PRIVACY POLICY

1. PURPOSE OF THIS NOTICE

This notice describes how we collect and use personal data about you, in accordance with the General Data Protection Regulation (GDPR), the Data Protection Act 1998 and any other national implementing laws, regulations and secondary legislation, as amended or updated from time to time, in the UK (‘Data Protection Legislation’).

Please read the following carefully to understand our practices regarding your personal data and how we will treat it.

2. ABOUT US

Quast Ltd (“Quast”) is a recruitment and professional services firm.  We are registered in England and Wales as a company under number 0942824 and our registered office is at 98 Fishpool Street, St Albans, Hertfordshire, AL3 4RX.

For the purpose of the Data Protection Legislation and this notice, we are the ‘data controller’. This means that we are responsible for deciding how we hold and use personal data about you. We are required under the Data Protection Legislation to notify you of the information contained in this privacy notice.

We have appointed a Data Protection Officer. Our Data Protection Officer is our Data Protection Point of Contact and is responsible for assisting with enquiries in relation to this privacy notice or our treatment of your personal data. Should you wish to contact our Data Protection Point of Contact you can do so using the contact details noted at paragraph 14 (Contact Us), below.

3. HOW WE MAY COLLECT YOUR PERSONAL DATA

We obtain personal data about you, for example, when:

• you engage us to provide recruitment services for you;
• you contact us by email, telephone, post or social media (for example when you have a query about our services); or
• from third parties and/or publicly available resources (for example, from your employer or from LinkedIn or similar public profiles on social media or job board sites).

In the event that you wish to have an application for employment or engagement submitted by us we may seek to collect:

• Information required to validate your right to work in the UK, for example, passport, visa;
• Partial information such as segments of date of birth and national insurance, for the purposes of creating a password for exchange of data.

In the event of an offer of employment or other contractual engagement we may also collect:

• Information required to confirm your identity and address, for example, passport, driving licence, council tax bill, bank statements, utility bills, date of birth;
• Information required to validate criminal records that may impact upon the role to be performed, for example, DBS certificate, Disclosure Scotland;
• Information required to make payments to you, including bank details, national insurance.

4. WHAT WE COLLECT

The information we hold about you may include the following:

• name and job title, employer details and salary information;
• contact information including phone number and email address;
• demographic information such as postcode, preferences and interests;
• curriculum vitae;
• other information relevant to customer surveys and/or offers;
• details of contact we have had with you in relation to the provision, or the proposed provision, of our services;
• details of any services you have received from us;
• our correspondence and communications with you;
• information about any complaints and enquiries you make to us;
• Information we receive from other sources, such as publicly available information, information provided by your employer or our clients;

Curriculum vitae (“CV”)

We give you the option of submitting your CV via our website or by providing your CV to one of our consultants. You can do this either to apply for a specific advertised job or for consideration by our recruitment consultants for positions as they come up. Your CV will be stored in the Quast database, and will be accessible by Quast consultants.

You can update your CV at any time, simply by following the same procedure to submit a new CV.

5. HOW WE USE PERSONAL DATA WE HOLD ABOUT YOU

We may process your personal data for the provision of our services to you or to our clients and to comply with our legal obligations.

We may process your personal data for the purposes necessary for the performance of our contract with our clients. This may include processing your personal data where you are an employee, subcontractor, supplier or customer of our client.

We may process your personal data for the purposes of our own legitimate interests provided that those interests do not override any of your own interests, rights and freedoms which require the protection of personal data.

We may process your personal data for certain additional purposes with your consent, and in these limited circumstances where your consent is required for the processing of your personal data then you have the right to withdraw your consent to processing for such specific purposes.

Please note that we may process your personal data for more than one lawful basis depending on the specific purpose for which we are using your data.

Situations in which we will use your personal data

We may hold, use and disclose your personal data as follows:

• to provide our recruitment services to you;
• to maintain our business relationship, where you are a user of our website, a client or candidate;
• Internal record keeping;
• to enable you to submit your CV for general applications, to apply for specific jobs or to alert you to vacancies. Please see the separate section on your CV below which outlines additional uses and disclosures;
• to match your details with job vacancies, to assist us in finding a position that is most suitable for you and to send your personal information to clients in order to apply for jobs;
• to answer your enquiries;
• to fulfil contractual obligations with our clients;
• to trusted third parties where we have retained them to provide services that you or our clients have requested, such as reference, qualification and criminal reference checking services (as required), verification of the details you have provided from third party sources, psychometric evaluations or skills tests. These third parties comply with similar and equally stringent undertakings of privacy and confidentiality as Quast;
• to third parties who perform functions on our behalf and who also provide services to us, such as professional advisors, IT consultants carrying out testing and development work on our business technology systems, research and mailing houses and function co-ordinators. These third parties comply with similar undertakings of privacy and confidentiality as Quast;
• we may also release personal information to regulatory or law enforcement agencies, if they require us to do so. We will also disclose your information where we are permitted and requested to do so by law; and
• we may also seek your consent to collect, hold, use and disclose your personal information for any other purpose not listed above.
• our website may also use a website recording service which can record mouse clicks, mouse movements, page scrolling and any text keyed into website forms. Data collected by this service is used to improve our website usability. The information collected is stored and is used for aggregated and statistical reporting, and is not shared with anybody else.

In some circumstances we may anonymise or pseudonymise the personal data so that it can no longer be associated with you, in which case we may use it without further notice to you.

If you refuse to provide us with certain information when requested, we may not be able to perform the contract we have entered into with you. Alternatively, we may be unable to comply with our legal or regulatory obligations.

We may also process your personal data without your knowledge or consent, in accordance with this notice, where we are legally required or permitted to do so.

Data retention

We will only retain your personal data for as long as is necessary to fulfil the purposes for which it is collected.

When assessing what retention period is appropriate for your personal data, we take into consideration:

• the requirements of our business and the services provided;
• any statutory or legal obligations;
• the purposes for which we originally collected the personal data;
• the lawful grounds on which we based our processing;
• the types of personal data we have collected;
• the amount and categories of your personal data; and
• whether the purpose of the processing could reasonably be fulfilled by other means.

Change of purpose

Where we need to use your personal data for another reason, other than for the purpose for which we collected it, we will only use your personal data where that reason is compatible with the original purpose.

Should it be necessary to use your personal data for a new purpose, we will notify you and communicate the legal basis which allows us to do so before starting any new processing.

6. HOW WE USE COOKIES

When you interact with the Site, we try to make that experience simple and meaningful. When you visit the Site, our web server sends a cookie to your computer. Cookies are small pieces of information which are issued to your computer when you visit a website and which store and sometimes track information about your use of the Site. A number of cookies we use last only for the duration of your web session and expire when you close your browser. Other cookies are used to remember you when you return to the Site and will last for longer.

7. OTHER WEBSITES

Please note that clicking on links and banner advertisements may result in your transferral to another website – where data privacy practices may be different to that of Quast. Visitors should consult the other websites’ privacy policies as we are not responsible for, and have no control over, information that is submitted to or collected by these third parties.

8. INTERNET-BASED TRANSFERS

Given that the Internet is a global environment, using the Internet to collect and process personal data necessarily involves the transmission of data on an international basis. Therefore, by browsing our website and communicating electronically with us, you acknowledge and agree to our processing of personal data in this way.

9. DATA SHARING

Why might you share my personal data with third parties? 

We will share your personal data with third parties where we are required by law, where it is necessary to administer the relationship between us or where we have another legitimate interest in doing so

Which third-party service providers process my personal data?

“Third parties” includes third-party service providers. The following activities are carried out by third-party service providers: IT and cloud services, professional advisory services, administration services and marketing services.

All of our third-party service providers are required to take commercially reasonable and appropriate security measures to protect your personal data. We only permit our third-party service providers to process your personal data for specified purposes and in accordance with our instructions.

What about other third parties?

We may share your personal data with other third parties, for example in the context of the possible sale or restructuring of the business. We may also need to share your personal data with a regulator or to otherwise comply with the law.

10. INTERNATIONAL DATA TRANSFERS

When we share data, it may be transferred to, and processed in, countries other than the country you live in – such as to the United States, where our data hosting provider’s servers are located. These countries may have laws different to what you are used to. Rest assured, where we disclose personal data to a third party in another country, we put safeguards in place to ensure your personal data remains protected.

For individuals in the European Economic Area (EEA), this means that your data may be transferred outside of the EEA. Where your personal data is transferred outside the EEA, it will only be transferred to countries that have been identified as providing adequate protection for EEA data (like New Zealand), or to a third party where we have approved transfer mechanisms in place to protect your personal data – i.e., by entering into the European Commission’s Standard Contractual Clauses, or by ensuring the entity is Privacy Shield certified (for transfers to US-based third parties). For further information, please contact us using the details set out in the Contact us section below.

11. DATA SECURITY

We have put in place commercially reasonable and appropriate security measures to prevent your personal data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. In addition, we limit access to your personal data to those employees, agents, contractors and other third parties who have a business need to know. They will only process your personal data on our instructions and they are subject to a duty of confidentiality.

We have put in place procedures to deal with any suspected data security breach and will notify you and any applicable regulator of a suspected breach where we are legally required to do so.

Quast Limited have been awarded a Cyber Essentials Certificate by the National Cyber Security Centre.  This demonstrates that Quast meets a Government endorsed standard for cyber security.

12. CONTROLLING YOUR PERSONAL INFORMATION

You have the right at any time to ask us for a copy of the information supplied by you that we hold. We may ask you to verify your identity and for more information about your request. We may also have the right to charge an administrative fee for this service. Where we are legally permitted to do so, we may refuse your request and will give you reasons for doing so.

If you would like to make a request for information, please contact us by email at dataprivacy@quast.co.uk.  You also have the right to ask Quast to stop using your information. However, if this involves a request for deletion of your file, please be aware that we may not be required or able to do so, particularly where your file also holds information about our clients or financial information that we need to keep for periods of up to six years, i.e. that relate to tax matters. Where we are unable to comply with your request we will provide reasons for failing to do so.

13. CHANGES TO OUR PRIVACY POLICY

This privacy policy may be changed by Quast at any time. If we change our privacy policy in the future, we will advise you of changes or updates to our privacy policy by a prominent notice on our website. Continued use of this website or our services after such changes will constitute your acceptance of such changes.

This privacy notice was last updated on 22 May 2018.

14. CONTACT US

If you have any questions, concerns, or suggestions regarding this privacy policy, please contact us by emailing us at dataprivacy@quast.co.uk or by post to Attention: Quast Data Privacy at Quast Limited, 98 Fishpool Street, St Albans, Hertfordshire, AL3 4RX.