Processing of Client’s Personal Data
1. Contact Details of the Data Controller
Data Controller
W EXECUTIVE UK LIMITED (W Executive)
Company Number: 15207872
Registered office: Mappin House, 4 Winsley Street, London, United Kingdom, W1W 8HF
Email: privacy@wexecutive.uk
EU Legal Representative under Art. 27 GDPR
W EXECUTIVE SRL
Registered Office:
Email: privacy@wexecutive.it
2. Categories of Personal Data We Use
We process your identification data, such as first name, surname, place and date of birth, tax code, VAT, your company, phone contacts and e-mail address, job title, role.
We may collect the data directly from you through phone calls, e-mails, fax, in person meetings, collection forms you fill in on our website or from other sources, such as your company’s website, third parties, professional social networks or other public domain sources within the limit of this privacy notice.
3. Why We Use Your Data and Data Retention Period
3.1 Establishing and Managing Commercial Relationships
Why we use your data
To establish and manage commercial relationship with you or your organisation.
Legal conditions for processing
The processing is necessary for the performance of the contract or in order to take steps prior to entering into the contract.
Data retention period
For the duration of the contract and for the following 6 years. An extra time (of maximum 12 months) necessary to delete the data from our database may be added.
3.2 Establishing, Exercising or Defending Legal Claims
Why we use your data
To establish, exercise or defend legal claims.
Legal conditions for processing
The legitimate interest of the Company to protect and defend its rights.
Data retention period
For the time necessary for the establishment, exercise, or defence of legal claims.
3.3 Fulfilling Legal Obligations
Why we use your data
To fulfil our obligations under the applicable tax and civil laws.
Legal conditions for processing
Compliance with legal obligations to which the Controller is subject.
Data retention period
For 6 years as of the end of the concerned business year. An extra time (of maximum 12 months) necessary to delete the data from our database may be added.
3.4 Contacting Prospective Clients and Marketing Our Services
Why we use your data
To contact you and find out if you are interested in our services. We can:
- Send direct marketing communications concerning our services and initiatives through email, text messages, picture messages, video messages, direct messages via social media (electronic mail marketing purposes).
Legal conditions for processing
If you are a business contact representing your organisation (company, limited liability partnership, Scottish partnership, any other entity that is a legal person distinct from its members) we can contact you on the basis of our legitimate interest in contacting prospect business clients in order to establish commercial relationships with them.
You can object to this processing at the moment of the collection or later, at any moment, by contacting us at our email address or by using the unsubscribe option in the email you receive.
If you are an individual (sole trader, non-limited liability partnership) the legal basis is your consent.
Data retention period
If you are a business contact representing your organisation, we will hold your data until you object to the processing.
If you are an individual, we will hold your data for 24 months unless you withdraw your consent before.
3.5 Marketing Communications to Existing Clients
Why we use your data
To send you marketing communications about services similar to what you have already purchased (soft opt-in).
Legal conditions for processing
Our legitimate interest to promote our services towards previous clients.
You can object to the processing of your data for this purpose at the moment of the collection and then at any time, by choosing the “unsubscribe” option within the communication you receive.
Data retention period
We will hold your data for 24 months starting from your purchase.
3.6 Deletion of Personal Data
After the above-mentioned retention periods have expired, all data stored in our database will be deleted.
4. Your Obligations to Provide the Data
The provision of data related to the management of the contractual relationship and to the compliance with legal obligations is mandatory. If you do not provide us with the data we ask for, we cannot be able to provide you with our services.
Consent for marketing purposes for individual is optional. If you do not consent to receive our promotional communication you will not be informed about our services, events and other initiatives.
You can always object to the processing of your data for direct marketing.
5. Categories of Data Recipients
The Company is part of a Group of companies. We may share your personal data with other Group’s companies for administrative and organisational purposes, based on our legitimate interest in managing the group’s clients within the group’s companies.
We can communicate the data to our service providers or other group companies which carry out some services on our behalf (such as software and hardware providers, website providers, and other IT services providers) as data processors in accordance with a data processing agreement.
We can communicate the data to other public or private bodies whenever we are obliged to do so, in response to orders or requests from a court, regulators, government agencies or public authorities, or to comply with other law or regulatory requirements.
6. Transfer of Data
We are based in UK, and we rely on an IT infrastructure located in the European Union. However, some of our suppliers (IT services) when provide some services can operate outside of the European Economic Area (“EEA”) and Switzerland, such as in the US, and have access to the data from outside the EEA.
In these cases, data is transferred only in the presence of the safeguards indicated in the applicable data protection legislation. In particular, the transfer will take place:
- To destination countries for which the UK Government and the European Commission have issued an adequacy decision (art. 45 GDPR and UK GDPR) or
- On the basis of the International Data Transfer Addendum to the EU Commission Standard contractual clauses (“SCCs”) (art. 46 GDPR and UK GDPR), provided that supplementary security measures are also in place.
For further information about the data transfers, you can contact our DPO at privacy@wexecutive.uk.
7. Rights of Data Subjects
Under the GDPR and the UK GDPR:
You have the right to access your data and to modify or correct your data.
You can obtain the erasure of personal data and the restriction of the processing when certain conditions are met.
You have the right to receive a copy of your personal data in a structured, commonly used and machine-readable format or ask Us to transmit that data to another controller, where technically feasible, if the processing is based on consent or on a contract and is carried out by automated means.
You have the right to withdraw the consent you have given at any time, without affecting the lawfulness of the processing carried out before the withdrawal.
You can always object to the processing of your personal data for direct marketing purposes and, on grounds relating to your particular situation, you can also object to the processing of your personal data based on the legitimate interest of the controller.
If you wish to exercise one of these rights, you can contact our DPO at privacy@wexecutive.uk
You can lodge a complaint with the data protection authority of your country if you believe that your rights have been breached. For the UK you can contact the Information Commissioner’s Office at https://ico.org.uk.
Additional text included in the PDF
The PDF also contains the following declarations and form wording after Section 7. These are reproduced separately because they appear intended for signature forms and marketing-consent checkboxes, rather than the body of a website privacy notice.
Privacy Notice Acknowledgement
I have read the privacy notice on the processing of my personal data.
Place: _________________________
Date: //____
Name and surname: _________________________
Signature: _________________________
Individual’s Consent for Marketing Purposes
I have read the information on the processing of personal data and, being aware that my consent is optional and that I have the right to withdraw it at any time, as regards the processing of my personal data by W EXECTUIVE UK for marketing purposes as set out in the privacy notice.
- ☐ I consent
- ☐ I refuse
Objection to Marketing Communications for Business Contacts
- ☐ I do not want to receive electronic marketing communications
Online Form
- ☐ I have read the privacy notice
- ☐ I consent to the processing of my personal data for sending promotional communication (marketing purposes). (optional)
- ☐ I do not want to receive electronic marketing communications
How Do We Manage Your Data?
We would like to inform you that to enhance our selection’s activities we can rely on an advanced automatic system which enables us to select from the data base, through key words, our candidates’ profiles which suit for the position searched.
Hence, we get a filtered selection of the information provided by the candidates, based on parameters such as, knowledges, education, job title, availability, which identifies a list of profiles suitable for the working position.
This is just a first step, we do not take decisions based solely on automated processing since there is always the human intervention of the recruiters who verifies this process and can evaluate other candidates’ profiles.
This tool allows us to enhance and make more efficient our selection’s process, and to provide an innovative service for our candidates and clients.
To enhance our activity, when we receive a large number of applications, we use a tool within our database, an intelligent search which enables us to filter through CVs, entering relevant key words such as field of practice, role, years of experience. It then analyses all the CVs uploaded into it and delivers a smaller pool of candidates by matching the key words in candidates’ CVs. We do not take decisions based solely on automated processing; there is always human intervention, so there is always a recruiter who verifies this process.