PRIVACY POLICY 1. INTRODUCTION Welcome to Bigblue Company. This policy explains how we handle and use your personal information and your rights in relation to that information. Under the GDPR of May 2018, Bigblue is the controller of that information. Bigblue (“Bigblue”, “we”, “our” or “us”) is committed to protecting and respecting your privacy. This Privacy Policy explains why and how we will use the personal information that we have obtained from you or others, with whom we share it and the rights you have in connection with the information we use. Please read the following carefully. This policy describes the way we handle and use the personal information that we obtain from all the different interactions you may have with us as a business, including when you visit our offices, social media pages or website currently located at www.bigblue.uk.com or when you contact us. Bigblue is the controller in relation to the processing activities described below. This means that Bigblue decides why and how your personal information is processed. Please see the section at the end of this policy for our contact and legal information. We may need to update this Privacy Notice from time to time. We'll notify you of any significant changes, but you're welcome to check it whenever you wish. 2.PERSONAL INFORMATION WE COLLECT ABOUT YOU We receive personal information about you that you give to us that we collect via various channels (including our website, through written correspondence (including e-mail), conversations or meetings with our consultants, or through any of our offices or websites globally). We only collect personal information which we need and that is relevant for the purposes for which we intend to use it.INFORMATION THAT WE COLLECT ABOUT YOU – IN PERSON, ONLINE, BY PHONE, SOCIAL MEDIA, AND EMAIL: I. Your name, title and contact details (email address, telephone number, postal address) and other relevant information from your Curriculum Vitae (CV). On occasion this will also include sensitive personal information such as details of criminal convictions and ethnic origin; II. Any information you include in correspondence you send to us or in forms you submit to us via email or when using our Site or social media pages; III. Personal information about you obtained during the course of our relationship with you; IV. The opinions and other information you provide when responding to customer surveys and service reviews; V. Any personal information included in your entries to competitions that we run; VI. Your identification information when exercising the rights that you have in relation to our processing of your personal information (see further Your rights in relation to your personal information); VII. Details of any transactions between you and us; VIII. Voice recordings of calls you make to our consultants and office manager and information you give us when you contact us with a query or issue; IX. Footage of you on CCTV; X. When you visit our Site we automatically collect: XI. Details of your use of our Site namely traffic data, weblogs and statistical data, including where and when you clicked on certain parts of our Site and details of the webpage from which you visited it; XII. The date and time you used our Site; XIII. The pages you visited on our Site and how long you visited us for; XIV. The website address from which you accessed our website; XV. If we have asked for it, details regarding when and how you consented to receive marketing communications from us (including the time and date you provided your consent); Cookie, pixels and beacon identification information (for more information please see our Cookie Policy). 3. USE OF YOUR PERSONAL INFORMATION We use your personal information for a variety of reasons. We rely on different legal grounds to process your personal information, depending on the purposes of our use and the risks to your privacy. We will hold, use and disclose your personal information, for our legitimate business purposes including: I. to provide our services to you; II. to maintain our business relationship, where you are a user of our website, a client or candidate; III. to enable you to submit your CV for general applications, to apply for specific jobs or to subscribe to our job alerts. Please see the separate section on your CV below which outlines additional uses and disclosures; IV. to match your details with job vacancies, to assist us in finding a position that is most suitable for you and to send your personal information (including sensitive personal information) to clients in order to apply for jobs; V. to retain your details and notify you about future job opportunities other than the specific role for which you have contacted us; VI. to answer your enquiries; VII. to direct-market products and services, advise you of news and industry updates, events, promotions and competitions, reports and other information. Before we do so, you will be given an option to opt-out of such communications and an option to unsubscribe will also be provided with each communication; VIII. to fulfil contractual obligations with our clients; IX. to provide further services to you by sharing your personal information with other companies within our Group of companies as well as trusted third parties. Further details about this are set out in the separate section below on Sharing your Personal Information; X. to release personal information to regulatory or law enforcement agencies, if we are required or permitted to do so; XI. our website uses a website recording service which can record mouse clicks, mouse movements, page scrolling and any text keyed into website forms. Data collected by this service is used to improve our website usability. The information collected is stored and is used for aggregated and statistical reporting, and is not shared with anybody else. XII. In order to provide you with personalised content on our website, with more relevant communication in our emails, and with a tailored service from our consultants, we track and record your usage and interaction with our website and emails. We employ a third party service provider to help us record, store and analyse this information to determine how we might best deliver your engagement. We ensure that no personally identifiable attributes are recorded in this database and, other than our chosen service provider, we do not share this information with any other business or affiliate. We may process, in accordance with local regulations, certain sensitive personal data (known as special category data in GDPR) where you include it in information you send to us e.g. if you include information about your health, religion or ethnic origin in the CV you send to us. We may also be required to conduct a criminal records check against your details. We have processes in place to limit our use and disclosure of such sensitive data other than where permitted by law. 4. THE LEGAL BASIS FOR PROCESSING YOUR PERSONAL INFORMATION Under GDPR, the main grounds that we rely upon in order to process personal information of clients and candidates are the following: (a) Necessary for entering into, or performing, a contract – in order to perform obligations that we undertake in providing a service to you, or in order to take steps at your request to enter into a contract with us, it will be necessary for us to process your personal data; (b) Necessary for compliance with a legal obligation – we are subject to certain legal requirements which may require us to process your personal data. We may also be obliged by law to disclose your personal data to a regulatory body or law enforcement agency; (c) Necessary for the purposes of legitimate interests – either we, or a third party, will need to process your personal data for the purposes of our (or a third party's) legitimate interests, provided we have established that those interests are not overridden by your rights and freedoms, including your right to have your personal data protected. Our legitimate interests include responding to requests and enquiries from you or a third party, optimising our website and customer experience, informing you about our products and services and ensuring that our operations are conducted in an appropriate and efficient manner; (d) Consent – in some circumstances, we may ask for your consent to process your personal data in a particular way. 5. DISCLOSURE OF YOUR PERSONAL INFORMATION BY US In certain circumstances we will share your personal information with other parties. Details of those parties are set out below along with the reasons for sharing it. Other Companies within our Group within the EEA Where you are registered as a candidate on our database, we will share your personal information with other companies in the Page Group of companies in the European Economic Area ("EEA"). We will share your personal information as above for any or all of the following purposes: • to provide you with recruitment services; • for business development; • for systems development and testing; • for development and marketing of other products and services; • to improve our customer service and to make our services more valuable to you; and/or • to tailor our website and the websites of other companies in our Group when you log on to make them relevant to you personally. Other companies within our Group outside the EEA In the event you require us to explore job opportunities for you outside the EEA, we will notify you that we intend to pass your personal information to, or allow access to such information by, other companies within our Group of companies worldwide so they can use it for the purposes set out above. A list of all the companies within our Group of companies which are outside the EEA and their addresses can be accessed here. If you would like details of the particular companies within our Group which can access your personal information, please contact us using the details in the Contact section below. We apply equal rigour to the security of data held and processed across the whole of our global network. Each company within our Group of companies outside the EEA with access to data in the UK, enters into a specific data protection agreement with MPIR thereby undertaking to meet the same standards of data security and to act in accordance with data protection principles applicable under the strict European data protection laws. This agreement is based on the Model Clauses as approved by the EU Commission. If you would like a copy of this agreement, please contact us using the details in the Contact section below. Clients We disclose your personal information to clients who have vacancies for jobs in which you are interested. Trusted Third Parties We will share your personal information and, where necessary, your sensitive personal information with trusted third parties where we have retained them to provide services that you or our clients have requested, such as: • employment reference checking; • qualification checking; • criminal reference checking (as required); • verification of details you have provided from third party sources; and/or • psychometric evaluations or skills tests. We will also share your personal information with third parties who perform functions on our behalf and provide services to us such as: • professional advisors; • data analytics providers • IT consultants carrying out testing and development work on our business technology systems; • research and mailing houses; and/or • function co-ordinators. We require minimum standards of confidentiality and data protection from such third parties. To the extent that any personal information is provided to third parties outside the EEA, or who will access the information from outside the EEA, we will ensure that approved safeguards are in place, such as the approved Model Clauses or the EU/US Privacy Shield. Regulatory and Law Enforcement Agencies As noted above, if we receive a request from a regulatory body or law enforcement agency, and if permitted under GDPR and other laws, we may disclose certain personal information to such bodies or agencies. New business owners If we or our business merges with or is acquired by another business or company, we will share your personal information with the new owners of the business or company and their advisors. If this happens, you will be sent notice of such event. 6. SECURITY AND LINKS TO OTHER WEBSITES We take the security of your personal information seriously and use a variety of measures based on good industry practice to keep it secure. Nonetheless, transmissions over the internet and to our Site, and our social media pages may not be completely secure, so please exercise caution. When accessing links to other websites, their privacy policies, not ours, will apply to your personal information. We employ security measures to protect the personal information you provide to us, to prevent access by unauthorised persons and unlawful processing, accidental loss, destruction and damage. The transmission of information via the internet is not completely secure. Although we will do everything possible to protect your personal information, we cannot guarantee the security of any personal information during its transmission to us online. You accept the inherent security implications of using the internet and will not hold us responsible for any breach of security unless we are at fault. If you are using a computer or terminal in a public location, we recommend that you always log out and close the website browser when you complete an online session for your security. In addition, we recommend that you take the following security measures to enhance your online safety: When creating a password, we recommend use at least 8 characters with a combination of letters and numbers. We recommend you frequently change your password – you can do this by going to “My Account” and clicking “Change name, email or password”. Keep your passwords private. Remember, anyone you knows your password may access your account. Avoid using the same password for multiple online accounts. We will never ask you to confirm any account or credit card details via email. If you receive an email claiming to be from Bigblue asking you to do so, please ignore it and do not respond. Our Site, and social media pages may contain links to other websites run by other organisations which we do not control. This policy does not apply to those other websites' so we encourage you to read their privacy policies. We specifically disclaim responsibility for their content, privacy practices and terms of use, and we make no endorsements, representations or promises about their accuracy, content or thoroughness. Your disclosure of personal information to third party websites is at your own risk. 7. THE PERIODS FOR WHICH WE RETAIN YOUR PERSONAL INFORMATION We will not hold your personal information in an identifiable format for any longer than is necessary for the purposes for which we collected it. The length of time we will hold or store your personal information for will depend on the services we perform for you and for how long you require these. As we often support candidates with placements over many years, and potentially throughout their careers, the purpose for which we retain candidate data is often an ongoing purpose. We conduct regular data-cleansing and updating exercises with our candidates to ensure that (a) the data that we hold is accurate and (b) we are not holding data for too long. Our standard terms of business state that our clients should retain candidate data such as CVs for the purposes of the specific role you apply for and that, as controllers of your data, they should inform you if they plan to retain your CV on file in order to notify you about potential future roles, or to otherwise hold or use your data for other purposes. 8.YOUR RIGHTS IN RELATION TO YOUR PERSONAL INFORMATION You have the right to access any personal information that BDO processes about you and to request information about: I. What personal data we hold about you II.The purposes of the processing III.The categories of personal data concerned IV.The recipients to whom the personal data has/will be disclosed V.How long we intend to store your personal data for VI.If we did not collect the data directly from you, information about the source If you believe that we hold any incomplete or inaccurate data about you, you have the right to ask us to correct and/or complete the information and we will strive to do so as quickly as possible; unless there is a valid reason for not doing so, at which point you will be notified. You also have the right to request erasure of your personal data or to restrict processing (where applicable) in accordance with the data protection laws; as well as to object to any direct marketing from us. Where applicable, you have the right to data portability of your information and the right to be informed about any automated decision-making we may use. If we receive a request from you to exercise any of the above rights, we may ask you to verify your identity before acting on the request; this is to ensure that your data is protected and kept secure. Consent To the extent that we are processing your personal information based on your consent, you have the right to withdraw your consent at any time. You can do this by contacting us using the details in the Contact section below. Job Alerts To subscribe to job alerts emails, you will be required to provide your name and e-mail address, which will be used for the purpose of keeping you informed, by e-mail, of the latest jobs in your nominated industry and to provide you with industry news and other information related to our services. Should you decide that you no longer wish to receive this information, unsubscribe links are provided in every job alert email that you receive. Job alerts emails are sent by MPIR or a company within our Group of companies. Where the sender is based outside the EEA your details will be sent to or accessed by that entity to enable them to issue the relevant job e-mail alert to you. Curriculum Vitae We give you the option of submitting your CV via our website or by providing your CV to one of our consultants. You can do this either to apply for a specific advertised job or for consideration by our recruitment consultants for positions as they come up. Your CV will be stored in our database, and will be accessible by our recruitment consultants. Your CV may also be emailed directly to other companies within our Group of companies for review and entry onto their database to enable them to provide their services to you. You are able to withdraw your permission for your data being processed outside the EEA upon completing your registration form with us. You can update your CV at any time, simply by following the same procedure to submit a new CV. Your old CV will automatically be archived providing the submission details remain the same (for example you submit both CVs using the same email address or you advise the relevant contact of your new submission). Use of Cookies Like most websites, when you visit our sites we place cookies on your computer or other device. For the most part, these cookies are used to enable the websites' functionality, improve the user experience or help us to optimise our websites, measure traffic and other internal management purposes. We run targeted and relevant banner advertising on a number of whitelisted websites around the world to present you with jobs and content that we believe will be of interest. We target these adverts based on your previous interactions with our website, with our emails and through your engagements with our consultants. Your interaction with our advertising may be used to measure the effectiveness of our advertising campaigns and to improve our marketing strategy in accordance with our legitimate interests. No advertising campaigns or advertising tracking technology records your personally identifiable information. You can find out more about our use of cookies, including how to reject cookies, in our Cookie Policy. 9. CHANGES TO OUR PRIVACY POLICY Please check this page regularly for changes to this policy. This policy was last updated on 1st August 2018. VIII. to fulfil contractual obligations with our clients; IX. to provide further services to you by sharing your personal information with other companies within our Group of companies as well as trusted third parties. Further details about this are set out in the separate section below on Sharing your Personal Information; X. to release personal information to regulatory or law enforcement agencies, if we are required or permitted to do so; XI. our website uses a website recording service which can record mouse clicks, mouse movements, page scrolling and any text keyed into website forms. Data collected by this service is used to improve our website usability. The information collected is stored and is used for aggregated and statistical reporting, and is not shared with anybody else. XII. In order to provide you with personalised content on our website, with more relevant communication in our emails, and with a tailored service from our consultants, we track and record your usage and interaction with our website and emails. We employ a third party service provider to help us record, store and analyse this information to determine how we might best deliver your engagement. We ensure that no personally identifiable attributes are recorded in this database and, other than our chosen service provider, we do not share this information with any other business or affiliate. We may process, in accordance with local regulations, certain sensitive personal data (known as special category data in GDPR) where you include it in information you send to us e.g. if you include information about your health, religion or ethnic origin in the CV you send to us. We may also be required to conduct a criminal records check against your details. We have processes in place to limit our use and disclosure of such sensitive data other than where permitted by law. 4. THE LEGAL BASIS FOR PROCESSING YOUR PERSONAL INFORMATION Under GDPR, the main grounds that we rely upon in order to process personal information of clients and candidates are the following: (a) Necessary for entering into, or performing, a contract – in order to perform obligations that we undertake in providing a service to you, or in order to take steps at your request to enter into a contract with us, it will be necessary for us to process your personal data; (b) Necessary for compliance with a legal obligation – we are subject to certain legal requirements which may require us to process your personal data. We may also be obliged by law to disclose your personal data to a regulatory body or law enforcement agency; (c) Necessary for the purposes of legitimate interests – either we, or a third party, will need to process your personal data for the purposes of our (or a third party's) legitimate interests, provided we have established that those interests are not overridden by your rights and freedoms, including your right to have your personal data protected. Our legitimate interests include responding to requests and enquiries from you or a third party, optimising our website and customer experience, informing you about our products and services and ensuring that our operations are conducted in an appropriate and efficient manner; (d) Consent – in some circumstances, we may ask for your consent to process your personal data in a particular way. CONTACT AND LEGAL INFORMATION You can contact us with your queries in relation to this policy or for any other reason by post, email or by phone. Please email us at office@bigblue.uk.com or call us on 07722 122985. Bigblue Search Limited, registered as a limited company in England and Wales under company number: 11886166. Registered Company Address: Bigblue Search Ltd, 1 King Street, London, EC2V 8AU