General Privacy Policy and GDPR

Information Notice — Processing of Personal Data

This notice applies to you if you are a European Union (EU) resident or citizen currently residing in the EU

Mercans is committed to protecting the privacy and security of your personal information.

This Information Notice has been prepared in accordance with the General Data Protection Regulation (GDPR) to provide you an overview of how Mercans General Trading LLC, including its affiliates, with the registered offices at Office 2704, Concord Tower, Media City, POB 282102, Dubai, the United Arab Emirates (“Mercans”), collect, use and processes Personal Data (as defined below) about you during and after your working relationship with us.

Mercans collects and processes your Personal Data for one of the following reasons:

• You are a current or former employee of Mercans;
• You are a contractor or independent consultant of Mercans;
• You are employed by Mercans in connection with the provision of Global Employment Outsourcing services to the entity which identified you as a worker to be employed by Mercans (“Client”);
• Your employer has contracted or is contemplating contracting Mercans to process your Personal Data on their behalf in connection with the provision of certain business process outsourcing services;
• You are a candidate seeking employment with Mercans or one of its Clients.

This notice does not form part of any contract of employment, a contract to provide services or any other contract. We may update this notice at any time.

It is important that you read this notice, together with any other privacy notice we may provide on specific occasions when we are collecting or processing personal information about you, so that you are aware of how and why we are using such information.

Data Controller/Processor

Typically, Mercans is a data controller. This means that we are responsible for deciding how we hold and use personal information about you. We are required under data protection legislation to notify you of the information contained in this privacy notice.

However, in certain circumstances Mercans may be a data processor, processing your Personal Data on behalf of another Data Controller; i.e. your employer, etc. The responsibilities defined in GDPR for the data processors, will apply in those cases.

Data protection principles

We will comply with data protection law. This says that the personal information we hold about you must be:

• Used lawfully, fairly and in a transparent way;
• Collected only for valid purposes that we have clearly explained to you and not used in any way that is incompatible with those purposes;
• Relevant to the purposes we have told you about and limited only to those purposes;
• Accurate and kept up to date;
• Kept only as long as necessary for the purposes we have told you about;
• Kept securely.

Types of personal data processed

Depending on the circumstances, we may collect, store, and use the following categories of personal information about you:

• Personal contact details such as name, title, addresses, telephone numbers, and email addresses
• Date of birth
• Gender
• Marital status and dependents
• Next of kin and emergency contact information
• National ID, taxpayer or social security number
• Bank account details, payroll records and tax status information
• Salary, annual leave, pension and benefits information
• Start date(s) of job roles
• Location of employment or workplace
• Copy of identity documents, such as passport, driving license, utility bill
• Recruitment information (including copies of right to work documentation, references and other information included in a CV or cover letter or as part of the application process)
• Employment records (including job titles, work history, working hours, training records and professional memberships)
• Salary/payments history
• Educational records
• Performance information
• Disciplinary and grievance information
• CCTV footage and other information obtained through electronic means such as telephone recordings, email usage data, internet usage data and swipe card records
• Information about your use of our information and communications systems
• Photographs

We may also collect, store and use the following “special categories” of more sensitive personal information:

• Information about your health relevant to your work, including, for example, any medical condition, health and sickness records
• Information about criminal convictions and offences

All of this information, and other personal information which may be collected and processed by Mercans, will be referred to collectively, in this Information Notice, as “Personal Data“.

How may your personal information be collected?

Mercans may collect personal information about employees, workers, contactors, candidates and individuals at clients or potential clients of ours in a number of different ways, including directly from you. This includes through an application and recruitment process, either directly from candidates or sometimes from another employment agency, employment business or background check provider. We may sometimes collect information from third parties including your current and former employers, credit reference agencies or other background check agencies.

Individuals at Clients may provide us with their contact details as part of a discussion about our services.

We may also collect personal data which is publicly available on websites such as jobs boards, LinkedIn, or similar recruitment-related websites. We may use third-party applications which source their data from publicly- available websites.

Purpose, legal basis and mandatory / discretionary nature of the processing

We will only use your personal information when the law allows us to. Most commonly, we may use your personal information in the following circumstances:

• Where we are taking steps at your request prior to entering into a contract;
• Where we need to perform a contract which we have entered into with you;
• Where we need to comply with a legal obligation;
• Where it is necessary for our legitimate interests (or those of a third party) and your interests and fundamental rights do not override those interests.

We may also use your personal information in the following situations, which are likely to be rare:

• Where it is necessary to protect the vital interests of you or another person.
• Where it is needed in the public interest or for official purposes.

Your Personal Data may also be processed by Mercans for accounting, administrative and human resource management purposes, including in order to manage Mercans’ relationships with social security and welfare institutions, as well as with the Tax Authorities and credit institutions regarding payment of wages / other remuneration, and to comply with any legal obligations connected with the services you provide to Mercans.

If you fail to provide personal information

If you fail to provide certain information when requested, we may not be able to perform the contract we have entered into with you (such as paying you or providing a benefit), or we may be prevented from complying with our legal obligations (such as to ensure the health and safety of our workers).

Change of purpose

Mercans will only use your personal information for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose. If we need to use your personal information for an unrelated purpose, we will notify you and we will explain the legal basis which allows us to do so.

We may process your personal information without your knowledge or consent where this is required or permitted by law.

Recipients and transfers of Personal Data

Your Personal Data may be shared with:

1. The Client;
2. Persons authorised by Mercans to process Personal Data, who have signed a confidentiality agreement (e.g., certain employees in Mercans’ Human Resources / Administration departments), including system administrators, who may have access to Personal Data during the performance of their duties. A list of names of all such persons authorised could be made available upon written request.
3. Payroll processing companies, consultants, social security and welfare organizations, trade unions, credit institutions and any other companies which may be engaged for accounting, administrative and technical maintenance purposes, as well as other entities which typically act as data processors on Mercans’ behalf;
4. Public authorities, bodies or entities to which Personal Data must be communicated under the applicable law or under binding orders from competent authorities; and
5. Other companies within Mercans’ Group.

Your Personal Data may be transferred to Recipients located in several different countries. We may transfer your personal information outside the EU. Mercans implements appropriate safeguards to ensure the lawfulness and security of these Personal Data transfers, such as by relying on adequacy decisions from the European Commission, written agreements including standard data protection clauses adopted by the European Commission, or other safeguards or conditions considered adequate to the transfer at hand.

Do we need your consent?

We do not need your consent if we use special categories of your personal information in accordance with our written policy to carry out our legal obligations or exercise specific rights in the field of employment law. In limited circumstances, we may approach you for your written consent to allow us to process certain particularly sensitive data. If we do so, we will provide you with full details of the information that we would like and the reason we need it, so that you can carefully consider whether you wish to consent. You should be aware that it is not a condition of your contract with us that you agree to any request for consent from us.

Information about criminal convictions

We may only use information relating to criminal convictions where the law allows us to do so. This will usually be where such processing is necessary to carry out our obligations and provided we do so in line with our data protection policy. Less commonly, we may use information relating to criminal convictions where it is necessary in relation to legal claims, where it is necessary to protect your interests (or someone else’s interests) and you are not capable of giving your consent, or where you have already made the information public.

Mercans will only collect information about criminal convictions if it is appropriate given the nature of the role and where we are legally able to do so. Where appropriate, we will collect information about criminal convictions as part of the recruitment or immigration processes or we may be notified of such information directly by you in the course of you working for us. We may use information about criminal convictions and offences in the following ways:

• For considering your suitability for a role with clients or with us;
• For processing you immigration applications;
• For sharing with the government authorities, when legally required to do so.

Retention of Personal Data

Mercans will only retain your Personal Data for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements. To determine the appropriate retention period for personal data, we consider the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal requirements.

In some circumstances we may anonymise your personal information so that it can no longer be associated with you, in which case we may use such information without further notice to you. Once you are no longer an employee, worker, contractor or candidate of the company or an individual working at a Client or potential Client of ours, we will retain and securely destroy your personal information in accordance with applicable laws and regulations.

Further information on retention periods is available, upon request to Mercans, at: [email protected].

Your duty to inform us of changes

It is important that the Personal Data we hold about you is accurate and current. Please keep us informed if your Personal Data changes during your working relationship with us.

Your rights

As a data subject, you are entitled to exercise the following rights, at any time:

• Access your Personal Data being processed by Mercans (and / or obtain a copy of those Personal Data), as well as information on the processing of your Personal Data;
• Correct or update your Personal Data being processed by Mercans, where it may be inaccurate or incomplete;
• Request the erasure of your Personal Data being processed by Mercans, where you feel that the processing is unnecessary or otherwise unlawful;
• Request the restriction of the processing of your Personal Data, where you feel that the Personal Data processed is inaccurate, or that the processing is unnecessary or unlawful, as well as where you have objected to the processing;
• Portability – the right to obtain a copy of the Personal Data you provided to Mercans in a structured, commonly used and machine-readable format, as well as to request the transmission of those Personal Data to another data controller;
• Object to the processing of your Personal Data, based on relevant grounds related to your particular situation, which you believe must prevent Mercans from processing your Personal Data for a given purpose; and
• Withdraw your consent to processing, where your consent serves as the legal basis for processing – this will not affect the lawfulness of processing carried out prior to your withdrawal.

Requests to exercise any of the above rights must be sent in writing to Mercans at the following address: [email protected].

In any case, you are always entitled to lodge a complaint with the competent supervisory authority, if you believe that Mercans’ processing of your Personal Data is in violation of the applicable law.

What we may need from you

Mercans may need to request specific information from you to help us confirm your identity and ensure your right to access the information (or to exercise any of your other rights). This is another appropriate security measure to ensure that personal information is not disclosed to any person who has no right to receive it.

Right to withdraw consent

In the limited circumstances where you may have provided your consent to the collection, processing and transfer of your personal information for a specific purpose, you have the right to withdraw your consent for that specific processing at any time. To withdraw your consent, please write to us at [email protected]. Once we have received notification that you have withdrawn your consent, we will no longer process your information for the purpose or purposes you originally agreed to, unless we have another legitimate basis for doing so in law.

Changes to this privacy notice

Mercans reserves the right to update this privacy notice at any time, and we will provide you with a new privacy notice when we make any substantial updates. We may also notify you in other ways from time to time about the processing of your personal information.

If you have any questions about this data protection / privacy notice, please contact us at [email protected].