Privacy Policy

1. Background

This Privacy Policy is made in compliance with the data protection obligations under the General Data Protection Regulation (GDPR). We make this policy on behalf of all companies within the TXM Group of Companies, as relevant. For clarification for the purpose of this policy, “TXM” incorporates TXM Group, TXM Recruit, TXM Inc, TXM Consult, TXM Healthcare, TXM Manpower, 2XM Technology, 2XM Recruit, 2XM Consult, NGP, Provide, Step5, Specialist Locum Network, Provide Medical, Teleconsult.

We at TXM Group, along with our subsidiaries and affiliates listed, respect your concerns about privacy. This Privacy Policy applies to (1) our job candidates, (2) our consultants, who are people we source or place on assignment with one of our clients, or individuals to whom we provide career transition services, (3) users of our websites, and (4) representatives of our clients.

The Policy describes the types of personal information we collect, how we use the information, with whom we share it, and the rights of and choices available to individuals regarding our use of their information. We also describe the measures we take to protect the security of the information and how you can contact us about our privacy practices and to exercise your rights. Our privacy practices may vary among the countries in which we operate to reflect local practices and legal requirements. This Policy should be read in conjunction with our Data Retention Schedule and Cookies Policy.

2. Information We Collect

We collect personal information about you in various ways, such as through our website, through job boards and social media channels; at our events and through phone and emails; through job applications and in connection with in-person recruitment; and in connection with our interactions with clients and vendors. We may collect the following types of personal information:

• Contact information (such as name, postal address, email address and telephone number and any other data contained in your CV);

• Username and password when you register on our websites;

• information you provide about friends or other people you would like us to contact;

• Other information you may provide to us, such as in surveys or through the "Contact Us" feature on our websites.

In addition, if you are a job candidate and you apply for a position or create an account to apply for a position, we may collect the following types of personal information:

• Employment and education history;

• Language proficiencies and other work-related skills;

• Eligibility to work documentation such as Passport (details or copies) or equivalent and/or visa documentation;

• Personal data such as date of birth and gender;

• Bank payment details and tax-related information;

• Disabilities and health-related information (if applicable to the job position);

• Results of drug and alcohol tests, DBS and other applicable background checks;

• Information provided by references; and

• Any other information contained in your C.V. regarding your career interests

In addition, we may collect information you provide to us about other individuals, such as information related to emergency contacts.

3. Information Collected by Automated Means

When you visit our websites, we may collect certain information by automated means, such as cookies and web server logs. The information we may collect in this manner includes IP address, unique device identifier, browser characteristics, device characteristics, operating system, language preferences, referring URLs, information on actions taken on our websites, dates and times of visits to our websites and other usage statistics. A "cookie" is a file that websites send to a visitor's computer or other Internet-connected device to uniquely identify the visitor's browser or to store information or settings in the browser. Through these automated collection methods, we may obtain "clickstream data," which is a log of the links and other content on which a visitor clicks while browsing a website.

As the visitor clicks through the website, a record of the action may be collected and stored. We link certain data elements we have collected through automated means, such as your browser information, with other information we have obtained about you to let us know, for example, whether you have opened an email we sent to you. Your browser may tell you how to be notified when you receive certain types of cookies or how to restrict or disable certain types of cookies. Please note, however, that without cookies you may not be able to use all of the features of our websites. To the extent required by applicable law, we will obtain your consent before collecting personal information using cookies or similar automated means.

The providers of third-party apps, tools, widgets and plug-ins on our websites, such as social media sharing tools, also may use automated means to collect information regarding your interactions with these features. This information is collected directly by the providers of the features and is subject to the privacy policies or notices of these providers. Subject to applicable law, TXM Group is not responsible for these providers' information practices.

4. Other Information We Collect

In addition, we use information collected through cookies, pixels, web server logs and other automated means for purposes such as (i) customising our users' use of our websites; (ii) delivering content tailored to our users' interests and the manner in which our users use our websites; and (iii) managing our websites and other aspects of our business. To the extent required by applicable law, we will obtain your consent before collecting information using cookies or similar automated means. We also use third-party analytics services on our websites. The analytics providers that administer these services use technologies such as cookies, web server logs to help us analyse your use of our websites. The information collected through these means (including IP address) may be disclosed to these analytics providers and other relevant third parties who use the information, for example, to evaluate use of the websites.

5. Information We Share

We do not disclose personal information we collect about you, except as described in this Privacy Policy or in separate notices provided in connection with particular activities. We share personal information with relevant third-parties for business and contractual reasons, who perform services on our behalf based on our instructions.

We do not authorise these third-parties to use or disclose the information except as necessary to perform services on our behalf or comply with legal requirements. We also may share your personal information (i) with our subsidiaries and affiliates; (ii) if you are a job candidate, with clients who may have job opportunities available or interest in placing our job candidates; and (iii) with others with whom we work, such as job placement consultants and subcontractors, to find you a job. In addition, we may disclose information about you (i) if we are required to do so by law or legal process; (ii) to law enforcement authorities or other government officials based on a lawful disclosure request; and (iii) when we believe disclosure is necessary or appropriate to prevent physical harm or financial loss, or in connection with an investigation of suspected or actual fraudulent or illegal activity. We also reserve the right to transfer personal information we have about you in the event we sell or transfer all or a portion of our business or assets (including in the event of a reorganisation, dissolution or liquidation). Information collected through third-party plug-ins and widgets on the websites (such as information relating to your use of a social media sharing tool) is collected directly by the providers of the plug-ins and widgets. This information is subject to the privacy policies of the providers of the plug-ins and widgets, and TXM Group is not responsible for those providers' information practices.

6. Lawful Basis for Processing Personal Data

Legal Obligations and Contractual Requirements

TXM Group uses personal data firstly to fulfil any contractual obligations that exist between us and yourself. Where we request personal data be provided to enter into, or meet the terms of any such contract, you will be required to provide the relevant personal data or we may not be able to continue to fulfil that contract and it may be terminated. In such cases the lawful basis of us processing the personal data is that it is necessary for the performance of a contract.

We are required by law to process personal data for purposes relating to our legal obligations, these include:

To provide for our financial commitments, or to relevant financial authorities.

To comply with regulatory requirements and any self-regulatory schemes.

To carry out required business operations and due diligence.

To cooperate with relevant authorities for reporting criminal activity, or to detect and prevent fraud.

To investigate any insurance claims, claims of unfair dismissal, claims of any kind of harassment or of discrimination, or any other claim whereby the organisation may have to defend itself.

Legitimate Interests

TXM Group may process Personal Data for any of the following purposes, which are considered to be within our legitimate business interests: Providing workforce solutions and connecting people to work;

Creating and managing online accounts;

Processing payments;

Managing our client and vendor relationships;

Sending promotional materials, alerts regarding available positions and other communications;

Communicating about, and administering participation in, special events, promotions, programs, offers, surveys, contests and market research;

Responding to individuals' inquiries;

Operating, evaluating and improving our business (including developing, enhancing, analysing and improving our services; managing our communications; performing data analytics; and performing accounting, auditing and other internal functions);

In addition to the activities listed above, if you are a job candidate and you apply for a position or create an account to apply for a position, we use the information described in this Privacy Policy to:

• Provide you with job opportunities and work;

• Provide HR services to you, including administration of benefit programs, payroll, performance management and disciplinary actions;

• Provide additional services to you, such as training and career transition services;

• Assess your suitability as a job candidate and your associate qualifications for positions; and

• Perform data analytics, such as (i) analysing our job candidate and associate base; (ii) assessing individual performance and capabilities, including scoring on work-related skills; (iii) identifying skill shortages; (iv) using information to match individuals and potential opportunities, and (v) analysing pipeline data (trends regarding hiring practices)

Special Category Personal Data

TXM Group may intend to process the following kinds of Special Categories of Personal Data:

Data concerning health information, Where Special Categories of Personal Data are processed, one or more of the following lawful basis shall apply: It is necessary for preventive or occupational medicine, for the assessment of the working capacity of an employee, medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems or pursuant to contract with a health professional.

7. How long will TXM Group keep your Personal Data?

We will keep your personal data only for as long as required to achieve the purposes for which it was collected, in line with this privacy notice. The following criteria are what determine the period for which we will keep your personal data: Until we are no longer required to do so to comply with regulatory requirements or financial obligations. Until we are no longer required to do so by any law we are subject to. Until all purposes for which the data was originally gathered have become irrelevant or obsolete. Until it has been requested that we no longer process the data and that it is erased, in some cases, Where there is a remaining relevant or legal reason why we are required to keep this data, we may opt to restrict the amount of processing being conducted to what is absolute necessary rather than erase it.

Please refer to our retention policy for more detailed information

8. Your Rights and Choices

We offer you certain choices in connection with the personal information we collect about you and how we communicate with you. To update your preferences, ask us to remove your information from our mailing lists, exercise your rights or submit a request, please contact us as indicated in the "How to Contact Us" section of this Privacy Policy. To the extent provided by the law of your jurisdiction, you may request access to the personal information we maintain about you or request that we correct, amend, delete or block the information by contacting us as indicated below. Where provided by law, you may withdraw any consent you previously provided to us or object at any time on legitimate grounds to the processing of your personal information, and we will apply your preferences going forward.

Your principal rights under data protection law are:

(a) the right to access;

(b) the right to rectification;

(d) the right to restrict processing;

(e) the right to object to processing;

(f) the right to data portability;

(g) the right to complain to a supervisory authority; and

(h) the right to withdraw consent.

You have the right to confirmation as to whether or not we process your personal data and, where we do, access to the personal data, together with certain additional information. That additional information includes details of the purposes of the processing, the categories of personal data concerned and the recipients of the personal data.

Providing the rights and freedoms of others are not affected, we will supply to you a copy of your personal data. The first copy will be provided free of charge, but please note that additional copies or any manifestly unfounded requests may be subject to a reasonable fee. You must supply appropriate evidence of your identity for this purpose; we will usually accept a clear copy of your passport certified by a solicitor or bank. Please refer to the individual TXM Company’s Subject Access Request policy for further details; to obtain this policy or to obtain a subject access request form, please write to gdpr@txmgroup.com.

You have the right to have any inaccurate personal data about you rectified and, taking into account the purposes of the processing, to have any incomplete personal data about you completed.

In some circumstances you have the right to the erasure of your personal data without undue delay. Those circumstances include: you withdraw consent to consent-based processing; the processing is for direct marketing purposes. However, there are certain general exclusions of the right to erasure.

Those general exclusions include where processing is necessary: for compliance with a legal obligation; or for the establishment, exercise or defence of legal claims.

In some circumstances you have the right to restrict the processing of your personal data. Those circumstances are: you contest the accuracy of the personal data; processing is unlawful but you oppose erasure; we no longer need the personal data for the purposes of our processing, but you require personal data for the establishment, exercise or defence of legal claims; and you have objected to processing, pending the verification of that objection.

Where processing has been restricted on this basis, we may continue to store your personal data. However, we will only otherwise process it: with your consent; for the establishment, exercise or defence of legal claims; for the protection of the rights of another natural or legal person; or for reasons of important public interest.

You have the right to object to our processing of your personal data on grounds relating to your particular situation, but only to the extent that the legal basis for the processing is that the processing is necessary for: the performance of a task carried out in the public interest or in the exercise of any official authority vested in us; or the purposes of the legitimate interests pursued by us or by a third party. If you make such an objection, we will cease to process the personal information unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing is for the establishment, exercise or defence of legal claims.

You have the right to object to our processing of your personal data for direct marketing purposes (including profiling for direct marketing purposes). If you make such an objection, we will cease to process your personal data for this purpose. You have the right to object to our processing of your personal data for scientific or historical research purposes or statistical purposes on grounds relating to your particular situation, unless the processing is necessary for the performance of a task carried out for reasons of public interest.

To the extent that the legal basis for our processing of your personal data is consent, and such processing is carried out by automated means, you have the right to receive your personal data from us in a structured, commonly used and machine-readable format. However, this right does not apply where it would adversely affect the rights and freedoms of others.

If you consider that our processing of your personal information infringes data protection laws, you have a legal right to lodge a complaint with a supervisory authority responsible for data protection. You may do so in the EU member state of your habitual residence, your place of work or the place of the alleged infringement.

To the extent that the legal basis for our processing of your personal information is consent, you have the right to withdraw that consent at any time. Withdrawal will not affect the lawfulness of processing before the withdrawal. You may exercise any of your rights in relation to your personal data by written notice to us.

9. International Transfers of Your Data

As a part of our standard business practices, we may transfer your personal data to organisations based in countries that have not been granted an adequacy decision under the General Data Protection Regulation.

Where data is transferred to international organisations, we shall ensure that specific safeguards or derogations have been established.

These might include where the data transfer is necessary in order to fulfil a contract between us and yourself, where we have received your specific consent after having made you aware of any risks involved, or where contracts are in place between us and the third-parties involved that ensure the recipient organisation has a suitable standard of data protection in place.

10. How We Protect Personal Information

We maintain administrative, technical and physical safeguards designed to protect the personal information you provide against accidental, unlawful or unauthorised destruction, loss, alteration, access, disclosure or use.

11. Links to Third-Party websites, Apps and Services

For your convenience and information, our websites may provide links to third-party sites, apps and services that may be operated by companies not affiliated with TXM Group. These companies may have their own privacy notices or policies, which we strongly suggest you review. We are not responsible for the privacy practices of any non-TXM Group sites or services.

12. Amendments

This Privacy Policy may be updated periodically to reflect changes in our personal information practices. For significant changes, we will notify you by posting a prominent notice on our websites indicating at the top of the Policy when it was most recently updated.

13. Data Protection Officer

TXM Group has outsourced its Data Protection Officer (DPO) responsibilities to Ametros Group, a consultancy that provides practitioner led GDPR advisory services to UK based organisations. Contact details for our DPO are as follows:

Mr J. Richards @ Ametros Group Ltd

Lakeside Offices

Thorn Business Park

Hereford

HR2 6JT

Email: dpo@ametrosgroup.com

Tel: 0330 223 2246

14. Contact Us

If you have any questions or comments about this Privacy Policy, or you would like to exercise your rights or update the information we have about you or your preferences, please contact TXM Group directly at gdpr@txmgroup.com. We endeavour to respond to queries and requests within two working days.

Should you wish to discuss a complaint, please feel free to contact us using the details provided above. All complaints will be treated in a confidential manner.