1. Introduction
Virtual Human Resources (VHR) is a technical recruitment company that provides recruitment services to our clients and candidates. VHR must process personal data (including sensitive personal data) so that we can provide these services – in doing so, the Company acts as a data controller.
This privacy policy sets out how VHR collects, processes and protects any information that you give VHR when you use our services. VHR is committed to ensuring that your data privacy rights are protected and safeguarded.
This policy applies to the personal data of our website users, candidates, clients, suppliers, and other people we may contact.
We may on occasion make changes to this Privacy Policy. Please visit this page to stay up to date with any changes.
2. Lawful purpose for maintaining possession of data
VHR is aware of an understands the General Data Protection Regulations (GDPR) requirement that possession of data may only be maintained on the basis of having a lawful purpose for doing so.
Accordingly, the following lawful bases is applied by VHR when maintaining and processing information in respect of the limited categories of data subjects for whom data is held and processed by VHR:
(a) Legitimate interests:
the processing of personal data is necessary for VHR’s legitimate interests or the legitimate interests of a third party unless there is a good reason to protect the individual’s personal data which overrides those legitimate interests.
(b) Consent:
when VHR staff are in contact with data subjects, which can include suppliers, candidates, clients or prospective clients, we seek to establish that consent for VHR to hold their personal data has not been withdrawn.
(c) Contract:
the processing of personal data is necessary for a contract VHR has with the individual, or because they have asked VHR to take specific steps before entering into a contract.
(d) Legal obligation:
the processing of personal data is necessary for VHR to comply with the law (not including contractual obligations).
(e) Vital interests:
the processing of personal data is necessary to protect someone’s life.
(f) Public task:
the processing of personal data is necessary for VHR to perform a task in the public interest or for VHR’s official functions, and the task or function has a clear basis in law.
3. What kind of personal data do we collect?
We may collect information about you whenever you interact with us or register on our systems or databases which may include your sensitive personal data. Our aim is to demonstrate that we comply with the requirements of GDPR Article 5 1) a) whereby we process data lawfully, fairly and in a transparent manner in relation to individuals.
The legal bases we rely upon to offer our services to you are detailed below;
3.1 Candidate Data
We process data belonging to Candidates who are Job Seekers engaging with us for work finding services or career support; and Placed Candidates who are placed into employment or temporary/contract assignments.
We collect Candidate Data in three ways:
1. Personal data that a Candidate gives to us
2. Personal data that we receive from other sources (such as referees or LinkedIn, job sites)
3. Personal data that we collect automatically (e.g. through our website, newsletters or other marketing material)
We obtain Candidate Data for the purpose of fulfilling a contract with the Client to whom the Candidate is or may be introduced and to carry out our legal obligations as a compliant recruitment business.
3.1.1 Job Seekers
The information we may collect from a Job Seeker in order to find them a suitable role or provide career support may include:
• Name
• Address
• Email address (personal and work)
• Telephone number
• CV/ work history
• Job preferences including role, geographical areas and salary
• Education and training certificates
3.1.2 Placed Candidates
Information that we may collect from Placed Candidates who we have placed into employment or temporary/contract assignments (in addition to the above) can include:
• Passport
• Work permits and/ or visas
• Marital Status
• Gender
• Date of birth
• National insurance number
• Bank details
• Details of job offers and placements
• Outcome of criminal record checks and security clearance (for certain roles)
• Medical information
• References
• Financial information
• A log of certain communications by social media, email and telephone
All Candidate Data is stored and processed in an organised manner. We retain Candidate data securely throughout the duration of the work finding services or assignment and after the end of an assignment for a maximum of 6 years to comply with our legal audit obligations.
3.2 Client and Supplier Data
All Client and Supplier data will be obtained, stored and processed in a secure manner.
We collect Client and Supplier data in three ways:
1. Personal data that we receive directly from the Client or Supplier (either by phone, email or through our consultants’ business development activities
2. Personal data that we received from other sources (due diligence checks, market intelligence, delegate lists at relevant events, candidates)
3. Personal data we collect automatically (e.g. through our website, newsletters or other marketing material)
Consent to process Client and Supplier data is obtained solely on the basis of fulfilling the services required, or may be required, under contract with the Client or Supplier.
3.2.1 Client Data
The information we may collect from a Client can include:
• Name
• Address
• Email address (personal and work)
• Telephone number (personal and work)
• Due diligence checks
• Company Details
• Financial information
3.2.2 Supplier Data
The information we may collect from a Supplier can include:
• Name
• Address
• Email address (work)
• Telephone number (work)
• Due diligence checks
• Company Details
• Financial information
Personal data obtained under this category is stored securely for 6 years after the end of the term of the services agreement with the Client and/or Supplier.
3.2.3 Prospective Clients
As part of our marketing and business development operations, we will obtain, store and process in a secure manner, the data from representatives of Prospective Clients.
We collect Prospective Client data in three ways:
1. Personal data that we receive directly from the Prospective Client (either by phone, email or through our consultants’ business development activities)
2. Personal data that we received from other sources (due diligence checks, market intelligence, delegate lists at relevant events, candidates)
3. Personal data we collect automatically (e.g. through our website, newsletter or other marketing material)
Consent to process their data is obtained solely on the basis of anticipation of entering into a business relationship pursuant to a fully executed services contract.
The information we may collect from a Prospective Client can include:
• Name
• Address
• Email address (work)
• Telephone number (work)
• Company Details
Personal data obtained under this category is stored only on the basis that there is a legitimate expectation of the need of our services prior to entering into a fully executed services contract.
Where there is no prospect of entering into a services contract we will obtain explicit consent to store the personal data on our database solely for the potential marketing and business development purposes in the future.
Children’s Data
We do not routinely collect any information on anyone under 18 years of age. However, there may be a rare occasion where we are required to take minimal data on Candidate’s children in relation to our services. The data will always be relevant and collected for a purpose, for example where a Placed Candidate’s benefits package includes schooling for their children. Such data will always be stored and processed in a secure manner. Consent to process their data is obtained solely on the basis of anticipation of entering into a placement or assignment.
Website Users and Cookies
When you visit our website, there is certain information that we may automatically collect. This can include your IP address, the date, time and frequency with which you access the website and the way you browse our content. We will also collect data from when you contact us via the website including our live chat function.
4. How do we use your information?
Candidate Data
The main reasons for us using and processing Candidates’ personal data is to help them find employment and assignments which may be suitable for them. Collecting Candidates’ data allows us to better respond to their individual needs and personalise their experience. We may also use Candidate information to improve our systems based on their feedback, improve customer service and to send periodic emails with information and updates.
Client Data
The main reason for us using and processing information about our Clients is to ensure that our services can be targeted in a meaningful way and agreements can be fully implemented to ensure a smooth business relationship. The more accurate information we have from our Clients, the better the service we can provide to them.
Supplier Data
The main reason for us processing Supplier information is to ensure that contract agreements between us can be fully implemented to ensure a smooth business relationship and to comply with any legal requirements.
Prospect Client and Supplier Data
The main reason for us using information about prospect Clients and Suppliers is for potential marketing and business development purposes in the future.
People whose data we receive from Candidates and VHR staff, such as referees and emergency contacts
When helping our Candidates find employment or assignment, we are required to ask for references whereby we will ask for personal data from the referees to verify employment and/or assignment details. We may also use referees’ personal data to contact them in relation to recruitment activities that be may of interest to them. We will also use the personal details of Candidate’s and Employee’s emergency contact numbers in case of an accident or emergency.
Website Users
We use data from users to improve their experience on our website, for example we may analyse your job search criteria to help us show you our recent jobs that we think you may be interested in. If you are a Candidate or Client, we may use your user data from our website to enhance our communication with you. We are also able to use emails and telephone recordings as part of our internal, external or legal investigations.
5. Who do we share your personal data with?
We do not sell, trade, or otherwise transfer to outside parties your personally identifiable information. This does not include trusted third parties who assist us in conducting our business or servicing you, so long as those parties agree to keep this information confidential. We may also release your information when we believe release is appropriate to comply with the law, enforce our Company policies, or protect ours or others rights, property, or safety. However, non-personally identifiable visitor information may be provided to other parties for marketing, advertising, or other uses.
6. How do we protect your information?
We understand how important it is to protect your personal information and we will always use our best efforts to take necessary precautions to prevent unauthorised access to, and misuse of, your personal data.
We implement a variety of security measures to maintain the safety of your personal information when we enter, submit, hold or access your personal information. We ensure that there are appropriate technical controls in place to protect your personal data such as encryption. We will review our technical controls and constantly monitor potential risks.
We also ensure that only authorised personnel have access to your data and that they are appropriately trained to manage your personal information.
7. How long do we keep your information for?
We retain Candidate, Client and Employee Data securely throughout the duration of the assignment or until the end of a Contract of Services or Employment for a maximum of 6 years after completion of an Assignment or Contract to comply with our legal and audit obligations.
If we have not had an employment or assignment contract with you and we have not had any contact with you for a period of at least three years, we will delete your personal data from our systems unless we believe that the law requires us to keep this information or we believe we have legitimate interest in retaining your personal data.
Where there is no prospect of entering into a contract, we will obtain explicit consent to store the personal data on our database solely for potential marketing and business development purposes in the future.
8. How can you access, amend or take back the personal data that you have given us?
If we hold your personal data, you have various rights which allow you to have control of how we use your data or if you would like us to strop processing your personal data. In some circumstances, we may be legally obliged to return your personal data for audit purposes, however these can be discussed with you depending on your requirements.
Under the General Data Protection Regulation, you are granted the following rights:
• Right to be informed: You have the right to be informed on which personal data we hold about you and how we collect, process, manage and store this information. All information on this will be detailed in our Privacy Notice on our website.
• Right of access: You have the right to ask us what information we hold about you at any time which is often referred to as Subject Access Request. We may ask you to verify your identity or ask for more information about your request.
• Right to rectification: You have the right to ask for your inaccurate personal data to be rectified. We will review your request and update you as to whether we can respond to the request.
• Right to erasure: You have the right to ask for your personal data to be erased which is often also referred to as ‘the right to be forgotten’. This applies in certain circumstances which will be fully explained to you.
• Right to restrict processing: You have the right to request for your personal data to be restricted or suppressed in certain circumstances. When your personal data is restricted, we are able to store your personal data but not use it.
• Right to data portability: You are able to request for us to transfer your personal data from us to another data controller. We can respond to such requests by either transferring the data directly to you, or by providing you with a copy in a commonly used machine-readable format.
• Right to object: If we hold your personal data because we deem it necessary for our legitimate interests and you do not agree, you have the right to object.
• Rights related to automated decision making: We do not currently utilise any automated decision-making applications or systems. We will continually monitor this Right and make updates to our policy where required.
PLEASE NOTE: We may ask you to verify your identity or ask for more information about your request. Where we are legally permitted to do so, we may decline your request, but we will explain why if we do so. We will respond to all requests within one month or receipt of your request.
9. How do we store and transfer your data internationally?
Virtual Human Resources is a global organisation whereby we are able to deliver our services globally. In order for us to be able to continue delivering our service, we may be required to transfer or store your data internationally. Currently our data is stored in our London Head Office location but is accessible in our global offices.
10. What are cookies and how do we use them?
‘Cookies’ are small pieces of information which are stored in your computer. They are used by nearly all websites and do not harm your computer system. We use cookies to track your activity on our website which enables us to tailor your preferences and options when you navigate our website. We can also use cookies to analyse website traffic and for advertising. To alter the way you accept cookies, please change your settings in your web browser.
11. Contacting Us
You have the right to request a copy of the information we hold about you. If you would like to access your personal information, please contact us:
• By Email:
Please contact us by email at GDPR@v-hr.com.
Please write your type of request and your name in the email subject line.
• By Post:
Alternatively, please send your request:
Virtual Human Resources Ltd.
Data Protection Officer
Luna House, 37-39 Bermondsey Wall West
London
SE16 4RN
UK
For more information on your rights. Please read the relevant guidance issued by the ICO at: https://ico.org.uk/for-organisations/guide-to-the-general-data-protection-regulation-gdpr/individual-rights/
If you would like to make a complaint about how we process your personal data, please contact our Data Protection Officer (details listed above).
If you are not happy with how we have dealt with your request, you should contact the Information Commissioner’s Office.
12. Changes to this Privacy Policy
This policy may change from time to time. If we make any significant changes to this policy, we will publicise these changes clearly on our website.