Who we are?
The Xcede Group will process your personal information in accordance with applicable data protection laws, including the, the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 (DPA 2018) and, where applicable, the EU General Data Protection Regulation (EU GDPR) and other jurisdiction specific data protection legislation.
What we do
We are a global technology recruitment service which provides work-finding services to its clients and work-seekers. We and our related entities are committed to protecting the privacy and security of the Personal Data we process about you. All companies under the Xcede Group collect the same Personal Data. The only differences between the companies are the sectors they recruit within.
This Privacy Notice applies to the entire Xcede Group:
• Xcede Global Holdings Limited
• Xcede Limited
• Earthstream Global Limited
• Xcede Group Inc
1. The purpose of this Privacy Notice
It is important that you read this Privacy Notice together with any other Privacy Notices we provide on specific occasions when we are collecting or processing Personal Data about you so that you are fully aware of how and why we are using your data. This Privacy Notice supplements the other Privacy Notices and is not intended to override them.
Who this privacy notice applies to
This privacy notice applies to you if:
• You visit our website
• You are a current client or prospective client of ours.
• You enquire about our services.
• You sign up and create an account on our website.
• You are applying for a role Xcede is advertising, or applying to be a candidate for a role that is yet to be found.
• You are an existing contract employee placed in an Xcede Group client organisation.
• You sign up to receive newsletters and/or other promotional communications from us.
2. What is Personal Data
The term “Personal Data” means any information relating to you that identifies you, or through which you can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, or an online identifier or to one or more factors specific to you physical, physiological, genetic, mental, economic, cultural or social identity.
The term “Special Category Personal Data” is Personal Data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data for the purpose of uniquely identifying someone, criminal records, data concerning health and data concerning a person’s sex life or sexual orientation.3. Why we collect your Personal Data and the Type of Data Collected
We collect your Personal Data for the purpose of providing you with Xcede recruitment services as an employer/client or as a candidate.
We will collect data about you, both personal data (such as your name and contact details) and, in some cases, Special Category Personal Data (such as information about your health or disability which is needed for the purpose of making reasonable adjustments for you during the recruitment process or to find out whether you would be able to undertake a function which is intrinsic to the job). Depending on the relevant circumstances and applicable local laws and requirements, we may collect:
• Business email address and telephone number.
• CVs, cover letters, and Application forms.
• Name.
• Date of birth.
• Next of kin details
• Email address.
• Residential address.
• Phone number.
• Visa details and copies of passports.
• Bank or building society account details.
• Details of job role and salary including data held on staff organisation charts.
• Pension information.
• Records concerning appraisal and training.
• Sickness and other absence details.
• Contracts or terms and conditions of employment.
• Correspondence between you and Xcede Group
• Correspondence, such as references, between Xcede Group and third parties in relation to your employment.
• Visual images, for example if CCTV images are used as part of building security
• Records of grievances.
• Investigations into breaches of terms and conditions of employment.
• Records of disciplinary proceedings.
• Health and safety records (including accident reports).
• In some departments, workload and work allocation.
• Where appropriate, audio and/or video recordings of lectures, presentations and workshops and team incentives.
• During our interviews, information about your personal life, including family, place of residence, personal background, education, job experience, views and opinions on situations and the workplace, preferences.
4. Security checks - as part of your recruitment process in order to carry out DBS, eligibility to work and additional checks for successful candidates. This will include your name, proof of address, and your passport. How we collect your Personal Data
We collect most of the Personal Data directly from you in person, by telephone, text or email and/or via our website.
However, we may also collect your Personal Data from third parties such as:
• reputable companies who provide lead generation contact lists or data enrichment services.
• others to whom you have provided consent
• publicly available sources such as social media platforms, including:
• Applicants found on the job board via the CV search function
If we find you on the job board, you will have already provided your contact details in order to apply for prospective jobs.
• Applicants found on LinkedIn
If we find you on LinkedIn, you will have already provided your employment history on your LinkedIn profile.
5. Our Lawful Bases for Processing your Personal Data
The UK GDPR and the EU GDPR (our global standards of data protection compliance) requires that a controller must have a lawful basis for processing Personal Data. In most instances, our lawful bases for processing your personal information are:
• The processing is necessary for the performance of a contract to which you are a party, or in order to take steps at your request, prior to entering into a contract. This is where you engage with the Xcede Group such as by applying directly on the website, job boards, or LinkedIn, with a view to securing an employment contract with the prospecting employer.
• The processing is necessary for our legitimate interests in providing you with services in order to receive, process and provide you with a response to your enquiries made through our website or phone, or when you download materials from our website such as Salary Surveys and any other guides.
• We need to comply with a legal obligation. For example, this is where the law requires us to obtain Personal Data in relation to things like work permit and DBS checks, making reasonable adjustments, and in relation to maintaining personal and financial records according to the relevant legislation;
• It is necessary for our legitimate interests (or those of a third party, including you). Under this lawful basis, we’ll process your personal data to provide you with high-standard recruitment services, including providing feedback regarding your unsuccessful application and contacting you regarding job positions we think may be of your interest, both for our internal recruitment services and when recruiting for our company clients. If you’re a business, we may also send you marketing content under the legitimate lawful basis, or contact people within your organisation to generate leads and upscaling our selling process.
• We have your consent. This is where you agree either in writing or verbally for us to store and process your Personal Data for our marketing purposes – including sending you newsletters, invitations to our webinars/events, and obtaining analytical insights about how you interact with our website, connecting your LinkedIn account with our portal, and to contact you with potential jobs available.
6. Data Sharing and International Transfers.
In order to provide our services, we may need to transfer and process your personal data in a country different to where you are located. We take appropriate steps to ensure appropriate safeguards are in place.
If you are not in a country listed below, we confirm that we take steps to protect any Personal Data transferred to any countries outside your country of residence and ensure that it is lawful to do so.
If you are in the UK
We confirm that we take appropriate steps to ensure that any Personal Data processed outside the UK does not have a materially lower level of protection to that guaranteed in the UK. We do this by ensuring that:
• Your Personal Data is only processed in a country which the Secretary of State has confirmed has an adequate level of protection (an adequacy regulation); or,
• We enter into an International Data Transfer Agreement (“IDTA”) with the receiving organization and adopt supplementary measures, where necessary.
• When transferring your Personal Data to America, we may rely on the UK-US Data Bridge where appropriate.
If you are in the EEA
We confirm that we take appropriate steps to ensure that any Personal Data transferred outside the EEA has an essentially equivalent level of protection to that guaranteed in the EEA. We do this by ensuring that:
• Your Personal Data is only processed in a country which the European Commission has confirmed has an adequate level of protection (an adequacy decision); or
• We enter into Standard Contractual Clauses (“SCCs”) with the receiving organizations and adopt supplementary measures, where necessary.
If you are in the United States of America
There are no restrictions relating to cross border transfers but we, nonetheless, take appropriate steps to ensure that your Personal Data is suitably protected when it is transferred outside of the United States of America[LL2.1].
.
Your Personal Data may be shared as follows:
• Service Providers
This can include data hosting and database management systems that we use to store data, finding prospective candidates and sharing that information with our clients, including recruitment platforms (Headhunt, Daxtra, Broadbean) DBS checking companies CRM systems, and our internal data management providers.
• Sharing data with prospective employers and other third parties
This is essential to carry out our business and place candidates.
• Data transfer due to a legal obligation
If we are obligated to transfer your Personal Data to a third party based on a legal obligation or in order to comply with applicable laws and governmental bodies, we will only do so in accordance with those laws (i.e. DPA 2018, EU GDPR and UK GDPR). This may include for example, defending or pursuing legal claims, investigating fraud and co-operating with criminal investigations, such as complying with a subpoena, or similar legal process, or with the ICO (UK) or other Data Protection Supervisory Authorities.
7. Marketing
With your consent, we may contact you via email or phone to promote our services, send you newsletters, and invite you to webinars/events. To start or stop receiving marketing from us, simply contact us via our job website portal, let us know through the phone, use the unsubscribe button placed on our communications[LL3.1] or email us directly at Unsubscribe@xcedegroup.com.
To fulfil our legitimate interests, we rely on third-party B2B databases to provide us with prospect contact details and data enrichment services to enable us to reach out to relevant people with decision-making powers inside prospect organisations. We only receive corporate identifiers such as name, corporate email address and phone number, role, location of work, seniority degree and organisation.
If you choose to unsubscribe from any or all marketing, we may retain information sufficient to identify you so that we can honour your request.
8. How long we will keep your Personal Data
We will retain your personal data for as long as is necessary to provide you with our services and for a reasonable period thereafter to enable us to meet our contractual and legal obligations and to deal with complaints and claims.
At the end of the retention period, your personal data will be securely deleted or anonymised, for example by aggregation with other data, so that it can be used in a non-identifiable way for statistical analysis and business planning.
9. Your Rights & How to Exercise your Rights
You have certain rights in relation to the processing of your Personal Data. The specific rights available to you depend on your country of residence.
If you are in any country not listed below, we confirm that we will process your Personal Dat[LL5.1]a in accordance with the applicable law.
United Kingdom and European Economic Area
If you live in the UK, we comply with the UK General Data Protection Regulation (“UK GDPR”).
If you live in the EU, we comply with the EU General Data Protection Regulation (“EU GDPR”).
You have the following rights in relation to the processing of your Personal Data, including:
• Right to be informed
You have the right to know what personal data we collect about you, how we use it, for what purpose and in accordance with which lawful basis, who we share it with and how long we keep it. We use our privacy notice to explain this.
• Right of access (commonly known as a “Subject Access Request”)
You have the right to receive a copy of the Personal Data we hold about you.
• Right to rectification
You have the right to have any incomplete or inaccurate information we hold about you corrected.
• Right to erasure (commonly known as the right to be forgotten)
You have the right to ask us to delete your Personal Data.
• Right to object to processing
You have the right to object to us processing your Personal Data. If you object to us using your Personal Data for marketing purposes, we will stop sending you marketing material.
• Right to restrict processing
You have the right to restrict our use of your Personal Data.
• Right to portability
You have the right to ask us to transfer your Personal Data to another party.
• Automated decision-making. You have the right not to be subject to a decision based solely on automated processing which will significantly affect you. We do not use automated decision-making.
• Right to withdraw consent
If you have provided your consent for us to process your Personal Data for a specific purpose, you have the right to withdraw your consent at any time. If you do withdraw your consent, we will no longer process your information for the purpose(s) you originally agreed to, unless we are permitted by law to do so.
If you are in the United States of America
Residents of certain U.S. states may have rights regarding their personal information under applicable state privacy laws. Depending on your state of residence and subject to applicable exemptions, these rights may include:
• Right to know
You have the right to know details such as what Personal Data we collect about you, who we share it with, how we use it, for what purpose and how long we keep it. We use our Privacy Notice to explain this.
• Right to rectification
You have the right to have an incomplete or inaccurate information we hold about you corrected.
• Right to erasure (commonly known as the right to be forgotten)
• Right to portability
You have the right to ask us to transfer your Personal Data to another party.
• Right of access (commonly known as a “Subject Access Request”)
You have the right to access and receive a copy of the Personal Data we hold about you.
• Rights Regarding the sale and sharing of your Personal Data
You have the right to know whether we sell your Personal Data and whether we disclose your Personal Data to anyone.
You have the right to opt out of certain processing activities, including targeted advertising and, where applicable, the sale pr sharing of personal information as defined by state law.
• Right against discrimination
You have the right not to be discriminated against for exercising your privacy rights.
Where required by applicable law, individuals may exercise their right to opt out of the sale or sharing of personal information and other processing activities subject to opt-out rights.[SN6.1]
These rights are not available in all U.S. states and may vary based on your state of residence and applicable law. We will review and respond to requests in accordance with the requirements of the laws that apply to you.
You will not usually need to pay a fee to exercise any of the above rights. However, we may charge a reasonable fee if your request is clearly unfounded or excessive. Alternatively, we may refuse to comply with the request in such circumstances.
If you wish to exercise your rights, you may contact us using the details set out below within the section called ‘How to contact us and our Data Protection Officer’. We may need to request specific information from you to confirm your identity before we can process your request. Once in receipt of this, we will process your request without undue delay and within one month. In some cases, such as with complex requests, it may take us longer than this and, if so, we will keep you updated.
10. Complaints
If you are not satisfied with the outcome of your complaint, you can complain to the UK supervisory authority, the Information Commissioner’s Office using the details below.
In jurisdictions within the EU/EAA, you have the right to lodge a complaint with the relevant supervisory authority, [LL7.1]if you believe we are infringing on the data protection laws or you are concerned about the way in which we are handling your personal data.
For supervisory authorities in countries within the EU see the link below:
https://edpb.europa.eu/about-edpb/about-edpb/members_en
Individuals located in the United States may not have access to an independent data protection supervisory authority equivalent to those established under UK or European data protection laws. If you are dissatisfied with our response to your complaint, you may, depending on your state of residence and the nature of your concerns, have the right to contact a relevant regulator, such as a State Attorney General, or otherwise exercise any remedies available to you under applicable federal or state law.
11. Automated Decision Making
12. Your obligations
13. How to contact our Data Protection Officer
14. Changes to this Privacy Notice
You can find previous version of this Notice here