Snapshot 49066
Normalized text
Scripts and page chrome removed; this is what change detection compares.
General Compliance Policy
Lumerate Privacy Notice
Date Created: December 7, 2023
Owner: Beth Adams, COO
1
Lumerate
People Data Privacy Notice
Issued: December 2023
1. Introduction
This notice’s fundamental under-pinning is respect for one another’s privacy and the corporate
commitment to the responsible handling of personal information. More formally, this policy sets
out the personal information that is collected and processed, the purposes of the processing and
the rights that individuals have in connection with it.
2. Types of personal information collected
When applying to a posted position, personal information about you (and related individuals
whose personal information has been provided) may be collected.
The types of personal information processed may include, but are not limited to:
● Identification data – such as your name, gender, photograph, date of birth.
● Contact details – such as home address, telephone/email addresses, emergency contact
details.
● Employment details – such as job title/position, office location, employment contract,
Reflection documentation, sickness/vacation records.
● Background information – such as academic/professional qualifications, education,
CV/résumé, criminal records data (for vetting purposes, where permissible and in
accordance with applicable law).
The personal data collected by Lumerate is limited to that which is necessary for effective
business’ operations and/or to comply with necessary laws and regulations.
As a general rule, sensitive personal Information about you (e.g., racial or ethnic origins,
religious/political beliefs, sexual orientation, etc.) is not collected, unless authorized by law or
where necessary to comply with applicable laws. However, in some circumstances, some
sensitive personal information may need to be collected as authorized by law or where
necessary to comply with applicable laws, or requested on a voluntary, disclosure basis. For
example, racial/ethnic origin, gender and disability information may be collected on the basis that
it is in the public interest and/or to comply with anti-discrimination laws or for government
reporting obligations.
2
3. Sources of personal information
In most cases, you will have provided the information held about you, but there may be
situations where personal information is collected from other sources. For example:
● Certain background and other information from recruitment agencies, academic institutions,
referees, background checking agencies and other third parties during the recruiting process.
4. Purposes for processing personal information
(i) Recruitment purposes
When applying for a role at Lumerate, personal information collected and used is primarily for
recruitment purposes – in particular, to determine your qualifications for employment and to
reach a hiring decision. This includes assessing your skills, qualifications and background for a
particular role, verifying your information, carrying out reference checks or background checks
(where applicable) and to generally manage the hiring process and communicate with you about
it.
If you join Lumerate, the information collected during the recruitment process will form part of
your ongoing employment or contractual record.
If you are not successful, your application may be retained for consideration for other suitable
openings within Lumerate in the future.
(ii) Law-related purposes
Personal information may be used to comply with laws and regulations, including collecting and
disclosing personal information as required by law (e.g. for tax, health and safety,
anti-discrimination and other employment laws), or to exercise or defend our individual or
collective corporate legal rights .
5. Who we share your personal information with
Care is taken to allow access to personal information only to those who require such access to
perform their tasks and duties, and to third parties who have a legitimate purpose for accessing
it. Whenever a third party is permitted to access personal information, appropriate measures are
implemented to ensure the information is used in a manner consistent with this policy and that
the security and confidentiality of the information is maintained.
3
(i) Transfers to other group companies
Personal information may be shared within Lumerate, including any group companies that we
may set up in the future.
(ii) Transfers to third party service providers
In addition, certain personal information is made available to third parties who provide services
to Lumerate. This is done on a "need to know basis" and in accordance with applicable data
privacy law.
For example, some of this information will be made available to:
● our primary HRIS system and ATS system
● third parties who provide, support and maintain our IT and communications infrastructure
(including for data storage purposes) and/or provide business continuity services;
● third parties who provide services in relation to staff training and/or qualifications and staff
surveys; and
● auditors, advisors, legal representatives and similar agents in connection with the advisory
services they provide to us for legitimate business purposes and under a contractual
prohibition of using the personal information for any other purpose.
(iii) Transfers to other third parties
Personal information to third parties may also be disclosed on other lawful grounds, including:
● To comply with our legal obligations, including where necessary to abide by law,
regulation or contract, or to respond to a court order, administrative or judicial process,
including, but not limited to, a subpoena, government audit or search warrant;
● In response to lawful requests by public authorities (including for tax, immigration, health
and safety, national security or law enforcement purposes);
● As necessary to establish, exercise or defend against potential, threatened or actual
litigation;
● Where necessary to protect the vital interests of another person;
● In connection with the sale, assignment or other transfer of all or part of our business; or
● With your consent.
4
6. Legal basis for processing personal information (UK only)
If you are in the UK, the legal bases for collecting and using the personal information described
above will depend on the personal information concerned and its specific context. Some of the
bases relied upon are set out above.
However, we will normally collect personal information from you only where:
● it is in the legitimate interests of Lumerate (as summarized above in Section 4) (which are
not overridden by your rights, particularly taking into consideration the safeguards that are in
place);
● the personal information is required to contract with you (i.e., to administer an employment or
work relationship with Lumerate);
● to comply with applicable immigration and/or employment laws and regulations;
● where you’ve provided consent. In these instances, you have the right to withdraw your
consent at any time;
● to protect your vital interests or those of another person.
When we collect sensitive personal information, it normally would be only:
● in circumstances where you have made the data public;
● to comply with applicable immigration and/or employment laws and regulations;
● for the assessment of your working capacity;
● to protect your vital interests or those of another person;
● to establish, exercise or defend legal claims; and/or
● for reasons of substantial public interest in accordance with relevant law.
If you have questions about or need further information concerning the legal basis on which we
collect and use your personal information, please contact the Privacy Team (see Section 11).
Where personal information is requested, you can choose not to provide it to us. However,
unless otherwise indicated, the information requested is required in order to enter into our
contract of employment with you or in order to comply with our legal obligations. Failure to
provide it prevents the effective administration of the contractual relationship with you (including
any related employment benefits) and/or complying, which may mean we are unable to continue
your employment.
5
7. Transfer of personal information abroad
As Lumerate employees are located in a number of countries, personal information from other
countries may need to be transferred to our Toronto office (or vice versa) and to our servers in
the US, or the servers of sub-processers in the US. When personal information is
imported/exported to a different country, steps will be taken to ensure that such data transfers
comply with applicable laws. For example, if personal information is transferred from the UK to a
country outside it, such as Canada, an appropriate data export solution will be implemented such
as entering into EU standard contractual clauses with the data importer, or taking other
measures to provide an adequate level of data protection under EU law.
8. Data retention periods
Personal information will be stored in accordance with applicable laws and kept as long as
needed to carry out the purposes described in this policy or as otherwise required by applicable
law. Generally this means your personal information will be retained until the end or your
employment, employment application, or work relationship with us plus a reasonable period of
time thereafter to respond to employment or work-related inquiries or to deal with any legal
matters (e.g. judicial or disciplinary actions), document the proper termination of your
employment or work relationship (e.g. to tax authorities), or to provide you with ongoing pensions
or other benefits.
9. Your data privacy rights
You may exercise the rights available to you under applicable data protection laws as follows:
• If you wish to access, correct, update or request deletion of your personal
information, you can do so at any time by contacting the Privacy Team using the
contact details provided in Section 11 below.
• In addition, you can object to processing of your personal information, ask to
restrict processing of your personal information or request portability of your
personal information. Again, you can exercise these rights by contacting the Privacy
Team.
• If personal information has been collected and processed with your consent, then
you can withdraw your consent at any time. Withdrawing your consent will not
affect the lawfulness of any processing conducted prior to your withdrawal, nor will it
affect processing of your personal information conducted in reliance on lawful
processing grounds other than consent.
6
• You have the right to contact a data protection authority about the collection and
use of your personal information (e.g., Information and Privacy Commissioner of
Ontario, Privacy Commissioner of Canada).
The Privacy Team responds to all requests received from individuals wishing to exercise their
data protection rights in accordance with applicable data protection laws.
10. Updates to this document
This Notice may be updated periodically to reflect any necessary changes in Lumerate’s privacy
practices and at a minimum reviewed annually. Where there are changes, you will be informed
via email by the Privacy Team. The top of the Notice will indicate when it was most recently
updated. Please check back periodically to review the most recent version of this Notice.
11. Contact details
Please direct your questions or requests relating to this Notice to the Privacy Team
([email protected]).
7