Employee Privacy Statement

30 August 2019

General

Your privacy is very important to us and this privacy statement sets out what personal data we hold and who for and how this is processed. For the purposes of employment, Oak will usually be your employing entity and so will be the primary "data controller" (meaning it determines the purposes and means of processing personal data). In the event you are employed by a different entity, that entity will be the data controller.

This notice applies to prospective, current and former employees, consultants and contractors. This notice does not form part of any contract of employment or other contract to provide services.

For the purposes of this notice the term Oak and Oak Group refers to the group and affiliated companies consisting of Oak Group Limited, Oak Trust (Guernsey) Limited, Oak Fund Services (Guernsey) Limited, Oak Group (IOM) Limited, Oak Group (Jersey) Limited, Oak (Malta) Limited, Oak Management (Mauritius) Limited and Oak Trust (Mauritius) Limited, OFS Holdings Limited and any subsidiaries of these companies.

Personal data - What we collect:

We process personal data in order to allow us to consider your application for employment / engagement and / or as part of your employment / engagement.

Personal data means any information relating to an identified or identifiable natural person. Oak Group processes the following types of personal data as part of the recruitment process and/or the employment/consultancy relationship:

• name, title, address, email address, telephone number and other contact information
• date and place of birth
• nationality
• sex
• marital status
• employment details including salary, compensation history, annual leave, benefits information, start date, location of employment or workplace
• details regarding dependents, next of kin and emergency contact information
• copies of identity documents – identity and address
  • passport, national ID card, registration card, driver’s license, employee identification numbers, utility bill, bank statement or other documents to satisfy our legal obligations
• information necessary to comply with our legal obligations and obligations to you including, social security number, bank account details, payroll records and tax status information
• recruitment information (including copies of right to work documentation, references and other information included in a CV or cover letter or as part of the application process)
• employment records (including job titles, work history, working hours, training records and professional memberships)
• CCTV footage and other information obtained through electronic means such as cotag access
• photographs
• information relating to employment administration and day to day matters such as performance information, disciplinary and grievance information, information about your use of our information and communications systems

Please note that the list is not exhaustive, and that Oak Group may also collect and process personal data to the extent this is useful or necessary for recruitment purposes and/or to fulfil the employment relationship.

• information about your race or ethnicity, religious beliefs, sexual orientation and political opinions
• information about your health, including any medical condition, health and sickness records
• genetic information and biometric data
• information about criminal convictions and offences

We may need to process special categories of personal information in the following circumstances:

In certain circumstances we may need to process special category data including:

• Where we need to carry out our legal obligations or exercise rights in connection with employment and the contract we have entered into with you
• Where it is needed in the public interest, such as for equal opportunities monitoring
• Less commonly, where it is needed in relation to legal claims or where it is needed to protect your interests (or someone else’s interests) and, for example, ensuring we maintain a safe working environment
• Where it is necessary for our legitimate interests (or those of a third party) and your interests and fundamental rights do not override those interests

Do we need your consent?

We do not need your consent if we use Special Category Data in accordance with our written policy. In limited circumstances, we may approach you for your written consent to allow us to process certain particularly sensitive data. If we do so, we will provide you with full details of the information that we would like and the reason we need it, so that you can carefully consider whether you wish to consent. You should be aware that this is not a condition of your contract with us that you agree to any request for consent from us.

Information about criminal allegations or convictions

Save where you have given explicit consent, we may only use information relating to the commission or alleged commission of a criminal offence by an individual where the law allows us to do so. This will usually be where such processing is necessary to carry out our obligations and provided, we do so in line with our data protection policy.

Less commonly, we may use information relating to criminal data where it is necessary in relation to legal claims, where it is necessary to protect your interests (or someone else’s interests) and you are not capable of giving your consent, or where you have already made the information public.

Due to the nature of the work Oak Group undertakes, we may seek your explicit consent to process criminal data which we ask you to provide as part of our recruitment process.

Personal data - How we collect it

We collect personal data in a number of ways during the recruitment process and/or during the course of working for us. Primarily, this will come from data subjects directly together with information provided by third-parties such as business partners, intermediaries, employment agencies, background check providers, credit references agencies, former employers or other service providers. We may also obtain information from criminal records checks permitted by law.

We also collect and process personal data held within the public domain such as the internet, social networks, commercial registers and third-party screening providers. We will also collect additional personal information in the course of job-related activities throughout the period of you working for us.

Personal data - How we use it

The majority of the personal data processed by Oak Group is necessary for the performance of a contract to which the data subject is a party or to comply with the request of the data subject prior to entering into a contract. Oak Group also processes personal data in order to comply with our legal and regulatory obligations, including the right to work in a given jurisdiction.

We may furthermore process personal data for the purposes of the legitimate business interests pursued by Oak Group. Such legitimate interests include, but are not limited to:

• managing the recruitment process, employee engagement and on-going management of your employment/consultancy record
• to enable us to procure staff benefits and insurance policies
• ensuring the services provided by Oak Group are managed professionally
• internal administrative purposes and strategic, organisational and business planning
• monitoring your use of our information and communication systems to ensure compliance with our IT policies
• preventing fraud and the detection of crime
• ensuring network and information security, including preventing unauthorised access to our computer and electronic communications systems and preventing malicious software distribution
• conducting data analytics studies to review and better understand employee retention and attrition rates
• handling enquiries, complaints and legal claims
• training, development and monitoring purposes

When we process your personal data for our legitimate business interests, we will consider and balance any potential impact on you and your rights under the relevant data protection and any other relevant law. Whenever we process personal data for these purposes you have the right to object to this way of processing.

If you fail to provide information when requested, which is necessary for us to consider your application (such as evidence of qualifications or work history), we will not be able to process your application successfully. For example, if we require a credit check or references for this role and you fail to provide us with relevant details, we will not be able to take your application further.

If you fail to provide certain information when requested, we may not be able to perform the contract we have entered into with you (such as paying you or providing a benefit), or we may be prevented from complying with our legal obligations (such as to ensure the health and safety of our workers).

Personal data - Who we provide it to

Oak Group may disclose or transfer personal data collected by us to our group companies, other providers of services (e.g. payroll, benefits provision and administration, IT services), any sub-contractors, agents or service providers to Oak Group, law enforcement agencies, regulatory and / or competent authorities, insofar as reasonably necessary for the purposes of the recruitment process, the employment/consultancy relationship or for bona fide compliance purposes as well as on the legal basis as set out in this Privacy Statement.

Oak Group may disclose or transfer personal data to third-parties for the purpose of marketing the Oak Group.

Oak Group may also provide personal data to any third-party with whom we may merge or transfer part or the whole of our business.

All our third-party service providers and other entities in the Oak Group are required to take appropriate security measures to protect your personal information in line with our policies. We do not allow our third-party service providers to use your personal data for their own purposes. We only permit them to process your personal data for specified purposes and in accordance with our instructions.

The personal data Oak Group processes is stored by Oak Group on its servers, and / or on the servers of any cloud-based database / platform provider with which Oak Group engages. 

Personal data - Where we transfer it

It may be necessary for Oak Group or associated third-parties to effect cross-border transfers of personal data, including to countries outside the EEA which have not been deemed to have data protection frameworks that are equivalent to those of the EEA. Such transfers may be to other Oak Group entities, to governmental, regulatory or judicial authorities, auditors, legal advisors or agents as well as to sub-contractors engaged by Oak Group.

In these situations, we will seek to put appropriate safeguards in place to maintain the security of your data. Please contact us if you would like to know more about these arrangements.

Personal data - Right of access and right of portability

You may request and receive copies of any personal data that Oak Group may hold about you. Should you wish at any time to receive a copy of this information, a request should be made to us in writing to dataprotection@oak.group and should clearly identify who you are.

Personal data - Right of rectification or erasure

You may request that any inaccuracies in the data we hold about you be corrected, and that any personal data that we hold about you which we do not have a legitimate reason to retain be erased.

Any such request should be in writing to dataprotection@oak.group and should clearly identify who you are.

Personal data - Right of restriction of processing

You have the right to ask Oak Group to restrict the processing of your personal information in case:

• The accuracy of the personal information held by Oak Group is contested by you
• The processing is unlawful, and you oppose the deletion of the personal data and request the restriction of use instead
• Oak Group no longer needs the personal data for the purposes of the processing, but you require the personal data for legal reasons
• You have objected to processing and Oak Group is investigating whether there are legitimate grounds to override the objection

Any such request should be in writing to dataprotection@oak.group and should clearly identify who you are

Personal data - Right regarding automated individual decision making

Oak Group generally does not make decisions by purely automatic means, and if we do decide to use automated decision-making, we will inform you accordingly. If we do use automated decision-making, you have the right to object.

Any such request should be in writing to dataprotection@oak.group and should clearly identify who you are.

Personal data - Right to object to processing for legitimate interest purposes

You have the right to object at any time to the processing of your personal data for legitimate interest purposes by Oak Group.

Any such request should be in writing to dataprotection@oak.group and should clearly identify who you are.

Personal data - Right to complain to the Data Protection Authority

In addition, you have the right to make a complaint with the local supervisory authority with respect to the way Oak Group is processing your personal data or the way Oak Group is handling your rights.

Personal data – Retention

Oak Group will process and store the relevant personal data for the duration of the recruitment process and/or the employment/consultancy relationship. We endeavour to ensure that all data held is accurate, complete and up to date. Oak Group may also store the data for as long as it is necessary or required in order to fulfil legal, contractual or statutory obligations and, or for the establishment, exercise or defence of legal claims, and in general where it has a legitimate interest for doing so.

Oak Group typically retains employee records for; 1 year from the date of application (for unsuccessful applicants), and up to 10 years from the end of the employment/consultancy relationship, these periods may vary depending on an assessment of any legal or regulatory obligations applicable to the relevant document. In the event you wish for us to erase data prior to this time, please send such request in writing to dataprotection@oak.group.

Amendment to Privacy Statement

Oak Group reserves the right to amend this privacy statement at any time without notice. It is therefore recommended that it be viewed on a regular basis in order to monitor any such changes.

Concerns or Queries

Should you have any questions regarding this Privacy Statement please address these to us in writing to dataprotection@oak.group.