Members, Directors and Officers Privacy Notice

Introduction

Revell Research Systems Limited (the Company, we, us, our) is providing you with this information in order to comply with the Data Protection Act 2018 and the UK General Data Protection Regulation (UK GDPR), which require us to tell you what we do with your personal information.

This notice relates to the personal data that we process as part of our governance function associated with our members, directors and officers.

Some of this personal data may include special category personal data.

This notice is not contractual. We may update this notice at any time but if we do so, we will provide you with an updated copy of this notice as soon as reasonably practical.

Who is collecting this personal data?

Revell Research Systems Limited is collecting this data as the Data Controller.

Revell Research Systems Limited is registered with the Information Commissioner in the United Kingdom as a data controller under number Z186392X.

Who are we sharing your personal data with?

We may share personal data processed under this notice, where necessary and proportionate, with the following categories of recipient:-

• The courts and those involved in legal proceedings and non-contentious matters, including solicitors and barristers
• Police and law enforcement agencies
• Our subsidiaries, our ultimate holding company and all its subsidiaries
• HM Revenue and Customs
• Other Government Agencies
• Companies House
• Vetting agencies
• Agents acting on our behalf
• Service providers (including associates)
• Our accountants, auditors and other financial advisers
• Our HR advisers
• Our insurers
• Other professional advisers

We will not sell or rent your data to third parties. We will not share it with third parties for marketing purposes.

Why are we collecting and what will we do with your personal data?

We process personal data relating to members, directors and officers to administer the Company's governance arrangements, comply with legal and regulatory obligations, maintain statutory records, manage engagements and appointments, protect health and safety, support equality and diversity initiatives where applicable and establish, exercise or defend legal claims.

In some circumstances your personal data may also be processed under additional privacy notices where information is collected for specific purposes such as staff administration, health and safety, equal opportunity monitoring, remote monitoring, websites and online services, usage logs or telephone recording.

We process your personal data under this notice in order to:-

• fulfil our contractual obligations to you
• comply with our legal obligations
• understand equality and diversity within governance
• ensure your safety
• defend legal claims

We are legally obliged to collect, retain and disclose certain information about you, for example to fulfil our statutory reporting duties and comply with other obligations. We believe we have legitimate interests in requesting and holding emergency contact information for you if you are a director or officer.

As a director or officer, we may process information relating to criminal convictions and offences where this is necessary, appropriate and permitted by law.

Where you choose to provide equality, diversity or inclusion information, processing is governed by our Equal Opportunity Monitoring Privacy Notice.

We specifically use your personal data as a member to:-

• communicate with you
• process dividend and other similar payments
• maintain statutory records
• make statutory disclosures

We specifically use your personal data as a director or officer to:-

• maintain accurate contact details (including who to contact in an emergency)
• assess your suitability to work for us
• comply with statutory and/or regulatory requirements and obligations
• make reasonable adjustments to accommodate your needs
• comply with disability discrimination legislation
• maintain an accurate record of your engagement terms
• administer the contract engaging you
• process fee or other similar payments
• record financial transactions between you and the Company
• comply with your statutory and contractual rights
• prepare financial and management accounts
• conduct internal and external audits
• provide director or officer insurance cover
• enable us to establish, exercise or defend possible legal claims

We may process this data for the purpose of the proper administration of our business and in communicating with you as well as maintaining backups.

We may share data with the courts and associated professionals in establishing, exercising or defending our legal rights. We may share data in reporting crime to or when co-operating with the police and law enforcement agencies.

Please note that we may process your personal information without your consent, in compliance with these rules, where this is required or permitted by law.

What is the legal basis for processing?

Our lawful bases are Consent, Contract, Legal Obligation, Vital Interests and Legitimate Interests.

• consent - we process some special category personal data about you with your explicit consent for assessing inclusion and diversity within the Company, which you may withdraw at any time.
• contract - the Company processes your personal data because of the contract engaging you to work for us or that exists between you and the Company as a member.
• legal obligation - the Company has legal obligations to share your personal data with various government agencies including Companies House.
• vital interests - we may share your personal data as a director or officer to protect your or another's vital interests in the event of an emergency.
• legitimate interests - the Company has legitimate interests in properly administering its business and backing up data.

These lawful bases are detailed in Article 6 of the UK General Data Protection Regulation (UK GDPR):-

• the data subject has given consent to the processing of his or her personal data for one or more specific purposes (Article 6(1)(a)).
• processing is necessary for the performance of a contract to which the data subject is party or to take steps at the request of the data subject prior to entering into a contract (Article 6(1)(b)).
• processing is necessary for compliance with a legal obligation to which the controller is subject (Article 6(1)(c)).
• processing is necessary in order to protect the vital interests of the data subject or of another natural person (Article 6(1)(d)).
• processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child (Article 6(1)(f)).

We process special category personal data (UK GDPR Article 9(1)) under the regulation because:-

• processing is necessary for the purposes of carrying out the obligations and exercising specific rights of the controller or of the data subject in the field of employment and social security and social protection law in so far as it is authorised by Union or Member State law or a collective agreement pursuant to Member State law providing for appropriate safeguards for the fundamental rights and the interests of the data subject (Article 9(2)(b)).
• processing is necessary to protect the vital interests of the data subject or of another natural person where the data subject is physically or legally incapable of giving consent (Article 9(2)(c)).
• processing is necessary for the establishment, exercise or defence of legal claims or whenever courts are acting in their judicial capacity (Article 9(2)(f)).
• processing is necessary for the purposes of preventive or occupational medicine, for the assessment of the working capacity of the employee, medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems and services on the basis of Union or Member State law or pursuant to contract with a health professional and subject to the conditions and safeguards referred to in paragraph 3 (Article 9(2)(h)).

How are we collecting this information?

We acquire information about you from the following sources:-

• Directly from you
• Referees
• Vetting agencies
• HM Revenue and Customs
• Government agencies

What information are we collecting?

We collect, process, hold and share the following categories of personal data about members:-

• your name and style of address
• postal address
• telephone numbers
• email address
• gender
• date of birth
• your bank account details

We collect, process, hold and share the following categories of personal data about directors and officers:-

• your name and style of address
• gender
• date of birth
• home address, personal telephone numbers and private email addresses
• other contact details
• your emergency contact and next of kin details
• the start and end dates of your engagement
• your CV, any application form, covering letter, interview notes, references, evidence of your qualifications and other background documentation
• the terms and conditions of the engagement
• related correspondence
• photographs
• your bank account details

The Company may also collect, use and process information about criminal convictions and offences.

Please note that our Equal Opportunity Monitoring Privacy Notice will apply to you if you elect to provide us with special category personal data for that purpose.

Who can see your information within the Company?

Access to your personal data is restricted to authorised directors, staff and associates who require it for legitimate business purposes.

How long is your information kept?

We will only keep your information for as long as necessary. The retention period is either dictated by law or our legitimate requirements. Once your information is no longer needed it will be securely and confidentially destroyed.

We retain statutory records relating to members, directors and officers for as long as necessary to comply with company law, regulatory requirements and legitimate business needs. Certain records may be retained permanently as part of the Company's statutory records and corporate history.

How secure is your information?

We take appropriate technical and organisational measures to protect your information against unauthorised access, disclosure, alteration and destruction. You can read more about our approach to security at www.rrs.co.uk/security.

Who keeps your information updated?

You are responsible for keeping your personal details up-to-date. Please advise the Company of any changes.

Will your information be used for any automated decision making?

No. We do not undertake solely automated decision making, including profiling, that produces legal effects concerning you or similarly significantly affects you.

Our Privacy Statement

You can access the Company's Privacy Statement at www.rrs.co.uk/privacy. This statement provides you with more information about how we address data protection and privacy as well as informing you of your rights.

Other Privacy Notices

You are likely to interact with us in more than one way, so our other privacy notices may apply to you in different scenarios. We are open and transparent about how we use your personal data. You can find all of our Privacy Notices at www.rrs.co.uk/privacy.

Changes to this Notice

Any changes to this privacy notice will take effect when the revised notice is published. If these changes affect how your personal data is processed, the Company will take reasonable steps to make sure you know.

Further Information