Privacy notice

Personal data means any information which identifies you or could be used to identify you. We make sure that we only process your personal data as strictly needed for a given purpose. 

Categories of personal data we process may include:

Identification and contact data: name, surname, address, date and place of birth, ID number, national insurance number or social security number, specimen signature, email address, telephone number;

Financial or transaction data: bank account number, payment behaviour, credit history, financial products you have with us, invoices, credit notes, payslips, whether you are registered with a credit register, payment arrears and information on your income;

Data about professional life: employer, experience, position, salary, education, any other pay-related information;

Data about family members: name of your spouse or children;

Digital data: cookies, IP address, websites and social network activities and other data publicly available on the Internet.

You are not required to provide your personal data to us, but if you choose to refuse, we may not be able to provide you with our products or services or we may not be able to respond to any inquiries you may have.

We may collect data directly from you for example when communicating or interacting with you by phone, e-mail or other communication channels or when you complete a survey or register for an account with us; automatically when you visit our website or interact with us online or from other sources for example through our business partners.

We process personal data by collecting, storing, recording, combining, and organising it in our systems. We will compare and alter data to ensure it is accurate and kept up to date. When appropriate, your data is erased or deleted. Within the course of our business activities as a multinational company, we may disclose or transfer your personal data between our companies in accordance with the legal data transfer requirements.

We only use your personal data based on the appropriate legal grounds, for business purposes such as:

The performance of a contract

We use your personal data for the performance of a contract to which you or your company is a party or to take steps prior to entering into the contract. For example we process your data to mange your payments, to answer your inquiries or requests or to develop and improve our products and services.

We will process your personal data set out above for the purpose of preparing to enter an employment contract including, in particular, to assess your suitability for a role and, if you are successful and we make you a job offer, to set up and administer payments and benefits.

We process only necessary information about you for these purposes, namely your identification data, contact data and data about professional life.

To comply with our legal obligations

We have various legal obligations to comply with such as audit, tax reporting, accounting or employment legislation obligations. To comply with these legal obligations, we may disclose your data to our financial consultants, auditors and other service providers, provided always that they ensure the confidentiality of your personal data.

For such purpose we process only necessary information about you.

Based on our legitimate interests

We may transmit your personal data within our group organisation, for example for internal administrative purposes in accordance with legal data transfer requirements.

We may process your personal data for our legitimate interest in conducting our business and our investor and shareholder relationship management consisting mainly of the following:  

• To operate and more efficiently administer our share plans
• To align our interest with the best interests of our shareholders
• To manage our relationship and interaction with you if you are a job candidate
• To do background checks and security vetting in our recruitment and HR functions
• To manage our website and understand your preferences (more details in our Cookie Policy)

To make sure our interests are balanced against your interests, we conduct a legitimate interest balancing test for processing activities we undertake.

Based on our legitimate interest we might process your identification data, contact data, financial or transaction data, data about professional life, data about family members and digital data. When we process your data based on our legitimate interest, we keep your data no longer that is necessary to fulfil the purpose. If your data is no longer required for the lawful purposes for which it was obtained, it will be removed subject to any conflicting laws or data protection considerations (for your information, some of the factors which will affect how long we retain your data include your continued participation in share plans operated within our company).

We may also collect and process your data based on your consent

Your consent is voluntary and represents a specific, informed, and unambiguous indication of your wish and can be withdrawn at any time. If we require consent, then at the relevant time we will provide you with all the information necessary to carefully consider whether you wish to consent. Please note that the withdrawal of your consent will not affect the lawfulness of processing taking place before such withdrawal.

If you are located outside of the EEA:

• the processing of your data may be governed by local national and/or other international laws, as well as the GDPR as applicable; and
• by participating in an IPF share plan, you are deemed to consent to the processing of your personal data, in accordance with this Privacy Notice.

We keep your personal data for as long as we need it for the purpose it is being processed and as allowed by the applicable legal basis.

We also endeavour to restrict the time we keep your data to as little as possible.

For the purpose of fulfilment of a legal obligation, we process your data required by the relevant laws and regulations for a period provided by the relevant law.

We may also keep your data to respond to any questions or complaints.

We can also process your data for other purposes. In such case the retention period will be defined specifically for a given purpose above. 

We take appropriate technical and organisational measures to ensure the confidentiality and integrity of your data, to make sure that your rights and freedoms are not put at risk and that compliance with relevant laws and regulations in the field of data protection is observed. We apply internal policies and standards across our business to keep your personal data safe. These are periodically reviewed to keep them updated with legislation and external developments.

We also regularly train and test our employees and partners. Our employees are subject to confidentiality obligations and may not disclose your personal data unlawfully or unnecessarily. We also make sure we carefully assess our suppliers to ensure they adhere to both legal requirements and our standards.

Depending on the purpose of processing, we may disclose your personal data to different categories of recipients, namely: 

• Your personal data might be processed or controlled by other subsidiaries of ours
• Our partners, shareholders, and investors
• Nominees, trustees, registrars, brokers, and administrators in the course of operating employee share schemes
• Our other external suppliers
• We are also in some cases legally obligated to disclose data to government, supervisory and judicial authorities or other public authorities (e.g. investigative authorities, tax administrators, the Financial Services Authority), to comply with a defined legal obligation
• We may have to share information with a bank or a specialised financial company for example to process certain payments.

We only disclose your data to the extent necessary and in a form that is required to achieve a given purpose.

We may use external suppliers in the processing of data to either optimise our internal processes and/or conduct some of the processing on our behalf (typically to provide support and maintenance services) or we may transfer data between our group companies.  

In this respect, we carefully assess the relevant circumstances and make sure appropriate safeguards are put in place so that your rights are not undermined. All our suppliers who process your data in a third country outside the UK or European Economic Area and are not a recipient of an adequacy decision under the applicable data protection laws are required to sign our model contractual clauses and we regularly check the level of security provided to personal data processed on our behalf. We ensure that conditions to enforce your rights and effective legal remedies are available. Any potential external supplier is subject to an internally conducted security pre-assessment and mutual rights and obligations are carefully addressed in the Data Processing Agreement.  

You have several rights under the existing legislation, and you can exercise at any point. These are not absolute rights and there are exceptions. Your privacy rights may also vary from jurisdiction to jurisdiction, based on applicable laws.

If you have questions about your rights, please contact us as mentioned in Contact Information section of this notice.

• You have a right to be informed about the data we collect and how we use your data.
  
• You have the right to access your personal data, including the right to obtain a copy of your personal data we process.
• You have a right to portability of your data which means it can be moved, copied, or transmitted under certain circumstances.
• We keep your personal data up to date, by asking you to review it from time-to-time and when required by law. However, if you find any data we have about you is incorrect, you can request rectification of inaccurate data and you can have incomplete data completed or additional data provided via contacts defined below. You can ask for restriction of your data processing if the accuracy of your personal data is contested for a period allowing us to verify the accuracy.
• You have a right to restrict processing under certain circumstances. That means we will store your data, but not use it for anything else.
• You have the right to object to processing based on legitimate interest if you have a justifiable reason. We will consider your objection and assess whether processing your personal data has an undue impact on you that would require us to stop processing it. Please note that we can continue processing if we find our legitimate interest is balanced with your rights and freedoms.
• You also have a right to be forgotten. Under certain circumstances you have the right to request that we erase or delete your personal data. If the personal data we collect is no longer needed for any purposes and we are not required by law to retain it, we endeavour to delete, destroy or permanently de-identify it.
• You have the right to object to automated decisions. You have the right to object to such automated decisions and ask for a human intervention for the respective decision.
• You have a right to lodge a complaint with us at any time if you are unsatisfied with the way we process your data or respond to your concerns. You can also turn to data protection authority or a court in the UK or in your country if applicable.

If you want to exercise your rights, please contact us. When doing so, the more specific you are with your application, the better we can assist you. We may ask for information to verify your identity.  In some cases, we may deny your request and, if permitted by law, we will inform you of the reason. If permitted by law, we may charge a reasonable fee for processing your request.

Our appointed a Data Protection Officer (DPO) can be contacted at Fifth Floor, No 1 Leeds, 26 Whitehall Road, Leeds LS12 1BE, United Kingdom, by e-mail at [email protected] or by submitting your question or request through the Contact Us form on our website.

We may amend this Privacy Notice to remain compliant with any changes in the law or data protection practices and to reflect how we process your personal data in our business. This version was updated in March 2023.