Privacy Policy

1. Who we are and what we do

Who we are

We are Greycoat Lumleys (“Greycoat”, “us”, “we”, “our”). We are a limited company registered in England and Wales under registration number 3218896 and we have our registered office at Old Church House, Sandy Lane, Crawley Down, Crawley, West Sussex, RH10 4HS, United Kingdom. We are registered with the UK supervisory authority, Information Commissioner’s Office (“ICO”) in relation to our processing of Personal Data under registration number Z4772288.

We are Empresaria Group plc (“us”, “we”, “our”). We are a public limited company registered in England and Wales under registration number 09946765 with a registered office at Old Church House, Sandy Lane, Crawley Down, Crawley, West Sussex, England RH10 4HS. We are registered with the Information Commissioner’s Office (“ICO”), the UK supervisory office under registration number Z124495X.

What we do

We are a specialist staffing provider, matching quality candidates to our clients’ available roles in the in diverse sectors across, the globe, including IT, professional services and healthcare across the globe. We and our affiliates, subsidiaries and related entities are committed to protecting the privacy and security of the Personal Data we process.

Controller

Unless we notify you otherwise, we are the Controller of the Personal Data we process, jointly with Empresaria. This means that we, together with Empresaria, jointly decide what Personal Data to collect and how to process it.

2. Purpose of this privacy notice

The purpose of this privacy notice is to explain what Personal Data we collect about you and how we process it. This privacy notice also explains your rights, so please read it carefully. If you have any questions, you can contact us using the information provided below under the ‘Contact Us’ section.

3. Who this privacy notice applies to

This privacy notice applies to you if:

You visit our website
You or the company you work for enters into a contract with us to provide recruitment related services
You make enquires about our services
You register with us
You are a business associate of ours
You sign up for job alerts
You are a candidate to whom we provide work-finding services
You are a client to whom we provide recruitment and staffing services
You are referee who we contact about a former employee of yours
We contact you to promote our services. For example, we send you newsletters and/or other promotional communications.

4. What Personal Data is

The definition of ‘Personal Data’ varies slightly from country to country but generally means any information from which someone can be identified either directly or indirectly. For example, you can be identified by your name or an online identifier. However, in America ‘Personal Information’ includes information that could reasonably be linked, either directly or indirectly, to a particular consumer or household.

In some cases, we also process more sensitive Personal Data such as information revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data for the purposes of uniquely identifying someone, data concerning physical or mental health or data concerning someone’s sex life or sexual orientation and criminal offence data. For the purposes of this privacy notice, we shall refer to this data as ‘Sensitive Personal Data’.

5. Interpretation & Definitions

APA means the Australian Privacy Act 1988 (Cth).
APPI means Japan’s Act on the Protection of Personal Information (Act No. 57 of 2003 as amended in 2020).
Business means the legal entity that determines the purposes and means of processing of Personal Data about residents of California in accordance with the California Consumer Privacy Act (CCPA) and/or the California Privacy Rights Act (CPRA).
Business Associates means a representative of a former, existing or potential client of ours.
Controller means, for the purposes of this privacy notice, the legal entity or natural person that determines the means and purposes of processing of Personal Data and includes the definition of Data User under Hong Kong’s PDPO and Malaysia’s PDPA, a Personal Information Handler under China’s PIPL, an Organisation under Singapore’s PDPA, a Business under California’s CPPA, an agency under New Zealand’s Privacy Act and a Data Processor under Vietnam’s LCS.
Chile’s PPLL means Chile’s Protection of Private Life Law 19, 628/1999.
CCPA means the California Consumer Privacy Act, California Civil Code sections 1798.100 et seq, and its implementing regulations.
“CDPA” means the Virginia Consumer Data Protection Act.
“CPA” means the Colorado Privacy Act.
CPRA means the California Privacy Rights Act.
“CTDPA” means the Connecticut Act Concerning Personal Data Privacy and Online Monitoring.
DPA means the Philippines’ Data Privacy Act of 2012 (Republic Act No. 10173)
EU GDPR means the EU’s the General Data Protection Regulation (EU) 2016/679.
IT Law means India’s Information Technology Law 2000.
Kominfo Regulation 20 means Regulation No.20 of 2016 on Personal Data Protection in Electronic Systems.
LCS means the Law on Cyber Information Security No.86/2015/QH13 (19 November 2015) in Vietnam.
Malaysia’s PDPA means Malaysia’s Personal Data Protection Act (“Malaysia’s PDPA”).
Peru’s PDPL means Peru’s Personal Data Protection Law (N° 29733 (PDPL)) and its Regulation (N° 003-2013-JUS-Regulation of the PDPL).
PDPO means Hong Kong’s Personal Data (Privacy) Ordinance (Cap.486) as amended.
Personal Data means information which can be used directly or indirectly to identify you and which relates to you (and shall be deemed to include “Personal Data” and “Personal Information” as defined in the various data protection laws referred to in this privacy notice.
PIPL means China’s Personal Information Protection Law.
Privacy Act 2020 means New Zealand’s Privacy Act 2020.
Processor means the legal entity or natural person that processes Personal Data on behalf of and under the strict instructions of a Controller and includes ‘Entrusted Parties’ under China’s Personal Information Protection Law.
Sensitive Personal Data – Sensitive personal data may be defined differently under different data protection laws but for the purposes of this privacy notice Sensitive Personal Data means Personal Data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, the processing of biometric data for the purpose of uniquely identifying someone, health data, sex life or sexual orientation and Personal Data relating to criminal convictions or offences.
Singapore’s PDPA means Singapore’s Personal Data Protection Act 2012.
SPDI Rules means India’s Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules 2011.
Thailand’s PDPA means Thailand’s Personal Data Protection Act 2019.
UK GDPR means the General Data Protection Regulation (EU) 2016/679 as it forms part of the law of the United Kingdom by virtue of section 3 of the European Union (Withdrawal) Act 2018.
“UCPA” means the Utah Consumer Privacy Act.

6. Personal Data we collect

The type of Personal Data we collect about you is set out in the table below in the section entitled ‘Purposes, lawful bases and retention periods’.

7. How we collect your Personal Data

We collect most of the Personal Data directly from you in person, by telephone, text, video call or email and/or via our website. We may record our telephone calls and video calls in order to refer back to them at a later date.

However, we may also collect your Personal Data from third parties such as:

Job Boards
Third Party CV Databases
Company Websites
General Enquiries
Publicly available sources such as social media platforms including but not limited to LinkedIn, Facebook, Github
Reputable companies who provide lead generation such as Lusha
Reputable companies who provide data enrichment services such as ContactOut and Caypro
Referrals/recommendations
Referees
Referencing agencies
Other organisations within the Empresaria Group
Our clients
Intermediaries such as MSPs, umbrella companies and management companies
Government agencies such as HMRC
Credit referencing agencies
Disclosure and Barring Service (DBS) or non-UK equivalent providing criminal record checks
Companies House (or non-UK equivalent)
Electoral registers
Others to whom you have provided consent

8. Purposes, lawful bases and retention periods

Categories of individuals	Categories of Personal Data	Purpose of Processing	Lawful Basis	Retention Period
Business Associates	Name, job title, work email address, work phone number, name of the company you work for	To send you newsletters and other promotional material and answer your enquiries To administer the contract we have entered into with the company you work for	Legitimate interests or consent, where necessary Contract or consent, where necessary	2 years following last meaningful contact 7 years following the termination of the contract
All Candidates	Personal contact details including name, email address, address, phone number, Gender, Date of birth, Marital status, Location. Employment and educational history data, such as CVs and job titles and qualifications, References, Test scores Information relating to discipline or performance Reasons for termination of employment Photographs Intermediaries in which you have an interest Work preferences Salary details and preferences Audio or video recordings Driving licence (if necessary)	For the purposes of finding work for you For the purposes of providing recruitment, staffing and related services to our clients To fulfil our contractual obligations	Legitimate interests in finding work for you or consent, where necessary Contract	If we have not placed you, 3 years from the date you registered with us or from the date of last meaningful contact If we have entered into a contract with you, 7 years from the date the contract is terminated. If we have placed you, 7 years from the date the placement ends.
Successful Candidates and Placed Candidates	Sickness records, pregnancy and maternity information, disabilities	To ensure you are provided with appropriate pay and benefits and reasonable adjustments are made to accommodate you in the workplace	Legal obligation	7 years from the date the employment contract is terminated
Successful Candidates and Placed Candidates	Results of criminal records checks	To ensure you are suitable for the role	Legal obligation	6 months following the decision for which it was obtained
Successful Candidates	Right to work information Proof of address documents ID documents	To ensure you have a right to work	Legal obligation	2 years from the date the contract of employment is terminated
Placed Candidates	Bank account details Payroll records Tax and social security data	To fulfil our contractual obligation to pay you To comply with tax laws	Contract Legal Obligation	7 years from the date the employment contract is terminated
Placed Candidates	Emergency contact details	To contact your next of kin in the event of an emergency	Legitimate interests or consent, where necessary	1 year from the date the employment contract is terminated
Website visitors	Using Google Analytics, we collect the following information: Device and browser data, such as IP address, information about your device and browser settings	Various purposes – see our cookie notice on our website	Consent	Various – see our cookie notice
Business Associates, Candidates and website visitors	Marketing and communications data	To contact you to promote our services	Consent or legitimate interests, where appropriate	2 years from the date of last meaningful contact

Where Personal Data is processed because it is necessary for the performance of a contract to which you are a party, we will be unable to provide our services without the required information.

9. Sharing your Personal Data

Internal Sharing within the Empresaria Group

We may share your Personal Data with other organisations within the Empresaria Group as appropriate in order to provide an efficient service to both our clients and candidates in finding the right candidates for the right the roles.

Marketing

In order to deliver our e-newsletters and email campaigns, we use third-party providers.

We will ensure that we have entered into data processing agreements with the third-party providers which means that they can only process your Personal Data in accordance with our instructions and the applicable data protection legislation and they will not be able to use it for their own purposes.

Authorized Third-Party Providers

We may share Personal Data with third-party providers that provide business services to us or on our behalf, such as IT services, hosting services. Payment information will be used and shared only to process your order and may be stored by a service provider for purposes of future transactions. We prohibit our third-party providers from using or sharing your Personal Data except as necessary to perform the contracted services on our behalf or to comply with applicable legal requirements.

As mentioned above, we use Google Analytics. For more information about Google Analytics, please visit www.google.com/policies/privacy/partners . You can opt out of Google’s collection and processing of data generated by your use of our services by going to http://tools.google.com/dlpage/gaoptout.

Please see our cookie policy on our website for more information on our use of cookies and similar technologies.

Other External Sharing

We may share Personal Data with banks, referencing agencies, DBS, credit referencing agencies and government agencies such as tax an immigration authorities and pension providers.

We may share the personal data of clients with candidates and vice versa. Also, we may (occasionally) share the personal data we collect with others such as professional advisers, insurers etc.

We will only share personal data when it is necessary, fair, lawful, justified and proportionate to do so.

10. International Transfers

Your Personal Data may be transferred to and processed in a country different to that in which you reside. This is because:

We share your Personal Data with other organisations within the Empresaria Group, as necessary, some of which are based outside your country of residence
Some of the organisations we use to provide our service to you (such as our processors) are based outside your country of residence
If you are a candidate, we may share your Personal Data with a client based outside your country of residence
If you are a client, we may share your Personal Data with a candidate outside your country of residence.

If you are in any country not listed below, we confirm that we take reasonable steps to protect any Personal Data transferred to any countries outside your country of residence and ensure that it is lawful to do so

If you are in a country which is the subject to US, EU or UK sanctions, we will not knowingly process your Personal Data.

If you are in Australia

We confirm that we will take reasonable steps to protect any Personal Data transferred to any countries outside Australia.

If you are in China

We will not transfer your Personal Data to any countries outside China.

If you are in Chile

We confirm that we take reasonable steps to protect any Personal Data transferred to any countries outside Chile.

If you are in the EEA

We confirm that we take appropriate steps to ensure that any Personal Data transferred outside the EEA has an essentially equivalent level of protection to that guaranteed in the EEA. We do this by ensuring that:

Your Personal Data is only processed in a country which the European Commission has confirmed has an adequate level of protection (an adequacy decision); or
We enter into Standard Contractual Clauses (“SCCs”) with the receiving organisations and adopt supplementary measures, where necessary. (A copy of the SCCs can be found here Standard Contractual Clauses (SCCs)).

If you are in Hong Kong

We confirm that we take reasonable steps to protect any Personal Data transferred to any countries outside Hong Kong.

If you are in India

We confirm that we take reasonable steps to protect any Personal Data transferred to any countries outside India. If the data to be transferred includes 'sensitive personal information or data' as defined under India’s SPDI Rules, we will ensure that the same standards of data protection required in India are adhered to in the destination country, and that the transfer is necessary for the performance of a lawful contract or you have consented to the transfer. Please note that the definition of ‘sensitive personal information or data’ used in the SPDI Rules is different to that listed above in the definitions section of this privacy notice. Under the SPDI Rules ‘sensitive personal information or data’ includes passwords, financial information such as bank account or credit card or debit card information, physical, physiological, and mental health condition, sexual orientation, medical records and history, and biometric information)

If you are in Indonesia

We confirm that we take appropriate steps to ensure that any Personal Data transferred outside Indonesia has at least an equivalent level of protection to that guaranteed in Indonesia and if not, we will ensure we obtain adequate and binding protection for the Personal Data or we will obtain your consent.

If you are in Japan

We confirm that we take appropriate steps to comply with Japan’s APPI and to protect any Personal Data transferred to any countries outside Japan.

If you are in Malaysia

We confirm that we will obtain your consent before transferring your Personal Data outside Malaysia or otherwise ensure that it is lawful to do so, in accordance with Malaysia’s PDPA.

If you are in New Zealand

We confirm that we take appropriate steps to protect any Personal Data transferred to any countries outside New Zealand.

If you are in Peru

We confirm that we take appropriate steps to ensure that any Personal Data transferred outside Peru has an essentially equivalent level of protection to that guaranteed in Peru or we will obtain your consent for the transfer or ensure that it is otherwise lawful to make the transfer.

If you are in the Philippines

We confirm that we take appropriate steps to ensure that any Personal Data transferred to any countries outside the Philippines has a comparable level of protection to that guaranteed in the Philippines.

If you are in Singapore

We confirm that we take appropriate steps to ensure that any Personal Data transferred to any countries outside Singapore has a comparable level of protection to that guaranteed in Singapore.

If you are in Thailand

We confirm that we will not transfer any Personal Data outside Thailand unless the destination country has an essentially equivalent level of protection to that guaranteed in the Thailand or it is otherwise lawful to do so.

If you are in the UK

We confirm that we take appropriate steps to ensure that any Personal Data processed outside the UK has an essentially equivalent level of protection to that guaranteed in the UK. We do this by ensuring that:

Your Personal Data is only processed in a country which the Secretary of State has confirmed has an adequate level of protection (an adequacy regulation) or
We enter into an International Data Transfer Agreement (“IDTA”) with the receiving organisation and adopt supplementary measures, where necessary. (A copy of the IDTA can be found here international-data-transfer-agreement.pdf (ico.org.uk))

If you are in the United States of America

There are no restrictions relating to cross border transfers but we, nonetheless, take appropriate steps to ensure that your Personal Data is suitable protected when it is transferred outside of America.

If you are in Vietnam

We confirm that we will obtain your consent before transferring your Personal Data outside Vietnam or otherwise ensure that it is lawful to do so.

11. Your rights and how to complain

You have rights in respect of your Personal Data. The specific rights available to you depend on your country of residence.

If you are in any country not listed below, we confirm that we will process your Personal Data in accordance with the applicable law.

If you are in a country which is the subject to US, EU or UK sanctions, we will not knowingly process your Personal Data.

To exercise your rights, please contact us using the details set out in the ‘Contact Us’ section below.

How to exercise your rights

You will not usually need to pay a fee to exercise any of the above rights. However, we may charge a reasonable fee if your request is clearly unfounded or excessive. Alternatively, we may refuse to comply with the request in such circumstances.

If you wish to exercise your rights, you may contact us using the details set out below within the section called ‘How to contact us and our Data Protection Officer’. We may need to request specific information from you to confirm your identity before we can process your request. Once in receipt of this, we will process your request without undue delay. Complex requests may take some time to process but we will keep you updated.

Australia

If you live in Australia, we comply with the Australian Privacy Act 1988 (Cth) and you have the following rights in relation to the processing of your Personal Data, including to:

Right to be informed

You have the right to know details such as what personal data we collect about you, who we share it with, how we use it, for what purpose and how long we keep it. We use our privacy notice to explain this.

Right of access (commonly known as a “Subject Access Request”)

You have the right to access and receive a copy of the Personal Data we hold about you.

Right to rectification

You have the right to have any incomplete or inaccurate information we hold about you corrected.

Right to object to processing

You have the right to object to us processing your Personal Data and to stop receiving unwanted direct marketing.

Right to withdraw consent

If you have provided your consent for us to process your Personal Data for a specific purpose, you have the right to withdraw your consent at any time. If you do withdraw your consent, we will no longer process your information for the purpose(s) you originally agreed to, unless we are permitted by law to do so.

Right to complain

You have the right to complain about us to the Office of the Australian Information Commissioner (“OAIC”), if you think we have mishandled your Personal Data whose contact details are: Contact us - Home (oaic.gov.au)

China

If you live in China, we comply with China’s Personal Information Protection Law (“PIPL”).

You have the following rights in relation to the processing of your Personal Data, including to:

Right to be informed

Right of access (commonly known as a “Subject Access Request”)

You have the right to access and receive a copy of the Personal Data we hold about you.

Right to rectification

You have the right to have any incomplete or inaccurate information we hold about you corrected.

Right to erasure (commonly known as the right to be forgotten)

You have the right to ask us to delete or de-identify your Personal Data.

Right to object to processing

You have the right to object to us processing your Personal Data.

Right to restrict processing

You have the right to restrict our use of your Personal Data.

Right to portability

You have the right to ask us to transfer your Personal Data to another party.

Automated decision-making.

You have the right not to be subject to a decision based solely on automated processing which will significantly affect you. We may use software to screen CVs and search applications for key words. You have the right to object to this if you consider that your CV or application has been unfairly rejected as a result of the automated decision-making.

Right to withdraw consent

Complaints

If you are concerned about the way in which we are handling your Personal Data, you can complain to the Cyberspace Administration of China, relevant State Council departments or relevant departments of local governments.

Chile

If you live in Chile, we comply with Chile’s Protection of Private Life Law 19, 628/1999.

You have the following rights in relation to the processing of your Personal Data, including to:

Right to be informed

Right of access (commonly known as a “Subject Access Request”)

You have the right to access and receive a copy of the Personal Data we hold about you.

Right to rectification

You have the right to have any incomplete or inaccurate information we hold about you corrected.

Right to blocking

You have the right to ask us to block your Personal Data.

Right to cancellation or elimination of processing

You have the right to cancellation or elimination of your Personal Data.

Right to erasure (commonly known as the right to be forgotten)

You have the right to ask us to erase your Personal Data.

If you are in Hong Kong

If you live in Hong Kong, we comply with the Personal Data (Privacy) Ordinance (Cap.486) (“PDPO”)

You have the following rights in relation to the processing of your Personal Data:

Right to be informed

Right of access (commonly known as a “Subject Access Request”)

You have the right to access and receive a copy of the Personal Data we hold about you.

Right to rectification

You have the right to have any incomplete or inaccurate information we hold about you corrected.

Right to cease using your Personal Data for marketing

You have the right to ask us to stop using your Personal Data for marketing purposes.

Complaints

If you are concerned about the way in which we are handling your Personal Data, you can contact the supervisory authority for Hong Kong whose contact details are:

Office of the Privacy Commissioner for Personal Data (the “Privacy Commissioner”)

Room 1303, 13/F, Dah Sing Financial Centre, 248 Queen's Road East

Wanchai, Hong Kong.

Telephone: +852 2827 2827

If you are in India

If you live in India, we comply with the Information Technology Act 2000 (“IT Law”), the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules 2011 (“SPDI Rules”) and all other relevant legislation.

You have the following rights in relation to the processing of your Personal Data, including to:

Right to be informed

Right of access (commonly known as a “Subject Access Request”)

You have the right to access and receive a copy of the Personal Data we hold about you.

Right to rectification

You have the right to have any incomplete or inaccurate information we hold about you corrected.

Right to erasure (commonly known as the right to be forgotten)

You have the right to ask us to delete or de-identify your Personal Data.

Right to withdraw consent

Complaints

If you are concerned about the way in which we are handling your Personal Data, you can seek clarification from the MEIT (Ministry of Electronics and Information Technology).

If you are in Indonesia

If you live in Indonesia, you have the following rights under Regulation No.20 of 2016 on Personal Data Protection in Electronic Systems (“Kominfo Regulation 20”)

Right to be informed

Right of access (commonly known as a “Subject Access Request”)

You have the right to access and receive a copy of the Personal Data we hold about you.

Right to rectification

You have the right to have any incomplete or inaccurate information we hold about you corrected.

Right to erasure (commonly known as the right to be forgotten)

You have the right to ask us to delete or de-identify your Personal Data.

Right to object

You have the right to object to us processing your Personal Data in certain circumstances.

Complaints

The data protections laws pertaining to data held electronically are mainly enforced by the Ministry of Communication and Information

("Menkominfo").

Jl. Medan Merdeka Barat No. 9,
Jakarta 10110,
Indonesia

https://kominfo.go.id

If you are in Japan

If you live in Japan, we comply with the Act on the Protection of Personal Information (Act No. 57 of 2003 as amended in 2020) (“APPI”).

You have the following rights in relation to the processing of your Personal Data, including to:

Right to be informed

Right of access (commonly known as a “Subject Access Request”)

You have the right to access and receive a copy of the Personal Data we hold about you.

Right to rectification

You have the right to have any incomplete or inaccurate information we hold about you corrected.

Right to erasure (commonly known as the right to be forgotten)

You have the right to ask us to delete or de-identify your Personal Data.

Right to cease processing

You have the right to request that we cease processing your Personal Data.

Complaints

If you are concerned about the way in which we are handling your Personal Data, you can contact the Personal Information Protection Commission for Japan whose contact details are:

Personal Information Protection Commission

Kasumigaseki Common Gate West Tower 32nd Floor,

3-2-1, Kasumigaseki,

Chiyoda-ku,

Tokyo, 100-0013,

Japan

TEL: +81-(0)3-6457-9680

www.ppc.go.jp

If you are in Malaysia

If you live in Malaysia, we comply with Malaysia’s Personal Data Protection Act (“Malaysia’s PDPA”).

You have the following rights in relation to the processing of your Personal Data, including to:

Right to be informed

Right of access (commonly known as a “Subject Access Request”)

You have the right to access and receive a copy of the Personal Data we hold about you.

Right to correction

You have the right to have any incomplete or inaccurate information we hold about you corrected.

Right to object

You have the right to object to us processing your Personal Data for direct marketing purposes.

Right to prevent processing

You have the right to prevent processing likely to cause damage or distress.

Right to withdraw consent

Right to complain

You have the right to complain to the to the Personal Data Protection Commissioner (“PDP Commissioner”) for Malaysia if the data user does not cease processing your Personal Data for direct marketing purposes following your request. The PDP Commissioner contact details are:

Aras 6, Kompleks Kementerian Komunikasi dan Multimedia
Lot 4G9, Persiaran Perdana, Presint 4,
Pusat Pentadbiran Kerajaan Persekutuan,
62100 Putrajaya,
Malaysia

www.pdp.gov.my

If you are in New Zealand

If you live in the New Zealand, we comply with New Zealand’s Privacy Act 2020.

You have the following rights in relation to the processing of your Personal Data, including to:

Right to be informed

Right of access (commonly known as a “Subject Access Request”)

You have the right to access and receive a copy of the Personal Data we hold about you.

Right to rectification

You have the right to have any incomplete or inaccurate information we hold about you corrected.

Complaints

If you are concerned about the way in which we are handling your Personal Data, you can contact the Office of the Privacy Commissioner of New Zealand (OPC”) whose contact details are:

Office of the Privacy Commissioner
Level 8,
109-111 Featherston Street,
Wellington 6143

www.privacy.org.nz

If you are in Peru

If you live in Peru, we comply with the PDPL and you have the following rights in relation to the processing of your Personal Data:

Right to be informed

Right of access (commonly known as a “Subject Access Request”)

You have the right to access and receive a copy of the Personal Data we hold about you.

Right to rectification

You have the right to have any incomplete or inaccurate information we hold about you corrected.

Right to erasure (commonly known as the right to be forgotten)

You have the right to ask us to delete or de-identify your Personal Data.

Right to object to processing

You have the right to object to us processing your Personal Data.

Right to portability

You have the right to ask us to transfer your Personal Data to another party.

Automated decision-making.

Right to withdraw consent

Right to complain

If you are concerned about the way in which we are handling your Personal Data, you have the right to complain to the National Data Protection Authority within the Ministry of Justice.

If you are in the Philippines

If you live in the Philippines, we comply with the Data Privacy Act of 2012 (Republic Act No. 10173) (“DPA”).

You have the following rights in relation to the processing of your Personal Data, including to:

Right to be informed

Right of access (commonly known as a “Subject Access Request”)

You have the right to access and receive a copy of the Personal Data we hold about you.

Right to rectification

You have the right to have any incomplete or inaccurate information we hold about you corrected.

Right to erasure (commonly known as the right to be forgotten)

You have the right to ask us to delete or de-identify your Personal Data.

Right to object to processing

You have the right to object to us processing your Personal Data.

Right to portability

You have the right to ask us to transfer your Personal Data to another party.

Automated decision-making

Right to complain

You have the right to complain to the relevant supervisory authority, if you are concerned about the way in which we are handling your Personal Data.

The National Privacy Commission is the supervisory authority for the Philippines. They can be contacted at:

5th Floor, Delegation Building

PICC Complex,

Roxas Boulevard, Manila

Metro Manila

www.privacy.gov.ph

If you are in Singapore

If you live in Singapore, we comply with Singapore’s Personal Data Protection Act 2012 (“Singapore’s PDPA”)

You have the following rights in relation to the processing of your Personal Data, including to:

Right to be notified

You have the right to be notified of the purpose for which we intend to collect, use, or disclose your Personal Data and you are also entitled to be provided with information about the ways in which your Personal Data has been used or disclosed during the past year.

Right of access (commonly known as a “Subject Access Request”)

You have the right to access and receive a copy of the Personal Data we hold about you.

Right to rectification

You have the right to have any incomplete or inaccurate information we hold about you corrected.

Right to withdraw consent

Complaints

If you are concerned about the way in which we are handling your Personal Data, you can contact the Personal Data Protection Commission for Singapore whose contact details are:

The Personal Data Protection Commission
10 Pasir Panjang Road #03-01
Mapletree Business City
Singapore
117438

www.pdpc.gov.sg

The Infocomm Media Development Authority of Singapore supports the Commission in administering compliance with the PDPA.

Thailand, United Kingdom and European Union

If you live in Thailand, we comply with Thailand’s Personal Data Protection Act 2019 (“Thailand’s PDPA”).

If you live in the UK, we comply with the UK General Data Protection Regulation (“UK GDPR”).

If you live in the EU, we comply with the EU General Data Protection Regulation (“EU GDPR”).

You have the following rights in relation to the processing of your Personal Data, including to:

Right to be informed

Right of access (commonly known as a “Subject Access Request”)

You have the right to access and receive a copy of the Personal Data we hold about you.

Right to rectification

You have the right to have any incomplete or inaccurate information we hold about you corrected.

Right to erasure (commonly known as the right to be forgotten)

You have the right to ask us to delete or de-identify your Personal Data.

Right to object to processing

You have the right to object to us processing your Personal Data.

Right to restrict processing

You have the right to restrict our use of your Personal Data.

Right to portability

You have the right to ask us to transfer your Personal Data to another party.

Automated decision-making

Right to withdraw consent

Right to complain

You have the right to complain to the relevant supervisory authority, if you are concerned about the way in which we are handling your Personal Data.

Thailand’s national supervisory authority is the Personal Data Protection Committee who can be contacted at:

7th Floor, Ratthaprasasanabhakti Building
Government Complex
Chaengwattana Road
Thung Song Hong Sub-District, Lak Si District
Bangkok, Thailand 10210

www.mdes.go.th/mission/82

E-mail: pdpc@mdes.go.th

Tel: +662-142-1033 and +662-141-6993

The UK’s supervisory authority is the Information Commissioner’s Office who can be contacted online at:

Or by telephone on 0303 123 1113

For EU supervisory authorities see the link below:

https://edpb.europa.eu/about-edpb/about-edpb/members_en

If you are in the United States of America

If you are in California

If you live in California, you have the following rights under the California Consumer Privacy Act (“CCPA”), as amended by the California Privacy Rights Act (“CPRA”).

The CCPA (as amended) provides California residents certain rights related to their Personal Data, namely:

Right to know

You have the right to know details such as what Personal Data we collect about you, who we share it with, how we use it, for what purpose and how long we keep it. We use our privacy notice to explain this.

Right of access (commonly known as a “Subject Access Request”)

You have the right to access and receive a copy of the Personal Data we hold about you.

Right to rectification

You have the right to have any incomplete or inaccurate information we hold about you corrected.

Right to erasure (commonly known as the right to be forgotten)

You have the right to ask us to delete or de-identify your Personal Data.

Right to object

You have the right to object to the sale of your Personal Data.

Right to restrict processing

You have the right to request that we limit the use and disclosure of Personal Data that we have about you which is sensitive (as defined in the CPRA).

Rights regarding the sale and sharing of your Personal Data

You have the right to know whether we sell your Personal Data and whether we disclose your data to anyone.

Right against discrimination

You have the right not to be discriminated against for exercising your privacy rights.

Right to portability

You have the right to ask us to transfer your Personal Data to another party.

We do not sell or disclose your Personal Data for monetary gain or any valuable consideration.

The Personal Data we collect about you is set out above under ‘Personal Data we collect’.

Complaints

If you are concerned about the way in which we are handling your Personal Data, you can submit a complaint to your supervisory authority, the California Privacy Protection Agency who can be contacted online at:

California Privacy Protection Agency (CPPA)

If you are in Virginia

If you live in Virginia, from 1st January 2023 you have the following rights under the Consumer Data Protection Act (“CDPA”):

Right to be informed

Right of access (commonly known as a “Subject Access Request”)

You have the right to access and receive a copy of the Personal Data we hold about you.

Right to rectification

You have the right to have any incomplete or inaccurate information we hold about you corrected.

Right to erasure (commonly known as the right to be forgotten)

You have the right to ask us to delete or de-identify your Personal Data.

Right to opt out

You have the right to opt out of us processing your Personal Data for the purposes of targeted advertising and the sale your Personal Data.

Right to portability

You have the right to ask us to transfer your Personal Data to another party.

Automated decision-making

Right not to be discriminated against for exercising your rights.
Right to appeal if we refuse to process your request to exercise your rights.

Complaints

If you are concerned about the way in which we are handling your Personal Data, you can submit a complaint to the Office of the Attorney General for Virginia who can be contacted at:

202 North Ninth Street

Richmond

VA 23219

Phone: (804) 786-2071

Email: oag@oag.state.va.us

If you are in Colorado

If you live in Colorado, from 1st July 2023 you have the following rights under the Colorado Privacy Act (“CPA”):

Right to be informed

Right of access (commonly known as a “Subject Access Request”)

You have the right to access and receive a copy of the Personal Data we hold about you.

Right to rectification

You have the right to have any incomplete or inaccurate information we hold about you corrected.

Right to erasure (commonly known as the right to be forgotten)

You have the right to ask us to delete or de-identify your Personal Data.

Right to opt out

You have the right to opt out of us processing your Personal Data for the purposes of targeted advertising and for the sale of your Personal Data.

Right to portability

You have the right to ask us to transfer your Personal Data to another party.

Automated decision-making

Right not to be discriminated against for exercising your rights.
Right to appeal if we refuse to process your request to exercise your rights.

Complaints

If you are concerned about the way in which we are handling your Personal Data, you can submit a complaint to the Office of the Attorney General for Colorado who can be contacted at:

https://coag.gov

Department of Law

Ralph L. Carr Judicial Building

1300 Broadway

10th Floor Denver

CO 80203

Phone: +1 720-508-6000

If you are in Connecticut

If you live in Connecticut, from 1st July 2023 you have the following rights under the Connecticut Act Concerning Personal Data Privacy and Online Monitoring (“CTDPA”):

Right to be informed

Right of access (commonly known as a “Subject Access Request”)

You have the right to access and receive a copy of the Personal Data we hold about you.

Right to rectification

You have the right to have any incomplete or inaccurate information we hold about you corrected.

Right to erasure (commonly known as the right to be forgotten)

You have the right to ask us to delete or de-identify your Personal Data.

Right to opt out

You have the right to opt out of us processing your Personal Data for the purpose of targeted advertising and the sale of your Personal Data.

Right to portability

You have the right to ask us to transfer your Personal Data to another party.

Automated decision-making

Right not to be discriminated against for exercising your rights.
Right to appeal if we refuse to process your request to exercise your rights.

Complaints

If you are concerned about the way in which we are handling your Personal Data, you can submit a complaint to the Office of the Attorney General for Connecticut who can be contacted at:

Connecticut Office of the Attorney General

165 Capitol Avenue
Hartford, CT 06106

Email: Attorney.General@ct.gov

Phone: 860-808-5318.

If you are in Utah

If you live in Utah, from 31st December 2023 you have the following rights under the Utah Consumer Privacy Act (“UCPA”):

Right to be informed

Right of access (commonly known as a “Subject Access Request”)

You have the right to access and receive a copy of the Personal Data we hold about you.

Right to erasure (commonly known as the right to be forgotten)

You have the right to ask us to delete or de-identify your Personal Data.

Right to opt out to processing

You have the right to opt out of us processing your Personal Data for the purposes of targeted advertising or sale of Personal Data.

Right to portability

You have the right to ask us to transfer your Personal Data to another party.

Automated decision-making.

Right not to be discriminated against for exercising your rights.

Complaints

If you are concerned about the way in which we are handling your Personal Data, you can submit a complaint to the Office of the Attorney General for Utah who can be contacted at:

Consumer Protection (utah.gov)

Phone: (801) 530-6601

Toll-Free in UT:

(800) 721-7233

Email: consumerprotection@utah.gov

Mailing Address:

PO Box 146704
Salt Lake City, UT 84114-6704

Physical Address:

160 East 300 South
Salt Lake City, UT 84111

If you are in Vietnam

If you live in the Vietnam, we comply with the Law on Cyber Information Security No.86/2015/QH13 (19 November 2015) (“LCS”) and all other applicable Vietnamese laws on data protection.

You have the following rights in relation to the processing of your Personal Data, including to:

Right to be informed

Right of access (commonly known as a “Subject Access Request”)

You have the right to access and receive a copy of the Personal Data we hold about you.

Right to rectification

You have the right to have any incomplete or inaccurate information we hold about you corrected.

Right to erasure (commonly known as the right to be forgotten)

You have the right to ask us to delete your Personal Data.

Right to object/opt-out

You have the right ask us to stop providing your Personal Data to a third party.

Complaints

If you are concerned about the way in which we are handling your Personal Data, you can contact the Ministry of Information and Communications for Vietnam whose contact details are:

Ministry of Information and Communications

18 Nguyen Du Street
Hang Bai Ward

Hoan Kiem District
Hanoi
Vietnam

english.mic.gov.vn

12. Children’s Privacy

We do not offer our services to children and we do not knowingly collect Personal Data of children without parental consent, unless permitted by law.

13. How to contact us and our Data Protection Officer

If you wish to contact us or our Data Protection Officer (“DPO”) in relation to this privacy notice or if you wish to exercise any of your rights outlined above, please contact us as follows:

FAO the ‘Data Protection Officer’, Old Church House, Sandy Lane, Crawley Down, Crawley, West Sussex, England RH10 4HS.

Email dataprotection@empresaria.com

Please mark your communications FAO the ‘Data Protection Officer’.

14. Changes to this privacy notice

We may update this notice (and any supplemental privacy notice), from time to time as shown below. We will notify of the changes where required by applicable law to do so.

Last modified May 2024

Previous versions of this notice are available upon request as per the contact details above.

If you wish to exercise any of the rights set out above, please contact us at dataprotection@empresaria.com

Check our Terms of Use