Privacy Notice

25th May 2018 (v1.2)

Policy for processing personal data

1. Introduction / Background

Strongfield (STL) is an international group with its head-office in the UK, that provides specialist technology based products, consultancy & recruitment solutions to our clients and candidates primarily across Aerospace, Defence, Aviation, Automotive and Advanced Engineering sectors. Strongfield operates from companies across UK, USA, Canada, India & China as well as through key strategic partnerships across the globe. In 2008, Strongfield also merged with Betts Recruitment to provide enhanced services to the Aviation market.

STL must process personal data so that we can provide these services – in doing so, the Company acts as a data controller.

Relating to this Privacy Notice, the “Company” shall mean the following UK companies:- Strongfield Technologies Ltd, Strongfield Aviation plc & Milfoam International Ltd. (Strongfield Consultants is a trading name of Strongfield Aviation plc)

STL is committed to protecting and respecting your privacy. This privacy notice outlines our approach regarding the collection and processing of any personal data we collect from you or you provide to us.

The General Data Protection Regulation (GDPR) (Regulation (EU) 2016/679) is a new regulation which replaces the Data Protection Regulation (Directive 95/46/EC). The Regulation aims to harmonise data protection legislation across EU member states, enhancing privacy rights for individuals and providing a strict framework within which commercial organisations can legally operate.

This notice applies to the personal data of our candidates, clients, suppliers, website users, and other people we may contact / interact with.

2. Lawful purpose for maintaining possession of data

The General Data Protection Regulations (GDPR) requirement is that possession of data may only be maintained on the basis of having a lawful purpose for doing so.

Accordingly, the following lawful basis is applied by STL when maintaining and processing information in respect of the data subjects for whom data is held and processed by STL:

(a) Legitimate interests:

the processing of personal data is necessary for STL’s legitimate interests or the legitimate interests of a third party unless there is a good reason to protect the individual’s personal data which overrides those legitimate interests.

(b) Consent:

the individual has given clear consent for STL to process their personal data for a specific purpose.

(c) Contract:

the processing of personal data is necessary for a contract STL has with the individual, or because they have asked STL to take specific steps before entering into a contract.

(d) Legal obligation:

the processing of personal data is necessary for STL to comply with the law (not including contractual obligations).

3. What kind of personal data do we collect?

We may collect information about you if you contact / interact with us or register on our systems or databases which may include your personal data. Our aim is to demonstrate that we we process data lawfully, fairly and in a transparent manner in relation to individuals.

The legal bases we rely upon to offer our services to you are as follows;

3.1 Candidate Data

We process data belonging to Candidates who are Job Seekers engaging with us for work finding services or career support; and Placed Candidates who are placed into employment or temporary/contract assignments.

We collect Candidate Data in three ways:

1. Personal data that a Candidate gives to us
2. Personal data that we receive from other sources (such as referees or LinkedIn, job sites/boards)
3. Personal data that we collect automatically (e.g. through our website, newsletters or other marketing material)

3.1.1 Job Seekers

The information we may collect from a Job Seeker in order to find them a suitable role or provide career support may include:

• Name
• Address
• Email address/s (personal and work)
• Telephone number/s

• CV / work history
• Job preferences including role, geographical areas and salary/rate

• A log about of certain communications by social media, email and telephone about a potential role / job seeker current status
• Education and training certificates

We obtain Candidate Data from a Job Seeker for the purpose and legitimate interest of finding the Job Seeker temporary work/employment, fulfilling a contract with the Client to whom the Candidate is or may be introduced and to carry out our obligations as a compliant recruitment business/agency.

Personal data obtained is stored only on the basis that there is a legitimate interest & expectation of the need of our services prior to entering into a fully executed contract/agreement.

3.1.2 Placed Candidates

Information that we may collect from Placed Candidates who we have placed into employment or temporary/contract assignments (in addition to the above) can include:

• Marital Status
• Gender
• Date of birth

• Passport
• Work permits and/ or visas
• National insurance number
• Bank details
• Medical information
• References
• Financial information
• A log of certain communications by social media, email and telephone

• Details of job offers and placements
• Outcome of criminal record checks and security clearance (for certain roles)

Personal data obtained is stored on the basis that there is a Contract and therefore a lawful basis, need & obligation for the data retention during the contract.

3.2 Client and Supplier Data

We collect Client and Supplier data in three ways:

1. Personal data that we receive directly from the Client or Supplier (either by phone, email or through our consultants’ business development / sales activities
2. Personal data that we received from other sources (due diligence checks, market intelligence, delegate lists at relevant events, candidates)
3. Personal data we collect automatically (e.g. through our website, newsletters or other marketing material)

The information we may collect from a Client or Supplier can include:

• Name
• Address
• Email address/s (personal and work)
• Telephone number/s (personal and work)
• Due diligence & ISO quality management checks
• Company Details
• Financial information

Consent to process Client and Supplier data is obtained solely on the basis of fulfilling the services required, or may be required, during execution of Contract / agreement with the Client or Supplier.

3.3 Prospective Clients & Suppliers

As part of our marketing and business development / sales activities, we will obtain, store and process in a secure manner, the data from representatives of Prospective Clients & Suppliers.

We collect Prospective Client & Supplier data in three ways:

1. Personal data that we receive directly (either by phone, email or through our consultants’ business development activities)
2. Personal data that we received from other sources (due diligence checks, market intelligence, delegate lists at relevant events, candidates)
3. Personal data we collect automatically (e.g. through our website, newsletter or other marketing material)

The information we may collect from a Prospective Client or Supplier can include:

• Name
• Address
• Email address (work)
• Telephone number (work)
• Company Details

Personal data of Prospective Client & Suppliers is stored on the basis that there is a legitimate interest & prospect of the need of our services/solutions prior to entering into a fully executed contract/agreement.

Where there is no prospect of entering into a services/consultancy contract, supply/distribution agreement we will obtain explicit consent to store the personal data on our database solely for the potential marketing and business development purposes in the future.

4. How do we use your information?

Candidate Data

The main reasons for us using and processing Candidates’ personal data is to help them find employment and assignments which may be suitable for them. Collecting Candidates’ data allows us to better respond to their individual needs and personalise their experience. We may also use Candidate information to improve our systems based on their feedback, improve customer service and to send periodic emails & posts with information and updates.

Client Data

The main reason for us using and processing information about our Clients is to ensure that our services can be targeted in a meaningful way and agreements can be fully implemented to ensure a smooth business relationship. The more accurate information we have from our Clients, the better the service we can provide to them.

Supplier Data

The main reason for us processing Supplier information is to ensure that contract agreements between us can be fully implemented to ensure a smooth business relationship and to comply with any legal requirements.

Prospect Client and Supplier Data

The main reason for us using information about prospect Clients and Suppliers is for potential marketing and business development / sales purposes in the future.

5. Website - Users and Cookies

When you visit our website, there is certain information that we may automatically collect. This can include your IP address, the date, time and frequency with which you access the website and the way you browse our content. We will also collect data from when you contact us via the website including our live chat function.

We use data from users to improve their experience on our website, for example we may analyse your job search criteria to help us show you our recent jobs that we think you may be interested in. If you are a Candidate or Client, we may use your user data from our website to enhance our communication with you.

‘Cookies’ are small pieces of information which are stored in your computer. They are used by nearly all websites and do not harm your computer system. We use cookies to track your activity on our website which enables us to tailor your preferences and options when you navigate our website. We can also use cookies to analyse website traffic and for advertising. To alter the way you accept cookies, please change your settings in your web browser.

6. Who do we share your personal data with?

We do not sell, trade, or otherwise transfer to outside parties your personally identifiable information. This does not include trusted third parties who assist us in conducting our business or servicing you, so long as those parties agree to keep this information confidential and compliant with the latest GDPR. We may also release your information when we believe release is appropriate to comply with the law, enforce our Company policies, or protect ours or others rights, property, or safety.

7. How do we protect your information?

We understand how important it is to protect your personal information and we will always use our best efforts to take necessary precautions to prevent unauthorized access to, and misuse of, your personal data.

We implement a variety of security measures to maintain the safety of your personal information when we enter, submit, hold or access your personal information. We ensure that there are appropriate technical controls in place to protect your personal data such secure electronic data storage (inhouse & cloud based servers), routine backup systems, anti-virus/malware protections and encryption where appropriate. We regularly review our technical controls & security measures and constantly monitor potential risks.

We also ensure that only authorised personnel have access to your data and that they are appropriately trained to manage your personal information.

8. How long do we keep your information for?

We retain Placed Candidate, Client and Supplier Data securely throughout the duration of a contract/agreement, Contract of Services or temporary assignment/employment placement until the end of such an agreement, for a maximum of 7 years after completion to comply with our legal / financial / audit obligations.

If we do not have an assignment contract, temporary employment or supply/distribution agreement with you and we have not had any contact with you for a period of at least 3 years, we will delete your personal data from our systems unless we believe that the law requires us to keep his information.

Where there is no prospect of entering into such a contract/agreement, we may also obtain explicit consent (via email communication or consent via our website) to store the personal data on our database solely for potential marketing and business development purposes in the future. On obtaining such consent we will retain your data for a maximum of 5 years.

9. How can you access, amend or take back the personal data that you have given us?

If we hold your personal data, you have rights which allow you to have control of how we use your data or if you would like us to stop processing your personal data. In some circumstances, we may be legally obliged to return your personal data for audit purposes, however these can be discussed with you depending on your requirements.

Under the General Data Protection Regulation, you are granted the following rights:

• Right to be informed

• Right of access

• Right to rectification

• Right to erasure

• Right to restrict processing

• Right to data portability

• Right to object

• Rights related to automated decision making

For more detailed information on your rights. Please read the relevant guidance issued by the ICO at: https://ico.org.uk/for-organisations/guide-to-the-general-data-protection-regulation-gdpr/individual-rights/

We may ask you to verify your identity or ask for more information about your request. Where we are legally permitted to do so, we may decline your request, but we will explain why if we do so. We will respond to all requests within one month or receipt of your request.

10. How do we store and transfer your data internationally?

All Candidate, Client and Supplier data will be obtained, stored and processed in a secure manner on our CRM, Payroll and ERP system/databases.

STL is a global organisation whereby we are able to deliver our services globally. In order for us to be able to continue delivering our service, we may be required to transfer or store your data internationally. Currently our data is stored in our UK Head Office location but is accessible remotely in our global offices./locations.

11. Contacting Us

• By Email:

Please contact us by email at compliance@.strongfield.com.

• By Post:

Alternatively, please send your request:to

Strongfield (Group of Companies)

Data Protection Officer
Strongfield House

Unit2, 89 Manor Farm Road
Wembley, Middlesex
HA0 1BA
UK

If you would like us to stop retaining your data, you can request the Erasure of your data by contacting our Data Protection Officer (details listed above).

If you would like to make a complaint about how we process your personal data, please contact our Data Protection Officer (details listed above).

If you are not happy with how we have dealt with your request, you should contact the Information Commissioner’s Office.

12. Changes to this Privacy Notice

This notice may change from time to time. If we make any significant changes to this notice, we will publicise these changes clearly on our website. Please check back frequently to see any updates.