Global Privacy Policy

Last Updated: 9 July 2024

Purpose and Scope
What We Do
How does this Policy apply to me?
What personal data do we collect?
How we collect personal data
How we use personal data
Who your personal data is shared with
Legal basis for processing personal data
Data retention
Your Rights
Your choices about marketing and advertising
Cookies and other technology
Data security
Personal data storage and transfer
Privacy policies of third parties
Changes to this Policy
How to contact us
Country specific information

1. Purpose and Scope

This Global Privacy Policy (“Policy”) applies to the group of companies that are ultimately owned by Robert Walters plc (company no. 03956083) of 11 Slingsby Place, St Martin's Courtyard, London, WC2E 9AB, United Kingdom, trading under the Robert Walters brand (“Robert Walters”).

The protection of your personal data is important to us.

This Policy explains how we collect, use, disclose and protect your personal data and your choices about the collection and use of your personal data. It is important that you read this Policy in conjunction with any notices or statements that we may issue at the time of collecting your personal data where applicable. Such additional notices or statements supplement this Policy unless stated otherwise in such additional notice or statement.

References in this policy to “we”, “us” or “our” are references to Robert Walters.

2. What We Do

Robert Walters provides:

recruitment consultancy services placing candidates on a permanent, contract and interim basis across a range of industries and geographies (“Recruitment Services”);
business process outsourcing services assisting companies with their permanent recruitment, temporary recruitment, contingent workforce solutions, supply chain and labour supply, commonly known as ‘RPO’, ‘MSP’ or ‘Service Procurement Desk Services’ (“Outsourcing Services”); and
other consultancy, technology and advisory services related to recruitment, including but not limited to market intelligence, future of work and talent development (“Advisory Services”).

3. How does this Policy apply to me?

We operate through a global network of affiliated entities and utilise vendors where needed to ensure we provide the best solutions to our clients. This Policy applies to the processing of personal data by Robert Walters as a controller. This means we determine the purposes and means of the processing of your personal data for our business purposes.

Due to the nature of our business, Robert Walters can also act as a processor on behalf of our clients. This means that when we are instructed by a client, we facilitate the processing of your personal data on behalf of that client. In this circumstance, the protections that apply to such personal data will be described in the individual privacy policies of those clients, and not in this Policy. We encourage you to reach out to them directly and read their privacy policies if you want to learn more about the privacy and data practices of those clients.

In further detail, and unless we notify you otherwise:

We operate as a controller when processing your personal data for our Recruitment Services and Advisory Services. If we share your personal data with our clients as part of our Recruitment Services or Advisory Services, it is likely that our clients will also process your personal data as a controller. Our clients may request additional personal data from you as part of their hiring processes.
We are the processor and our clients are the controllers of your personal data processed by us for our Outsourcing Services. Where we act as a processor, the privacy policy of our client will apply.
If Robert Walters engages you on a temporary assignment, Robert Walters will be the controller of your personal data.

If you are uncertain about who is the controller of your personal data, please contact us using our contact information set out in section 17 of this Policy.

4. What personal data do we collect?

Data protection laws around the world define ‘personal data’ in different ways, but in general, we mean any information relating to an identified or identifiable person.

The personal data Robert Walters collects will depend on the circumstances in which it is being collected and determined by your interaction with us, our clients and other sources.

We will only collect personal data that we are lawfully permitted to collect. Personal data we may collect includes, but is not limited to:

Type of Personal Data	Description of Personal Data
Identity data	Your title, first name, last name, maiden name, date of birth, gender, photograph, national insurance number (or equivalent in your country), nationality and other information relating to residency and citizenship which may be required to establish a right to work in a given country, marital status and number of dependents.
Contact data	Your physical and email address and telephone numbers, emergency contact details.
Historical data	Your educational history and credentials, employment history, criminal background history, social media, skills and qualifications, and results from any other background and disclosure checks in countries where it is lawful to carry out such checks.
Employment-related data	Your current remuneration, pension and benefits, what role you are looking for, what work-related areas interest you, third party references (if taken) and interview and assessment feedback created either by us or our client following an interview or assessment.
Verification data	A copy of your driving licence, passport, identity card or another form of identification and referee details.
Financial data	Your bank sort code and account number, tax-related information and credit checks.
Diversity data	We may collect diversity data for governmental reporting purposes, which may include racial or ethnic origin, religious or other similar beliefs and physical or mental health, including disability-related information.
Technical data	Your internet protocol (IP) address, MAC address, your login data, browser type and version, time zone setting and location, browser plug-in types and versions, operating system and platform, and location data.
Profile data	Your usernames applicable to accessing our services, interests in so far as these are applicable to the services we provide to you and other preferences and other insights or determinants that we have gained from our analysis and profiling of you.
Usage data	How you use, interact and navigate around our websites and what you browse within them.
Marketing data	Your preferences in receiving marketing from our third parties and us and your communication preferences.
Visa application data	Your immigration history (including residency, immigration status and travel history), character disclosures (including offences, disclosures and information relevant to meeting character requirements), health disclosures and information relevant to meeting health criteria.
Video	If video surveillance operates in or near our premises, we may capture images of you where permitted by law. We may also capture video of you if you attend an event organised by us where you have given your express consent for us to do so.

Sensitive or special category personal data

During the recruitment process or in the course of the services we operate, we may collect personal data that is considered sensitive or special category data in certain countries. We will only collect sensitive personal data in accordance with the applicable data protection and privacy laws, including if you have you given your explicit consent to handle this type of personal data or where we are required by law to collect such personal data.

Other types of data

We also collect, use and handle “Aggregated Data” such as statistical or usage data (for example usage of a website feature) for our own internal purposes and to improve our services. Aggregated Data may be derived from your personal data but is where all personally identifying characteristics have been stripped from the data. As such, it is not considered personal data as this data does not directly or indirectly reveal your identity.

Children’s data

The age at which an individual is regarded as a child differs per country. We do not typically collect personal data relating to individuals under 18 as our services are not intended for children.

5. How we collect personal data

The ways that we may collect your personal data broadly falls into the following categories:

a) Information you provide us directly

We generally collect your personal data directly from you. For example, we collect your personal data when you:

use our services, including submitting your CV, completing psychometric assessments or other assessments;
deal with us in person or correspond with us whether online or offline, including by telephone, letter, fax, email or via our websites;
register for a Robert Walters account via our website;
register for, attend and/or otherwise take part in our events (e.g. at career fairs);
download, subscribe or otherwise engage with Robert Walters content and publications, including subscribing to job alerts;
enter a competition, promotion or survey we are conducting;
visit our offices or premises;
submit request for action, support or information, including giving us feedback via email or our website; or
otherwise directly interact with us.

b) Information that we automatically collect about you

When you visit our website, we collect certain information automatically from your device depending on the settings of your device or browser to help us measure traffic, usage trends and data analytics that assist us in improving our websites and services. Some of this information may be collected using cookies and similar tracking technology, as explained further under section 12 (Cookies and other technology) of this Policy.

The information we collect automatically may include, IP address, location, browser type, and usage data about your activity on our websites, pages viewed and searches.

c) Information that we obtain from third party sources

We may obtain personal data about you from the following third party sources:

pre-employment screening and background checking organisations where permitted in the jurisdiction. We will only contact the references you have indicated during the application process and use of our services;
our clients and their third party suppliers;
governmental and regulatory bodies, such as tax and social security authorities;
third party suppliers, including other recruitment and employment agencies, job board providers and job aggregators and our managed service providers who are within our supply chain;
other recruitment agencies;
analytics providers, such as Google Analytics and various job boards; and
communication platforms, such as Adobe Marketo, Cison and PR.

d) Information that we obtain from third-party applications

We allow you to sign up or login to a Robert Walters account with a LinkedIn or Google account (“Social Media Account”) so you can use our online services simply and easily. If you choose to use this feature, we will process your name and primary email address on your Social Media Account in accordance with this Policy.

e) Publicly available sources

We may also collect your personal data from publicly available sources where permitted by the applicable laws in the jurisdictions we operate in, including:

your identity and historical data from social media sites, such as LinkedIn, X (formerly Twitter) and Facebook;
your identity and contact data from company and commercial registers or electoral registers; and
your identity, from qualification and membership lists of professional bodies.

6. How we use personal data

In general, we will only use your personal data as permitted by law. We will use the personal data we collect for the purposes set out in this Policy or for the purposes we explain to you at the time we collect your personal data. These include:

a) For candidates

Your personal data will be collected and handled by us in order to:

provide careers, recruitment and/or related intermediary services to or for you;
match your details against job vacancies which we consider are appropriate for you in order to assess your suitability for them;
allow you to submit your CV, apply for specific jobs or to subscribe to our job alerts so that we can notify you when relevant job vacancies arise;
apply for jobs on your behalf by sending your personal data to clients;
facilitate the recruitment process if a client wishes to progress your application;
fulfil our contractual obligations to our clients;
inform you about any relevant industry developments, events, promotions and competitions, and to communicate any other relevant information;
answer your enquiries or questions;
conduct talent surveys;
conduct statistical analysis;
monitor diversity;
comply with our legal and regulatory obligations;
pursue or defend a legal claim;
conduct pre-employment screening;
prevent or detect a crime, where the law requires us to carry out such monitoring;
provide you with further information which may be of interest to you regarding the employment market and opportunities;
preparing and processing your visa application and related immigration services, where applicable; and
enhancing and optimizing business operations, which may include analysing your engagement with our services and website to develop, improve and provide our services.

b) For business contacts (personnel of our prospective clients, clients, prospective suppliers and suppliers)

In your capacity as a representative of the company that is a client, prospective client, supplier or prospective supplier of ours (as applicable), your personal data will be collected and processed by us in order to:

provide recruitment and/or related intermediary services to the company you represent, including billing and account management purposes;
facilitate the recruitment process for the company you represent;
fulfil our contractual obligations with the company you represent;
inform you about any relevant industry developments, events, promotions and competitions, and to communicate any other relevant information which we consider may be of interest to you in regard to the employment market and/or our services;
respond to your enquiries or questions;
conduct statistical analyses or surveys as the contact point of prospective clients and clients;
comply with our legal and regulatory obligations;
pursue or defend a legal claim;
prevent or detect a crime, where the law requires us to carry out such monitoring; and
enhancing and optimizing business operations, analysing your engagement with our services and website to develop, improve and provide our services.

c) Website users

Your personal data will be collected and handled by us in order to:

improve our customer service and the way we operate to ensure our services are useful and relevant to you (which includes tailoring our websites to suit your requirements);
inform you know about our recruitment services across all areas of our business;
send you communications where you have indicated you are happy to receive such information or have purchased products or services from us, which may include the following:
- e-newsletters and hard copy newsletters;
- emails about the services we offer and new product launches;
- reminders when your products or services may be due for renewal; and
- opportunities to participate in market research.

Depending on the contact preferences you select, we will communicate with you by post, telephone, SMS, email or other electronic means such as via social and digital media. We may use your usage data to help ensure that this messaging is personalised and relevant to you.

d) Referees

We will use your personal data solely for the purpose of conducting a reference check on a candidate.

Where we need to collect and process your personal data by law, or under a contract we have entered into with you, and you fail to provide the required personal data when requested, we may not be able to comply with our legal obligations or perform our contract with you, including providing the services or information you have requested.

7. Who your personal data is shared with

Subject to local laws and regulations that apply to Robert Walters in the jurisdictions we operate in, we may disclose your personal data to:

any company in the Robert Walters brand;
prospective employers or engagers;
other recruitment companies or intermediaries involved in managing the supply of personnel;
data processors of Robert Walters;
pre-employment screening and background checking organisations;
your referees;
your past employers and relevant education institutions;
professional bodies you belong to or are accredited with;
government and regulatory bodies, such as tax and social security authorities;
third party suppliers and service providers, including job board providers and job aggregators and our managed service providers who are within our supply chain;
to any other person or party with your express consent to disclosure; and
third parties to whom we may choose to sell, transfer, or merge parts of our business or our assets. Alternatively, we may seek to acquire other businesses or merge with them. If a change happens to our business structure, any new owners may use your personal data in the same way as set out in this Policy.

We do not allow our third-party service providers to use your personal data for their own purposes and only permit them to process your personal data for specified purposes and in accordance with our instructions, which includes compliance with this Policy.

8. Legal basis for processing personal data

If you are located in a region that requires a legal basis for processing of personal data (such as the EEA, Switzerland or UK), we need a lawful basis pursuant to applicable law to collect, use and disclose your personal data where Robert Walters is a controller. Our legal basis will depend on the information concerned and the context in which it is processed.

Generally, Robert Walters will collect and use your information as follows:

Legal Ground	Permitted Purpose
Consent - where you have given us consent to use your personal data for one or more permitted purposes.	For example: when you create a website account with us; when we are required by law to collect your explicit consent to process your personal data; and where you otherwise provide us with your consent.
Legal obligation - where we need to process your personal data to comply with a legal or regulatory obligation.	For example:  to perform background checks in accordance with our legal obligations; to comply with our legal and regulatory requirements in relation to taxation and financial compliance; for equal opportunities monitoring and reporting purposes; to co-operate with our regulators and other public authorities; and to comply with any other obligation to which we are subject under applicable rules and law, including record keeping and data retention.
Contractual necessity - where we need to process your personal data to perform and fulfil our obligations to you under the contract, we are able to enter or have entered into with you.	For example: to employ/engage you if you are applying for a vacancy with us; and to enter into or perform our agreement with you if you are a supplier or external adviser.
Legitimate interests - where the processing of your personal data is necessary for the pursuit of our legitimate business interests and provided your interests and fundamental rights do not override our legitimate interests.	For example:  to offer and provide our recruitment services to you and to assess your skills against our vacancies with our clients; to provide you with marketing material to aid your job search; to manage complaints and legal claims; to conduct appropriate background checks if you are to be employed/engaged by us; sharing your personal data with the companies that operated within the Robert Walters brand; sharing your personal data with our third party services providers; and sharing your personal data with potential employers and our clients (including our MSP clients) who can offer job opportunities within their organisations.

Depending on our relationship with you, we may rely on one or more of the above legal basis for processing your data. If you would like to know what legal basis we rely upon to process your personal data, please contact us using our contact details provided in section 17 of this Policy.

9. Data retention

We will only retain your personal data for as long as necessary to fulfil the purposes we collected it for or for as long as we have a valid purpose to do so, and in any case as permitted by applicable law, including to comply with any legal, accounting, auditing or reporting requirements.

We view our relationship with you as being one which is to support your career through numerous roles and assignments. Accordingly, we may retain your data for a period of time which is materially greater than simply one placement if we reasonably believe that we will continue to have an ongoing relationship with you.

We will appropriately and securely dispose of your personal data when it is no longer required. To determine the appropriate retention period for personal data, we will consider the following factors:

amount and nature of the personal data;
its sensitivity;
the potential risk of harm from unauthorised use or disclosure of the personal data;
the purposes for which we handle your personal data;
whether we can achieve those purposes through other means; and
applicable legal requirements.

When we act as a data processor to our clients, the data controllers, we will retain your personal data in accordance with the retention periods prescribed by our clients.

10. Your rights 

You may have rights under applicable law to request that we take certain actions in connection with personal data that we may have about you. Not all jurisdictions grant privacy rights, so whether or not you have any such rights, and the nature of those rights, are determined by multiple factors, including the country you are located in and the applicable privacy laws. These rights may include:

Right	Description of Right
Right to be informed	This is the right to be provided with clear, transparent and easy to understand information about what personal data we collect about you, how we use and protect such data, including the third parties to whom we disclose it to, and your rights. This is why we’re providing you with the information in this Policy.
Right of access	You may be able to request a copy of your personal data and to obtain certain other information about how we handle and process it.
Right to have rectification/correction	You may be able to request modifications or corrections your personal data if it is inaccurate or incomplete.
Right of erasure	You may be able to request that we delete your personal data that we hold (also known as the “right to be forgotten”). This right is not absolute, and there are circumstances where we may need to continue processing your data despite a request for erasure. We do not delete personal data from our back-up files that are created for disaster recovery purposes and are not easily accessible.
Right to restrict handling and processing	You may be able to request that we restrict use of your personal data, which includes requesting us to suppress your personal data file.
Right to portability	You may be able to request a copy of your personal data in a structured, machine-readable format, to allow you to transfer your data to another organisation.
Right to object	You may be able to object to the processing of your personal data for certain purposes, in particular to personal data processed for direct marketing purposes and to personal data that is handled and processed for certain reasons based on our legitimate interests.
Right to withdraw consent	Where you have provided your consent to certain processing and no longer want us to use your data for that purpose (for example electronic marketing communications), you may withdraw your consent to this use at any time, although this will not affect the lawfulness of processing based on consent before its withdrawal.
Rights in relation to automated decision making	You may be able to request not to be subject to a decision based solely on automated processing where it has a legal effect on you or otherwise significantly affects you.
Right to complain	You have the right to complain to us or to the data protection authority in your country in relation to the handling of your personal data.

Please contact us using our contact details set out in section 17 of this Policy if you wish to exercise any of your privacy rights.

We will respond to all legitimate requests we receive from individuals wishing to exercise the privacy rights applicable to them in accordance with applicable data protection laws, including within any legal timeframes.

Where permitted by law, you may be charged a fee to access your personal data or to exercise any other privacy right that may apply to you. We will let you know if a fee applies to your request before we complete it.

We may also request certain information to help us verify your identity, ensure your right to exercise any of privacy rights in the table above and to prevent your personal data being disclosed to any person who has no right to receive it.

11. Your choices about marketing and advertising

You have the right to opt-out of marketing communications that we send at any time. You can exercise this right through the through unsubscribe options available within the marketing communication itself or by contacting us via our contact details in section 17 of this Policy.

Please note that:

it may take us a short period of time to remove your contact information from our marketing communications lists, so you may receive correspondence from us for a short time after you make your request; and
opting-out of receiving marketing communications not opt you out of receiving important business communications related to your current relationship with us, such as service announcements or security information.

12. Cookies and other technology

We use cookies and similar tracking technologies (collectively “Cookies”) to collect and use personal data about you when you visit and navigate our website. You can find out more about Cookies, including how we use them and what choices are available to you, by reading our Cookies Policy.

We may on occasion use technological filters to sort through the job applications we receive and to match candidates to specific job vacancies. If we have used technological tools to a significant extent when assessing your job application, we will inform you of this. Please let us know when we contact you if you feel there are other factors that we should consider as part of your job application.

13. Data security

We hold your personal data in a combination of secure computer storage facilities and paper-based files.

We have in place an appropriate level of security around your personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage to it.

We have implemented appropriate technical and organisational measures to ensure a level of security appropriate to the risk of harm that might result from unauthorised or unlawful processing, accidental or unlawful loss, destruction or alteration, unauthorised (or disclosure of) access or damage to your personal data including:

locks and security systems;
encryption
usernames and passwords;
virus checking;
auditing procedures and regular data integrity checks; and
recording of file movements.

We limit access to your personal data to those employees, agents, contractors and other third parties who have a business need to know. They must only process your personal data on our instructions and subject to the access controls listed above. They are also subject to a duty of confidentiality.

We have agreed on security-related measures with the third parties we share your personal data with to ensure that it is treated by those third parties in a way that is consistent with how we safeguard your personal data.

We have also put in place procedures to deal with any suspected personal data breach and will notify you and any applicable data protection authority where we are legally required to do so.

If you suspect any misuse, loss of or unauthorised access to your personal data, please contact us immediately using our contact details in section 17 of this Policy.

14. Personal data storage and transfer

As a global organization, we may store and process your data, including personal data, in the countries in which we operate or any other country in which Robert Walters or its group companies or service providers maintain facilities or employ staff. Robert Walters may also need to transfer your personal data to our group companies, contractors, service providers, and to third parties in various countries and jurisdictions around the world, including the UK and US. These countries may have data protection laws that are different to the laws of your country (and, in some cases, may not be as protective). In each case, we take care to use appropriate safeguards to ensure your personal data remains protected.

Personal Data originating from the UK or European Economic Area (“UK or EEA Personal Data”)

Due to the global nature of our business, we may need to transfer UK and EEA Personal Data outside of the UK and EEA. For example, we may transfer personal data to a company or companies within the Robert Walters brand, service providers and government or public authorities in order to perform our recruitment services and comply with our legal obligations.

If we do transfer UK and EEA Personal Data outside of the UK and EEA to a country that does not benefit from an adequacy decision by the European Commission, UK or Swiss authorities, we will make sure that appropriate safeguards are in place, for example by using approved contractual agreements including EU Model Clauses and the UK International Data Transfer Addendum, unless certain exceptions apply, or we are authorised to do so. If requested, we will provide you with details of the safeguards that we have implemented.

We, our service providers and/or the third parties to whom we may disclose UK and EEA Personal Data may transfer such data outside of the UK and EEA with the appropriate safeguards in place.

Personal Data originating from outside the UK or EEA (“Non-UK and Non-EEA Personal Data”)

Due to the global nature of our business, we may need to transfer Non-UK and Non-EEA Personal Data outside the original territory in which the data was collected (“Original Territory”). For example, we may transfer personal data to a company or companies within the Robert Walters brand or potential employers internationally in any of the countries listed above, and to service providers and government or public authorities in order to perform our services and comply with our legal obligations.

If we do transfer Non-UK and Non-EEA Personal Data outside the Original Territory, we will make sure that such transfers are performed in compliance with applicable law. We, our service providers and/or the third parties to whom we may disclose Non-UK and Non-EEA Personal Data may transfer such data outside of the Original Territory with the appropriate safeguards.

15. Privacy policies of third parties

Our websites may contain links to other websites and services maintained by third parties. The privacy and data security practices of such third-party sites and/or services are determined by such third parties and governed by the privacy statements of those third parties, and not by this Privacy Policy.

This Policy explains how Robert Walters handles your personal data. Please also read the privacy policies of the social media platforms and third party websites through which you arrive at a Robert Walters’ website. We encourage you to read the privacy policies of these third parties before giving them your personal data.

16. Changes to this Policy

We may amend this Policy from time to time to reflect our current practices and ensure compliance with applicable laws. When we update our Privacy notice, we will take appropriate measures to inform you consistent with the significance of the changes we make. If we make changes to this Policy, we will revise the “Last Updated” date at the top of this Policy. We recommend that you visit this page from time to time to keep up to date with any changes.

17. How to contact us

If you have questions about this Policy, our privacy practices, or if you would like to submit a request exercising your privacy rights, please contact us via:

Email:

Africa and the Middle East	dataprotection@robertwalters.com
Australia and New Zealand	ANZPrivacyOfficer@robertwalters.com.au
Brazil	DataProtectionBR@RobertWalters.com
European Economic Area (EEA) and UK	dataprotection@robertwalters.com
Greater China and South East Asia (India, Indonesia, Malaysia, the Philippines, Thailand, Vietnam)	ContactSEAC@robertwalters.com
Japan	privacy@robertwalters.co.jp
Singapore	SingaporeDPOs@robertwalters.com.sg
South Korea	privacy@robertwalters.co.kr
Switzerland	dataprotection@robertwalters.com
USA and Canada	dataprotection@robertwalters.com
Brazil, Chile and Mexico	dataprotectionLATAM@robertwalters.com

Our local representative in the UK is:

Richard Harris – Data Protection Officer (DPO)

DPO@robertwalters.com

Our local representative in the EU is:

Sandy Scott 
eu.representative@robertwalters.com

18. Country specific information

This section applies if you are located in any of the following countries listed and provides you supplemental information to this Policy.

Australia	Process for lodging a complaint if you believe your personal data has been mishandled by us: We will acknowledge receipt of your complaint and respond to it within 30 days. We will take steps to confirm the authenticity of the complaint and the contact details provided to us. We will seek additional information about the complaint if necessary. If the complaint can be resolved by procedures for access and correction, or some other solution, we will suggest these to you as possible solutions (where necessary on a confidential and without prejudice basis). If we do not respond to your complaint within 30 days, or we are unable to resolve your complaint, you may make a complaint the Office of the Australian Information Commissioner.
Germany	In addition to section 8 of this Policy, further detail about the legal basis for the processing personal data is as follows: Insofar as we obtain your consent for the processing of your personal data, Art. 6 para. 1 sentence 1 lit. a General Data Protection Regulation (GDPR) serves as the legal basis for the processing of your personal data. When processing is necessary for the performance of a contract between you and Robert Walters, Art. 6 para. 1 sentence 1 lit. b GDPR serves as the legal basis. This also applies to processing operations that are necessary for the implementation of pre-contractual measures. Insofar as the processing of personal data is necessary for compliance with a legal obligation to which Robert Walters is subject, Art. 6 para. 1 sentence 1 lit. c GDPR serves as the legal basis. If the processing is necessary for the purposes of the legitimate interests pursued by Robert Walters or a third party, except where such interests are overridden by your interests or fundamental rights and freedoms, Art. 6 para. 1 sentence 1 lit. f GDPR serves as the legal basis for the processing.
Japan	In addition to section 9 of this Policy, Robert Walters will retain your personal data for a commercially reasonable time, and for as long as we have an ongoing legitimate business need to do so in connection with the purposes set out in this Policy. We will take reasonable steps to keep your personal data accurate and up to date during the period in which we retain your information. If you wish to inform us of any changes to your personal data or update any inaccurate or out-of-date data about you that you suspect we hold, please contact us using our details provided in section 17 of this Policy.
Mainland China	For the purposes of this Policy, references to “personal data”, “sensitive or special category personal data”, “process/processing”, “data processor”, and “supervisory authority” shall have the same meaning as “personal information”, “sensitive personal information”, “process/processing”, “entrusted party” and “supervisory authority” as defined in the Personal Information Protection Law of the People’s Republic of China (the “PIPL”). The personal information processor located in China responsible for the processing and protection of your personal information is Robert Walters Talent China Limited (“we”). By agreeing to this Policy, you consent to our processing of your personal information in accordance with this Policy. To the extent required under applicable law, we will obtain separate consent from you before processing your sensitive personal information, providing your personal information to other personal information processors, exporting your personal information, etc. What personal data do we collect? In addition to the types of personal data listed in section of this Policy, we may collect and use your personal information for the following purposes: human resources administration, we may collect and process your name, telephone, email address, detailed address, employee number, nationality, national insurance number, ID number, date of birth, age, gender, emergency contact, photos, family information, health and medical information, religious affiliation, marital status and criminal records. payrolling, we may collect and process your ID information, financial information such as bank account. talent acquisition, we may collect and process your name, telephone, email address, ID number, nationality, date of birth, age, gender, employment history, qualification, photos and image. The Processing of Sensitive Personal Information With regard to the “sensitive or special categories of personal data” referred to in section 4 of this Policy, we will only process your sensitive personal information if there is a specific purpose and sufficient necessity to do so, and if strict protection measures are taken. In mainland China, we may collect and process your sensitive personal information, including your medical and health data, and financial account. You understand and are aware that sensitive personal information is personal information that, if disclosed or used illegally, could easily lead to the infringement of a natural person’s human dignity or the endangerment of the safety of his or her person or property. Unless otherwise provided by applicable laws, before processing your sensitive personal information, we will obtain your separate consent to process the sensitive personal information. If you are the parent or guardian of a minor under the age of 14 (“Child”), we will obtain your separate consent before processing the personal information of the Child. Legal grounds Depending on our relationship with you, if required to do so, we will rely on one or more of the following legal grounds: where you have given us your consent to use your personal information; where the processing is necessary for us to conduct human resource management in accordance with the labour rules and regulations, or collective labour agreements developed according to the law; where the processing is necessary for the execution or performance of the contract to which you are a party; where the processing is necessary for the performance of our legal duties or statutory obligations; where the processing is necessary to respond to public health emergencies or protect natural persons' life, health and property safety under emergency circumstances; where we carry out news reporting, public opinion supervision and other acts for public interests, and process personal information within a reasonable scope; where the personal information that has been published by yourself or other personal information that has been legally published is processed within a reasonable scope in accordance with the PIPL; or under any other circumstance as provided by any law or regulation. In most cases, we will process your personal information based on your consent or HR management necessity. Who your personal data is shared with We may entrust third parties as set out in section 7 of this Policy to process your personal information to fulfil the purposes set out in section 6 of this Policy. Where your personal information is provided to other third-parties who can independently determine the purpose and means of processing, we will inform you with the information as required by applicable laws and obtain your separate consent or rely on other appropriate legal grounds. Personal Information Export Due to the global nature of our business, we may need to transfer your personal information outside your country of residence to a company within the Robert Walters brand in order to perform our services and comply with our legal obligations. Where personal information is transferred to another jurisdiction outside mainland China, your personal information will be secured by appropriate safeguards as set forth under applicable law, including without limitation, where applicable by conducting a personal information protection impact assessment, concluding the standard contract published by the supervisory authority for the transfer of personal information between Robert Walters’s mainland China entity and the overseas recipient, as well as filing the standard contract in accordance with relevant regulatory requirements, etc. To the extent required under applicable law, we will obtain separate consent from you before the export of your personal information. Specifically, we may export your personal information to the following overseas recipient: Name: Robert Walters Operations Limited Contact information: dataprotection@robertwalters.com Purpose and method: For purposes disclosed in section 6 of this Policy (“How we use personal data”), Robert Walters needs to engage service providers located outside China to process your personal information, and hence needs to export your personal information. Type of personal information: Please refer to section 4 of this Policy (“What personal data do we collect”). Retention period: Please refer to section 9 of this Policy (“Retention”) Country or region: The United Kingdom
Thailand	Please refer to section 14 of this Policy titled ‘Personal Data originating from outside the UK or EEA (“Non-UK and Non-EEA Personal Data”)’.
United States of America, California	The data processing activities we carry out on the personal information of California residents (“California data”) does not currently fall within scope of the California Consumer Privacy Act (CCPA). Should this change over time, we will update this policy accordingly. Please rest assured that we do and will continue to ensure that we aim to follow best industry practice when processing California data.
Vietnam	Notification of processing personal data The contents in this Vietnam section together with the above contents of this Policy will constitute a complete personal data processing notice and provide you with information, including but not limited to the following: (i) types of personal data (including sensitive personal data) to be processed (as specified in section 4 of this Policy); (ii) how personal data is processed and processing methods (as specified in sections 5 and 6 of this Policy) (iii) parties involved in the processing of personal data (as specified in section 7 of this Policy); (iv) retention, with the start time and end time of personal data processing (as specified in section 9 of this Policy); and (v) your rights and obligations (as specified below in this part of section 18 Country Specific Information). Accordingly, you as a data subject will have the following rights regarding your personal data: right to be informed; right to give consent; right to access; right to withdraw consent; right to delete; right to restrict data processing; right to be provided with data; right to object to data processing; right to bring complaints, denounce, and initiate lawsuits; right to claim compensation for damage; and right to self-protection. You also have obligations as follows: protect your personal data; respect and protect the personal data of others; provide complete and accurate personal data when agreeing to allow the processing of personal data; and participate in preventing and combating violations of regulations on personal data protection. By consenting to this Policy, you acknowledge and confirm that you are fully aware of your rights and obligations pertaining to personal data stipulated under the applicable laws of Vietnam. During personal data processing, we use appropriate technical, physical, and administrative security measures to protect your personal data and to mitigate the risk of loss, misuse, unauthorized access, disclosure, or modification of such data. Nevertheless, data loss and information leakage may still occur due to technical reasons, bad actors, unlawful or unauthorized destruction, loss, alteration, access, disclosure, use, or other unforeseen circumstances that are beyond our control. No internet transmission is 100% secure or error-free, nor is stored data free from vulnerabilities. Robert Walters cannot guarantee the security of our websites, databases or services, nor can we guarantee that the information you supply will not be intercepted while being transmitted to us over the internet. To the extent permitted by the applicable laws, we will proceed to notify the violation (if occur) the concerned parties and competent authorities within the statutory time limit. If you suspect any misuse, loss of or unauthorised access to your personal data please contact us immediately using our contact details in section 17 of this Policy.