Privacy Policy
Storm Global Analytics
Who are we?
We are Storm Global Analytics and this privacy statement is for the General Data Protection Regulation(Regulation (EU) 2016/679) (the GDPR).

What is the purpose of this statement?
We are committed to protecting the privacy and security of your personal information.
This privacy statement describes how we collect and use personal information about you during and after
your working relationship with us, in accordance with the General Data Protection Regulation (GDPR) as
updated from time to time. It applies to all clients, candidates and contractors
We will comply with data protection law. This says that the personal information we hold about you
must be:
1. Used lawfully, fairly and in a transparent way.
2. Collected only for valid purposes that we have clearly explained to you and not used in any way that is
incompatible with those purposes.
3. Relevant to the purposes we have told you about and limited only to those purposes.
4. Accurate and kept up to date.
5. Kept only as long as necessary for the purposes we have told you about.
6. Kept securely.

Our legal basis for using your personal data
For prospective candidates, candidates, contractors, referees and clients, we will only collect, store, use,
process, transfer and disclose personal data in so far as it is necessary for our legitimate interests in that
we need the information to assess suitability for potential roles, to find potential candidates and tocontact clients and referees.
For clients we may also rely on the need for us to perform a contract for you, for example in contacting
you to discuss relevant vacancies and suitable candidates.

1
V1.1 Privacy Policy SGA

In the event that we need to collect and hold special category personal data about you such as healthinformation that you or others provide about you we always ask for your consent before undertaking suchprocessing, please see below
This Privacy Policy (“Policy”) describes how Storm Global Analytics (we, us, our or SGA) may use, process,store and disclose Personal Information that we may collect about individuals, including if you registerwith us via our Candidate Registration process, through our website and from other sources, such as when
you apply for a job through job sites such as Totaljobs, Indeed, Jobsite, and JobServe, or any other Job
search engine. The types of data we collect are described in the section below ‘Your Personal Informationand how we collect it’.
We act as a controller and we are responsible for the Personal Information we process. This Notice informs
you how we protect your Personal Information and informs you about your privacy rights.
It is important that you read this Notice together with any other Privacy Notice we may provide such as
the Notice contained in our Candidate Introduction form and on specific occasions when we are collecting
or processing your Personal Information so that you are fully aware of how and why we are using your
Personal Information. This Privacy Notice supplements other Notices you may receive from us and is notintended to override them.

How this privacy policy applies to you?
This privacy policy applies to:
Website Users – any individual visitors to, and users of, our websites whose personal data is collected by
us during the Website Users’ use and navigation around our websites;
Candidates – applicants for any type of job or engagement via us whose personal data is collected during
our services;
Referees – referees of Candidates whose personal data is collected during our verification of a Candidate;
and/orCorporate Staff – individuals who work for, or are engaged by, our customers, clients or suppliers whose
personal data is collected during our work with them.
We refer to the above groups of individuals collectively as “you” unless the context dictates otherwise.

This privacy policy replaces any privacy policy that we have previously issued.

2
V1.1 Privacy Policy SGA

Any notices or statements relating to data, data protection, fair processing and/or privacy that we may
issue at the time of collecting personal data about you will supplement this privacy policy. They are notintended to override it.
We may change this privacy policy from time to time to reflect changes in the law and/or our personal
data handling activities and data protection practices.
We encourage you to check this privacy policy for changes whenever you visit our website, as we may notalways notify you of the changes

Your Personal Information and how we collect it
Registering with this Website
When you use or register with this website, we may ask for certain Personal Information including yourname and contact information (email, home address and phone number). Depending on the nature ofyour enquiry or activities on our website, we may also ask for your job search criteria and preferences,
employment experience, salary. You can stop receiving these job alerts at any time by clicking on theunsubscribe link contained in the job alert email.
Registering as a Candidate for work finding services
We will collect your Personal Information directly from you and from other sources including when you
apply for a job via a Job Board, directly through our website, from Social Media sites such as LinkedIn,
Facebook and Twitter or when you provide us with your details during a job fair, promotional, networking
or training event. When you ask us to provide you with work finding services we will ask you to register
as a Candidate. During our Candidate Registration process, we will collect your Personal Information
directly from you, your CV, from employment and educational referees and via online tests you may
perform at our request. Our Clients may request additional Personal Information about you in relation totheir job vacancies and requirements. The categories of Personal Information we may collect include:

•
•
•
•
•
•
•
•

your Identity (your full name, previous names, evidence of a change of name); gender, date ofbirth and marital status);
evidence of your right to work in the UK which may include a photograph, nationality, place ofbirth, birth certificate, driving licence, etc. (in accordance with Home Office requirements);
contact details including your email, home address and phone numbers;bank account and national insurance number (so we can make payments to you and account for
tax if you are working as a temporary worker supplied through SGA);
your job search criteria, preferences and expectations;
your qualifications, skills, experience and training;
current remuneration and other benefits;
educational history;
3

V1.1 Privacy Policy SGA

•
•
•
•
•
•
•

•
•
•

employment history;
details of employment or educational referees;
references;details of disabilities (where you provide this, and it is relevant);
unspent criminal/motoring convictions, court proceedings and pending court proceedings
relating to an offence committed or alleged to have been committed by you;other information contained in your CV or that you choose to provide to us;technical data including internet protocol (IP) address, your login data, browser type and version,
time zone setting and location, browser plug-in types and versions, operating system and platform
and other technology on the devices you use to access this website. We may also receive technicaldata about you if you visit other websites employing our cookies. Please see our Cookie Policy forfurther details;
profile data including your username and password, your interests, preferences, feedback andcustomer survey responses;
usage data including information about how you use our website and services;marketing and communications data including your marketing and communication preferences.

To provide you with work finding services we will send you job alert emails matching your job search
criteria and preferences. From time to time you may also receive job alerts which our consultants consider
you may find interesting.
Details about your health, unspent criminal or motoring convictions, court proceedings, or any pending
proceedings relating to an offence committed or alleged to have been committed by you is only processed
if it is relevant (for example to enable us to assess whether these present grounds for not taking yourcandidate registration or job application further) and in accordance with the restrictions imposed by law.
We may be obliged to disclose unspent convictions and criminal proceedings to our clients so that they
can determine if these are relevant to your suitability for a role within their organisation. If you provide
us with information about 3rd parties, we will assume that the 3rd party in question has given you
permission to do so and to SGA collecting, processing and transferring their Personal Information to thesame extent as yours.

Our Clients and Suppliers
If you are a Client or supplier of goods and services, we will collect and process information about
individuals in your organisation to enable us to communicate with them and to provide our services or
receive goods and services. Usually, we process the individual’s name and business contact data only.

4
V1.1 Privacy Policy SGA

How we use your Personal Information
We use, process, store and disclose your Personal Information and other data we collect including during
our Candidate Registration process, to provide you with work finding services including sending you job
alerts through this website and by email, temporary assignments, project related work and permanentand fixed term contract placements in finance, accounting, technology, big data, and or any other relatedroles, employment opportunities and career-related information. SGA will process your Personal
Information in accordance with our Candidate contract (provided during our candidate registration
process) applicable to the type of work you are seeking, and we will disclose your Personal Information to
our Clients in relation to their job vacancies. We will also process your Personal Information for other
legitimate business purposes such as producing statistics, analysing how successful our marketing
campaigns are, the number of visitors to our website and complying with other contractual, legal andregulatory obligations and duties.
Change of Purpose
We will only use your Personal Information for the purposes for which we collected it (e.g. the provisionof work finding services if you are a candidate or to consider you for employment if you are a job
applicant), unless we reasonably consider that we need to use it for another reason and that reason iscompatible with the original purpose.
If we need to use your Personal Information for an unrelated purpose, we will notify you and we will
explain the legal basis which allows us to do so.
We may process your Personal Information without your knowledge or consent, in compliance with theabove rules, where this is required or permitted by law.

Transferring your Personal Information outside of the UK / Europe/USA
We may share some of your Personal information i.e. CV’s with potential employers within or outside the
UK and European Economic Area (EEA), to place you with them and potential interviews, who may use
and process your Personal Information for similar purposes as described in this Privacy Notice. The dataprotection laws outside the UK and Europe may not provide an equivalent level of protection to those in
the UK and in these circumstances, we will take steps to ensure that your Personal Information isadequately protected, secure, kept confidential and that we have a lawful basis for the transfer. Thismeans we may require the 3rd party recipient to sign the EU Model Contract clauses approved by theEuropean Commission as providing personal data with the same protection that your Personal
Information has when it is processed within UK/EEA.

When we transfer your Personal Information to 3rd parties based in the US, we will check if they are amember the EU/US Privacy Shield (as Membership requires the business to provide similar protection topersonal data shared between the UK, Europe and the US). If they are not Privacy Shield certified, we will5
V1.1 Privacy Policy SGA

ensure these recipients will only process your Personal Information on our instructions and they will be
subject to a duty of confidentiality and required to sign the EU Model Contract.
Disclosing your Personal Information to 3rd Parties
To the extent necessary or appropriate and without notifying you, Storm Analytics may disclose your
Personal Information to external 3rd Parties in the following circumstances:

•

•

•

•

•

•

to companies and individuals, we employ to perform business functions and services on ourbehalf. Examples of service providers include: providing payroll services to enable us to pay our
employees and temporary workers who work on client premises; background screening andverification services; data storage facilities including in the US and the Cloud; hosting our Web
servers; analysing data and producing statistics and legal, accounting, audit and other professional
services.
to government agencies including HM Revenue & Customs; UK Border Agency; Home Office;
Police and other law enforcement agencies; regulatory and supervisory authorities (such as the
UK Information Commissioner); credit reference agencies; the Disclosure and Barring Service; and3rd parties performing sanctions and terrorism checks.
to comply with applicable laws, the service of legal process, or if we reasonably believe that suchaction is necessary to (a) comply with the law requiring such disclosure; (b) protect the rights orproperty of SGA; (c) prevent a crime, protect national security or for fraud detection or
prevention; or (d) protect the personal safety of individuals using our website or members of the
public.
to 3rd parties to whom we may choose to sell, transfer, or merge parts of our business or ourassets. Alternatively, we may seek to acquire other businesses or merge with them. If a change
happens to our business, we will let you know.
to IT consultants carrying out testing and development work on our IT systems, service providers
who we may appoint as data processors and to other service providers who may be based in the
United States or Europe.
Where applicable, we will impose appropriate contractual, security, confidentiality and otherobligations on to 3rd party service providers and processors we have appointed, based on thenature of the services they provide to us. We will only permit them to process your Personal
Information in accordance with the law and our instructions. We do not allow them to use your
Personal information for their own purposes and when our relationship ends we will ensure your
Personal Information is securely returned or destroyed.

Some of these 3rd parties are also controllers responsible for processing your Personal Information for
their purposes, for example, HM Revenue & Customs is a controller for tax purposes. We may not be able
to impose obligations or restrictions on these controllers in connection with how they process your
Personal Information.

6
V1.1 Privacy Policy SGA

Keeping your Personal Information Secure
We have put in place appropriate security measures to prevent your Personal Information from being
accidentally lost, used or accessed in an unauthorised way, altered or disclosed. In addition, we limit
access to your Personal Information to those employees, agents, contractors and other third parties who
have a business need to do so.
We have put in place procedures to deal with any suspected Personal Information breaches and we will
notify you and the applicable supervisory authority of a breach where we are legally required to do so.
How long we Retain your Personal Information
Storm Global Analytics will retain your Personal Information for as long as necessary to fulfil the purposesthat we collected it for. This means we will keep your Personal Information throughout the period of yourrelationship with us and whilst we are providing you with work finding services.
If you no longer wish to receive our services we will continue to retain your Personal Information on our
Candidate database for a further period of 2 years after our relationship ends, so that we can comply with
our regulatory obligations. However, we will inactivate your candidate record and limit access to your
Personal Information during this period. After the 2-year retention period expires, we will anonymise the
Personal Information in our database so that we can no longer identify you.
We are required by law to keep basic information about our Candidates, Clients and customers (including
contracts, evidence of identity, financial and transaction data) for up to 7 years from when our relationshipends, for legal, compliance and tax purposes.
Where there is no retention period stated in law, we determine the appropriate retention period for
Personal Information by considering the amount, nature, and sensitivity of the Personal Information, thepotential risk of harm from unauthorised use or disclosure of the data, the purposes for which we process
it and whether we can achieve those purposes through other means, and the applicable legal
requirements.
In some circumstances, we may anonymise your Personal Information (so that it can no longer be
associated with you and we cannot identify you). We do this for research or statistical purposes in whichcase we may use this anonymised data indefinitely without further notice to you.
Details of the retention periods for different aspects of your Personal Information are set out in our Record
Retention and Destruction Policy which you can request from us by contacting us atamrita@stormglobalanalytics.com.

7
V1.1 Privacy Policy SGA

Where is your personal data stored?
All information you provide to us is stored on our secure servers and is protected using industry standard
Secure Layer (SSL) Encryption Technology.
We will do our best to protect your personal data, although as the transmission of information via theinternet is not completely secure we cannot guarantee the security of your data transmitted to our site;
any transmission is at your own risk. Once we have received your information, we will use strict
procedures and security features to try to prevent unauthorised access, misuse or loss.

Your Legal Rights
You have the right to:Make a Data Subject Access Request to access your Personal Information at any time. This enables you
to receive a copy of the Personal Information we hold about you and to check that we are lawfully
processing it.
Request correction of the Personal Information that we hold about you. This enables you to have any
incomplete or inaccurate Personal Information we hold about you corrected, although we may need toverify the accuracy of the new data you provide to us.
Request erasure / deletion / removal of your Personal Information. This enables you to ask us to deleteor remove your Personal Information where we do not have a valid reason to continue to process it. You
also have the right to ask us to delete or remove your Personal Information where you have successfully
exercised your right to object to processing, where we may have processed your information unlawfully
or where we are required to erase your Personal Information to comply with local law. Please Note: wemay not always be able to comply with your request for erasure for specific legal reasons which will be
notified to you, if applicable, at the time of your request.
Object to the processing of your Personal Information where we are relying on a legitimate interest (orthose of a 3rd party) and there is something about your situation which makes you want to object toprocessing on this ground as you feel it impacts on your fundamental rights and freedoms. You also havethe right to object where we are processing your Personal Information for direct marketing purposes. In
some cases, we may demonstrate that we have compelling legitimate grounds to process yourinformation which override your rights and freedoms.
Request restriction of processing of your Personal Information. This enables you to ask us to suspend
the processing of your Personal Information in the following scenarios: (a) if you want us to establish thedata’s accuracy; (b) where our use of the data is unlawful but you do not want us to erase it; (c) where
you need us to hold the data even if we no longer require it as you need it to establish, exercise or defend
legal claims; or (d) you have objected to our use of your data but we need to verify whether we haveoverriding legitimate grounds to process it.

8
V1.1 Privacy Policy SGA

Data Portability / Request the transfer of your Personal Information to you or directly to anothercontroller. This right only applies to automated information which you initially provided consent for us touse or where we used the Personal Information to perform a contract with you. We will (unless there isan exemption) assist you by securely transferring your Personal Information directly to another controller
where technically feasible or by providing you with a copy in a structured commonly used machinereadable format. The data we can provide is:Withdraw consent at any time where we are relying on your consent to process your Personal
Information. However, this will not affect the lawfulness of any processing carried out before you
withdraw your consent. If you withdraw your consent, we may not be able to provide certain services toyou. We will advise you if this is the case at the time you withdraw your consent.
We want to ensure we keep your Personal Information accurate and up to date. In addition to your legal
rights, you may ask us to make changes or request a copy of your Personal Information.

Additional information, Response Times and Fees
We may need to request specific information from you to help us confirm your identity and ensure yourright to access your Personal Information (or to exercise any of your other rights or when you make an
informal request). This is a security measure to ensure that Personal Information is not disclosed to any
person other than the individual who has the right to receive it. We may also contact you to ask you forfurther information in relation to your request to help us locate your data and to speed up our response.
We try to respond to all legitimate requests within one month. It may take us longer than a month if yourrequest is particularly complex or you have made a number of requests. In this case, we will notify you
and keep you updated.
You will not have to pay a fee to exercise any of these rights. However, we may charge a reasonable fee
if your request is unfounded, repetitive or excessive. Alternatively, we may refuse to comply with yourrequest in these circumstances.

9
V1.1 Privacy Policy SGAThe Legal Basis for processing your Personal Information
We have set out a short description of main ways we will collect, store, process, share and disclose your
Personal Information and the legal bases we rely on to do so. We have also identified what our legitimate
interests are, where appropriate.
We will only use your Personal information when the law allows us to. Most commonly, we will use your
Personal information in the following circumstances:••••

To fulfil a contract, we are about to enter or have entered with you;
Where it is in our legitimate interests;
When it is our legal or regulatory duty;
When you consent.

A legitimate interest is when we have a business or commercial reason to use your information in
conducting and managing our business. We will consider and balance any potential impact on you andyour legal rights when we process your Personal Information for our legitimate interests. We do not use
your Personal Information for activities where our interests are overridden by the impact on you (unless
we have your consent or are otherwise required for compliance with a legal or regulatory obligation or
permitted to by law).

10
V1.1 Privacy Policy SGA

Purpose/Activity

Type of Personal
Information

To register you as a candidate for work finding (a) Identity
services or when you make an employment
application to us(b) Contact details(c) Evidence of yourright to work in the UK

The lawful basis forprocessing Personal
Information
Fulfil a contract (the SGA
Candidate Agreement);
Legal or regulatory duty
(complying with therecruitment industry andimmigration regulations)(d) CV(e) referees(f)unspent criminal
convictions
To provide you with work finding services including: (a) Identity
sending you details of available job opportunities
and job alert emails in accordance with your job (b) Contact details
search preferences and criteria, providing careeradvice, providing your CV to clients in relation to (c) Financial data
their job vacancies / roles), paying your wages (ifyou are a temporary worker) paying your fees if you (d) Transaction data
work through an umbrella or a Limited Company,
and charging clients for placements we make(e) Marketing andCommunications
Transferring your Personal Information to (a) Identity
companies (including Invenias in the UK CRM).
(b) Contact details

Fulfil a contract (SGA
Candidate Agreement andClient Contracts);
Legitimate interests
Legal or regulatory duty

Legitimate interests
Your Consent(c) Evidence of yourright to work in the UK

Disclosing your Personal Information to
government and law enforcement agencies andour appointed 3rd party vendors, including
vendors located in the US providing Cloud based
services(d) CV(e) referees(f) unspent criminal
convictionsa) Identity(b) Contact details

Legitimate interests
Legal or regulatory duty(c) Evidence of yourright to work in the UK(d) CV(e) referees(f) unspent criminal
convictions
11

V1.1 Privacy Policy SGA

To manage our relationship with you including:(a) Identity(a) Fulfil a contract(a) Notifying you about changes to our Candidate (b) Contact(b) Legal or regulatory
Agreement or Privacy Notices
duty(c) Profile/Survey(b) Asking you to leave a review or feedback or(c) Legitimate interests
complete a survey(d) Marketing and (keeping our records
Communications
updated and to study how(c) administration and IT services connected withcandidates and potential
representing you for roles, placing you in temporary
candidates and visitors toassignments to work for our clients.
our website use ourservices and website, todevelop and improvethem and to grow ourbusiness
Keeping your Personal Information secure to (a) Identity
Legal or regulatory duty
prevent it from being lost, used, accessed, disclosed
or altered in an authorised way(b) Contact details
Legitimate interests(c) Evidence of yourright to work in the UK

Fulfil a contract(d) CV(e) referees(f) unspent criminal
convictions
Retaining your Personal Information for as long as (a) Identity
necessary for the purposes of providing you withwork finding services.
(b) Contact details

Legitimate interests
Legal or regulatory duty(c) Evidence of yourright to work in the UK(d) CV(e) referees(f) unspent criminal
convictions
To help us respond to queries, complaints or for (a) Contacts
Legitimate interests
other reasons such as responding to requests from
regulators, government and law enforcement
Legal or regulatory duty
agencies

12
V1.1 Privacy Policy SGAMarketing Messages
Generally, we do not rely on consent as a legal basis for processing Personal Information except in relation
to sending direct marketing communications via email or text message. However, where we are providing
you with work finding services, you will receive email marketing communications from us even if you havenot given us consent as we rely on the ‘soft opt-in’ form of consent.
You may receive marketing communications from us if you provided us with your details when you
entered a competition or registered with us at a job fair, promotional or networking event or attended a
training course and you have given us consent to send you marketing. We may also use your identity,contact details, technical data, usage data and profile data to form a view and decide which services mayof interest or relevant to you.
We have established an email preference centre where you can view and make decisions about your email
marketing preferences and opt out of receiving email marketing from us at any time.
You have the right to withdraw your consent to marketing at any time by:••••Visiting our website and checking or unchecking the relevant box to change your email marketing
preference;
following the opt-out links contained in our marketing email messages;
following the opt-out the process described in our text marketing messages;
Sending an email with “UNSUBSCRIBE ME” in the subject field toamrita@stormglobalanalytics.com

Opting out of receiving marketing messages does not apply to:
•
•
•

•

Personal Information that you have provided to us as a result of your request for work finding
services;
Personal Information that you have provided to us in connection with the performance of acontract between us;
Job alerts sent to you through the website in response to your request to receive specific job
details. You can select your preferences in the Job Search section and you can stop receiving thesealerts at any time by clicking on the unsubscribe link within the job alert email; andJob alert emails which you will receive from our recruitment consultants which match your job
search criteria confirmed with you during our Candidate Registration process.

We will never sell or disclose your Personal Information to any 3rd parties to use for marketing

13
V1.1 Privacy Policy SGACookie policy
Our sites use cookies to distinguish you from other users of our sites. This helps us to provide you with agood experience when you browse our sites and also allows us to improve our sites. By continuing tobrowse our sites, you are agreeing to our use of cookies.
A cookie is a small text file that is stored by your browser on your device or the hard drive of yourcomputer, if you agree. Cookies contain information that is transferred to your computer's hard drive or
device.
We use the following cookies:

essential cookies: these are cookies that are required for the operation of our site. They include, forexample, cookies that enable you to log into secure areas of our site;analytical/performance cookies: they allow us to recognise and count the number of visitors and to see
how visitors move around our site when they are using it. This helps us to improve the way our site works,
for example, by ensuring that users are finding what they are looking for easily;functionality cookies: these are used to recognise you when you return to our site. This enables us topersonalise our content for you, greet you by name and remember your preferences (for example, yourchoice of region); andtargeting cookies: these cookies record your visit to our site, the pages you have visited and the links you
have followed. We will use this information to make our site and the advertising displayed on it more
relevant to your interests. We may also share this information with third parties for this purpose.
You may block cookies by activating the setting on your browser that allows you to refuse the setting of
all or some cookies. However, if you use your browser settings to block all cookies (including essential
cookies) you may not be able to access all or parts of our site.

Staff training
All updates and changes in GDPR legislation and regulatory matters are checked daily and highlighted tosenior management, all appropriate measures are taken place to ensure we abide by the employment
agencies and conduct regulations and data protection guideline’s, we also conduct weekly meetings byback office managers and sales to ensure we are in line with the recruitment legislation and GDPR & HMRC
rules concerning contractors and contracts.

14
V1.1 Privacy Policy SGA

Internal audits are carried out with all departments to ensure we have effective and efficient ways tomeasure and analyse the managed process in respect to customer focus and delivery for the best service
to our clients, all information is presented in our quarterly operations board meeting for senior
management to review and action.

Changes to this Privacy Notice
If we change this Privacy Notice we will post any updates here for your review. If we change material
terms we will provide notice of the revised Privacy Notice for 30 days on our home page at
http://www.stormglobalanalytics.com/ with a link back to this page.

By agreeing to our Privacy Policy, you are also stating that you have read and agree to our Privacy andCookies Policy.

15
V1.1 Privacy Policy SGA