General Applicant Privacy PolicY

This Policy sets out the basis on which any personal data collected by DataFlow Services FZ LLC (hereafter, “DataFlow”, “we” or “us”) from you, or that you provide to us, will be handled, processed, used and transferred by us. We are committed to protecting and respecting your privacy when we collect, handle, process, use and transfer your personal data. DataFlow is the controller of your personal data. The contact details of DataFlow and its Data Security Officer can be found in the “Contact” section below.

We collect, use and are responsible for certain personal data about you.

When we collect data about you, we are subject to applicable data protection laws in the United Arab Emirates, and the UK General Data Protection Regulation (UK GDPR) if you are in the United Kingdom (UK). We are also subject to the EU General Data Protection Regulation (EU GDPR) in relation to services we offer to applicants in the European Economic Area (EEA). In this Policy a reference to the GDPR is to the UK or EU GDPR as applicable based on your location.

Please read this Policy carefully to understand our views and practices regarding your personal data and how we will treat it. It also explains your rights in relation to your personal data and how to contact us or supervisory authorities in the event you have a complaint and are an applicant in the UK or the EEA.

We may collect and process the following data about you:

• Information that you provide by filling in authorisation forms (online or in physical format) through our clients when we provide services to them or directly to Us including your full name, passport details, national ID details, email address, address, telephone number, Pearson VUE registration ID, staff number/employee code, seat/roll/hall ticket number, registration/enrolment/licence number, bank account details/receipt number and any personal information contained within any scanned or photographed documentation you provide to Us, such as your gender and date of birth.

• Any information you provide when you contact Us. With regard to each of your visits to the DataFlow Corporate website we will automatically collect the information set out in our cookie policy.

To the extent permitted by applicable laws, by providing any of your personal data detailed above to us, you expressly consent to our use of such personal data for the purposes of providing you with our services. The collection of the abovementioned personal data is mandatory for us to provide our verifications services. If you do not provide the personal data, we will not be able to provide you with our services.

We will not process your personal data in a manner that is inconsistent with the collection purpose except where we are permitted to do so by applicable law.

It is important that the personal data we hold about you is accurate and current. Please keep us informed if your personal data changes during your relationship with us.

We collect most of this personal data directly from you—in person, by telephone, text messaging systems (such as SMS or WhatsApp) or email and/or via our website and app. However, we may also collect information:

• directly from a third party (including publicly accessible sources), eg:

  • sanctions screening providers;

  • criminal records databases (e.g. INTERPOL, US Court Records);

  • credit reference agencies;

  • customer due diligence providers;

  • news and media data aggregation services such as Thomsons, Reuters, Factiva, Dow Jones;

  • local councils, city halls and public records archives;

• from a third party with your consent, eg former employers, educational institutions, professional bodies etc that you listed on your application form;

• from cookies on our website—for more information on our use of cookies, please see our cookie policy.

Where we need to collect personal data by law, or under the terms of a contract we have with you and you fail to provide that data when requested, we may not be able to perform the contract we have or are trying to enter into with you. In this case, we may have to cancel a product or service you have with us but we will notify you if this is the case at the time.

We can only use your personal data if we have a proper reason, e.g.:

• where you have given consent;

• to comply with our legal and regulatory obligations;

• for the performance of a contract with you or to take steps at your request before entering into a contract; or

• for our legitimate interests or those of a third party, where permitted by applicable laws.

A legitimate interest is when we have a business or commercial reason to use your information, so long as this is not overridden by your own rights and interests. We will carry out an assessment when relying on legitimate interests, to balance our interests against your own.

The table below explains what we use your personal data for and why.

Where we process special category personal data or personal data relating to criminal convictions and offences or related security measures, we will also ensure we are permitted to do so under applicable data protection laws, such as:

• we have your explicit consent;

• the processing is necessary to establish, exercise or defend legal claims; or

• the processing is necessary in the substantial public interest, for example (in the case of criminal conviction or similar information) to protect the public against dishonesty, malpractice or other seriously improper conduct or unfitness or incompetence.

If you would like more information about the lawful basis on which we process these kinds of data and the ways we use and store it, please see our associated policy.

To facilitate the purposes set out above, we may transfer, disclose, grant access to or share your personal data (whether within or outside the countries we operate) with:

• Any other companies in our Group, including, without limitation, CrossCheck Private Limited in connection with our CrossCheck service referred to above;

• Professional advisers including lawyers, bankers, auditors and insurers;

• Regulators and other authorities such as the licensing authority or visa processing agency to whom you may have applied to initially which required the support of the DataFlow process in order to complete your application, who require reporting of processing activities in certain circumstances;

• In the event that we are involved in a bankruptcy, merger, acquisition, reorganisation or sale of assets, in which case your information may be transferred as part of that transaction. This Policy will apply to your information as transferred to the new entity;

• Third-party companies who help us provide and improve our services such as:

  • to assist with our verification process where we may not be able to do it ourselves (only used in exceptional circumstances);

  • to enable us to send one time passwords via voice, to operate a ticketing tool and to make our service more efficient and easier to use in similar ways;

  • to help us understand and improve the use of our Services, such as Google Analytics; and

  • to Google, Inc (Global) and Amazon Web Services (Ireland and Singapore) for providing cloud-based hosting, storage and processing services.

We share your personal data with such third-party service providers subject to obligations consistent with this Policy and any other appropriate confidentiality and security measures, and on the condition that the third parties use your personal data only for specified purposes and in accordance with our instructions.

Personal data may be held at our offices and those of our group companies, third party agencies, service providers, representatives and agents as described above (see above: ‘Transfers of data to third parties).

Some of these third parties may be based outside the country in which you provide the information, for example in the servers of our cloud data hosting providers in Ireland. For more information, including on how we safeguard your personal data when this happens, see below: ‘International Transfers”’.

All information you provide to us is stored on our secure servers. Once we have received your information, we have put in place appropriate strict procedures and security features to prevent unauthorised access, use, alteration or disclosure of your personal data or prevent your personal data from being accidentally lost. In addition, we limit access to your personal data to those employees, agents, contractors and other third parties who have a business need to know. They will only process your personal data on our instructions and they are subject to a duty of confidentiality.

We have put in place procedures to deal with any suspected personal data breach and will notify you and any applicable regulator of a breach where we are legally required to do so.

As explained in the previous section, we share your personal data with other companies in our group. This will sometimes involve transferring personal data outside the country where you provided it.

We only transfer personal data out of the country where you provided it to us if we are allowed by law to do so. For example, if we transfer personal data outside the UK or EEA (European Economic Area) we may not do so unless we put appropriate safeguards in place.  We may accordingly use specific contracts approved by the UK or the European Commission (such as the Standard Contractual Clauses) which are binding on the exporting and importing entities and assure personal data the same level of protection in the destination country that it has under the GDPR.

Please contact us if you want further information on the specific mechanism used by us when transferring your personal data out of the UK or EEA.

We may (subject to obtaining your consent where required under applicable law), occasionally use your personal data to send marketing communications to you about products, services and opportunities which may be of interest to you. You may receive marketing communications from us if you have requested information from us or purchased services from us and you have opted in to receiving that marketing.

Direct marketing may be provided to you by email, mail, fax, phone or other means.

Where applicable law permits we may have a legitimate interest in using your personal data for marketing purposes (see above ‘How and why we use your personal data’).  This means we do not usually need your consent to send you marketing information. However, where applicable law requires consent, we will ask for this separately and clearly.

You can exercise your right to opt out of direct marketing or update your marketing preferences at any time by contacting our Data Security Office via the Support Page on the DataFlow Corporate website.

We may ask you to confirm or update your marketing preferences if you ask us to provide further services in the future, or if there are changes in the law, regulation, or the structure of our business.

We may from time to time review who we intend to share your personal data with, including sharing your data with business partners and affiliates. If following such a review there is any change in who we intend to share your personal data with, we will update this Privacy Policy accordingly and notify you that there has been a change to this Privacy Policy, and obtain your consent if required.

If you interact with us on social media platforms (for example if you “Like” our Facebook Page or post on our timeline), we can interact with you and send you messages via these platforms. We will interact with you in accordance with the social media platform’s rules but we are not responsible for how the platform operators collect and handle your personal data. We are not responsible for what third parties post on our social media accounts.

While using our services you may be presented with links to third-party websites, plug-ins and applications. Clicking on those links or enabling those connections may allow third parties to collect or share data about you. We do not control these third-party websites and are not responsible for their privacy statements or practices. We encourage you to read the privacy policy of every website you visit so you are fully aware how your personal data is being used.

We will generally retain the personal data you provide to us or which we collect for the purpose of providing a Report for a period of 15 years from the time of case completion in order to provide responses to enquiries from you, our clients, or the regulatory authorities we supply your report to, for the purposes of satisfying any legal, regulatory, tax, accounting or reporting requirements, or to provide you with Report Transfer services where you may wish to use the report in order to support a transfer to an alternative or future regulator or to a future employer. We consider this to be the period which is reasonably necessary for these purposes.  After this period of time the personally identifiable information related to your cases is either deleted or made anonymous. Case completion is normally at the point of producing the report but this may vary depending upon the complexity of the case or where an appeal, a request for further review, or report transfer situation occurs.

If you would like to delete your data, please refer to the “Your Rights” section for further information.

In some circumstances we will anonymise your personal data (so that it can no longer be associated with you) for research or statistical purposes, in which case we may use this information indefinitely without further notice to you.

Under certain circumstances, for example if you are in the UK or the EEA, you have rights under applicable data protection laws in relation to your personal data. These are the rights to:

• Request access to your personal data (commonly known as a “data subject access request”). This enables you to receive a copy of the personal data we hold about you and to check that we are lawfully processing it.

• Request correction of the personal data that we hold about you. This enables you to have any incomplete or inaccurate data we hold about you corrected, though we may need to verify the accuracy of the new data you provide to us.

• Request erasure of your personal data. This enables you to ask us to delete or remove personal data where there is no good reason for us continuing to process it. You also have the right to ask us to delete or remove your personal data where you have successfully exercised your right to object to processing (see below), where we may have processed your information unlawfully or where we are required to erase your personal data to comply with local law. Note, however, that we may not always be able to comply with your request of erasure for specific legal reasons which will be notified to you, if applicable, at the time of your request.

• Object to processing of your personal data where we are relying on a legitimate interest (or those of a third party) and there is something about your particular situation which makes you want to object to processing on this ground as you feel it impacts on your fundamental rights and freedoms. You also have the right to object where we are processing your personal data for direct marketing purposes. In some cases, we may demonstrate that we have compelling legitimate grounds to process your information which override your rights and freedoms.

• Request restriction of processing of your personal data. This enables you to ask us to suspend the processing of your personal data in the following scenarios:

  • If you want us to establish the data’s accuracy.

  • Where our use of the data is unlawful but you do not want us to erase it.

  • Where you need us to hold the data even if we no longer require it as you need it to establish, exercise or defend legal claims.

  • You have objected to our use of your data but we need to verify whether we have overriding legitimate grounds to use it.

• Request the transfer of your personal data to you or to a third party. We will provide to you, or a third party you have chosen, your personal data in a structured, commonly used, machine-readable format. Note that this right only applies to automated information which you initially provided consent for us to use or where we used the information to perform a contract with you.

• Withdraw consent at any time where we are relying on consent to process your personal data. However, this will not affect the lawfulness of any processing carried out before you withdraw your consent. As previously stated, if you withdraw your consent, we may not be able to provide certain products or services to you. We will advise you if this is the case at the time you withdraw your consent.

We provide applicants with access to obtain a copy of their data and to ensure that maintained data is up-to-date and accurate. Most data can be updated by the individual through our online systems. Where this is not the case, you may request access to, correction, adjustment, or erasure of your personal data, object to the processing of your personal data, or request that we transfer a copy of your personal data to another party by contacting the Data Security Office via the Support Page on DataFlow Corporate website. The Data Security Office may also be contacted in order to obtain a complete and portable set of data.

You will not have to pay a fee to access your personal data or to exercise any of the other rights. However, we may charge a reasonable fee if your request for access is clearly unfounded or excessive. Alternatively, we may refuse to comply with the request in such circumstances.

We may need to request specific information from you to help us confirm your identity and ensure your right to access the information (or to exercise any of your other rights). This is another appropriate security measure to ensure that personal data is not disclosed to any person who has no right to receive it.

We process these cases without undue delay and usually aim to complete such requests within 30 working days, at which point we will confirm what actions have been taken.

Should you be unhappy with our processing of your personal data or wish to exercise any of your rights, please let us know by contacting us via the Support Page of the DataFlow Corporate website.

You have the right to make a complaint at any time to the supervisory authority in your jurisdiction for data protection issues (for example the Information Commissioner’s Office (ICO) in the UK (www.ico.org.uk)).  Details of other supervisory authorities can be found here: Members | European Data Protection Board (europa.eu). We would however, appreciate the chance to deal with your concerns before you approach the ICO so please contact us in the first instance by visiting our support page at https://corp.dataflowgroup.com/supportcontact-us/.

Camera

We will access your camera in order to take photos and copies of documents. We will not access your photo library or camera roll without your explicit permission. We will only use images that you choose to share with us.

Contacts

We will not access or scan your contacts stored on your mobile device without your explicit consent. We will only use the contacts that you choose to share with us which will help you with completion of the application process. We will not use the contact information for any other purpose unless we obtain your explicit permission.

Calendar

We will access your calendar in order to place reminders and entries should you choose to accept them. We will not scan the calendar for any other details and will not copy data from your calendar.

Location

We will not access your location unless you give us explicit permission. Should you choose to grant access to location facilities, we will only use this permission to access your location in order to better assist with the completion of the application process in the App.

Network state

We will access your device’s network state in order to determine the status of network connectivity to DataFlow’s on-line services. This will allow us to provide a more seamless experience in the case of varying network

Read/Write to your storage

We will Read and Write data to the internal storage on your device in order to complete the application. We will only read the information to which you give us explicit consent, and we will only write data that is used for the purposes of the application process.

WiFi State

We will access the wifi state of your phone to determine the most optimal method of connecting to DataFlow’s services in order to complete the application process.

Vibrate

We will utilise the Vibrate function to provide feedback on the application process.

Any changes we may make to our Privacy Policy in the future will be posted on this page. You may be subject to an earlier version of this Privacy Policy if your personal data was collected when it applied.

Questions, comments and requests regarding this Privacy Policy are welcomed and should be addressed to our Data Security Office via the Support Page on DataFlow’s Corporate website [https://corp.dataflowgroup.com/supportcontact-us/].