Privacy Policy

​Welcome to the Empresaria Group privacy policy.

1. Who we are and what we do 

Who we are

We are Empresaria Group plc (“us”, “we”, “our”). We are a public limited company registered in England and Wales under registration number 09946765 with a registered office at Old Church House, Sandy Lane, Crawley Down, Crawley, West Sussex, England RH10 4HS. We are registered with the Information Commissioner’s Office (“ICO”), the UK supervisory office under registration number Z124495X.

What we do

We and our direct and indirect subsidiaries (each a “Group Company” and together, the “Empresaria Group”) are specialist recruitment and staffing providers, matching quality candidates to our clients’ available roles in diverse sectors (including IT, professional services and healthcare) across the globe. The Empresaria Group is committed to protecting the privacy and security of the Personal Data we process. 

Controller

Unless we notify you otherwise, we are the Controller of the Personal Data we process, jointly with each of our Group Companies. This means that we, together with each Group Company, jointly decide what Personal Data to collect and how to process it. 

2. Purpose of this privacy notice 

The purpose of this privacy notice is to explain what Personal Data we collect about you and how we process it. This privacy notice also explains your rights, so please read it carefully. If you have any questions, you can contact us using the information provided below under the ‘Contact Us’ section. 

3. Who this privacy notice applies to

This privacy notice applies to you if: 

• You visit our website 
• You or the company you work for enters into a contract with us to provide recruitment related services 
• You make enquires about our services 
• You register with us 
• You are a business associate of ours 
• You sign up for job alerts 
• You are a candidate to whom we provide work-finding services 
• You are a client to whom we provide recruitment and staffing services
• You are referee who we contact about a former employee of yours
• We contact you to promote our services. For example, we send you newsletters and/or other promotional communications. 

4. What Personal Data is

The definition of ‘Personal Data’ varies slightly from country to country but generally means any information from which someone can be identified either directly or indirectly. For example, you can be identified by your name or an online identifier. However, in America ‘Personal Information’ includes information that could reasonably be linked, either directly or indirectly, to a particular consumer or household. 

In some cases, we also process more sensitive Personal Data such as information revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data for the purposes of uniquely identifying someone, data concerning physical or mental health or data concerning someone’s sex life or sexual orientation and criminal offence data. For the purposes of this privacy notice, we shall refer to this data as ‘Sensitive Personal Data’. 

5. Interpretation & Definitions

• Capitalised words in this privacy notice have the meanings given below. All definitions have the same meaning regardless of whether they are used in singular or plural. 
•  APA means the Australian Privacy Act 1988 (Cth). 
• APPI means Japan’s Act on the Protection of Personal Information (Act No. 57 of 2003 as amended in 2020). 
• Business means the legal entity that determines the purposes and means of processing of Personal Data about residents of California in accordance with the California Consumer Privacy Act (CCPA) and/or the California Privacy Rights Act (CPRA). 
• Business Associates means a representative of a former, existing or potential client of ours. 
• Controller means, for the purposes of this privacy notice, the legal entity or natural person that determines the means and purposes of processing of Personal Data and includes the definition of Data User under Hong Kong’s PDPO and Malaysia’s PDPA, a Personal Information Handler under China’s PIPL, an Organisation under Singapore’s PDPA, a Business under California’s CPPA, an agency under New Zealand’s Privacy Act and a Data Processor under Vietnam’s LCS. 
• Chile’s PPLL means Chile’s Protection of Private Life Law 19, 628/1999. 
• CCPA means the California Consumer Privacy Act, California Civil Code sections 1798.100 et seq, and its implementing regulations. 
• “CDPA” means the Virginia Consumer Data Protection Act. 
• “CPA” means the Colorado Privacy Act. 
• CPRA means the California Privacy Rights Act. 
• “CTDPA” means the Connecticut Act Concerning Personal Data Privacy and Online Monitoring. 
• DPA means the Philippines’ Data Privacy Act of 2012 (Republic Act No. 10173) 
• EU GDPR means the EU’s the General Data Protection Regulation (EU) 2016/679. 
• IT Law means India’s Information Technology Law 2000. 
• Kominfo Regulation 20 means Regulation No.20 of 2016 on Personal Data Protection in Electronic Systems. 
• LCS means the Law on Cyber Information Security No.86/2015/QH13 (19 November 2015) in Vietnam. 
• Malaysia’s PDPA means Malaysia’s Personal Data Protection Act (“Malaysia’s PDPA”). 
• Peru’s PDPL means Peru’s Personal Data Protection Law (N° 29733 (PDPL)) and its Regulation (N° 003-2013-JUS-Regulation of the PDPL). 
• PDPO means Hong Kong’s Personal Data (Privacy) Ordinance (Cap.486) as amended. 
• Personal Data means information which can be used directly or indirectly to identify you and which relates to you (and shall be deemed to include “Personal Data” and “Personal Information” as defined in the various data protection laws referred to in this privacy notice. 
• PIPL means China’s Personal Information Protection Law. 
• Privacy Act 2020 means New Zealand’s Privacy Act 2020. 
• Processor means the legal entity or natural person that processes Personal Data on behalf of and under the strict instructions of a Controller and includes ‘Entrusted Parties’ under China’s Personal Information Protection Law. 
• Sensitive Personal Data – Sensitive personal data may be defined differently under different data protection laws but for the purposes of this privacy notice Sensitive Personal Data means Personal Data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, the processing of biometric data for the purpose of uniquely identifying someone, health data, sex life or sexual orientation and Personal Data relating to criminal convictions or offences. 
• Singapore’s PDPA means Singapore’s Personal Data Protection Act 2012. 
• SPDI Rules means India’s Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules 2011. 
• Thailand’s PDPA means Thailand’s Personal Data Protection Act 2019. 
• UK GDPR means the General Data Protection Regulation (EU) 2016/679 as it forms part of the law of the United Kingdom by virtue of section 3 of the European Union (Withdrawal) Act 2018. 
• “UCPA” means the Utah Consumer Privacy Act. 

6. Personal Data we collect

The type of Personal Data we collect about you is set out in the table below in the section entitled ‘Purposes, lawful bases and retention periods’. 

7. How we collect your Personal Data

We collect most of the Personal Data directly from you in person, by telephone, text, video call or email and/or via our website.  We may record our telephone calls and video calls in order to refer back to them at a later date.

However, we may also collect your Personal Data from third parties such as:  

• Job Boards 
• Third Party CV Databases 
• Company Websites 
• General Enquiries 
• Publicly available sources such as social media platforms including but not limited to LinkedIn, Facebook, Github 
• Reputable companies who provide lead generation such as Lusha 
• Reputable companies who provide data enrichment services such as ContactOut and Caypro 
• Referrals/recommendations 
• Referees
• Referencing agencies
• Other organisations within the Empresaria Group
• Our clients
• Intermediaries such as MSPs, umbrella companies and management companies
• Government agencies such as HMRC
• Credit referencing agencies
• Disclosure and Barring Service (DBS) or non-UK equivalent providing criminal record checks 
• Companies House (or non-UK equivalent) 
• Electoral registers 
• Others to whom you have provided consent 

8. Purposes, lawful bases and retention periods

We will only use your Personal Data when the law allows. Most commonly, we will use your Personal Data in the following circumstances:

Where Personal Data is processed because it is necessary for the performance of a contract to which you are a party, we will be unable to provide our services without the required information. 

9. Sharing your Personal Data

Internal Sharing within the Empresaria Group

We may share your Personal Data with other organisations within the Empresaria Group as appropriate in order to provide an efficient service to both our clients and candidates in finding the right candidates for the right the roles. 

Marketing 

In order to deliver our e-newsletters and email campaigns, we use third-party providers.

We will ensure that we have entered into data processing agreements with the third-party providers which means that they can only process your Personal Data in accordance with our instructions and the applicable data protection legislation and they will not be able to use it for their own purposes. 

Authorized Third-Party Providers

We may share Personal Data with third-party providers that provide business services to us or on our behalf, such as IT services, hosting services. Payment information will be used and shared only to process your order and may be stored by a service provider for purposes of future transactions. We prohibit our third-party providers from using or sharing your Personal Data except as necessary to perform the contracted services on our behalf or to comply with applicable legal requirements. 

As mentioned above, we use Google Analytics. For more information about Google Analytics, please visit www.google.com/policies/privacy/partners. You can opt out of Google’s collection and processing of data generated by your use of our services by going to http://tools.google.com/dlpage/gaoptout. 

Please see our cookie policy on our website for more information on our use of cookies and similar technologies. 

Other External Sharing

We may share Personal Data with banks, referencing agencies, DBS, credit referencing agencies and government agencies such as tax an immigration authorities and pension providers.

We may share the personal data of clients with candidates and vice versa. Also, we may (occasionally) share the personal data we collect with others such as professional advisers, insurers etc.

We will only share personal data when it is necessary, fair, lawful, justified and proportionate to do so.

10. International Transfers

Your Personal Data may be transferred to and processed in a country different to that in which you reside. This is because: 

• We share your Personal Data with other organisations within the Empresaria Group, as necessary, some of which are based outside your country of residence 
• Some of the organisations we use to provide our service to you (such as our processors) are based outside your country of residence
• If you are a candidate, we may share your Personal Data with a client based outside your country of residence
• If you are a client, we may share your Personal Data with a candidate outside your country of residence. 

If you are in any country not listed below, we confirm that we take reasonable steps to protect any Personal Data transferred to any countries outside your country of residence and ensure that it is lawful to do so.

If you are in a country which is the subject to US, EU or UK sanctions, we will not knowingly process your Personal Data.

If you are in Australia

We confirm that we will take reasonable steps to protect any Personal Data transferred to any countries outside Australia. 

If you are in China 

We will not transfer your Personal Data to any countries outside China. 

If you are in Chile 

We confirm that we take reasonable steps to protect any Personal Data transferred to any countries outside Chile. 

If you are in the EEA 

We confirm that we take appropriate steps to ensure that any Personal Data transferred outside the EEA has an essentially equivalent level of protection to that guaranteed in the EEA. We do this by ensuring that: 

• Your Personal Data is only processed in a country which the European Commission has confirmed has an adequate level of protection (an adequacy decision); or 
• We enter into Standard Contractual Clauses (“SCCs”) with the receiving organisations and adopt supplementary measures, where necessary. (A copy of the SCCs can be found here Standard Contractual Clauses (SCCs)) . 

If you are in Hong Kong 

We confirm that we take reasonable steps to protect any Personal Data transferred to any countries outside Hong Kong. 

If you are in India 

We confirm that we take reasonable steps to protect any Personal Data transferred to any countries outside India. If the data to be transferred includes 'sensitive personal information or data' as defined under India’s SPDI Rules, we will ensure that the same standards of data protection required in India are adhered to in the destination country, and that the transfer is necessary for the performance of a lawful contract or you have consented to the transfer. Please note that the definition of ‘sensitive personal information or data’ used in the SPDI Rules is different to that listed above in the definitions section of this privacy notice. Under the SPDI Rules ‘sensitive personal information or data’ includes passwords, financial information such as bank account or credit card or debit card information, physical, physiological, and mental health condition, sexual orientation, medical records and history, and biometric information) 

If you are in Indonesia 

We confirm that we take appropriate steps to ensure that any Personal Data transferred outside Indonesia has at least an equivalent level of protection to that guaranteed in Indonesia and if not, we will ensure we obtain adequate and binding protection for the Personal Data or we will obtain your consent. 

If you are in Japan 

We confirm that we take appropriate steps to comply with Japan’s APPI and to protect any Personal Data transferred to any countries outside Japan. 

If you are in Malaysia 

We confirm that we will obtain your consent before transferring your Personal Data outside Malaysia or otherwise ensure that it is lawful to do so, in accordance with Malaysia’s PDPA. 

If you are in New Zealand 

We confirm that we take appropriate steps to protect any Personal Data transferred to any countries outside New Zealand. 

If you are in Peru 

We confirm that we take appropriate steps to ensure that any Personal Data transferred outside Peru has an essentially equivalent level of protection to that guaranteed in Peru or we will obtain your consent for the transfer or ensure that it is otherwise lawful to make the transfer. 

If you are in the Philippines 

We confirm that we take appropriate steps to ensure that any Personal Data transferred to any countries outside the Philippines has a comparable level of protection to that guaranteed in the Philippines. 

If you are in Singapore 

We confirm that we take appropriate steps to ensure that any Personal Data transferred to any countries outside Singapore has a comparable level of protection to that guaranteed in Singapore. 

If you are in Thailand 

We confirm that we will not transfer any Personal Data outside Thailand unless the destination country has an essentially equivalent level of protection to that guaranteed in the Thailand or it is otherwise lawful to do so. 

If you are in the UK 

We confirm that we take appropriate steps to ensure that any Personal Data processed outside the UK has an essentially equivalent level of protection to that guaranteed in the UK. We do this by ensuring that: 

• Your Personal Data is only processed in a country which the Secretary of State has confirmed has an adequate level of protection (an adequacy regulation) or
• We enter into an International Data Transfer Agreement (“IDTA”) with the receiving organisation and adopt supplementary measures, where necessary. (A copy of the IDTA can be found here international-data-transfer-agreement.pdf (ico.org.uk)) 

If you are in the United States of America 

There are no restrictions relating to cross border transfers but we, nonetheless, take appropriate steps to ensure that your Personal Data is suitable protected when it is transferred outside of America. 

If you are in Vietnam

We confirm that we will obtain your consent before transferring your Personal Data outside Vietnam or otherwise ensure that it is lawful to do so. 

11. Your rights and how to complain

You have rights in respect of your Personal Data. The specific rights available to you depend on your country of residence. 

If you are in any country not listed below, we confirm that we will process your Personal Data in accordance with the applicable law.

If you are in a country which is the subject to US, EU or UK sanctions, we will not knowingly process your Personal Data.

To exercise your rights, please contact us using the details set out in the ‘Contact Us’ section below. 

How to exercise your rights

You will not usually need to pay a fee to exercise any of the above rights. However, we may charge a reasonable fee if your request is clearly unfounded or excessive. Alternatively, we may refuse to comply with the request in such circumstances. 

If you wish to exercise your rights, you may contact us using the details set out below within the section called ‘How to contact us and our Data Protection Officer’. We may need to request specific information from you to confirm your identity before we can process your request. Once in receipt of this, we will process your request without undue delay. Complex requests may take some time to process but we will keep you updated.   

Australia

If you live in Australia, we comply with the Australian Privacy Act 1988 (Cth) and you have the following rights in relation to the processing of your Personal Data, including to: 

• Right to be informed 

You have the right to know details such as what personal data we collect about you, who we share it with, how we use it, for what purpose and how long we keep it. We use our privacy notice to explain this. 

• Right of access (commonly known as a “Subject Access Request”) 

You have the right to access and receive a copy of the Personal Data we hold about you. 

• Right to rectification 

You have the right to have any incomplete or inaccurate information we hold about you corrected. 

• Right to object to processing 

You have the right to object to us processing your Personal Data and to stop receiving unwanted direct marketing. 

• Right to withdraw consent 

If you have provided your consent for us to process your Personal Data for a specific purpose, you have the right to withdraw your consent at any time. If you do withdraw your consent, we will no longer process your information for the purpose(s) you originally agreed to, unless we are permitted by law to do so. 

• Right to complain 

You have the right to complain about us to the Office of the Australian Information Commissioner (“OAIC”), if you think we have mishandled your Personal Data whose contact details are: Contact us - Home (oaic.gov.au) 

China 

If you live in China, we comply with China’s Personal Information Protection Law (“PIPL”). 

You have the following rights in relation to the processing of your Personal Data, including to: 

• Right to be informed 

You have the right to know details such as what personal data we collect about you, who we share it with, how we use it, for what purpose and how long we keep it. We use our privacy notice to explain this. 

• Right of access (commonly known as a “Subject Access Request”) 

You have the right to access and receive a copy of the Personal Data we hold about you. 

• Right to rectification 

You have the right to have any incomplete or inaccurate information we hold about you corrected. 

• Right to erasure (commonly known as the right to be forgotten) 

You have the right to ask us to delete or de-identify your Personal Data. 

• Right to object to processing 

You have the right to object to us processing your Personal Data. 

• Right to restrict processing 

You have the right to restrict our use of your Personal Data. 

• Right to portability 

You have the right to ask us to transfer your Personal Data to another party. 

• Automated decision-making. 

You have the right not to be subject to a decision based solely on automated processing which will significantly affect you. We may use software to screen CVs and search applications for key words. You have the right to object to this if you consider that your CV or application has been unfairly rejected as a result of the automated decision-making.

• Right to withdraw consent 

If you have provided your consent for us to process your Personal Data for a specific purpose, you have the right to withdraw your consent at any time. If you do withdraw your consent, we will no longer process your information for the purpose(s) you originally agreed to, unless we are permitted by law to do so. 

Complaints

If you are concerned about the way in which we are handling your Personal Data, you can complain to the Cyberspace Administration of China, relevant State Council departments or relevant departments of local governments. 

Chile 

If you live in Chile, we comply with Chile’s Protection of Private Life Law 19, 628/1999. 

You have the following rights in relation to the processing of your Personal Data, including to: 

• Right to be informed 

You have the right to know details such as what personal data we collect about you, who we share it with, how we use it, for what purpose and how long we keep it. We use our privacy notice to explain this. 

• Right of access (commonly known as a “Subject Access Request”) 

You have the right to access and receive a copy of the Personal Data we hold about you. 

• Right to rectification 

You have the right to have any incomplete or inaccurate information we hold about you corrected. 

• Right to blocking 

You have the right to ask us to block your Personal Data. 

• Right to cancellation or elimination of processing 

You have the right to cancellation or elimination of your Personal Data. 

• Right to erasure (commonly known as the right to be forgotten) 

You have the right to ask us to erase your Personal Data. 

If you are in Hong Kong 

If you live in Hong Kong, we comply with the Personal Data (Privacy) Ordinance (Cap.486) (“PDPO”)   

You have the following rights in relation to the processing of your Personal Data: 

• Right to be informed 

You have the right to know details such as what personal data we collect about you, who we share it with, how we use it, for what purpose and how long we keep it. We use our privacy notice to explain this. 

• Right of access (commonly known as a “Subject Access Request”) 

You have the right to access and receive a copy of the Personal Data we hold about you. 

• Right to rectification 

You have the right to have any incomplete or inaccurate information we hold about you corrected. 

• Right to cease using your Personal Data for marketing 

You have the right to ask us to stop using your Personal Data for marketing purposes. 

Complaints 

If you are concerned about the way in which we are handling your Personal Data, you can contact the supervisory authority for Hong Kong whose contact details are: 

Office of the Privacy Commissioner for Personal Data (the “Privacy Commissioner”) 

Room 1303, 13/F, Dah Sing Financial Centre, 248 Queen's Road East

Wanchai, Hong Kong. 

Telephone: +852 2827 2827 

If you are in India 

If you live in India, we comply with the Information Technology Act 2000 (“IT Law”), the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules 2011 (“SPDI Rules”) and all other relevant legislation. 

You have the following rights in relation to the processing of your Personal Data, including to: 

• Right to be informed 

You have the right to know details such as what personal data we collect about you, who we share it with, how we use it, for what purpose and how long we keep it. We use our privacy notice to explain this. 

• Right of access (commonly known as a “Subject Access Request”) 

You have the right to access and receive a copy of the Personal Data we hold about you. 

• Right to rectification 

You have the right to have any incomplete or inaccurate information we hold about you corrected. 

• Right to erasure (commonly known as the right to be forgotten) 

You have the right to ask us to delete or de-identify your Personal Data. 

• Right to withdraw consent 

If you have provided your consent for us to process your Personal Data for a specific purpose, you have the right to withdraw your consent at any time. If you do withdraw your consent, we will no longer process your information for the purpose(s) you originally agreed to, unless we are permitted by law to do so. 

Complaints 

If you are concerned about the way in which we are handling your Personal Data, you can seek clarification from the MEIT (Ministry of Electronics and Information Technology). 

If you are in Indonesia 

 If you live in Indonesia, you have the following rights under Regulation No.20 of 2016 on Personal Data Protection in Electronic Systems (“Kominfo Regulation 20”) 

• Right to be informed 

You have the right to know details such as what personal data we collect about you, who we share it with, how we use it, for what purpose and how long we keep it. We use our privacy notice to explain this. 

• Right of access (commonly known as a “Subject Access Request”) 

You have the right to access and receive a copy of the Personal Data we hold about you. 

• Right to rectification 

You have the right to have any incomplete or inaccurate information we hold about you corrected. 

• Right to erasure (commonly known as the right to be forgotten) 

You have the right to ask us to delete or de-identify your Personal Data. 

• Right to object 

You have the right to object to us processing your Personal Data in certain circumstances. 

Complaints 

The data protections laws pertaining to data held electronically are mainly enforced by the Ministry of Communication and Information

("Menkominfo"). 

Jl. Medan Merdeka Barat No. 9, 
Jakarta 10110, 
Indonesia 

https://kominfo.go.id

If you are in Japan

If you live in Japan, we comply with the Act on the Protection of Personal Information (Act No. 57 of 2003 as amended in 2020) (“APPI”). 

You have the following rights in relation to the processing of your Personal Data, including to: 

• Right to be informed 

You have the right to know details such as what personal data we collect about you, who we share it with, how we use it, for what purpose and how long we keep it. We use our privacy notice to explain this. 

• Right of access (commonly known as a “Subject Access Request”) 

You have the right to access and receive a copy of the Personal Data we hold about you. 

• Right to rectification 

You have the right to have any incomplete or inaccurate information we hold about you corrected. 

• Right to erasure (commonly known as the right to be forgotten) 

You have the right to ask us to delete or de-identify your Personal Data. 

• Right to cease processing 

You have the right to request that we cease processing your Personal Data. 

Complaints 

If you are concerned about the way in which we are handling your Personal Data, you can contact the Personal Information Protection Commission for Japan whose contact details are: 

Personal Information Protection Commission

Kasumigaseki Common Gate West Tower 32nd Floor,

3-2-1, Kasumigaseki,

Chiyoda-ku,

Tokyo, 100-0013,

Japan 

TEL: +81-(0)3-6457-9680 

www.ppc.go.jp

If you are in Malaysia

If you live in Malaysia, we comply with Malaysia’s Personal Data Protection Act (“Malaysia’s PDPA”). 

You have the following rights in relation to the processing of your Personal Data, including to: 

• Right to be informed 

You have the right to know details such as what personal data we collect about you, who we share it with, how we use it, for what purpose and how long we keep it. We use our privacy notice to explain this. 

• Right of access (commonly known as a “Subject Access Request”) 

You have the right to access and receive a copy of the Personal Data we hold about you. 

• Right to correction 

You have the right to have any incomplete or inaccurate information we hold about you corrected. 

• Right to object 

You have the right to object to us processing your Personal Data for direct marketing purposes. 

• Right to prevent processing 

You have the right to prevent processing likely to cause damage or distress. 

• Right to withdraw consent 

If you have provided your consent for us to process your Personal Data for a specific purpose, you have the right to withdraw your consent at any time. If you do withdraw your consent, we will no longer process your information for the purpose(s) you originally agreed to, unless we are permitted by law to do so. 

• Right to complain 

You have the right to complain to the to the Personal Data Protection Commissioner (“PDP Commissioner”) for Malaysia if the data user does not cease processing your Personal Data for direct marketing purposes following your request. The PDP Commissioner contact details are: 

Aras 6, Kompleks Kementerian Komunikasi dan Multimedia 
Lot 4G9, Persiaran Perdana, Presint 4, 
Pusat Pentadbiran Kerajaan Persekutuan, 
62100 Putrajaya, 
Malaysia 

www.pdp.gov.my 



If you are in New Zealand

If you live in the New Zealand, we comply with New Zealand’s Privacy Act 2020. 

You have the following rights in relation to the processing of your Personal Data, including to: 

• Right to be informed 

You have the right to know details such as what personal data we collect about you, who we share it with, how we use it, for what purpose and how long we keep it. We use our privacy notice to explain this. 

• Right of access (commonly known as a “Subject Access Request”) 

You have the right to access and receive a copy of the Personal Data we hold about you. 

• Right to rectification 

You have the right to have any incomplete or inaccurate information we hold about you corrected. 

Complaints 

If you are concerned about the way in which we are handling your Personal Data, you can contact the Office of the Privacy Commissioner of New Zealand (OPC”) whose contact details are: 

Office of the Privacy Commissioner 
Level 8, 
109-111 Featherston Street,
Wellington 6143 

www.privacy.org.nz 

If you are in Peru

If you live in Peru, we comply with the PDPL and you have the following rights in relation to the processing of your Personal Data: 

• Right to be informed 

You have the right to know details such as what personal data we collect about you, who we share it with, how we use it, for what purpose and how long we keep it. We use our privacy notice to explain this. 

• Right of access (commonly known as a “Subject Access Request”) 

You have the right to access and receive a copy of the Personal Data we hold about you. 

• Right to rectification 

You have the right to have any incomplete or inaccurate information we hold about you corrected. 

• Right to erasure (commonly known as the right to be forgotten) 

You have the right to ask us to delete or de-identify your Personal Data. 

• Right to object to processing 

You have the right to object to us processing your Personal Data. 

• Right to portability 

You have the right to ask us to transfer your Personal Data to another party. 

• Automated decision-making. 

You have the right not to be subject to a decision based solely on automated processing which will significantly affect you. We may use software to screen CVs and search applications for key words. You have the right to object to this if you consider that your CV or application has been unfairly rejected as a result of the automated decision-making. 

• Right to withdraw consent 

If you have provided your consent for us to process your Personal Data for a specific purpose, you have the right to withdraw your consent at any time. If you do withdraw your consent, we will no longer process your information for the purpose(s) you originally agreed to, unless we are permitted by law to do so. 

• Right to complain 

If you are concerned about the way in which we are handling your Personal Data, you have the right to complain to the National Data Protection Authority within the Ministry of Justice. 

If you are in the Philippines

If you live in the Philippines, we comply with the Data Privacy Act of 2012 (Republic Act No. 10173) (“DPA”). 

You have the following rights in relation to the processing of your Personal Data, including to: 

• Right to be informed 

You have the right to know details such as what personal data we collect about you, who we share it with, how we use it, for what purpose and how long we keep it. We use our privacy notice to explain this. 

• Right of access (commonly known as a “Subject Access Request”) 

You have the right to access and receive a copy of the Personal Data we hold about you. 

• Right to rectification 

You have the right to have any incomplete or inaccurate information we hold about you corrected. 

• Right to erasure (commonly known as the right to be forgotten) 

You have the right to ask us to delete or de-identify your Personal Data. 

• Right to object to processing 

You have the right to object to us processing your Personal Data. 

• Right to portability 

You have the right to ask us to transfer your Personal Data to another party. 

• Automated decision-making

You have the right not to be subject to a decision based solely on automated processing which will significantly affect you. We may use software to screen CVs and search applications for key words. You have the right to object to this if you consider that your CV or application has been unfairly rejected as a result of the automated decision-making.   

• Right to complain 

You have the right to complain to the relevant supervisory authority, if you are concerned about the way in which we are handling your Personal Data. 

The National Privacy Commission is the supervisory authority for the Philippines. They can be contacted at:

5^th Floor, Delegation Building 

PICC Complex, 

Roxas Boulevard, Manila 

Metro Manila 

www.privacy.gov.ph

If you are in Singapore

If you live in Singapore, we comply with Singapore’s Personal Data Protection Act 2012 (“Singapore’s PDPA”) 

You have the following rights in relation to the processing of your Personal Data, including to: 

• Right to be notified 

You have the right to be notified of the purpose for which we intend to collect, use, or disclose your Personal Data and you are also entitled to be provided with information about the ways in which your Personal Data has been used or disclosed during the past year. 

• Right of access (commonly known as a “Subject Access Request”) 

You have the right to access and receive a copy of the Personal Data we hold about you. 

• Right to rectification 

You have the right to have any incomplete or inaccurate information we hold about you corrected. 

• Right to withdraw consent 

If you have provided your consent for us to process your Personal Data for a specific purpose, you have the right to withdraw your consent at any time. If you do withdraw your consent, we will no longer process your information for the purpose(s) you originally agreed to, unless we are permitted by law to do so. 

Complaints 

If you are concerned about the way in which we are handling your Personal Data, you can contact the Personal Data Protection Commission for Singapore whose contact details are: 

The Personal Data Protection Commission 
10 Pasir Panjang Road #03-01 
Mapletree Business City 
Singapore 
117438 

www.pdpc.gov.sg

The Infocomm Media Development Authority of Singapore supports the Commission in administering compliance with the PDPA. 

Thailand, United Kingdom and European Union

If you live in Thailand, we comply with Thailand’s Personal Data Protection Act 2019 (“Thailand’s PDPA”). 

If you live in the UK, we comply with the UK General Data Protection Regulation (“UK GDPR”). 

If you live in the EU, we comply with the EU General Data Protection Regulation (“EU GDPR”). 

You have the following rights in relation to the processing of your Personal Data, including to: 

• Right to be informed 

You have the right to know details such as what personal data we collect about you, who we share it with, how we use it, for what purpose and how long we keep it. We use our privacy notice to explain this. 

• Right of access (commonly known as a “Subject Access Request”) 

You have the right to access and receive a copy of the Personal Data we hold about you. 

• Right to rectification 

You have the right to have any incomplete or inaccurate information we hold about you corrected. 

• Right to erasure (commonly known as the right to be forgotten) 

You have the right to ask us to delete or de-identify your Personal Data. 

• Right to object to processing 

You have the right to object to us processing your Personal Data. 

• Right to restrict processing 

You have the right to restrict our use of your Personal Data. 

• Right to portability 

You have the right to ask us to transfer your Personal Data to another party. 

• Automated decision-making

You have the right not to be subject to a decision based solely on automated processing which will significantly affect you. We may use software to screen CVs and search applications for key words. You have the right to object to this if you consider that your CV or application has been unfairly rejected as a result of the automated decision-making. 

• Right to withdraw consent 

If you have provided your consent for us to process your Personal Data for a specific purpose, you have the right to withdraw your consent at any time. If you do withdraw your consent, we will no longer process your information for the purpose(s) you originally agreed to, unless we are permitted by law to do so. 

• Right to complain 

You have the right to complain to the relevant supervisory authority, if you are concerned about the way in which we are handling your Personal Data. 

Thailand’s national supervisory authority is the Personal Data Protection Committee who can be contacted at: 

7^th Floor, Ratthaprasasanabhakti Building 
Government Complex 
Chaengwattana Road 
Thung Song Hong Sub-District, Lak Si District 
Bangkok, Thailand 10210 

www.mdes.go.th/mission/82 

E-mail: pdpc@mdes.go.th 

Tel: +662-142-1033 and +662-141-6993 

The UK’s supervisory authority is the Information Commissioner’s Office who can be contacted online at: 

Contact us | ICO 

Or by telephone on 0303 123 1113 

For EU supervisory authorities see the link below: 

https://edpb.europa.eu/about-edpb/about-edpb/members_en 

If you are in the United States of America 

If you are in California

If you live in California, you have the following rights under the California Consumer Privacy Act (“CCPA”), as amended by the California Privacy Rights Act (“CPRA”). 

The CCPA (as amended) provides California residents certain rights related to their Personal Data, namely:

• Right to know 

You have the right to know details such as what Personal Data we collect about you, who we share it with, how we use it, for what purpose and how long we keep it. We use our privacy notice to explain this. 

• Right of access (commonly known as a “Subject Access Request”) 

You have the right to access and receive a copy of the Personal Data we hold about you. 

• Right to rectification 

You have the right to have any incomplete or inaccurate information we hold about you corrected. 

• Right to erasure (commonly known as the right to be forgotten) 

You have the right to ask us to delete or de-identify your Personal Data. 

• Right to object 

You have the right to object to the sale of your Personal Data. 

• Right to restrict processing 

You have the right to request that we limit the use and disclosure of Personal Data that we have about you which is sensitive (as defined in the CPRA). 

• Rights regarding the sale and sharing of your Personal Data 

You have the right to know whether we sell your Personal Data and whether we disclose your data to anyone. 

• Right against discrimination 

You have the right not to be discriminated against for exercising your privacy rights. 

• Right to portability 

You have the right to ask us to transfer your Personal Data to another party. 

We do not sell or disclose your Personal Data for monetary gain or any valuable consideration.

The Personal Data we collect about you is set out above under ‘Personal Data we collect’. 

Complaints 

If you are concerned about the way in which we are handling your Personal Data, you can submit a complaint to your supervisory authority, the California Privacy Protection Agency who can be contacted online at: 

California Privacy Protection Agency (CPPA) 

Contact Us - California Privacy Protection Agency (CPPA) 

If you are in Virginia 

If you live in Virginia, from 1^st January 2023 you have the following rights under the Consumer Data Protection Act (“CDPA”): 

• Right to be informed 

You have the right to know details such as what personal data we collect about you, who we share it with, how we use it, for what purpose and how long we keep it. We use our privacy notice to explain this. 

• Right of access (commonly known as a “Subject Access Request”) 

You have the right to access and receive a copy of the Personal Data we hold about you. 

• Right to rectification 

You have the right to have any incomplete or inaccurate information we hold about you corrected. 

• Right to erasure (commonly known as the right to be forgotten) 

You have the right to ask us to delete or de-identify your Personal Data. 

• Right to opt out 

You have the right to opt out of us processing your Personal Data for the purposes of targeted advertising and the sale your Personal Data. 

• Right to portability 

You have the right to ask us to transfer your Personal Data to another party. 

• Automated decision-making

You have the right not to be subject to a decision based solely on automated processing which will significantly affect you. We may use software to screen CVs and search applications for key words. You have the right to object to this if you consider that your CV or application has been unfairly rejected as a result of the automated decision-making.   

• Right not to be discriminated against for exercising your rights. 

• Right to appeal if we refuse to process your request to exercise your rights. 

Complaints 

If you are concerned about the way in which we are handling your Personal Data, you can submit a complaint to the Office of the Attorney General for Virginia who can be contacted at:

202 North Ninth Street 

Richmond 

VA 23219 

Phone: (804) 786-2071 

Email: oag@oag.state.va.us 

If you are in Colorado 

If you live in Colorado, from 1^st July 2023 you have the following rights under the Colorado Privacy Act (“CPA”): 

• Right to be informed 

You have the right to know details such as what personal data we collect about you, who we share it with, how we use it, for what purpose and how long we keep it. We use our privacy notice to explain this. 

• Right of access (commonly known as a “Subject Access Request”) 

You have the right to access and receive a copy of the Personal Data we hold about you. 

• Right to rectification 

You have the right to have any incomplete or inaccurate information we hold about you corrected. 

• Right to erasure (commonly known as the right to be forgotten) 

You have the right to ask us to delete or de-identify your Personal Data. 

• Right to opt out 

You have the right to opt out of us processing your Personal Data for the purposes of targeted advertising and for the sale of your Personal Data. 

• Right to portability 

You have the right to ask us to transfer your Personal Data to another party. 

• Automated decision-making

You have the right not to be subject to a decision based solely on automated processing which will significantly affect you. We may use software to screen CVs and search applications for key words. You have the right to object to this if you consider that your CV or application has been unfairly rejected as a result of the automated decision-making.   

• Right not to be discriminated against for exercising your rights. 

• Right to appeal if we refuse to process your request to exercise your rights. 

Complaints 

If you are concerned about the way in which we are handling your Personal Data, you can submit a complaint to the Office of the Attorney General for Colorado who can be contacted at: 

https://coag.gov

Department of Law 

Ralph L. Carr Judicial Building 

1300 Broadway 

10^th Floor Denver 

CO 80203 

Phone: +1 720-508-6000 

If you are in Connecticut 

If you live in Connecticut, from 1^st July 2023 you have the following rights under the Connecticut Act Concerning Personal Data Privacy and Online Monitoring (“CTDPA”): 

• Right to be informed 

You have the right to know details such as what personal data we collect about you, who we share it with, how we use it, for what purpose and how long we keep it. We use our privacy notice to explain this. 

• Right of access (commonly known as a “Subject Access Request”) 

You have the right to access and receive a copy of the Personal Data we hold about you. 

• Right to rectification 

You have the right to have any incomplete or inaccurate information we hold about you corrected. 

• Right to erasure (commonly known as the right to be forgotten) 

You have the right to ask us to delete or de-identify your Personal Data. 

• Right to opt out 

You have the right to opt out of us processing your Personal Data for the purpose of targeted advertising and the sale of your Personal Data. 

• Right to portability 

You have the right to ask us to transfer your Personal Data to another party. 

• Automated decision-making

You have the right not to be subject to a decision based solely on automated processing which will significantly affect you. We may use software to screen CVs and search applications for key words. You have the right to object to this if you consider that your CV or application has been unfairly rejected as a result of the automated decision-making.   

• Right not to be discriminated against for exercising your rights. 

• Right to appeal if we refuse to process your request to exercise your rights. 

Complaints 

If you are concerned about the way in which we are handling your Personal Data, you can submit a complaint to the Office of the Attorney General for Connecticut who can be contacted at: 

Connecticut Office of the Attorney General 

165 Capitol Avenue 
Hartford, CT 06106 

Email: Attorney.General@ct.gov  

Phone: 860-808-5318. 

If you are in Utah 

If you live in Utah, from 31^st December 2023 you have the following rights under the Utah Consumer Privacy Act (“UCPA”): 

• Right to be informed 

You have the right to know details such as what personal data we collect about you, who we share it with, how we use it, for what purpose and how long we keep it. We use our privacy notice to explain this. 

• Right of access (commonly known as a “Subject Access Request”) 

You have the right to access and receive a copy of the Personal Data we hold about you. 

• Right to erasure (commonly known as the right to be forgotten) 

You have the right to ask us to delete or de-identify your Personal Data. 

• Right to opt out to processing 

You have the right to opt out of us processing your Personal Data for the purposes of targeted advertising or sale of Personal Data. 

• Right to portability 

You have the right to ask us to transfer your Personal Data to another party. 

• Automated decision-making.

You have the right not to be subject to a decision based solely on automated processing which will significantly affect you. We may use software to screen CVs and search applications for key words. You have the right to object to this if you consider that your CV or application has been unfairly rejected as a result of the automated decision-making.   

• Right not to be discriminated against for exercising your rights. 

Complaints 

If you are concerned about the way in which we are handling your Personal Data, you can submit a complaint to the Office of the Attorney General for Utah who can be contacted at: 

Consumer Protection (utah.gov) 

Phone: 

(801) 530-6601 

Toll-Free in UT: 

(800) 721-7233 

Email: 

consumerprotection@utah.gov 

Mailing Address: 

PO Box 146704 
Salt Lake City, UT 84114-6704 

Physical Address: 

160 East 300 South 
Salt Lake City, UT 84111 

If you are in Vietnam

If you live in the Vietnam, we comply with the Law on Cyber Information Security No.86/2015/QH13 (19 November 2015) (“LCS”) and all other applicable Vietnamese laws on data protection. 

You have the following rights in relation to the processing of your Personal Data, including to: 

• Right to be informed 

You have the right to know details such as what personal data we collect about you, who we share it with, how we use it, for what purpose and how long we keep it. We use our privacy notice to explain this. 

• Right of access (commonly known as a “Subject Access Request”) 

You have the right to access and receive a copy of the Personal Data we hold about you. 

• Right to rectification 

You have the right to have any incomplete or inaccurate information we hold about you corrected. 

• Right to erasure (commonly known as the right to be forgotten) 

You have the right to ask us to delete your Personal Data. 

• Right to object / opt-out 

You have the right ask us to stop providing your Personal Data to a third party. 

Complaints 

If you are concerned about the way in which we are handling your Personal Data, you can contact the Ministry of Information and Communications for Vietnam whose contact details are: 

Ministry of Information and Communications 

18 Nguyen Du Street 
Hang Bai Ward

Hoan Kiem District 
Hanoi 
Vietnam 

english.mic.gov.vn

12. Children’s Privacy

We do not offer our services to children and we do not knowingly collect Personal Data of children without parental consent, unless permitted by law. 

13. How to contact us and our Data Protection Officer 

If you wish to contact us or our Data Protection Officer (“DPO”) in relation to this privacy notice or if you wish to exercise any of your rights outlined above, please contact us as follows: 

FAO the ‘Data Protection Officer’, Old Church House, Sandy Lane, Crawley Down, Crawley, West Sussex, England RH10 4HS.

Email dataprotection@empresaria.com 

Please mark your communications FAO the ‘Data Protection Officer’.

14. Changes to this privacy notice

We may update this notice (and any supplemental privacy notice), from time to time as shown below. We will notify of the changes where required by applicable law to do so. 



Last modified April 2024 

Previous versions of this notice are available upon request as per the contact details above.

If you wish to exercise any of the rights set out above, please contact us at dataprotection@empresaria.com