PRIVACY POLICY

INTRODUCTION:

AMG Search Limited (AMG) specialises in Financial Services and Wealth Management recruitment.

The personal data that AMG processes relates to our clients, candidates and staff.

This policy sets out AMG’s commitment to ensuring that any personal data, including special category personal data, which AMG processes is carried out in compliance with data protection law (including the General Data Protection Regulation 2016/679; the UK Data Protection Act 2018 and all relevant EU and UK data protection legislation). AMG is committed to ensuring that good data protection practice is imbedded in the culture of our staff and our organisation.

AMG is committed to ensuring that its complies with the GDPR Data Protection Principles when processing any personal data and that it meets its legal obligations as laid down in data protection law.

Scope:

This policy applies to all personal data processed by AMG and is part of AMG’s approach to compliance with data protection law. All AMG staff are expected to comply with this policy.

Data Protection Principles:

AMG confirms that it complies with the following data protection principles and undertakes to ensure that when it processes personal data:

• it is processed lawfully, fairly and in a transparent manner in relation to the data subject (‘lawfulness, fairness and transparency’);
• it is collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes; (‘purpose limitation’)
• it is all adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed; (‘data minimisation’)
• it is all accurate and, where necessary, kept up to date and that reasonable steps will be taken to ensure that personal data that are inaccurate, having regard to the purposes for which they are processed, are erased or rectified without delay (‘accuracy’)
• it is kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed; (‘storage limitation’)
• it is processed in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures (‘integrity and confidentiality’).
• AMG is committed to facilitating and complying with any request from a data subject who wishes to exercise their rights under data protection law in a transparent manner and without undue delay.

PROCESSING:

AMG will:

• only collect and process the personal data that it is necessary for the purpose or purposes that it has identified in advance.
• ensure that the legal basis for processing the personal data is identified in advance, including any special category data.
• ensure that as far as possible the personal data it holds is accurate.
• only process your data for as long as is it required for its purposes and then it will be securely disposed of, or deleted.
• will provide anyone they collect personal data from with a privacy notice which provides more detail on why it is asking for that data and what it intends to do with it.
• not do anything with personal data that is unexpected given the content of this policy and the privacy notice provided at the time it is provided.
• ensure that appropriate security is in place in relation to personal data held in paper and digital formats.
• ensure that all staff who handle personal data are aware of their responsibilities under this policy and other relevant data protection and information security policies and that they are adequately trained and supervised.

Proceedings under AMG’s disciplinary policy may be taken in respect of those employees who breach this policy. Staff should also be aware that processing personal data in breach of this policy and data protection law can be a criminal offence.

Data Subject Rights:

AMG will ensure that it has procedures in place to allow data subjects to exercise the following data subject rights under the GDPR:

Subject access: the right to request information about how personal data is being processed including whether personal data is being processed and the right to be allowed access to that data and to be provided with a copy of that data along with the right to obtain the following information:

• the purpose of the processing;
• the categories of personal data;
• the recipients to whom data has been disclosed or which will be disclosed;
• the retention period;
• the right to lodge a complaint with the ICO;
• the source of the information if not collected direct from the subject; and
• the existence of any automated decision making.

Rectification: the right to allows you to rectify inaccurate personal data concerning you without undue delay.

Erasure: the right to have data erased in certain circumstances, and to have confirmation of erasure, but only where:

• the data is no longer necessary in relation to the purpose for which it was collected;
• where consent is withdrawn;
• where there is no legal basis for the processing; or
• there is a legal obligation to delete data.

Restriction of processing: the right to ask for certain processing to be restricted in the following circumstances: 

• if you contest the accuracy of your personal data;
• if our processing is unlawful and you do not want it to be erased;
• if we no longer need the data for the purpose of the processing but it is required by you for the establishment, exercise or defence of legal claims; or
• if you have objected to the processing, pending verification of that objection.

Data portability: you have the right to receive a copy of the personal data you have provided to us and certain information generated by us, if our processing is carried by automated means, which will allow you to transfer it to another data controller. This only applies if our legal basis for processing is consent or under a contract.

Object to processing: you have the right to object, on grounds relating to your particular situation, to the following:

processing carried out in the public interest or in the exercise of official authority; or

processing relying on the legitimate interests processing condition unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms or for the establishment, exercise or defence of legal claims.

Special Category Personal Data:

This includes the following personal data revealing:

• Racial or ethnic origin,
• Political opinions,
• Religious or philosophical beliefs,
• Trade union membership,
• The processing of genetic data, biometric data for the purpose of uniquely identifying a natural person,
• Data concerning health,
• Data concerning a natural person’s sex life or sexual orientation,
• Data about criminal convictions and offences.

This policy sets out the safeguards we believe are appropriate to ensure that we comply with the Data Protection Principles set out above. We only process special category data when we have a legal basis to do so; access to this data is restricted; extra security measures are in place and we will only retain it as long as it strictly necessary.

Responsibility for the Processing of Personal Data:

If you have any concerns or wish to exercise any of your rights under the GDPR then you can contact our data protection lead in the following ways:

Andrew McGarvey

andrew@amgsearch.com

0141 314 3640

Monitoring and Review:

This policy was last updated in May, 2018 and shall be regularly monitored and reviewed, at least every two years.