In this Privacy Statement, we set out how Harneys collects and processes your personal data and what rights you have in relation to the personal data we hold and process in connection with job applications.

Personal data is defined as any information relating to an identified or identifiable natural person – a “data subject”.

Processing means anything that can be done with personal data. This includes the collection, storage, use, transfer and removal of data.

Harneys determines why and how we process your personal data. Harneysconsists of Harney Westwood & Riegels International, Harney Westwood & Riegels LP, Harney Westwood & Riegels (Cayman), Harney Westwood & Riegels LLP, Harney Westwood & Riegels (Hong Kong), Harney Westwood & Riegels Singapore LLP, Aristodemou Loizides Yiolitis LLC (practising as Harneys), Harney Westwood & Riegels SARL, Harneys Fiduciary Limited, Harneys Fiduciary Cyprus Limited and each of their subsidiaries.

We collect different types of personal data for different reasons. This may include:

Education and work experience: Information collected is used to conduct background checks as part of your application and determine your eligibility for the role. Examples include academic qualifications and transcripts.

Identification and Contact information: Information such as your name, educational background, employment and professional history, job title, postal address, home address where you provide this to us, contact number, email address.

Information collected during your interviews: This information is collected to comply with our legal obligation and local laws.

Publicly available information: Information collected from publicly available resources, including but not limited to information collected from public domain searches (such as google), social media, networking websites, databases we use to carry out compliance checks or credit rating agencies.

Reference information: Information you provide on referees and information obtained from referees.

Sensitive/Special Category Information: Such information is processed when permitted by law under a legal or regulatory obligation to do so or where you have provided us with the information to facilitate your application process or conduct criminal records checks.

Technical/Platform information: This includes information collected when you visit our website or client portal services which we offer or which you have agreed to use. This data relates to your internet protocol (IP) address, device type, operating system and platform, time zone, browser type and version, your username and password, and other related log-in details for platforms maintained by Harneys, where you have access to any services.

Third party information: In some circumstances, we may collect personal data about you from third parties, such as personal data from your organisation, other organisations with whom you have dealings, such as a recruitment agent you have granted consent to, acting on your behalf, or publicly available information set out above.

We may collect personal data about you in various cases, such as:

• When you make an enquiry through our website, in person, over email or over the telephone;
• When you provide your information for recruitment purposes;
• When conducting searches and checks from publicly available information, such as a google search, LinkedIn and social media;
• When conducting compliance screening, background checks, criminal record checks; or
• When you or your organisation provide services to us, or otherwise offer to do so.

We will use your personal data for the following purposes (Permitted Purposes):

• To assess suitability for a job vacancy or for other recruitment purposes;
• To identify information which may possibly have an adverse impact on our reputation;
• For compliance with our legal obligations (such as background checks, criminal record checks), compliance screening or recording obligations, which may include automated checks of your contact data or other information you provide about your identity against applicable sanctioned-party lists and contacting you to confirm your identity in case of a potential match or recording interaction with you which may be relevant for compliance purposes;
• To monitor and assess compliance with our policies and standards;
• To communicate with you through the channels you have approved to keep you up to date on the status of your job application or enquiry, the latest job vacancies, announcements, and other information about us; and
• For any purpose related and/or ancillary to any of the above or any other purpose for which your personal data was provided to us.

Depending on for which of the above Permitted Purposes we use your personal data, we may process your personal data on one or more of the following legal grounds:

• Consent: where we ask for your consent to process your personal data;
• Legitimate interest: where processing is necessary for the purpose of the legitimate interests pursued by Harneys or by a third party. This is only used in jurisdiction where allowed and assessments are carried out to ensure your rights to privacy is considered and balance any potential impact on your fundamental rights and freedoms;
• Legal obligation: there is an obligation to carry out the processing to comply with a legal or regulatory obligation that the firm is subject to.

We may share your personal data in the following circumstances:

• Between Harneys entities to allow access by other departments such as human resources, finance etc. or other offices. Please see here and here for a list of the countries in which the Harneys entities are located.
• With third party processors to carry out compliance screening, background checks or criminal record checks.
• With any third party to whom we assign or novate any of our rights or obligations.
• To instruct service providers within or outside Harneys, domestically or abroad, e.g., shared service centres, to process personal data on our behalf and in accordance with our instructions. Harneys will retain control over and will remain fully responsible for your personal data and will use appropriate safeguards as required by applicable law to ensure the integrity and security of your personal data when engaging such service providers.
• As part of aggregated personal data and statistics for the purpose of monitoring website usage to help us develop our website and our services.

We will otherwise only disclose your personal data when you direct us or give us permission to do so, when we are required by applicable law or regulations or judicial or official request to do so, or as required to investigate actual or suspected fraudulent or criminal activities.

Specifically in relation to Harneys’ operations in Luxembourg, we shall ensure that adequate restrictions on information access are in place in accordance with Luxembourg Bar requirements (such as encryption tools and access permissions).

In general, we receive your personal data where you provide this on a voluntary basis, and there will typically be no detrimental effect for you if you wish not to provide this or otherwise withhold your consent for it to be processed. However, there are certain cases where we will unfortunately be unable to act without receiving such data, for example where we need to carry out legally required compliance screening or require such data to process your instructions or orders, or otherwise to provide you with our online services or communications.

Where it is not possible for us to provide you with what you request without the relevant personal data, we will let you know accordingly.

We take appropriate technical and organisational measures to keep your personal data confidential and secure, in accordance with our internal policies and procedures regarding storage of, access to and disclosure of personal data. We may keep your personal data in our electronic systems, in the systems of our contractors, or in paper files.

Harneys is active across the world. This means that we may transfer your personal data abroad if required to do so for the Permitted Purposes. In certain cases, this may include transferring data to countries which do not offer the same level of protection as the laws of your country (such as for example the data protection legislation of the EU/EEA).

When making such transfers, we will ensure that they are subject to appropriate safeguards in accordance with the General Data Protection Regulation (Regulation 2016/679) or other relevant data protection legislation. This may include entering into the EU Commission’s Standard Contractual Clauses. Please get in touch at fidprivacy@harneysfiduciary.com if you wish to obtain further information on the appropriate safeguards which we are adhering to.

All entities and offices within Harneys will ensure an adequate level of protection for your personal data at all times.

We delete your personal data once it is no longer reasonably necessary for us to keep it for the Permitted Purposes, or, where we have relied on your consent to keep your personal data, once you withdraw your consent for us to do so, and we are not otherwise legally permitted or required to keep the data.

Importantly, Harneys will keep your personal data as necessary for the purposes of defending or making legal claims until the end of the period during which we may retain the data and otherwise until the settlement of any such claims, as relevant. We may also retain your information for archiving purposes.

Subject to certain conditions under applicable legislation, you have the right to:

• Right of access and rectification: you have the right to request a copy of the personal data which we hold about you and have any inaccurate data corrected;
• Right to object or restrict our use of your personal data: In certain instances, you may object or request restriction on the processing of your personal data. We will make a new determination of whether your data should no longer be used or restricted and cease processing if your interest outweighs our interest. Where possible, we will oblige with your request or inform you of why the request cannot be satisfied stating our reason.
• Right to not be subject to fully automated decision-making: Harneys does not process your personal data using automated means.
  • Right to data portability: You have the right to request that personal data be provided to you, or to another data controller, in a commonly used, machine-readable format.
• Right to transparency of information: You are entitled to clear and transparent information about the processing of your data.
• Right to be forgotten: If you object to the processing of your data, you can ask for the data we hold to be deleted. An example is if the processing is not legitimate or no longer necessary for the purposes for which the data was collected. Upon receipt of request, your data will be deleted providing there is no legal obligation to retain the information.
• Submit a complaint if you have concerns about the way in which we are handling your data.

To do any of the above, please contact us at fidprivacy@harneysfiduciary.com. To enable us to process your request, we may require that you provide us with proof of your identity, such as by providing us with a copy of a valid form of identification. This is to ensure that we appropriately protect the personal data we hold from unauthorised access requests and comply with our security obligations.

We may charge you a reasonable administrative fee for any unreasonable or excessive requests we may receive, and for any additional copies of the data you may request.

Where any personal data you have provided us with has changed, or where you believe the personal data we hold is inaccurate, please let us know at fidprivacy@harneysfiduciary.com.

If you have any concerns or complaints about Harneys processing of your personal data, we encourage that you contact us initially as we aim to satisfactorily resolve any concerns or complaints you may have in relation to the processing of your personal data.

However, you may directly report any concerns to your local data protection authority, where you can also find out more information about your rights under applicable data protection law, or make a formal complaint.

We may store cookies on your devices for the purposes of delivering a better user experience for you on our websites. Please see our Cookies Policy.

We would be happy to hear your views about our website and this Privacy Statement. Please let us know any questions, comments or clarifications you may have at privacy@harneysfiduciary.com or send us a letter at FAO Data Protection Officer, Harney Westwood & Riegels LLP, 4th Floor, South Quay Building, 77 Marsh Wall, London E14 9SH, United Kingdom.

This Privacy Statement is effective February 2024. We have the right to update the contents of this Privacy Statement from time to time to reflect any changes in the way in which we process your personal data or to reflect legal requirements as these may change. In case of updates, we will post the revised Privacy Statement on our website. Changes will take effect as soon as the revised version is made available on our websites.