+ General Data Protection Regulation

In accordance with the General Data Protection Regulation (EU) 2016/679 (‘GDPR’) that came into effect on 25 May 2018, Twenty-One Twelve is obliged to issue a Data Processing Notice if we store your personal data in our database. The GDPR is a new regulation which replaces the Data Protection Directive 95/46. The GDPR aims to harmonise data protection legislation across EU member states, enhancing privacy rights for individuals and providing a strict framework within which commercial organisations can legally operate.

This Data Processing Notice will outline:

• Twenty-One Twelve Recruitment as a Data Controller
• Which Personal Data Twenty-One Twelve Recruitment Collects
• How Twenty-One Twelve Recruitment Collects Personal Data
• Why We Hold Your Data and Legal Basis
• Optional Marketing Communication
• How long will we store your data?
• What Are Your Rights Under GDPR
• Automated Decision Making, Including Profiling
• Lodging a Complaint
• Changes to This Data Processing Notice
• Contact Details for GDPR and Data Queries

+ Twenty-One Twelve as a Data Controller

Twenty-One Twelve Recruitment (also known by Twenty-One Twelve) will be what’s known as the ‘Controller’ of the personal data you provide to us. We are headquartered in the UK. Your personal data will be stored on our servers and specifically in our CRM system, Bullhorn.

Your personal data may also be shared with our clients for the purpose of introducing you or arranging interviews with them, upon prior written notice to you in which one of our staff members outlines which client(s) Twenty-One Twelve will share your details with and the exact data that will be forwarded to this client. Our employees will only share your personal data with our clients if you explicitly agree for them to do so.

We may furthermore disclose your personal information to third parties in the event that we sell or buy any business or assets in which case we will have to disclose your personal data to the prospective seller or buyer of such business or assets. Furthermore, we may be under a duty to disclose or share your personal data in order to comply with any legal obligation, to defend our business against a legal claim, or in order to enforce or apply our standard terms of business or other agreements or to protect the rights, property or safety of Twenty-One Twelve, our customers, or other parties.

+ What Personal Data Twenty-One Twelve Collects

Twenty-One Twelve only collects personal data to help us match you with the right career opportunity.

Twenty-One Twelve would typically collect the following personal data:

• Your full name
• Your registered address
• Your date of birth
• Your email addresses
• Your (mobile) telephone number
• Your website
• Professional profiles available in the public domain, e.g. LinkedIn, Twitter or Facebook
• Your CV
• Skillset (if not already covered in a CV)
• Job preferences (if not already covered in a CV)
• Current employer/client
• Your passport/visa, when requested by the client
• Current salary/employment conditions
• Desired salary/ employment conditions
• Other documentation, if requested by our clients (e.g. references)

+ How Twenty-One Twelve Collects Personal Data

Twenty-One Twelve collects your personal data in the following ways:

• You apply for a job in response to a job ad on our website,
• You upload your CV and/or portfolio on our website,
• You complete a ‘Contact us’ form or register with Twenty-One Twelve on our website,
• A Twenty-One Twelve Recruitment Consultant gets in contact with you because they found your profile on a database/ job board you have subscribed to or or a Recruitment Consultant has approached you on LinkedIn or registered your CV with and Twenty-One Twelve uses these platforms to headhunt and access details of candidates,
• We have received your details about you from another third party, for instance; a business contact, a client, or professional advisors,
• You applied for a job ad by Twenty-One Twelve published on an external job board, e.g. Monster, Jobsite or LinkedIn, etc.,
• You have met or spoken with a Twenty-One Twelve Recruitment Consultant and are sharing information or sending your CV/application by email to Twenty-One Twelve.

When Twenty-One Twelve receives your details in one of the above ways we save your application and information provided by you on our secure CRM system. Your information and application will be reviewed by our consultants who will potentially share that information with our clients to advance your application, provided you have given your express consent to this upfront.

When we receive these details, our sales consultant will inform you as soon as possible but no later than within a maximum of 30 days of collecting the data of the source where your personal data originates from. If this information is not provided, please let us know straight away and we will confirm how we located your data.

+ Why We Hold Your Data and Legal Basis

Twenty-One Twelve will collect your information to carry out our core business and ancillary activities – for the purpose of recruitment services. In particular, Twenty-One Twelve will collect and process your personal data for the following purposes:

• Introducing you to (potential) clients or employers of which the scope will be identified and communicated by one of our members of staff;
• Keeping your personal data on file for current and future opportunities that may arise;
• Evaluating your experience with Twenty-One Twelve and our recruitment process;
• If we ask for a copy of your passport or visa, we do this as we may have to verify your identity and/ or the right to work.
• Clients may ask Twenty-One Twelve to provide them with additional documentation (e.g. your passport details or references). If that happens we will ask for your permission to share these data with our clients. Please let us know if you have any issues with this.

The following legal basis applies for processing your data if we have been in touch with you within the last three years:

We will process your data as we believe that we have legitimate interests to do so.

We have carried out a three-part test (a so-called legitimate interest’s assessment). More information about this test can be requested from office@twentyonetwelve.net.

As a recruitment business we introduce candidates to clients for permanent employment and temporary worker placements (if you provide services as a contractor through Twenty-One Twelve). The exchange of relevant personal data of our candidates to our client contacts is paramount if we want to provide services to our clients or support our candidate’s career aspirations.

As we thus need to satisfy our client’s resourcing needs, we require an up-to-date database of candidate data. We would only use your personal data to introduce you to our clients and do not share more data with our clients than reasonably necessary. We would usually only process data that is already available online to other recruiters (e.g. a CV downloaded from a job board). We always ask for your permission before we process any of your sensitive data (e.g. passport copy or references). In practice, we would acquire this type of information only upon request when we introduce you to one of our clients.

Thus, to maintain, expand, and develop our business we need to record the personal data of our (prospective) candidates who have been in touch with Twenty-One Twelve within the last three years. We have chosen this three-year period as it is likely that (1) there is a(n) ongoing relationship between you and Twenty-One Twelve Recruitment, (2) you may be looking for opportunities that Twenty-One Twelve Recruitment can help you with, and (3) your data on our database is still up-to-date. We have also chosen this three-year period as we think this timeframe is regarded to be industry standard.

The following legal basis applies for processing your data if we have not been in touch with you within the last three years:

We will process your data as we believe that we have legitimate interests to do so.

We have carried out a three-part test (a so-called legitimate interest’s assessment). More information about this test can be requested from office@twentyonetwelve.net.

As a recruitment business, we introduce candidates to clients for permanent employment and temporary worker placements (if you provide services as a contractor through Twenty-One Twelve Recruitment). The exchange of relevant personal data of our candidates to our client contacts is paramount if we want to provide services to our clients or support our candidate’s career aspirations.

As we thus need to satisfy our client’s resourcing needs, we require an up-to-date database of candidate data. We would only use your personal data to introduce you to our clients and do not share more data with our clients than reasonably necessary. We would usually only process data that is already available online to other recruiters (e.g. a CV downloaded from a job board). We always ask for your permission before we process any of your sensitive data (e.g. passport copy or references). In practice, we would acquire this type of information only upon request when we introduce you to one of our clients.

Thus, to maintain, expand and develop our business we need to record the personal data of our (prospective) candidates who have been in touch with Twenty-One Twelve Recruitment within the last three years. We have chosen this three-year period as it is likely that (1) there is a(n) ongoing relationship between you and Twenty-One Twelve Recruitment, (2) you may be looking for opportunities that Twenty-One Twelve Recruitment can help you with, and (3) your data on our database is still up-to-date. We have also chosen this three-year period as we think this time frame is regarded to be industry standard.

The following legal basis applies for processing your data if you are (permanently) employed by one of our clients:

If you are a candidate of Twenty-One Twelve Recruitment and have been successfully hired by one of our clients, we have a legal obligation to keep your data on file for six years. This legal requirement is in place so that Twenty-One Twelve Recruitment is able to evidence any transactions with our clients for tax purposes and to be able to produce proof of the placement should any legal claims arise against Twenty-One Twelve Recruitment by any parties involved during the recruitment and/or hiring process.

+ Optional Marketing Communication

Twenty-One Twelve Recruitment will hold your personal data for marketing purposes which are optional.

The legal basis for collecting and processing personal data for marketing purposes is ‘consent’ which means Twenty-One Twelve Recruitment will only send you marketing communication if you have opted into receiving this.

If you opted into receiving updates from Twenty-One Twelve Recruitment, we will use your data, preferences, user behaviour, and information you have provided to personalise your experience, provide you with relevant service announcements and updates, and to better understand your needs and interests in relation to your job search.

Twenty-One Twelve Recruitment uses the personal data and information you have provided with your CV or portfolio to match your profile with relevant job opportunities. Our marketing team analyses your profile to provide you with additional information which helps you to better position yourself in the job market, i.e. with invitations to networking events in your city, news and updates relevant for your area of expertise, or job alerts tailored to your preferences, if you have opted in to receiving marketing communication.

You are entitled to withdraw consent or restrict the use of your personal information for whatever purpose at any time, without affecting the lawfulness of processing based on consent before its withdrawal. To opt out of any data processing and/ or marketing communications from Twenty-One Twelve Recruitment. please click the ‘unsubscribe’ link in the footer of the respective email or contact us directly at office@twentyonetwelve.net.

+ How long will we store your data?

Your personal data will be stored in our systems for six years following the date your profile was added to our database. However, if you do not stay in touch with us for a period of more than three years your data will be deleted unless you give Twenty-One Twelve Recruitment consent that we can process your data for another three years. If you do not give us consent to hold your data, then we will remove your data from our database.

Your personal data will be stored in our systems for three consecutive years. As long as you are working with Twenty-One Twelve Recruitment’s Consultants on your next career step, we will keep your data on file to be able to match you with the latest opportunities and to contact you.

Your data will be removed from our systems if a) We have not heard from you during a period of three years, or b) If you request for your data to be removed.

Different retention periods apply if a) you have entered into an agreement with Twenty-One Twelve Recruitment for which a different Data Processing Notice applies or b) unless there is a direct statutory requirement (that comes into force) under which Twenty-One Twelve Recruitment is obliged to keep your data stored in our internal databases for another period of time. This applies for example if you are hired by one of our clients and Twenty-One Twelve Recruitment subsequently needs to keep records of the relevant transaction. The current limitation period is six years from the date of the transaction (may be changed from time to time). Also, under the Conduct of Employment Agencies and Employment Businesses Regulations 2003 Twenty-One Twelve Recruitment must retain evidence of an introduction or supply for at least one year from the last activity e.g. interview, introduction, or engagement.

+ What are your rights under GDPR?

Under GDPR you are entitled to various rights:

• You can request correction of the personal information that we hold about you. This enables you to have any incomplete or inaccurate information we hold about you corrected. This means when working with our recruitment consultants, make sure you notify us of any changes or update your information like email, phone number, etc. when they change.
• You can request erasure of your personal information. This enables you to ask us to delete or remove personal information where there is no good reason for us continuing to process it. You also have the right to ask us to delete or remove your personal information where you have exercised your right to object to processing (see below). This means should you wish to be removed from Twenty-One Twelve Recruitment’s database, please email office@twentyonetwelve.net. We will review and process your request within 30 days.
• You can object to the processing of your personal information where we are relying on a legitimate interest (or those of a third party) and there is something about your particular situation which makes you want to object to processing on this ground. You also have the right to object where we are processing your personal information for direct marketing purposes. This means we will only send you marketing communication if you have opted in. You can opt out at any time by clicking the ‘unsubscribe’ link in the footer of the email in question and will be removed from the Twenty-One Twelve Recruitment’s marketing mailing list. You can also contact us directly by emailing us at office@twentyonetwelve.net
• You can request the restriction of processing of your personal information. This enables you to ask us to suspend the processing of personal information about you, for example, if you want us to establish its accuracy or the reason for processing it.
• You can request the transfer of your personal information to another party in certain formats, if practicable.

All such requests need to be addressed to office@twentyonetwelve.net.

The fact that you can lodge a request does not necessarily mean we will grant your request, at all times, especially if Twenty-One Twelve Recruitment has a legitimate interest that outweighs your interests as an individual. Twenty-One Twelve Recruitment will, however, provide information without undue delay and in any event within one month (this can be extended to 2 months in exceptional circumstances) of the receipt of the request, however where requests are manifestly unfounded or excessive, in particular, because of its repetitive character, Twenty-One Twelve Recruitment may refuse to act upon your request. In that case, we will inform you within one month of the request of the possibility of lodging a complaint with a supervisory authority (in the UK this will be the ICO) or seeking a judicial remedy.

+ Existence of Automated Decision Making, Including Profiling

Twenty-One Twelve Recruitment will not conduct any forms of automated processing of your personal data consisting of the use of personal data to evaluate certain personal aspects relating to you. In particular to analyse or predicts aspects concerning your personal preferences, job roles interests, reliability, behaviour, location, or movements. We will not make decisions that are based solely on automated processing which produces legal effects or similarly significantly affects you as a data subject.

+ Lodging a Complaint

If you feel that your rights as a data subject have been breached, you are entitled to lodge a complaint with the national supervisory authority (in the UK this will be the Information Commissioner’s Office via https://ico.org.uk/concerns/) or seek a legal remedy. However, we strongly encourage you to contact us first via office@twentyonetwelve.net in the first instance.

+ Changes to this Data Processing Notice

Any changes we make to our Data Processing Notice in the future will be posted on this website and where appropriate (if we make any significant changes that may affect your rights as a data subject), notified to you by email. Please check back frequently to see any updates or changes to this Data Processing Notice.