General

This Recruitment Privacy Notice outlines our policy in relation to all personal data processing activities carried out by IFM Limited (“IFM”) in relation to recruitment of new employees (including those engaged on a permanent or temporary basis, in full or part time employment, as well as consultants, contractors and/or secondees) and the conduct of our HR function in this regard.

Depending on the job you are applying for, you may be engaged by IFM as a staff member to provide your services as an employee of IFM, or offering your services as an independent (self-employed) contractor/consultant, to:

• ISOLAS LLP (“ISOLAS”);
• Fiduciary Management Limited (including subsidiaries thereof and otherwise referred to as the“Fiduciary Group” or “Fiduciary”);
• An affiliated entity of the Fiduciary Group and/or ISOLAS LLP
• An unaffiliated entity of Fiduciary Group and/or ISOLAS LLP; or
• More than one of the above entities as a member of ‘Shared Services’ or consultant member ofstaff.

(each an “IFM Affiliate”, and any references to a “relevant” Affiliate or Affiliates shall be taken to mean the IFM Affiliate you are providing services to or which we believe will be most suited to consider your application)

This policy sets out what personal data we collect and how we process it together with any IFM Affiliates that act as joint data controllers in respect of your personal data. Please note that IFM is not responsible for the privacy policies and practices of IFM Affiliates, and you should therefore ensure you have read and understood any privacy policies or notices issued by such entities insofar as they may apply to you as a prospective or future employee of IFM providing services to one or more IFM Affiliates.

If your application is in response to an advertised vacancy, the job description provided therein will detail the specific role required by one or more IFM Affiliates.

If your application is on your own initiative, the relevant IFM Affiliate(s) will consider your suitability for a role and engage the services of IFM. Organisations are obligated under relevant legislation to register any vacancy with the Employment and Training Board, and should we envisage that no vacancies are likely to arise within a 1-year period from the time your application is submitted, we may advise you to re-apply at such time as a suitable vacancy arises.

The policy in this notice is not to be confused with the privacy policies and notices prepared by IFM Affiliates, as available on the respective websites of those entities. Such privacy policies are usually (but not always) aimed at the clients, vendors, suppliers and stakeholders of those entities, as well as users of their websites. It is for this reason that IFM has prepared separate privacy notices in respect of Recruitment (directed at job applicants) and in respect of Employment (directed at successful applicants and current employees of IFM and those offering services as consultants/independent contractors).

IFM does not have a generic privacy policy in place and does not offer its services to the general public via a website. If you are successful in your application for  employment with one or more IFM Affiliates you will be provided with the privacy policy of IFM aimed at its employees (the “IFM Employee Privacy Notice”).

If, in addition to seeking to become an employee of IFM, or where you are looking to provide your services to IFM and/or one or more IFM Affiliates as a consultant, you are also:

• A customer/client/user of any services provided by IFM Affiliates;
• a vendor;
• a supplier;
• a stakeholder; or
• a user of any website(s) operated or controlled by IFM Affiliates,

then please note that in such a case this Recruitment Privacy Notice applies to you in addition to any privacy notice or policies prepared by IFM Affiliates.

Personal Data means any information relating to you as an identified or identifiable natural person (“data subject”); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an online identifier or to one or more factors specific to your physical, physiological, genetic, mental, economic, cultural or social identity.

To make it easier for you to navigate through this Privacy Policy, you can click on the text below each box to be taken directly to the relevant section.

• 

  INFORMATION WE MAY COLLECT ABOUT YOU

• 

  HOW DO WE COLLECT THIS INFORMATION?

• 

  WHY DO WE PROCESS THIS INFORMATION?

• 

  SPECIAL CATEGORY DATA

• 

  WHERE DO WE STORE AND HOW DO WE ENSURE YOUR DATA IS SAFE?

• 

  HOW LONG DO WE RECORD YOUR DATA FOR?

• 

  OUR OBLIGATIONS TO KEEP YOUR DATA ACCURATE AND UP TO DATE

• 

  DISCLOSURE AND TRANSFER OF PERSONAL DATA

• 

  YOUR RIGHTS

INFORMATION WE MAY COLLECT ABOUT YOU

We maintain certain personal information about you as part of the recruitment process. Our records may include (but not necessarily be limited to):

In addition, for certain senior management positions, particularly in cases where an IFM Affiliate is a licensed entity, we may make additional enquiries and retain third parties to conduct such enquiries on our behalf, in order to obtain further information about:

• your credit history rating;
• information related to your good reputation and character (including data relating to criminal convictions and offences)
• Information on your other business interests or directorships

In addition, when you enter certain premises, IFM Affiliates may capture your image on CCTV images in pursuance of legitimate interests in keeping their premises secure. Your image will only be stored for a period of 30 days1 and CCTV footage will be deleted after such period has expired unless requested by an authority or other law enforcement entity or body for the purposes of prevention and detection of crime or otherwise as may be required under any applicable laws.

HOW DO WE COLLECT THIS INFORMATION?

We may have become aware of personal data relating to you in a number of ways - directly from you at the application stage (whether in response to an advertised job vacancy or otherwise on your own initiative), through publicly available sources, or from third parties.

We will receive, record and/or retain it in various formats (in writing, electronically, verbally or otherwise).

WHY DO WE PROCESS THIS INFORMATION?

We collect and process personal data for a variety of reasons. We do not collect, use or process personal data without an appropriate legal basis; these legal bases can be, for example (including but not limited to):

1. Contractual necessity – your personal data will be processed in order to take steps, at yourrequest, prior to entering into an employment contract or consultancy arrangement with us, asrequired under the terms of that contract, or otherwise alternative contract. Where nosubsequent contract is entered into (i.e. you are not successful during our recruitment process)we may need to rely on an alternative legal basis. If an employment relationship is formed (i.e.you are successful during our recruitment process) we will process your data in accordance withany contract of employment we enter into with you, as required under the terms of that contract,as well as in accordance with our Employee Privacy Notice, which will be made available to youthereafter;
2. Legal obligation – IFM and relevant IFM Affiliates are required by law to collect and processcertain personal data. Several legal obligations are applicable to us, such as keeping certainrecords under employment legislation;
3. Legitimate interests – we may collect and process your personal data where it is in our legitimateinterests to do so and without prejudicing your interests or fundamental rights or freedoms. Anexample of this is our legitimate interests in keeping our premises secure; or
4. Consent – at certain times, where the above legal bases are not applicable, we may onlyprocess your personal data with your consent, which can be given orally or in writing (includingelectronically). Further, in certain cases where data is particularly sensitive, we may require yourexplicit consent, which means we will only accept a written record of the same. We maytherefore need to request your consent for us to process your personal data for one or morespecific purposes. Consent which has been given may be revoked by you at any time withrespect to future processing. During the recruitment process we will not ordinarily rely on consentas a lawful basis for processing, but this lawful basis would become more relevant were you toenter into an employment relationship with IFM for the provision of services to an IFM Affiliate.

We use this information for the recruitment process. For example:

• To consider and check qualifications and suitability for the role;
• To communicate with you;
• To consider your employment history and experience.
• To comply with record keeping and other obligations as prescribed by law

SPECIAL CATEGORY DATA

Special Category Data means personal data about an individual’s race, ethnic origin, political opinions, religious or philosophical beliefs, trade union membership (or non-membership), genetic data and biometric data (where used to identify an individual), and information concerning an individual’s health, sex life or sexual orientation.

We may also collect and process other certain special categories of data and data relating to criminal convictions and offences. This data would only be collected and processed with your explicit consent (or where IFM or relevant IFM Affiliates are lawfully permitted to do so without your consent) or on the basis of another lawful justification (such as protection of your vital interests, e.g. preserving your health) and only for limited purposes such as fraud prevention, prevention of money laundering, financial crime and terrorist financing, bribery and corruption.

We may therefore, as part of our recruitment process, seek confirmations from relevant law enforcement agencies and authorities as to any data relating to criminal convictions and offences where you are the data subject.

We do not, as part of our recruitment process, request special category data to be disclosed, but this may come to our attention where you disclose such data to us at any point in the recruitment process, or otherwise manifestly make that information public (e.g. making comments on social media platforms or in the press).

If you are successful in securing employment with IFM, or are contracted to offer consultancy services otherwise than remotely, we may need to request certain data concerning your health, in the context of our obligations in relation to the employment contract and for the purposes of carrying out obligations and exercising specific rights (as they relate to us and/or you) in the field of employment and social security or social protection law insofar as we may do so under applicable legislation. Further details on how we process special category data of our employees is described in our Employee Privacy Notice.

WHERE DO WE STORE AND HOW DO WE ENSURE YOUR DATA IS SAFE?

We store your personal information electronically on our databases, servers, email accounts and encrypted back-up storage. We also process your personal information in paper format securely kept with restricted access only by members of HR staff and members of senior management from the relevant IFM Affiliate(s) on a need-to-know basis, with access by non-management staff strictly on an exceptional basis.

For clients and employees, we may use client relationship management software and other HR software, which has restricted access. In respect of these information management systems, we use EU-based processors providing secure software with logins and passwords, ensuring users of such software are given access on a need-to-know basis.

Our staff dealing with recruitment and other HR matters controls the storage of your personal data records. We have security measures in place, which will ensure the confidentiality of the information contained. These measures will be reviewed over time and upgraded in line with technological developments and legal requirements.

HOW LONG DO WE RECORD YOUR DATA FOR?

We retain your information only for as long as is necessary for the purposes for which we process the information as set out in this policy. Records can be held on a variety of media (physical or electronic) and formats.

Retention periods are determined based on the type of record, the nature of the record and activity and the legal or regulatory requirements that apply to those records.

Generally speaking, where you are unsuccessful in securing employment with us, we will keep your data for a period of 1 year from the date of the conclusion of the recruitment process with you. This period applies equally in cases where you have submitted your application of your own initiative or in response to an advertised vacancy, and shall begin from the point you are notified in writing that you have not unsuccessful on that occasion.

There will be occasions where we may have a legal basis to keep data for longer. For example, if you commence employment with us, the provisions of the IFM Employee Privacy Notice apply and personal data will be processed in accordance with that policy.

Where we need to obtain further information, or further information is disclosed from you to us at the interview stage, we will confirm with you what personal data we will be required to keep for the purposes of the recruitment process. You will be able to withdraw from the recruitment process and ask us to destroy such data, unless a legal obligation requires us to keep some or all of the personal data.

We reserve our right to retain your personal data for a longer period of time where such retention is necessary for compliance with a legal obligation to which we are subject; in order to protect your vital interests or the vital interests of another natural person; or otherwise where circumstances are such that we consider that the processing is necessary for the establishment, exercise or defence of legal claims. In such cases we would only retain the minimum data necessary for us to be in compliance with such obligations and protect our own legal rights.

Where we wish to prepare aggregated data for statistical purposes, we will take steps (to such extent as allowed by applicable laws) to “de-identify” or “anonymise” your personal data so that it cannot be used to identify you.

OUR OBLIGATIONS TO KEEP YOUR DATA ACCURATE AND UP TO DATE

We are required to keep any data we hold accurate and up to date. You have a right to rectification (see below).

DISCLOSURE AND TRANSFER OF PERSONAL DATA

Your application is treated in the strictest confidence and will only be disclosed to staff members of IFM and relevant IFM Affiliates on a need-to-know basis.

In certain cases, we may disclose information about you to third parties if we believe disclosure is in accordance with, or required by, any contractual relationship with you, applicable law, regulation or legal process.

IFM will only disclose information about you to public authorities (including the Employment and Training Board, Income Tax and Social Security department) to the extent we are obliged to do so according to the law, and will take steps (to such extent as allowed by applicable laws) to “de-identify” or “anonymise” your personal data so that it becomes aggregated data used for statistical purposes and cannot be used to identify you.

You are reminded that if you are successful in securing employment with IFM, to provide your services to one or more IFM Affiliates, then you will be subject to the IFM Employee Privacy Notice which will be communicated to you prior to your acceptance of any offer of employment that may be made to you. In such cases IFM and/or relevant IFM Affiliates may from time to time disclose information about you to public authorities to the extent we are obliged to do so according to the law including (but not limited to) the Employment and Training Board, the Income Tax Office, Social Security department and in certain cases the Gibraltar Financial Services Commission or other relevant regulatory or public bodies.

If IFM or any relevant IFM Affiliates (for which your recruitment application is being made) enter into a sale, reorganisation, transfer, asset disposal or joint venture with or is/are merged with another business entity, your information may be disclosed to our new business partners.

YOUR RIGHTS

The right to confirmation and access

You have the right to ask us to confirm to you whether or not we collect, process or store your personal information (“personal information”, in this policy, includes personal data, special categories of data and/or data relating to criminal convictions and offences). You have the right to be informed about:

• the purpose of the processing we do;
• the categories of personal information we hold;
• the envisaged period for which it will be stored, or, if not possible, the criteria used to determinethat period;
• the existence of the right to request from us rectification or erasure of personal information, orrestriction of processing of personal information or to object to such processing;
• the existence of the right to lodge a complaint with a supervisory authority;
• where the personal information is not collected from you, any available information as to itssource;
• the existence of automated decision-making, including profiling and meaningful informationabout the logic involved, as well as the significance and envisaged consequences of suchprocessing for you; and
• whether your personal information is transferred to a third country and if so of the appropriatesafeguards in place relating to the transfer.

There may be instances when access to such information may be restricted and /or prohibited by law. For example (but not necessarily limited to):

• Information in connection with investigations on criminal conduct, money laundering orfinancing of terrorism.
• the business and procedures of IFM or IFM Affiliates, including internal assessments and reviews.

The right to rectification

You have the right to have any inaccurate personal information about you rectified and to have any incomplete personal information about you completed.

The accuracy of your information is important to us. If you do not want us to use your personal data in the manner set out in this Recruitment Privacy Notice, or need to advise us of any changes to your personal data, or would like any more information about the way in which we collect and use your personal data, please contact the Privacy Manager on the details provided below under ‘Contact and further information’ or the relevant Privacy Manager of an IFM Affiliate.

The right to erasure

You have the general right to request the erasure of your personal information in the following circumstances:

1. the personal information is no longer necessary for the purpose for which it was collected;
2. you withdraw your consent to consent based processing and no other legal justification forprocessing applies;
3. you object to processing for direct marketing purposes;
4. we unlawfully processed your personal information; and/or
5. erasure is required to comply with a legal obligation that applies to us.

We will proceed to comply with an erasure request without delay unless continued retention is necessary for:

1. exercising the right of freedom of expression and information;
2. complying with a legal obligation under EU or other applicable law;
3. the performance of a task carried out in the public interest;
4. archiving purposes in the public interest, scientific or historical research purposes, or statisticalpurposes, under certain circumstances; and/or
5. the establishment, exercise, or defence of legal claims.

The right to restrict processing

You have the right to restrict the processing of your personal information under certain circumstances:

• you contest the accuracy of the personal information;
• where processing is unlawful you may request, instead of requesting erasure, that we restrictthe use of the unlawfully processed personal information; or
• we no longer need to process your personal information but need it for the establishment,exercise, or defence of legal claims.

You may also request that we restrict the processing of your personal data where this is outside the scope of the potential employment/consultancy relationship and you believe no other lawful basis applies in respect of our processing.

The right to object to processing

You have the right to object to processing of your personal information under certain circumstances, such as where the processing is based on your consent and you withdraw that consent. This may impact the services we can provide and we will explain this to you if you decide to exercise this right.

Processing based on your consent will be rare in the employment context, and therefore certain overriding processing grounds apply in relation to your potential employment/consultancy relationship with us, such as legal obligations applicable on us to process and retain your personal data. This means you will not always be able to exercise this right to object in every case.

The right to data portability

Where the legal basis for our processing is your consent or is necessary for the performance of a contract to which you are party or in order to take steps at your request prior to entering into a contract, you have a right to receive the personal information you provided to us in a structured, commonly used and machine-readable format, or ask us to send it to another person.

Right to freedom from automated decision-making

IFM do not use automated decision-making, but where any automated decision-making takes place or is used by IFM or an IFM Affiliate, we shall draw your attention to that fact or this will be mentioned in the Privacy Policies of IFM Affiliates. You will have the right in this case to express your point of view and to contest the decision, as well as request that decisions based on automated processing concerning you or significantly affecting you and based on your personal data are made by natural persons; not only by computers.

The right to complain to a supervisory authority

If you consider that our processing of your personal information has infringed data protection laws, you have a legal right to lodge a complaint with a supervisory authority responsible for data protection. You may do so in the EU member state of your habitual residence, your place of work or the place of the alleged infringement. In Gibraltar, the supervisory authority responsible for data protection is the Gibraltar Regulatory Authority (“GRA”).

Right to object to direct marketing (‘opting out’)

You have a choice about whether or not you wish to receive marketing information from us.

It is our policy not to market to our own or prospective employees/consultants, but you may have subscribed to receive certain marketing information from an IFM Affiliate in the past. In such cases you always have a right to ’opt-out’ by changing your marketing preferences at any time, contacting the Privacy Manager on the ’Contact and further information’ section of this Recruitment Privacy Notice, or the relevant Privacy Manager of an IFM Affiliate.

Please note that your right to opt-out does not change our right to contact you as part of any contractual relationship we may form with you should your application be successful.

Right to request access

You also have a right to access information we hold about you. We are happy to provide you with details of your personal data that we hold or process. To protect your personal data, we follow set storage and disclosure procedures, which mean that we will require proof of identity from you prior to disclosing such information. You can exercise this right at any time by contacting the Privacy Manager on the ’Contact and further information’ section of this Recruitment Privacy Notice, or the relevant Privacy Manager of an IFM Affiliate.

The right to withdraw consent

Where the legal basis for processing your personal information is your consent, you have the right to withdraw that consent at any time, by contacting the Privacy Manager on the ’Contact and further information’ section of this Recruitment Privacy Notice, or the relevant Privacy Manager of an IFM Affiliate.

Right to raise a complaint about how we have handled your personal data

If you wish to raise a complaint on how we have handled your personal data, you can contact the Privacy Manager on the ’Contact and further information’ section of this Recruitment Privacy Notice, or the relevant Privacy Manager of an IFM Affiliate.

Right to lodge a complaint with a relevant supervisory authority

If we have not responded to you within a reasonable time, or if you consider that our processing of your personal data has infringed data protection laws, you have a legal right to lodge a complaint with a supervisory authority responsible for data protection. You may do so in the EU member state of your habitual residence, your place of work or the place of the alleged infringement.

In Gibraltar, you are entitled to make a complaint to the Data Protection Commissioner under the Data Protection Act, which is presently the Gibraltar Regulatory Authority (GRA). You may contact the GRA on the below details:

Gibraltar Data Protection Commissioner
Gibraltar Regulatory Authority
2nd Floor, Eurotowers 4, 1 Europort Road, Gibraltar
Email: info@gra.gi
Phone: (+350) 200 74636
Fax: (+350) 200 72166

Contact and further information

If you would like a copy of the personal records we hold about you, or if you have any questions regarding this policy or generally about the way we handle your personal information, you should contact the Privacy Manager.

The IFM Privacy Manager is contactable via privacy@isolas.gi, or if you prefer in writing at:
Privacy Manager IFM Limited
Suite 23, Portland House
Glacis Road
Gibraltar GX11 1AA

In addition, you may also contact the relevant Privacy Manager(s) or other person(s) with responsibility for data protection within any relevant IFM Affiliate(s). The privacy policies of such entities should provide the contact details of such persons.

Further information on the rights described above is contained in Regulation (EU) 2016/679 (known as the “General Data Protection Regulation” or simply “GDPR”), as well the GRA’s website (www.gra.gi).

© FIDUCIARY MANAGEMENT LIMITED