In the context of this privacy notice, Hireserve Ltd is your data controller. This means we are responsible for the security and legitimacy of the personal data we hold about you.

Hireserve Ltd is registered in England and Wales under company number 03420688. Our registered office is: Wey Court West, Union Road, Farnham, Surrey, GU9 7PT.

Our office address is: Norton House, Stewart Road, Basingstoke, RG24 8NF. If you would like to email us with a data enquiry, please use dataprotection@hireserve.khdigitaldev.co.uk.

The Data Protection Bill sets out six legal bases for processing data. We have identified the appropriate one(s) for each time we collect, store and process your personal data, which you will find out more about below.

Typically, there are four kinds of data that we process:

• Candidate data for our internal recruitment
• Customer data in order to communicate with our customers and to progress expected business activity
• Marketing/sales data in order to develop new business and inform individuals and organisations of our product and services
• Employee data so we can support, pay and communicate with our staff. We have an internal privacy notice for our employee data, which is available upon request.

We collect candidate data in order to assess an individual’s suitability for a role working at Hireserve.

What kind of data do we collect?

When you apply for a job at Hireserve, we will usually ask you to complete an online application form and upload a CV. The application form may request personal data such as your name, address and telephone number. The reason for this is that we will need to contact you in order to progress your job application with us.

We may also ask for information like your education and/or work history, qualifications and details of skills you have used in previous roles. Again, the reason for this information is because it will help us to undertake an initial assessment about whether you are suitable for the role you are applying for.

We may ask you to upload a CV and/or covering letter. Please note that your CV and/or covering letter may include personal data that we have not specifically requested but which we may store and process along with the data submitted in your application form.

 What is our legal basis for processing candidates’ personal data?

We have identified ‘legitimate interests’ as the most appropriate legal basis for collecting, storing and processing candidates’ personal data for recruitment purposes.

This is because we need this data in order to make informed decisions about how candidates progress through our recruitment process. Our recruitment process is necessary because, without hiring new members of staff, Hireserve cannot grow as a business and may be unable to deliver the product and service on which our customers depend.

There is no other practical, appropriate or sustainable way at present to assess a candidate’s suitability for a role other than our current process of collecting some personal data at application stage.

When you apply for a role with Hireserve, your data will be entered into our Applicant Tracking System.

• Currently we do not use automated decision-making as part of our recruitment process.
• We do not transfer your personal data outside of the EEA.
• Hireserve’s Applicant Tracking System hosting provider is based in the UK.

We do not collect Special Category data during our application process.

How long will we store candidates’ personal data for?

We have undertaken a data audit process, and as part of this have identified an appropriate data retention period which balances the rights of you, the individual, with Hireserve’s business needs/interests and any potential risks.

The outcome of this exercise is that we will retain your candidate personal data for a maximum of 12 months from the point of your first application. This is based on both CIPD recommendations for data retention, and because we may wish to contact you about future roles for which you may be suited at Hireserve. If you have any questions about Hireserve’s approach to data retention, please contact dataprotection@hireserve.khdigitaldev.co.uk

Your data will be stored securely in our Applicant Tracking System, which is hosted in the UK. Your contact information may also be stored in our Outlook email application.

We collect customer data in order to communicate with our customers effectively.

What kind of data do we collect?

When you become a Hireserve customer, we will ask for the names and business contact details (usually job title, business phone and business email address) of the key stakeholders relating to the Hireserve partnership.

Please note that the only personal data we are likely to request is your name.

We will also require business information to help us raise and process invoices.

What is our legal basis for processing customers’ data?

We have identified ‘legitimate interests’ as the most appropriate legal basis for collecting, storing and processing customers’ data.

This is because we need this data in order to contact customers to advise them of new product features, to support them with issues, to discuss contractual obligations or any other reasonable communications you would expect between a supplier and their end customer.

How long will we store customers’ data for?

We have undertaken a data audit process, and as part of this have identified an appropriate data retention period which balances the rights of you, the individual, with Hireserve’s business needs/interests and any potential risks.

The outcome of this exercise is that we will retain customer data for the duration of each contract, with frequent reviews as to the accuracy and relevancy of the data, and then an additional seven years after the contract expiry date. This is so that we can comply with HMRC statutory requirements. If you have any questions about Hireserve’s approach to data retention, please contact dataprotection@hireserve.khdigitaldev.co.uk

When you begin working with Hireserve, your business contact information will be stored by our Services team in Salesforce Service Cloud. Salesforce is based in the USA and complies with the EU-U.S. Privacy Shield Framework. You can read more about Salesforce and the EU-US Privacy Shield Framework here.

We also store your business contact information in an online marketing automation platform called Pardot. This enables us to send you customer communications, such as a customer newsletter or system updates. If you do not wish to receive these kind of updates, you can manage your preferences or unsubscribe by clicking a link in the bottom of an email newsletter from us, or contacting a member of our team. Pardot is part of the Salesforce product suite. As such, your business data in Pardot is also protected by the EU-US Privacy Shield Framework.

We may also store your business contact information in our online mailing platform called MailChimp. MailChimp is based in the USA and, again, all data transfers are protected by the Privacy Shield Framework, meaning your information is secure.

Your business contact information may also be stored in our Outlook email application.

Some business information may also be stored in Hireserve’s Applicant Tracking System, Hireserve ATS, as you and your colleagues will be users of the system. It is likely that you will set many of these user accounts up in Hireserve ATS, so you will therefore be the Data Controller, as opposed to Hireserve.

We collect marketing/sales data in order to develop new business relationships and inform individuals and organisations of our product and services

What kind of data do we collect?

There are several ways we collect marketing/sales data from potential prospects. These include, but may not be limited to:

• Contact/ ‘Request a Demo’ forms on our website (hireserve.khdigitaldev.co.uk)
• Gated content download forms on our website (hireserve.khdigitaldev.co.uk)
• Meeting people in person at events and taking a business card or noting down data when freely provided by you, and with your verbal consent.
• Data shared by events partners. Please note, we only work with marketing and events partners who also meet the requirements of the Data Protection Act.
• Direct enquiries via email or telephone

Typically, we will only ask for your name and business contact details (usually job title, business phone and business email address) on our website forms.

Please note that the only personal data we are likely to request is your name, unless you choose to provide us with a personal email address. If you do choose to provide us with your personal email address, we will use it in the strictest of confidence in accordance with this privacy notice.

What is our legal basis for processing marketing/sales data from potential prospects?

We have identified ‘legitimate interests’ as the most appropriate legal basis for collecting, storing and processing prospects’ data from a hireserve.khdigitaldev.co.uk form, a gated content download form, direct enquiries over email or telephone, or when we meet you at an event.

This is because we need this data in order to respond to direct enquiries and inform individuals and organisations who have an interest in our product and services. This means that when we request your details on a website form, or you provide us with your details at an event or download a piece of content, we will not ask for your consent to process and store your data in the first instance.

We also abide by PECR (Privacy and Electronic Communications Regulation). If we want to send you additional marketing communications, via email, to your business email address, we will not ask for your consent. This is because we undertake B2B (business to business) marketing and have defined you as a corporate subscriber rather than an individual. You will always be able to freely to opt-out of our B2B marketing emails by following the ‘unsubscribe’ link in the footer of our emails.

To ensure we comply with PECR, we will not send you marketing communications via email without your consent if you are using a personal email address, are a sole trader, or other partner as defined by PECR.

If we receive your data from a trusted third party, such as one of our Marketing partners or our parent company, XCD, we will contact you so that you know that we are now the data controller and to share a link to this privacy notice with you.

We will only share your data with trusted third parties if we ask for your consent first.

How long will we store marketing/sales data for?

We have undertaken a data audit process, and as part of this have identified an appropriate data retention period which balances the rights of you, the corporate subscriber, with Hireserve’s business needs/interests and any potential risks.

The outcome of this assessment is that we will retain your prospect data for a maximum of 18 months from the point of your last engagement with Hireserve (e.g. through clicking a link in an email, completing a website form or via an event). This is because our sales and marketing cycles can be long processes and it can take a long time to nurture and engage potential prospects, and for business relationships to mature. You can, of course, opt out of or unsubscribe from Hireserve communications at any time. If you have any questions about Hireserve’s approach to data retention, please contact dataprotection@hireserve.khdigitaldev.co.uk

Your business contact information will be stored by our Marketing and Communications team in a marketing automation platform called Pardot. Pardot is part of the Salesforce product suite. Salesforce is based in the USA and complies with the EU-U.S. Privacy Shield Framework. You can read more about Salesforce and the EU-US Privacy Shield Framework here.

Your business contact information may also be stored in our Outlook email application.

Under the PECR guidelines, you are free to opt-out of our communications at any time.

In the interest of providing a good and accurate service to our clients, we may record the telephone calls you make to us, and we may use your personal data that we have collected for the following purposes:

1. Prevention, detection, investigation and prosecution of fraud
2. Complaint handling and resolution
3. Measuring the quality of the call
4. Internal training on call handling

The information you provide during your phone calls will be managed as required by the prevailing Data Protection law.

We have a legitimate interest in recording calls in order to offer our customers a good service and to protect our business.  If you object to the call recording, you will have the option to end the call when you are informed that calls may be recorded.  You will have the option to contact us through alternative means.

All calls will be retained for a period of one year, and will be deleted automatically after that timeframe, unless the call content is part of an ongoing complaint or crime investigation.

You have the right to receive a copy of the call recording.  To do this you must submit a data subject access request. Please follow the guidance in How you can exercise your data subject rights section.

Your information may be shared with other organisations if they have a legal right to access it, for example; legal bodies governing a fraud case.

Your information will not be transferred outside the European Economic Area.

When you visit our website, we collect data from your cookies and business IP address. When you visit our website for the first time, you will see a cookie notice bar advising you that we use cookies.

You can read our cookie policy and learn what cookies we use (and why) on Hireserve.com here.

We only track fixed business IP addresses. This does not provide us with any personal data – we can only see the organisation’s name associated with the IP address. The reason for this information is that it helps us to understand more about who is visiting our website and how we can enhance it for future marketing/sales activity.

Whether you are a customer, candidate or sales/marketing prospect, you all share the same data subject rights under the Data Protection Act:

1. The right to be informed
2. The right of access
3. The right to rectification
4. The right to erasure
5. The right to restrict processing
6. The right to data portability
7. The right to object
8. Rights in relation to automated decision making and profiling.

If you would like to learn more about your data subject rights, or to make a data subject request regarding your personal data, please email dataprotection@hireserve.khdigitaldev.co.uk and we will send you the relevant data subject request form for you to complete and return.

We do not share your personal data with any un-authorised or non-statutory third parties.

If we do need to share your data, we will let you know the reason behind this and provide the contact details and any other appropriate information on a case-by-case basis.

Throughout all our communications, we strive for transparency, accountability and fairness at Hireserve, in line with the principles of the Data Protection Act.

Please email dataprotection@hireserve.khdigitaldev.co.uk and we will be happy to help.