Website
Privacy Notice
1 Introduction
Brand 22 Ltd (“Brand Twenty Two”, “we, “us”, “our”), of 1 Vincent Square, London, SW1P 2PN, a company registered in England, registration number 13901722, is committed to protecting the privacy and security of the personal data we collect about website visitors, users of our services and end customers (“you”, “your”).
The purpose of this privacy notice is to explain what personal data we collect about you when you visit our website or use our services. When we do this, we are the Controller of the personal data we process, registered in the UK with the Information Commissioner’s Office (“ICO”), registration number ZB319539.
Please read this privacy notice carefully as it provides important information about how we handle your personal information and your rights. If you have any questions about any aspect of this privacy notice, you can contact us using the information provided below (in the Contact us section).
We update this privacy notice from time to time in response to changes in applicable laws and regulations, to our processing practices and to the products and services we offer. When changes are made, we will update the date at the top of this document. Please review this privacy notice periodically to check for updates.
2 Personal data we collect
Brand Twenty Two is primarily a business-to-business service provider, as such we may collect the personal data of employees of our business customers. We may collect the following categories of personal data:
For the provision of our products and services:
first name and surname;
job title;
business name;
business email address; and
business or personal phone numbers.
Relating to use of our cloud-based secure storage solution:
username;
password;
IP addresses (logged for data security purposes);
files and folders accessed; and
time stamp of all activity.
With regard to each of your visits to our website or our cloud-based secure storage solution, we may automatically collect technical information, including:
the IP address used to connect your computer to the internet;
your login information;
browser type and version;
time-zone setting;
browser plug-in types and versions; and
operating system and platform.
We may also collect other information about your visit, including:
the full URL clickstream to, through and from our site (including date and time);
products and services you viewed or searched;
page response times;
download errors;
length of visits to certain pages;
page interaction information (such as scrolling, clicks and mouse-overs);
methods used to browse away from the page.
Information we receive from other sources.
We may receive information about you from any other websites we operate or from other third parties including:
business partners;
sub-contractors in technical, payment and delivery services;
advertising networks;
analytics providers; and
search information providers.
3 Purposes for which we use personal data and the legal bases
When providing services to you, we may use your personal data for the following purposes and on the following lawful bases:
Purpose
Responding to correspondence from you.
Lawful Basis for Processing
It is in our legitimate interest to respond to enquiries made via our website, by email, through our social channels or any other means.
Purpose
Sending you information such as product information which may be of interest.
Lawful Basis for Processing
If you are an existing customer or have expressed an interest in our products or services, we will rely on legitimate interests to contact you for marketing purposes. You may object to the processing for this purpose by emailing privacy@brandtwentytwo.com. If we have captured your consent for the purposes of marketing, that consent may be withdrawn at any time by emailing privacy@brandtwentytwo.com.
Purpose
Provision of our services.
Lawful Basis for Processing
Processing is necessary for performance of the contract between us.
Purpose
Business management, forecasting and statistical purposes.
Lawful Basis for Processing
It is our legitimate interest to identify areas for managing current business relationships, develop new products and services, and for managing our business.
Purpose
Maintenance of physical security and ensuring the health and safety of employees and on-site visitors
Lawful Basis for Processing
We have a legitimate interest in maintaining secure, safe premises for employees and on-site visitors and to protect company property.
Purpose
Improving our websites and the overall website visitor and user experience.
Lawful Basis for Processing
It is our legitimate interest to allow analytics and search engine providers to help improve and optimise our websites.
Purpose
Improving our websites and the overall website visitor and user experience.
Lawful Basis for Processing
We use cookies on our websites with your consent, unless they are strictly necessary cookies, in which case your consent is not required.
Where personal data is processed because it is necessary for the performance of a contract to which you are a party, we will be unable to provide our services without the required information.
4 Sharing your data
It is unlikely that we will ever share your personal data outside the UK. If a business need arises and it becomes necessary for us to share your data outside the UK for the purposes of providing our services to you, we will only share it with organisations in countries which benefit from a UK Adequacy Regulation, or if not, by using the UK International Data Transfer Agreement, which contractually obliges the recipient to process and protect your personal data to the standard expected within the UK.
5 How long we keep your data
We will retain your personal data for as long as is necessary to provide you with our services and for a reasonable period thereafter to enable us to meet our contractual and legal obligations and to deal with complaints and claims.
At the end of the retention period, your personal data will be securely deleted or anonymised, for example by aggregation with other data, so that it can be used in a non-identifiable way for statistical analysis and business planning. Retention periods are detailed within our Personal Data Retention Policy, available upon request.
6 How we protect your data
We implement appropriate technical and organisational measures to protect data against unauthorised or unlawful processing and against accidental loss, destruction or damage.
In addition to the technical and organisational measures we have put in place, there are simple things you can do to in order to further protect your personal information, such as:
Never share One Time Passcodes (OTPs);
Never enter your details after clicking on a link in an email or text message;
Always send confidential information by encrypted email to reduce risk of interception;
if you are logged into any online service do not leave your computer unattended;
Close down your internet browser once you have logged off;
Never download software or let anyone log on to your computer or devices remotely, during or after a cold call; and
You can easily identify secure websites by looking at the address in the top of your browser which will begin https:// rather than http://.
7 Your data protection rights
There are certain fundamental rights that you have in respect of your personal data:
Rights
Right to be informed.
Description
Individuals have the right to be informed about the collection and use of their personal data.
Rights
Right of access.
Description
Individuals have the right to receive a copy of their personal data, and other supplementary information.
Rights
Right to rectification.
Description
Individuals have the right to have inaccurate personal data rectified or completed if it is incomplete.
Rights
Right to erasure (the ‘right to be forgotten’).
Description
Individuals have the right to request their personal information to be erased, in certain circumstances.
Rights
Right to restrict processing
Description
Individuals have the right to request the restriction or suppression of their personal data, in certain circumstances, in particular:
if your data is not accurate;
if your data has been used unlawfully but you do not want us to delete it;
if your data is no longer needed, but you want us to keep it for use in legal claims; or
if you have already asked us to stop using your data but you are waiting to receive confirmation from us as to whether we can comply with your request.
Rights
Right to data portability.
Description
Individuals have the right to obtain and reuse their personal data, in a machine-readable format, for their own purposes across different services, in certain circumstances.
Rights
Right to object.
Description
Individuals have the right to object to the processing of their personal data, in certain circumstances
Where we are using your personal data because it is in our legitimate interests to do so, you can object to us using it this way
Where we are using your personal data for direct marketing, including profiling for direct marketing purposes, you have an absolute right to ask us to stop doing so
Rights
Rights with respect to automated decision-making and profiling.
Description
Individuals have the right not to be subject to a decision based solely on automated processing (including profiling) that produces legal effects concerning you or similarly significantly affects you.
In addition to the above, an individual also has the following rights:
Rights
Right to withdraw consent.
Description
Where we are using your personal data based on your consent, you can withdraw your consent at any time.
Rights
Right to lodge a complaint with a supervisory authority.
Description
You have the right to raise a complaint about how we handle your personal information with the ICO.
8 Exercising your data protection rights
You will not have to pay a fee to access your personal data (or to exercise any of the other rights). However, we may charge a reasonable fee if your request for access is clearly unfounded or excessive. Alternatively, we may refuse to comply with the request in such circumstances.
9 Contact us
If you would like to exercise your statutory data protection rights, or if you have any concerns or questions about how we handle personal data, please contact us using the details below:
Brand 22 Ltd
1 Vincent Square
London
SW1P 2PN
Our telephone number is +44 (0)20 3093 0611
Alternatively, you can email us at privacy@brandtwentytwo.com
10 Raising a complaint with the UK data protection supervisory authority
If you believe that you have exhausted all possible avenues of resolving your data protection concerns with us, you may lodge a complaint with the ICO.
The ICO Helpline and can answer your data protection enquiries on 0303 123 1113.
You can also send your postal correspondence to:
Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
Alternatively, you can contact them at https://ico.org.uk/make-a-complaint/.
Job Applicant
Privacy Notice
1 Introduction
Brand 22 Ltd (“Brand Twenty Two”, “us”, “we”, “our”) are committed to protecting your privacy and meeting our legal obligations when you apply for a job or you (or an agent acting on your behalf) share your employment details with us.
This privacy notice explains what personal data we collect and use relating to employment and associate candidates (“you”,“your”) during the recruitment process.
As an information-led business, we place great importance on ensuring the quality, confidentiality, integrity, and availability of the data we hold, and in meeting our data protection obligations where we process personal data. We are committed to protecting the security of your personal data. We use a variety of technical and organisational measures to help protect your personal data from unauthorised access, use or disclosure.
We update this privacy notice from time to time in response to changes in applicable laws and regulations, to our processing practices and to products and services we offer. When changes are made, we will update the effective date at the top of this document.
2 What personal data do we process?
Personal data means any information about an individual from which that person can be identified, therefore does not include data where the identity of the person has been removed (anonymous data). There are “special categories” of more sensitive personal data which require a higher level of protection. Brand 22 Ltd is the Controller of the personal data we hold about you, registered in the UK with the Information Commissioner’s Office (“ICO”), registration number ZB319539.
When you apply for a position, whether as an employee, worker, consultant, contractor or intern, or submit your CV (or similar employment information) to us, whether directly or through an agency, or attend an interview in person or by remote means, we will collect your personal data. This may include (but is not limited to):
Name and contact details (address, mobile phone number and email address);
Company details (where applicable);
Date of birth and gender;
Work history and employment positions held;
Salary, other compensation, and benefits information;
Nationality / visa / work permit information (where applicable);
Academic and professional qualifications, education, and skills;
Photographs you may submit with your application;
Demographic information;
Records we create during interviews or correspondence with you;
Results of pre-employment screening checks such as references or DBS checks (where applicable); and
Any other information you choose to give us.
We may also collect special category data in accordance with the Equality Act 2010. We will only do this, for example, to make reasonable adjustments to enable all candidates to apply for vacancies, attend interviews and to commence employment. This is also necessary to ensure we meet our legal obligations when recruiting.
3 Purposes and bases for using your personal data
We will process your personal information for the following purposes and under the following lawful bases:
Purpose
To respond to your employment enquiry.
Lawful Basis for Processing
We have a legitimate interest to contact you regarding your application, to arrange an interview and to inform you of your progress through the recruitment process.
Purpose
To assess your suitability for the role.
Lawful Basis for Processing
Processing is necessary for taking steps to enter into a contract with you or for the performance of our contract with you.
Purpose
To make reasonable adjustments for you during the interview process and comply with our legal obligations under the Equality Act 2010.
Lawful Basis for Processing
Processing is necessary for us to comply with our legal obligations.
For special category data, the additional basis that we rely on relates to our obligations in the field of employment and the safeguarding of your fundamental rights.
Purpose
To conduct pre-employment screening checks including checking your identity and your right to work in the UK.
Lawful Basis for Processing
Processing is necessary for us to comply with our legal obligations.
For special category data, the additional basis that we rely on relates to our obligations in the field of employment and the safeguarding of your fundamental rights.
Purpose
To contact unsuccessful applicants about future suitable vacancies.
Lawful Basis for Processing
Processing is necessary through our legitimate interest of searching for suitable candidates for future vacancies, based on their skills set out in the records we hold about candidates.
4 Sensitive personal data
We will only process sensitive ‘special category’ personal data where we meet one of the conditions required by law for doing so. This includes complying with legal obligations or exercising specific rights in the field of employment law. We may also ask for your explicit consent to process some special categories of personal data.
We process special categories of personal data when we collect or process information about your physical or mental health, or disability status, to ensure your health and safety in the workplace and to assess your fitness to work and to provide appropriate workplace adjustments.
5 Sharing of your information
We may share your data with service providers and suppliers to our business who process data on our behalf. In such cases, our service providers and suppliers are data processors and may only use the data in line with our instructions and not for any other purpose. This and other obligations are agreed in the written contract between Brand Twenty Two and the service providers and suppliers.
Where we need to transfer or store your personal data outside the UK, we will only do so relying on either an Adequacy Regulation (the UK equivalent of an EU Adequacy Decision), the UK International Data Transfer Agreement (the UK equivalent of the EU-approved Standard Contractual Clauses), or another approved international data transfer mechanism, which contractually oblige third party organisations in those countries to comply with the same data protection standards as legislated within the UK.
Within Brand Twenty Two, your personal data will only be shared with those who need to have access to it, which will primarily be our HR personnel and hiring managers.
6 How long will we retain your information?
We will retain your personal data for only as long as is necessary for the recruitment process. If your candidacy is successful and you are employed or hired by us, your data will be processed and retained as set out in our employee privacy notice, provided to you with your employment paperwork.
If your candidacy is not successful, we will retain your CV, application details and interview notes for 6 months from the date we notified you we would not move forward with your application, to inform you about any future vacancies we have that may be of interest to you. Please let us know if you would like us to delete your records before our retention period lapses and we will do so.
We will also retain personal data where it is necessary to comply with our legal obligations or as necessary in relation to legal claims. This is rare but may mean we need to retain your data for longer than 6 months.
7 Your rights
Individuals whose personal data we process have the following rights:
You have the right of access to your personal data and can request copies of it and information about our processing of it
If the personal data we hold about you in incorrect or incomplete, you can ask us to rectify or add to it
Where we are using your personal data with your consent, you can withdraw your consent at any time
Where we are using your personal data because it is in our legitimate interests to do so, you can object to us using it this way
In some circumstances, you can restrict our processing of your data, request a machine-readable copy of your personal data to transfer to another service provider and compel us to erase your personal data
If you wish to exercise any of your rights, please write to us at privacy@brandtwentytwo.com.
You will not have to pay a fee to access your personal data (or to exercise any of the other rights). However, we may charge a reasonable fee if your request for access is clearly unfounded or excessive. Alternatively, we may refuse to comply with the request in such circumstances.
In addition to the above, please note that you have the right to make a complaint at any time to the ICO if you are concerned about the way in which we are handling your personal data.
8 Contact
You can contact Brand Twenty Two in relation to data protection and this privacy notice by emailing privacy@brandtwentytwo.com.