Privacy Notice For Internal Staff

1. WHAT THIS PRIVACY NOTICE COVERS

This Privacy Notice provides information about personal data which is processed by a company or companies within the Prax Group of companies (“Prax Group” or “we”) in relation to individuals who are or were employees, interns, or temporary external staff.

This Privacy Notice explains what personal data we are processing about you, why we are processing your personal data and for what purposes, how long we will hold your personal data for, how to access and update your personal data, as well as the options you have regarding your personal data and where to go for further information.

2. PERSONAL DATA WE PROCESS ABOUT YOU

We process personal data to manage the employment relationship, to engage temporary external staff and interns, and to provide benefits.

This includes personal home contact information, date of birth, marital status, payroll and bank account information, wage and benefit information, emergency contacts, work performance information, information required to ensure you have the right to work in the country you are engaged in, as well as any other information necessary for managing the employment relationship, for engaging temporary external staff and providing benefits.

3. DATA PROTECTION PRINCIPLES

We will comply with data protection law and principles, which means that your data will be:

  • Used lawfully, fairly and in a transparent way
  • Collected only for valid purposes that we have clearly explained to you and not used in any way that is incompatible with those purposes
  • Relevant to the purposes we have told you about and limited only to those purposes
  • Accurate and kept up-to-date
  • Kept only as long as necessary for the purposes we have told you about
  • Kept securely

4. SENSITIVE PERSONAL DATA

We may also process some special categories of personal data, such as data relating to an individual’s health, race, religious beliefs, sexual orientation, political opinions, and trade union membership. We only process such personal data where it is necessary for the purposes of complying with employment and social security laws, for establishment, exercise, or defence claims or, where necessary, for the purposes of providing occupational medical advice and support, to protect the vital interests of an individual, where necessary for reasons for public health or where the individual provided their explicit consent.

5. WHY WE PROCESS YOUR PERSONAL DATA

We process your personal data a) in order to satisfy our obligations to comply with laws and regulations; b) for legitimate business interest, and c) where we have your explicit consent.

Personal data requested is the minimum required in order to fulfil legal and/or contractual requirements and to provide opportunities to take part in programs or to provide a benefit.  Failure to provide us with the information requested may negatively affect your ability to remain in employment, or internship, or engagement as a temporary external staff member or from participating in a program or receiving a benefit.

We process your personal data covered by this Privacy Notice for the following purposes:

  • Human Resources, personal management, business process execution, internal management, management reporting, organisational analysis and development. We may need to use data (including CCTV video and audio recordings) for investigation of bad practices, unsafe ways of working, inappropriate behaviours, attendance etc.
  • Health, safety, and security, including protection of an individual’s life or health, occupational health and safety, protection of Prax companies and staff, authentication of individual status and access rights.
  • Legal and/or regulatory compliance, including compliance with legal or regulatory requirements.
  • Secondary purposes, such as storing, deleting, or anonymising your personal data, fraud prevention, audits, investigations, dispute resolution, insurance purposes, litigation and defence of claims; or research.

6. HOW WE WILL USE INFORMATION ABOUT YOU

We will use the personal data that we collect about you for a number of purposes, including:

  • in order to take steps at the request of an individual prior to entering into a contract or responding to any query that you have submitted to us, accessing our premises or administering or customising our websites;
  • where it is necessary to comply with a legal or regulatory obligation;
  • where it is necessary for the purposes of the legitimate interests pursued by the relevant Prax Group company/companies, except where such interests are overridden by the interests or fundamental rights and freedoms of the individual/s; or
  • (only if legally required) with the explicit consent of the individual.

In those cases where processing is based on consent, and subject to applicable local laws which provide otherwise, you have the right to withdraw your consent at any time. This will not affect the validity of the processing prior to the withdrawal of consent.

7. MONITORING

We may monitor all activities conducted on Prax Group IT, security and communications equipment and/or when connected to the Prax Group IT network for legitimate purposes.

The Prax Group may record the date, time, and access points made by individuals within Prax Group premises and assets. The data from the access and security systems are used for: a) health, safety and security purposes, to prevent fraud and theft occurring to Prax Group assets, employees and visitors; b) to comply with legal and regulatory requirements, c)  to monitor the number of individuals entering and working on Prax Group premises for human resources and real estate planning, and d) data and time of entry and exit of Prax Group premises for financial management and control.

8. SCREENING

To comply with legal and regulatory obligations, to protect Prax Group assets and employees/contractors, and ensure that the Prax Group complies with trade control, anti-money laundering, bribery and corruption laws and other regulatory requirements, we may conduct screening on our employees and temporary external staff. The screening takes place against publicly available information, or government-issued sanctions lists and compared with information we hold about you.

9. DATA SHARING

We process your data for the purposes referred above and will only be shared on a strict need-to-know basis with:

  • Other companies within the Prax Group of companies;
  • Authorised third party agents, service providers, external auditors and/or subcontractors of the Prax Group; or
  • A competent public authority, government, regulatory or fiscal agency where it is necessary to comply with a legal or regulatory obligation to which the relevant the Prax Group company/companies is subject to or as permitted by applicable local law.

We will only disclose your personal data to other organisations where it is necessary (i) to enable the organisation to provide services for or on behalf of us, (ii) to comply with  applicable legal  requirements,  (iii) to protect  or defend our rights  or property, or (iv) to protect the health, safety and well-being of our employees, contractors, visitors or members of the public.

10. TRANSFER TO OTHER COUNTRIES

Where your personal data has  been transferred to companies within the Prax Group and/or authorised third parties located outside of your country, we take organisational, contractual, and legal measures to ensure that your personal data is processed for the purposes mentioned above and that adequate levels of protection are in place to safeguard personal data. These measures may include data sharing and/or data transfer agreements for transfers within the Prax Group, and EU-approved transferred mechanisms for transfers to third parties.

11. SECURITY OF PERSONAL DATA

The Prax Group is committed to safeguarding your personal data.  We have implemented physical security, cybersecurity technology and policies with the objective of protecting your privacy from unauthorised access, improper use, alteration or disclosure.  We update and review these measures on an ongoing basis.

We have put in place appropriate security measures to prevent your personal information from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. We have put in place procedures to deal with any suspected data security breach and will notify you and any applicable regulator of a suspected breach where we are legally required to do so.

In addition, we limit access to your personal information to those employees, agents, contractors and other third parties who have a business need to know. They will only process your personal information on our instructions and they are subject to a duty of confidentiality.

12. HOW LONG WE KEEP PERSONAL DATA FOR

All information including personal data is securely deleted once no longer required for the legitimate business purpose, or for the legal or the regulatory purpose for which it was collected.  In all cases, information may be held for a longer period where there is legal or regulatory reason to do so.  In some circumstances, we may anonymise your personal information so that itcan no longer be associated with you, in which case we may use such information without further notice to you.

13. SOCIAL MEDIA

If you choose to interact with Prax through social media on a Prax administered social media page such as X (formerly Twitter), Facebook, LinkedIn or YouTube, your personal data (such as your name, your profile picture and the fact that you are interested in the Prax Group) will be visible to all visitors, depending on your privacy settings on the relevant social media platform, and will also be visible to Prax. You can delete any information that you share on these sites at any time through your relevant social media platform’s account. Prax does not track your activity across the different social media sites that you use. If you send a message to Prax via any messenger service on a social media platform, please note these messages will be held on file and shared internally by Prax via e-mail to ensure swift resolution. These messages will be retained as long as is necessary and in line with the Prax Data Retention Policy.

Additionally, and to the extent the Prax Group is jointly responsible with a social media platform of a Prax social media page, Prax will have access through the social media platform to aggregated data providing statistics and insights that help to understand the types of actions you take on Prax social media pages. For more information on how your personal data is processed on those social media platforms, including any targeted advertising that you may receive, please refer to your privacy settings accessible through your relevant social media platform’s account.

14. YOUR RIGHTS IN RELATION TO PERSONAL DATA

Under certain circumstances, you have the following rights under data protection laws in relation to your personal data:

  • access to your personal data;
  • correction or deletion of the personal data (but only where it is no longer required for a legitimate business purpose);
  • object to the processing of your personal data;
  • that the processing of your personal data is restricted;
  • that you receive personal data that you have provided to the Prax Group, in a structured, digital form to be transmitted to another party, if this is technically feasible;
  • withdraw consent at any time where we are relying on consent to process your personal data. However, this will not affect the lawfulness of any processing carried out before you withdraw your consent. To withdraw your consent, please contact us using the contact  details below. Once we have received notification that you have withdrawn your consent, we will no longer process your information for the purpose or purposes you originally agreed to, unless we have another legitimate basis for doing so in law.

15. ENQUIRIES, CONCERNS OR COMPLAINTS

If you have any queries or complaints regarding your personal data, please contact: privacy@prax.com.

We have a Data Privacy Officer (DPO) to oversee compliance with this privacy notice.   If you have any questions about this privacy notice or how we process your personal data, please contact our DPO at: privacy@prax.com.

If you are not satisfied with our handling of personal data, you have the right to submit a complaint to your local data protection authority or the Information Commissioner’s Office (ICO), the UK supervisory authority for data protection issues (www.ico.org.uk).

16. CHANGES TO THIS PRIVACY NOTICE

This Privacy Notice is subject to change over time. You are advised to regularly review this Privacy Notice for possible changes. This Privacy Notice was last updated in October 2024.