • consent will be obtained before sharing sensitive information; and/or
    • necessary for carrying out obligations and exercising specific rights in the field of employment law.

Where appropriate and in accordance with local laws and regulations, we generally share your personal data with the following categories of people:

Group Companies and Colleagues within Futurelink

This includes entities such as Futurelink Permanent Placements (South Africa) and Futurelink Flexible Staffing (South Africa), which are part of our corporate group and colleagues within the various entities which will assist in facilitating the various aspects of our services;

References and Application Related Individuals/Organisations

We may disclose your information to individuals or organisations holding records regarding your references or application for a job with us, such as employers (past or present), educators, licensing authorities, and employment/recruitment agencies;

Service Providers

This includes third-party service providers who perform functions on our behalf, such as external consultants, business associates, professional advisers (e.g., lawyers, auditors, accountants), administration and technical support functions, and IT consultants involved in testing and development work on our business technology systems, IT and Document Storage Provides, and third-parties responsible for conducting relevant background checks;

Potential Employers

Your data may be shared with potential employers to increase your chances of securing suitable job placements;

Job Boards, Platforms and Aggregators

We may share data with job boards, platforms, aggregators, software providers, and cloud-based databases to maximise the likelihood of sourcing the appropriate job for the candidate; and

Internal and External Auditors of Clients

In compliance with contractual or regulatory obligations, we may share data with internal and external auditors of our clients upon request.

DATA RETENTION PERIOD

When considering the retention period for the various categories of personal data, Futurelink will consider how long the data is needed for the purpose for which it was collected. In addition to this Futurelink will consider the sensitivity of the data, nature of the data and the potential risk of harm arising from a data breach.

The following paragraphs set out the general retention policy that will apply:

Candidates

Personal data will be retained for a minimum of two years from the date upon which it was collected.

Employer Clients and Suppliers

Futurelink will retain the personal data of its employer clients and suppliers in order to be able to continue providing or receiving services. Should a employer client or supplier expressly advise that they are not interested in Futurelink’s services, Futurelink shall delete the relevant information provided that we do not have legitimate grounds to retain it.

PERSONAL DATA RIGHTS

Candidates, employer clients, suppliers and website users retain the following rights regarding their person data, even after said personal data has been provided to Futurelink:

Right to Object

You can object to Futurelink processing your personal data, in which case processing must cease immediately provided that we do not have compelling legitimate grounds or legal claims that override your interests;

Right to Withdraw Consent

Consent can be withdrawn at any time, in which case Futurelink shall stop the data processing activity unless there is an alternative justification for processing which shall be disclosed to you in writing;

Data Subject Access Requests (DSAR)

You have the right to request certainty regarding what data is held by Futurelink, and to request for certain amendments to and/or deletions of data;

Right to Erasure

In order for Futurelink to comply with a request for the deletion of data, one of the following requirements must be met:

  • the data is no longer necessary for the purpose for which Futurelink originally collected and/or processed it;
  • you have withdrawn your consent to Futurelink processing your data, and there is no other valid reason for us to continue processing;
  • the data has been processed in a manner that does not comply with the GDPR;
  • it is necessary for the data to be erased in order for Futurelink to comply with its legal obligations; and/or
  • if Futurelink has no legitimate or legal grounds for the continued processing of the data.

Under certain circumstances, Futurelink has the right to refuse to comply with a request for erasure of your personal data for the following reasons:

  • to exercise the right of freedom of expression and information;
  • to comply with legal obligations or for the performance of a public interest task or exercise of official authority;
  • for public health reasons in the public interest;
  • for archival, research, or statistical purposes; and/or
  • to exercise or defend a legal claim.

Right to Restrict Processing

This involves the right for a data subject to request that Futurelink limit the processing of your personal data in the following circumstances:

  • the accuracy of the personal data is contested by the data subject, for a period enabling Futurelink to verify the accuracy of the personal data;
  • the processing is unlawful and the data subject opposes the erasure of the personal data and requests the restriction of their use instead;
  • Futurelink no longer needs the personal data for the purposes of the processing, but they are required by the data subject for the establishment, exercise or defence of legal claims; and/or
    • the data subject has objected to processing pending the verification whether the legitimate grounds of the controller override those of the data subject.

Right to Rectification

You can request correction of inaccurate or incomplete data. Futurelink will convey the changes to  third parties to the extent it is practicable to do so. If it is reasonable for Futurelink not to comply with your request, an explanation will be provided to you in writing;

Right of Data Portability

You have the right to transfer your data between data controllers. This is applicable to automatically processed data, provided by the data subject or processed on the basis of consent or contractual fulfilment; and

Right to Lodge a Complaint

Should you believe that any of your privacy rights have been infringed upon, you have the right to lodge a complaint with your local supervisory authority.

To exercise rights or withdraw consent, contact us. We will promptly respond within one month. It is crucial to keep your information up to date, so please inform us of any changes.

HOW DOES FUTURELINK STORE AND TRANSFER DATA INTERNATIONALLY

Futurelink implements the following measures when transferring your data:

Internal Transfers

Your data may be transferred between and within Futurelink entities, including Futurelink Permanent Placements (South Africa) and Futurelink Flexible Staffing (South Africa), subject to compliance with all applicable data protection laws and regulations;

Third-Party Transfers

Your data may be shared with third parties such as sub-processors, advisers or other business suppliers. We establish appropriate procedures with these parties to ensure compliance with data protection regulations.

Overseas Clients

Data may be transferred to overseas employer clients, subject to compliance with applicable data protection laws and regulations;

Cloud-Based Storage

Data may be stored in cloud-based storage providers, with measures in place to safeguard your data.

For data transfers outside the European Economic Area (EEA), we ensure compliance with data protection laws and regulations through various means:

Standard Contractual Clauses

We use data transfer agreements incorporating the standard contractual clauses adopted by the European Commission;

Adequacy Decisions

We transfer data to countries with adequacy decisions from the European Commission regarding their data protection laws and regulations;

Approved Schemes

We may utilise schemes approved by the European Commission for regulating data exchanges between jurisdictions;

Contractual Obligations

Data transfers outside the EEA may occur to fulfil contractual obligations, with your interests and consent considered;

Consent

Your explicit consent may be obtained for data transfers outside the EEA, excluding Internal Transfers, which you are deemed to have hereby consented to when engaging Futurelink.

We ensure that third parties handling your personal data adhere to applicable data protection laws and regulations and respect your privacy rights. In the event of Futurelink undergoing any change of control, such as a sale or merger, where data transfer is necessary, it will be subject to compliance with our Privacy Notice and relevant data protection laws and regulations.

THIRD PARTY SERVICES

While using our services, candidates, clients and website users may encounter certain websites and third-party services, such as job platforms and marketing strategies, that are not associated with us. These independent sources operate outside of our control, and accordingly, it is your responsibility to assess the safety of said independent sources.

Should we engage with third party service provides to process personal data obtained by us as the data controller, these third-party service providers will act in accordance with their own privacy policies. Futurelink uses a range of third-party sub-processors, including but not limited to those listed below, to assist in connection with recruitment services (who will also store, process, manage and protect your data).

Third Party Sub-ProcessorService Details
VincereCRM System
BroadbeanData analytics software, job distribution and multi-posting technology
XeroFinance / invoicing
Sage VIPFinance / invoicing
Pastel PayrollFinance / invoicing
Smyth & Co.Accountants
DocusignElectronic signature solution
iDriveOnline cloud backup
MicrosoftEnd-user productivity software
GoogleInternet browser
LinkedInSocial media platform
InstagramSocial media platform
FacebookSocial media platform
BTInternet services to support recruitment processes
EEMobile and network services to support recruitment processes