Privacy.

We are a managed service provider who also provide products and services for customer consumption. We collect the personal data of the following types of people to allow us to undertake our business;

• Prospective customers
• Existing customers
• Supplier contacts to support our services
• Employees, consultants, temporary workers. We collect information about you to carry out our core business and ancillary activities

How we obtain your Personal Data at BOM Group Limited, Public Information you give us or we may collect from you. We may collect information about you when you fill in forms on the
company website or by corresponding with us by phone, e-mail or otherwise. It includes information you provide when you register to use our site, to download information, to enter our database, subscribe to our services, attend our events, participate in discussion boards or other social media functions on our site or enter a competition, promotion or survey.

The information you give us or we collect about you may include:

• Information contained in your CV or job application such as your name, address, private and corporate e-mail address and phone number
• Information contained in any documents that you send to any of us for identity verification purposes such as your passport or driving licence
• Financial information, compliance documentation
• Links to your professional profiles available in the public domain e.g. LinkedIn or Twitter
• Information that you provide about yourself when negotiating or entering into a contract with us
• Information we collect about you when you visit our websites. With regard to each of your visits to our website we will automatically collect the following information:
• Information that you provide by filling in forms on any of our websites. This includes information provided to us at the time of registering to use any of our website (where applicable)
• Subscribing to any of our services (where applicable)
• Technical information relating to your visits including, but not limited to, traffic data, location data, weblogs, other communication data and the resources that you access
• Information when you respond to a survey and/or when you report a problem with our website
• Information we obtain from other sources. This is information that we obtained about you from other sources such as LinkedIn

Our prospective employee’s information is checked with credit reference agencies, organisations who process criminal checks (with your prior consent), state authorities such as driver and vehicle licensing authorities, and any other pre-engagement or pre- employment screening providers prior to the start of employment. This may include information about you from them for the purposes of pre- employment. Special Categories of Data Diversity We may ask you for some ethnicity and diversity information to support our own equal opportunities monitoring, to the extent permissible by law. This could be information about your ethnic background, gender, disability, age, sexual orientation, religion or other similar beliefs and/or social-economic background. Providing this information is entirely voluntary and will not adversely affect your employment. It will be used for statistical analysis and equality monitoring only. In the UK we are required to comply with the Equality Act 2010 and therefore have a legitimate interest in understanding the composition of our workforce. If we ask you to provide diversity data which requires your explicit consent to processing, we will always ask for your consent first.

To the extent that we collect your personal data from the United Kingdom or Europe, and depending on the purpose for which we hold and process your data, we will rely on one or more of the following legal grounds to process your data:

a) Legitimate Interests – We will rely on legitimate business interests to process your personal data to carry out normal business dealings. For pre-employment workflow to carry out preengagement and pre-employment screening services (except where we are required to obtain explicit consent to carry out a check). The exchange of personal data of our candidates and our client contacts is a fundamental, essential part of this process. Legitimate Interests means the interests of the Company in conducting and managing our managed services and ancillary solutions or as part of Human Resource management. For example, we have an interest in ensuring that the information provided in your CV and/or job application is correct and that you have the necessary skills and experience to meet our requirements or to provide authorised BOM Group Limited employee/contractor access to customer data to meet our obligations as set out in customer Master Service Agreements Legitimate Interests can also apply to the processing of data that is in your interests. For example, we only wish to employ the right, suitably qualified, members to ensure the right skills and knowledge is in place to deliver contracted services. Where you have requested information about our services via our website we also rely on legitimate interest to inform you about similar services and products. When we process your personal data, we make sure we consider and balance any potential impact on you (both positive and negative), and your rights under data protection laws. We will not use your personal data for activities where our interests are overridden by the impact on you (unless we have your consent or are otherwise required or permitted to by law).

b) Necessary for the performance of a contract – We will rely on a contract if you are appointed to undertake an assignment on behalf of a client (whether as a contractor or temporary worker), however, written authorisation must be provided prior to any confidential information or service is provided. Your personal data will be processed as necessary throughout the assignment in order to perform the contract. For example, when the delivered service has been concluded. We will also make sure you comply with your obligations under the contract. We will also rely on the contract if we are negotiating or have entered into a contract to provide services to you or receive services from you or your organisation.

c) Necessary for compliance with a legal obligation – We will rely on legal obligation if we are legally required to hold information on you to fulfil our legal obligations. For example, if you are a limited company contractor engaged on an assignment HMRC requires that we submit regular reports to them detailing the payments which we make to you and other information as set out in The Income Tax (Pay as You Earn) (Amendment No.2) Regulations 2015.

d) Consent – Should we want or need to rely on consent for processing activities, we will request consent verbally, by email or by an online process for the specific activity we require consent for. Your responses will be recorded on our system. Where consent is the lawful basis for our processing you have the right to withdraw your consent to this particular activity at any time by emailing privacy@bom.co.uk.

We will take all steps reasonably necessary to ensure that your information is treated securely and in accordance with this Privacy Notice. All information that you provide to us in physical form such as documents will be stored securely at our offices or at a secure storage facility. All information you provide to us electronically is stored on our secure servers. If you agree to us sending you documents electronically for signing your email address and a copy of the relevant document will be sent to you via DocuSign with whom we have appropriate arrangements in place to protect your personal data and comply with data protection laws. Unfortunately, sending information to us via post, email or the internet is not completely safe and secure.

Although we will do our best to protect your personal data, we cannot guarantee the security of your information sent to us by any of these means and any information sent to us in this way is at your own risk. Once we have received your information, we will each use strict procedures and security features to try to prevent unauthorised access and require our suppliers to do the same.

We will do so until you ask us to stop by contacting us via sales@bom.co.uk or at the address below. Our websites may, from time to time, contain links to and from the websites of our partner networks, advertisers and affiliates. If you follow a link to any of these websites, please note that these websites have their own privacy policies and that we do not accept any responsibility or liability for these policies. Please check these policies before you submit any personal information to these websites.

You have the right to:

• Request correction of personal data that we hold about you. This enables you to have any incomplete or inaccurate information we hold about you corrected
• Request erasure of your personal data. This enables you to ask us to delete or remove personal data where there is no good reason for us continuing to process it
• You also have the right to ask us to delete or remove your personal data where you have exercised your right to object to processing (see below)
• Object to processing of your personal data including where we are processing your personal data for direct marketing purposes
• Request the restrictions of processing of your personal data. This enables you to ask us to suspend the processing of personal data about you, for example if you want us to establish its accuracy or the reason for processing it
• Make a complaint to a supervisory body which in the United Kingdom is the Information Commissioner’s Office. The ICO can be contacted at: https://ico.org.uk/concerns/

If you want to contact us to exercise any of your rights, you can write to BOM Group Limited, Clue House, Central Park Industrial Park, Petherton Road, Bristol, BS14 9BZ or contact us by email at privacy@bom.co.uk.

Comments and requests regarding this Privacy Notice are welcomed and should be addressed to privacy@bom.co.uk.