PRIVACY POLICY




ARL GROUP

PRIVACY POLICY






Contents


Previsions


  1. Introduction

  2. Scope

  3. Purpose of the Policy

  4. The Data Protection Principles

  5. Information security

  6. Sending personal data outside the European Economic Area

  7. Exemptions

  8. Complaints regarding booking platform & content on our website

  9. Information relating to your method of payment

  10. Job application and employment

  11. Affiliate and business partner information

  12. Retention period for personal data

  13. Policy Review

Previsions

This GDPR Employee Data Protection Policy contains the following provisions:

 

  1. Introduction

  2. The Data Protection Principles

  3. The Rights of Data Subjects

  4. Lawful, Fair, and Transparent Data Processing

  5. Specified, Explicit, and Legitimate Purposes

  6. Adequate, Relevant, and Limited Data Processing

  7. Accuracy of Data and Keeping Data Up-to-Date

  8. Data Retention

  9. Secure Processing

  10. Accountability and Record-Keeping

  11. Data Protection Impact Assessments

  12. Keeping Data Subjects Informed

  13. Data Subject Access

  14. Rectification of Personal Data

  15. Erasure of Personal Data

  16. Restriction of Personal Data Processing

  17. [Data Portability]

  18. Objections to Data Processing

  19. [Automated Decision-Making]

  20. [Profiling]

  21. Personal Data

  22. Health Records

  23. Benefits

  24. [Trade Unions]

  25. Employee Monitoring

  26. Data Security - Transferring Personal Data and Communications

  27. Data Security - Storage

  28. Data Security - Disposal

  29. Data Security - Use of Personal Data

  30. Data Security - IT Security

  31. Organisational Measures

  32. Transferring Personal Data to a Country Outside the EEA

  33. Data Breach Notification

  34. Implementation of Policy


  1. Introduction


The General Data Protection Regulation (GDPR) will apply from 25 May 2018 replacing the 1998 (DPA) Data Protection Act and introduce new rules building on current data protection laws on privacy notices, as well as processing and safeguarding personal data.

The GDPR expands on the current regime established by the Data Protection Act 1998, setting out a number of important principles governing how personal data is collected, held, and processed by organisations.

This policy applies where we are acting as a data controller with respect to the personal data of [our service users, website job opportunities and employees for internal record keeping]; in other words, where we determine the purposes and means of the processing of that personal data.

We are committed to continue safeguarding the privacy of everyone’s data we have collected, ensuring that your information is secure In order to prevent unauthorised access. We have put in place suitable physical, electronic and managerial procedures to safeguard and secure the information we collect.

We will not sell, distribute or lease your personal information to third parties unless we have your permission or are required by law to do so. You may request details of personal information which we hold about you under the General Data Protection Regulation (GDPR). A small fee will be payable. If you would like a copy of the information held on you please write to [address].

Our policy complies with UK law and accordingly implemented, including that required by the EU General Data Protection Regulation (GDPR).


  1. Scope


This policy applies to all staff employed by the ARL Group (ARL Services Limited, & Anytime Resources Limited), whether full time or part time, irrespective of length of service. This Privacy Policy and Procedure sets out in detail is the agreed procedures for all Group’s employees.


  1. Purpose of the Policy


ARL Group is committed to ensuring that your privacy is protected. Should we ask you to provide certain information data by which you can be identified when using our service/products, and then you can be assured that it will only be used in accordance with this privacy statement.


  1. The Data Protection Principles


  • The law requires us to determine under which of defined bases we process different categories of your personal information, and to notify you of the basis for each category.

  • If a basis on which we process your personal information is no longer relevant then we shall immediately stop processing your data.

  • If the basis changes then if required by law we shall notify you of the change and of any new basis under which we have determined that we can continue to process your information.


    1. (Principle 1) Processing personal data fairly and lawfully

Information we process because we have a contractual obligation with you


It means that we must:


  • have legitimate grounds for collecting and using the personal data;

  • not use the data in ways that have unjustified adverse effects on the individuals concerned;

  • be transparent about how we intend to use the data, and give individuals appropriate privacy notices when collecting their personal data;

  • handle people’s personal data only in ways they would reasonably expect; and

  • Make sure we do not do anything unlawful with the data.


Specific personal information you provide to us is obtained and processed fairly and lawfully; only disclosed in appropriate circumstances; is accurate, relevant and not held longer than necessary; and is kept securely.

Our web base services facility allows you to input personal information with a view to that information being read, processed, printed, and used specifically explicit, and legitimate purposes

to facilitate and deliver requested services. We do not use this information except to manage your specified booking.

When you create an account on our website, buy a product or service from us, or otherwise agree to our terms and conditions, a contract is formed between you and us. In order to carry out our obligations under that contract we must process the information you give us. Some of this information may be personal information. We may use it in order to:


  • verify your identity for security purposes

  • sell products to you

  • provide you with our services

  • Provide you with suggestions and advice on products, services and how to obtain the most from using our web base services.

  • We process this information on the basis there is a contract between us, or that you have requested we use the information before we enter into a legal contract.


Additionally, we may aggregate this information in a general way and use it to provide class information, for example to monitor our performance with respect to a particular service we provide. If we use it for this purpose, you as an individual will not be personally identifiable. We shall continue to process this information until the contract between us ends, service delivered or/and is terminated by either party under the terms of the contract.


    1. (Principle 2) Processing personal data for specified purposes

Information we process with your consent


Personal data shall be obtained only for one or more specified and lawful purposes, and shall not be further processed in any manner incompatible with that purpose or those purposes.

This requirement aims to ensure that organisation is open about their reasons for obtaining personal data, and that what they do with the information is in line with the reasonable expectations of the individuals concerned.

In practice, this data protection principle means that we must:


  • be clear from the outset about why we are collecting personal data and what we intend to do with it;

  • comply with the Act’s fair processing requirements – including the duty to give privacy notices to individuals when collecting their personal data;

  • comply with what the Act says about notifying the Information Commissioner; and

  • Ensure that if we wish to use or disclose the personal data for any purpose that is additional to or different from the originally specified purpose, the new use or disclosure is fair.


Where you provide your consent to us to process information that may be personal information and where you would expect us to process your data, and consider it reasonable to do so basis there is a legitimate purposes for the processing.

Where you have ‘’consented” our organisation to use your information for a specific purpose, through certain actions when contractual relationship between us, such as when you peruse our website or ask us to provide you more information about our business, including [job opportunities and] and acquirement of products and services.

Wherever possible, we aim to obtain your explicit consent to process this information, for example, by asking you to agree to our services Terms & Conditions.


Job application and employment:


If you send us information in connection with a job application, we may keep it for up to [12 Months] in case we decide to contact you at a later date. If we employ you, we collect information about you and your work from time to time throughout the period of your employment.

This information will be used only for purposes directly relevant to your employment. After your employment has ended, we will keep your file for [12 Months] before destroying or deleting it.


Sending a message to our support team:


When you contact us, whether by telephone, through our website or by e-mail, we collect the data you have given to us in order to reply with the information you need.

We record your request and our reply in order to increase the efficiency of our [business / organisation]. We keep personally identifiable information associated with your message, such as your name and email address so as to be able to track our communications with you to provide a high quality service.


Complaining:


When we receive a complaint, we record all the information you have given to us. We use that information to resolve your complaint.

If your complaint reasonably requires us to contact some other person [investigation / Fact finding], we may decide to give to that other person(s) some of the information contained in your complaint. We do this as infrequently as possible, but it is a matter for our sole discretion as to whether we do give information, and if we do, what that information is.

We may also compile statistics showing information obtained from this source [Feedback / Service report] to assess the level of service we provide, but not in a way that could identify you or any other person.


Affiliate and business partner information:


This is information given to us by you in your capacity as an affiliate of us or as a business partner.

It allows us to recognise business that you have referred to us, and to credit to you commission due for such referrals. It also includes information that allows us to transfer commission to you.

The information is not used for any other purpose.

We undertake to preserve the confidentiality of the information and of the terms of our relationship.

We expect any affiliate or partner to agree to reciprocate this policy.


    1. (Principle 3) The amount of personal data we may hold

Information we process for the purposes of legitimate interests


In practice, it means we should ensure that:


  • We hold personal data about an individual that is sufficient for the purpose we are holding it for in relation to that individual; and

  • We do not hold more information than we need for that purpose.

  • Personal data shall be adequate, relevant and not excessive in relation to the purpose or purposes for which they are processed.

So we should identify the minimum amount of personal data we need to properly fulfill our purpose. We should hold that much information, but no more. This is part of the practice known as “data minimisation”.

The Data Protection Act requires us to ensure we only collect the personal data we need for the purposes we have specified. We are also required to ensure that the personal data we collect is sufficient for the purpose for which it was collected.

These requirements of data adequacy and data minimisation are covered by principle 3 of the Data Protection Act.

We may process information on the basis there is a legitimate interest, either to you or to us of doing so, and If you have given us explicit permission to use your personal data, we may from time to time pass your information to selected associates, principal authorities and governing bodies to acquire mandatory clearances for the provision to propose employment engagement or expected services /products delivery.

Sometimes you might give your consent implicitly, such as when you send us a message by e-mail to which you would reasonably expect us to reply.

We may process your data on this basis for the purposes of:


    • For the proper and necessary clearances, approvals, record-keeping and administration of our organisational or/and business industries principal authorities and governing bodies mandatory requirement.

    • Responding to communication from you to which we believe you would expect a response or/and anticipate resolution.

    • Protecting and asserting the legal rights of any party.

    • Insuring against or obtaining professional advice that is required to manage organisational or business risk

    • Protecting your interests where we believe we have a duty to do so.


    1. (Principle 4) Keeping personal data accurate and up to date

Information we process because we have a legal obligation


To comply with these provisions we shall:


  • Take reasonable steps to ensure the accuracy of any personal data we obtain;

  • Personal data shall be accurate and, where necessary, kept up to date.

  • Ensure that the source of any personal data is clear;

  • Carefully consider any challenges to the accuracy of information; and

  • Consider whether it is necessary to update the information.


Although this principle sounds straightforward, the law recognises that it may not be practical to double-check the accuracy of every item of personal data we receive. So the Act makes special provision about the accuracy of information that individuals provide about themselves, or that is obtained from third parties.


We are subject to the law like everyone else. Sometimes, we must process your information in order to comply with a statutory obligation.

For example, we may be required to give information to legal authorities if they so request or if they have the proper authorisation such as a search warrant or court order.

This may include your personal information.






    1. (Principle 5) Retaining personal data

Information we keep for the purposes of legal obligation & reasonable interests


In practice, it means that we will need to:


  • Review the length of time we keep personal data;

  • Consider the purpose or purposes we hold the information for in deciding whether (and for how long) to retain it;

  • Securely delete information that is no longer needed for this purpose or these purposes; and

  • Update, archive or securely delete information if it goes out of date.


      1. What Approach should be taken for decisions about retaining personal data?


It is good practice to regularly review the personal data we hold, and delete anything we no longer need. If any records are not being used, we shall reconsider whether they need be retained.

Information that does not need to be accessed regularly, but which still needs to be retained, should be safely archived.


      1. What determines the length of a retention period?


Personal data will need to be retained for longer in some cases than in others. How long we retain different categories of personal data should be based on our legitimate and lawful business needs.

  • The current and future value of the information;

  • The costs, risks and liabilities associated with retaining the information; and

  • The ease or difficulty of making sure it remains accurate and up to date.

  • The appropriate retention period is also likely to depend on the following.


How long we shall keep personal data depends on the purpose for which it was obtained and its nature. If it continues to be necessary to hold the data for one of the reasons set out in Principle 2 and 3 of the Data Protection Act (such as the performance of a public function or compliance with employment law), then we shall retain it for as long as that reason applies. On the other hand, information with only a short-term value may have to be deleted within days.


There may often be good grounds for keeping personal data for historical, statistical or research purposes. The Data Protection Act provides that personal data held for these purposes may be kept indefinitely as long as it is not used in connection with decisions affecting particular individuals, or in a way that is likely to cause damage or distress. This does not mean that the information may be kept forever – it should be deleted when it is no longer needed for historical, statistical or research purposes.


      1. What should happen to personal data at the end of its retention period?


At the end of the retention period, or the life of a particular record, it should be reviewed and deleted, unless there is some special reason for keeping it.

There is a significant difference between permanently deleting a record and archiving it. If a record is archived or stored offline, this should reduce its availability and the risk of misuse or mistake. However, only archive a record (rather than delete it) if we still need to hold it. We must be prepared to give subject access to it, and to comply with the data protection principles. If it is appropriate to delete a record from a live system, it should also be deleted from any back-up of the information on that system.

The word ‘deletion’ can mean different things in relation to electronic data.

ARL Services (UK) Limited can ensure compliance with the DPA, in particular the fifth data protection principle, when archiving or deleting personal data and we have implemented process as per the guidelines of Information Commissioner's Office (ICO).


      1. The surrounding circumstances & examples


If personal data has been recorded because of a relationship between ‘’Organisation’’ and the individual, we shall’ consider whether we need to keep the information once the relationship ends.

We may not need to delete all personal data when the relationship ends. We may need to keep some information so that we can confirm that the relationship existed – and that it has ended – as well as some of its details.

In some cases, we may need to keep personal data so we can defend possible future legal claims. However, we would still delete information that could not possibly be relevant to such a claim. Unless there is some other reason for keeping it, personal data should be deleted when such a claim could no longer arise.


Example

As an employer we shall review the personal data we hold about an individual when she/he leaves the organisation’s employment. We shall’ need to retain enough data to enable our organisation to deal with, say, providing references or information about the individual’s pension arrangements. However, personal data that is unlikely to be needed again should be removed from the organisation’s records – such as the individual’s emergency contact details, previous addresses, or death-in-service beneficiary details.


Example

An employer receives several applications for a job vacancy. Unless there is a clear business reason for doing so, the employer should not keep recruitment records for unsuccessful applicants beyond the statutory period in which a claim arising from the recruitment process may be brought.


Example

The individual may be a customer who no longer does business with us. When the relationship ends, we must decide what personal data to retain and what to delete.

We may need to keep some personal data about the customer so that we can deal with any complaints they might make about the services we provided.


Example

A business receives a notice from a former customer requiring it to stop processing the customer’s personal data for direct marketing. It is appropriate for the business to retain enough information about the former customer for it to stop including that person in future direct marketing activities.


      1. Any legal or regulatory requirements


There are various legal requirements and professional guidelines about keeping certain kinds of records – such as information needed for income tax and audit purposes, or information on aspects of health and safety. We shall’ keep personal data to comply with a requirement like this, it will not be considered to have kept the information for longer than necessary.


      1. Agreed industry practices


How long certain kinds of personal data should be kept, may also be governed by specific business-sector requirements and agreed practices.



    1. (Principle 6) The rights of individuals

Information provided on the understanding that it will be shared


The Data Protection Act gives rights to individuals in respect of the personal data that organisations hold about them. The Act says that:


Personal data shall be processed in accordance with the rights of data subjects under this Act.

This is the sixth data protection principle, and the rights of individuals that it refers to are:


  • a right of access to a copy of the information comprised in their personal data;

  • a right to object to processing that is likely to cause or is causing damage or distress;

  • a right to prevent processing for direct marketing;

  • a right to object to decisions being taken by automated means;

  • a right in certain circumstances to have inaccurate personal data rectified, blocked, erased or destroyed; and

  • a right to claim compensation for damages caused by a breach of the Act.

Recording is important to demonstrate the accountability of staff…it helps to focus the work of staff and supports effective partnerships with end service users and training and quality purposes. It also ensures there is accountability participation with end service users, with support and assistances when required, with continuity of excellence service.

Where statutory duty requires the information to be shared, information should be shared even if consent has not been given.


      1. Subject Access - What is an individual entitled to?


Created by section 7 of the Data Protection Act, individuals who want to see could request a copy of the information an organisation holds about them. However, the right of access goes further than this and an individual who makes a written request and pays a fee is entitled to be:


  • Told whether any personal data is being processed;

  • Given a description of the personal data, the reasons it is being processed, and whether it will be given to any other organisations or people;

  • Given a copy of the information comprising the data; and given details of the source of the data (where this is available).

We have implemented process as per the guidelines of Information Commissioner's Office (ICO) and we comply with what the Act says about; Subject access checklist.

https://ico.org.uk/for-organisations/subject-access-request-checklist/


      1. Preventing processing likely to cause damage or distress


An individual has a right to object to processing only if it causes unwarranted and substantial damage or distress. If it does, they have the right to require an organisation to stop (or not to begin) the processing in question.

So, in certain limited circumstances, we must comply with such a requirement. In other circumstances, we must only explain to the individual why we do not have to do so.

The Act refers to the “right to prevent processing”. Although this may give the impression that an individual can simply demand that an organisation stops processing personal data about them, or stops processing it in a particular way, the right is often overstated. In practice, it is much more limited.




      1. What does the Data Protection Act say about objecting to processing?


The Act limits the extent to which we must comply with such an objection, in the following ways:


  • An individual can only object to us processing their own personal data;

  • Processing an individual’s personal data must be causing unwarranted and substantial damage or distress; and

  • The objection must specify why the processing has this effect.

 

In addition, an individual has no right to object to processing if:


  • They have consented to the processing;

  • the processing is necessary:

    • in relation to a contract that the individual has entered into; or

    • because the individual has asked for something to be done so they can enter into a contract;

  • The processing is necessary because of a legal obligation that applies to you (other than a contractual obligation); or

  • The processing is necessary to protect the individual’s “vital interests”.


      1. What is meant by “damage or distress”?


The Act does not define what is meant by unwarranted and substantial damage or distress. However, in most cases:


  • Substantial damage would be financial loss or physical harm; and

  • Substantial distress would be a level of upset, or emotional or mental pain that goes beyond annoyance or irritation, strong dislike, or a feeling that the processing is morally abhorrent.


The Act recognises that organisations may have legitimate reasons for keeping records about people which may have a “negative” effect on them. The Act does not give individuals the right to prevent this. Even where damage or distress has been caused, the Act limits the right to prevent processing to cases where the effects are unwarranted.


      1. Preventing direct marketing


The Act includes some help on what is meant by “direct marketing” in a data protection context. The table below sets out the factors that are used to identify direct marketing material.


  • Directed to particular individuals: “junk mail” that is not addressed to a particular person(s) but to “the occupier”. This type of marketing is not directed at an individual and so is not direct marketing for the purposes of the Act. Kind of mail, posted through letterboxes, includes leaflets like takeaway menus and information about clothing collections etc.


  • Communication by whatever means: The common image of direct marketing is that of mailshots or telemarketing. However, for the purposes of the Act it also includes all other means by which you might contact individuals, such as emails and text messages.


  • Advertising or marketing material: Direct marketing does not just refer to selling products or services to individuals. It includes promoting particular views or campaigns, such as those of a political party or charity. So, even if you are using personal data to elicit support for a good cause rather than to sell goods, you are still carrying out direct marketing and would have to comply with a written notice to stop.


We shall, stop any promotional activity directed at a particular individual or/and company, using that personal data to communicate the promotional activity to them, if they write and ask us to stop.

The Act does not require that we respond to a notice to stop direct marketing – it only requires us to stop. This is because you have no discretion about whether to comply with such a notice. However, acknowledging that you have received and acted on a notice is good practice, where this is appropriate.


Telephone marketing is regarded as a form of electronic marketing. Marketing which is conducted this way, or is sent by other electronic means (by fax, email, or text message) is subject to extra rules set out in the Privacy and Electronic Communications (EC Directive) Regulations 2003.

We have implemented process as per the guidelines of Information Commissioner's Office (ICO) and we comply with what the Act says about; Direct Marketing.

https://ico.org.uk/media/for-organisations/documents/1555/direct-marketing-guidance.pdf


      1. When do the rights arise (what is an automated decision)?


The rights in respect of automated decisions only arise if two requirements are met. First, the decision has to be taken using personal data processed solely by automatic means.

The rights do not apply to any decision involving human intervention. Many decisions that are commonly regarded as “automated” actually involve human intervention.


Example

An employee is issued with a warning about late attendance at work. The warning was issued because the employer’s automated clocking-in system flagged the fact that the employee had been late on a defined number of occasions. However, although the warning was issued on the basis of the data collected by the automated system, the decision to issue it was taken by the employer’s HR manager following a review of that data. So the decision was not taken by automated means.


      1. Correcting inaccurate personal data


The fourth data protection principle requires personal data to be accurate, where it is inaccurate, the individual concerned has a right to apply to rectify, block, erase or destroy the inaccurate information.


  1. (Principle 7) Information security


The seventh data protection principle in practice, it means we must have appropriate security to prevent the personal data we hold being accidentally or deliberately compromised. In particular, we will need to:

  • design and organise our security to fit the nature of the personal data we hold and the harm that may result from a security breach;

  • be clear about who in our organisation is responsible for ensuring information security;

  • make sure we have the right physical and technical security, backed up by robust policies and procedures and reliable, well-trained staff; and

  • Be ready to respond to any breach of security swiftly and effectively.


Our privacy policy offers an overview of what the Data Protection Act requires in terms of security, and aims to help us decide how to manage the security of the personal data we hold, conversely it’s difficult to provide a complete guide to all aspects of security in all circumstances, There is no “one size fits all” solution to information security.

The security measures that are appropriate should adopt a risk-based approach when deciding what level of security is needed.

ARL Services (UK) Limited have devised and implemented suitable technical, structural and managerial measures in place against unauthorised or unlawful processing of personal data and against accidental loss or destruction of, or damage to, personal data.

Physical and technological security measures we have put in place ensure that, every aspect of storing, transmitting, processing and protecting personal data information meets all principals and standards in accordance with General Data Protection Regulation (GDPR)

  • Organisations physical and technical security, backed up by robust policies and procedures and reliable, well-trained staff; and

  • Process ensures the security measures have appropriate counter measures to prevent the personal data we hold, being accidentally or deliberately compromised.

  • Be clear about who in organisation is responsible for ensuring information security;

  • Be aware of the personal data we hold, and the harm that may result from a security breach;

  • Be ready to respond to any breach of security swiftly and effectively in the event of information being lost, corrupted or misused.


  1. (Principle 8)Sending personal data outside the European Economic Area


ARL Services (UK) shall not be transferred Personal data to a country or territory outside the EEA unless that country or territory ensures an adequate level of protection for the rights and freedoms of data subjects in relation to the processing of personal data.


  1. Exemptions


Entitlement to an exemption depends and explained in part 4.1 purpose for processing.

on your purpose for processing the personal data in question – for example, there is an exemption from some of the Act’s requirements about disclosure and non-disclosure that applies to processing personal data for purposes relating to criminal justice and taxation. However, you must consider each exemption on a case-by-case basis because the exemptions only permit you to depart from the Act’s general requirements to the minimum extent necessary to protect the particular functions or activities the exemptions concern.


7.1 Disclosure and non-disclosure – how do the exemptions work?


Different exemptions work in different ways. An exemption may:

  • restrict certain rights of individuals in relation to the processing of their personal data; and/or

  • Limit the duties of organisations when processing that data.


Most organisations that process personal data must notify the ICO of certain details about that processing. However, the Act provides exemptions from notification for processing personal data only for:

  • staff administration (including payroll);

  • advertising, marketing and public relations (in connection with their own business activity); a

  • accounts and records;

  • some not-for-profit organisations;

  • organisations that process personal data only for maintaining a public register;

  • Organisations that do not process personal information on computer.


Organisations and individuals can use ICO online self-assessment tool to check whether they need to register with (“notify”) the ICO.


COOKIES

A Cookie is a piece of text that attaches to your hard drive and from which it can store and sometimes track information on how you make use of a web-site.

We do not store any kind of cookies on our online booking system.


Google Analytics


We use Google Analytics to analyse the use of our website and help us create a more useful and easy to use site. This is a web analytics service provided by Google. Google Analytics uses “cookies”, which are text files placed on your computer, to collect information such as visitor numbers and the most popular pages.


  1. Complaints regarding booking platform & content on our website


If you complain about services booking platform or/and any of the content on our website, we shall investigate your complaint.

If we feel it is justified or if we believe the law requires us to do so, we shall remove the content while we investigate.

If we think your complaint is unsupported or without any basis, we shall not correspond with you about it.

When we receive a complaint, we record all the information you have given to us.

We use that information to resolve your complaint.

If your complaint reasonably requires us to contact some other person, we may decide to give to that other person some of the information contained in your complaint. We do this as infrequently as possible, but it is a matter for our sole discretion as to whether we do give information, and if we do, what that information is.

We may also compile statistics showing information obtained from this source to assess the level of service we provide, but not in a way that could identify you or any other person.


  1. Information relating to your method of payment


Payment information is never taken by us or transferred to us either through our website or otherwise. Our employees and contractors never have access to it.

At the point of payment, you are transferred to a secure page on the website of [World Pay / Sage Pay] or some other reputable payment service provider. That page may be branded to look like a page on our website, but it is not controlled by us.


  1. Job application and employment


If you send us information in connection with a job application, we may keep it for up to [years] in case we decide to contact you at a later date.

If we employ you, we collect information about you and your work from time to time throughout the period of your employment. This information will be used only for purposes directly relevant to your employment. After your employment has ended, we will keep your file for [years] before destroying or deleting it.


  1. Affiliate and business partner information


This is information given to us by you in your capacity as an affiliate of us or as a business partner.

It allows us to recognise business that you have referred to us, and to credit or/and commission due for such referrals, includes information that allows us to transfer credit or/and commission to you.

The information is not used for any other purpose.

We undertake to preserve the confidentiality of the information and of the terms of our relationship.

We expect any affiliate or partner to agree to reciprocate this policy.


  1. Retention period for personal data


Except as otherwise mentioned in this privacy notice, we keep your personal information only for as long as required by us:


  • To provide you with the services you have requested;

  • to comply with other law, including for the period demanded by our tax authorities;

  • To support a claim or defence in court.


  1. Policy Review


ARL Service (UK) Limited reserves the right to change this privacy policy as we deem necessary from time to time or as may be required by law.  Any policy changes, either due to business reasons or future changes in legislation. This policy was last updated 24th May 2018.








page 14 of 14

Privacy policy

Authored Shaz Malik (GM) – (QCM)

Approved (CEO)


24/7 Control Room +44 (0) 1753 684 100

24/7 Reservation Center +44 (0) 208 745 6011

Recruitment +44 (0) 1753 681 391