Associates privacy policy

TCC and Recordsure act as Data Controllers and are committed to safeguarding the personal information of Associate or prospective Associate personnel. This notice explains what personal information we collect, the legal basis for processing it, how we use it and who we share it with.

TCC & Recordsure — Data Controller

10 Lower Thames Street, London, EC3R 6EN

Email: dataprotection@tcc.group

Tel: 020 3772 7230

Data may be collected directly, passively or indirectly. Categories include:

• Contact information: name, address, phone numbers, email, emergency contacts
• Personal information: date of birth, birthplace, gender, marital status, nationality, languages, photos, biometrics
• Residency status: right to work, passport, visa documentation
• Employment information: start and end dates, job title, grade, department, duties, performance, compensation, banking details, leave records, CV, references
• Education and training: qualifications, certifications, technical skills, training records
• Special category data: health, sickness, physical limitations, work restrictions
• Financial and background: credit checks, county court judgements, criminal background, fraud and sanctions checks
• Communication information: voicemails, emails and correspondence via company systems
• Photographs and images for marketing (with consent)

Indirect sources include:

• Recruitment agencies and umbrella companies
• Past employers (references)
• Security and background screening providers
• LinkedIn and social media
• Client, employee feedback or referrals

Data is processed only where a legal basis exists, primarily to assess candidacy and manage associate contracts.

Contractual necessity

Enables us to enter into and manage the associate role and contract.

Consent

Required before sharing photos, videos, images or biographical information in marketing, or sharing data with third-party clients for marketing or proposals.

Legal obligation

Compliance with FCA regulation, employment law, social security law and the establishment or defence of legal claims.

Legitimate interest

• Providing relevant opportunities and assessing candidacy
• Maintaining relationship and communication records
• Recording work previously conducted for TCC
• Business development contact (phone and email)
• Improving our services and communications
• Understanding experience and interests for future opportunities
• Emergency and disaster recovery communication
• Internal bulletins and newsletters
• Regulatory and business updates

You have the right to object to processing for which we rely on legitimate interest — contact dataprotection@tcc.group.

We will respond to any request within one month. Proof of identity may be required. Submit requests to:

Email: dataprotection@tcc.group

Post: TCC & Recordsure, 6th Floor, 10 Lower Thames Street, London, EC3R 6EN

Tel: 020 3772 7230

Prospective associates

Refusal to provide required data may result in removal from candidate shortlists.

Current associates

Obligations exist under the associate contract. Withholding data such as banking details prevents contractual performance. Objecting to screening data may prevent FCA certification from being maintained.

Data is shared internally with Finance, line managers, business area managers and IT staff, limited to what is necessary for their role.

Third-party providers may include:

• CRM systems (e.g. Salesforce)
• Disclosure and Barring Service and credit check providers
• Cifas (fraud checks)
• Vetting and onboarding check providers
• Umbrella companies
• Third-party meeting room providers
• HR and payroll systems
• Purchasing, invoicing and timesheet providers
• Accounting and banking providers
• Email and file storage providers
• Backup systems
• Travel and expense management providers
• Legal advisors (employment law)
• Company clients (billing, workflow, system access)
• Third-party auditors (ISO certification)

All third-party processors are required to have adequate data protection measures in place. Recordsure does not sell personal data to third parties.

• Data is retained only as long as necessary for the original purposes or while a legal basis exists.
• Personal data is erased six years from last contact.
• Data is deleted or fully anonymised when it is no longer necessary.
• We will update data if it is found to be inaccurate or outdated.

• Internal policies against accidental or unlawful destruction, loss, alteration or unauthorised access
• Access restricted to authorised employees only
• Physical, electronic and managerial safeguards
• All data stored on servers within the EEA — no processing outside the EEA

We encourage you to keep your personal information current. If any of your details change, please send an update to dataprotection@tcc.group.

Queries or complaints may be directed to dataprotection@tcc.group. You also have the right to contact the Information Commissioner’s Office (ICO):

Website: ico.org.uk

Helpline: 0303 123 1113

Back to Privacy Policy