ADGM Privacy Notice for Candidates, Employees, Former Employees and Applicants

Introduction

This Notice sets out details of how and why X12 Capital Limited (referred to throughout as, “us”, “we”, “our”, “the Firm”), and third parties, collect and process personal information in connection with your enquiries or application for employment with the Firm, your employment with us, or associated interactions with us (“our relationship”). We do this in compliance with our obligations under applicable data protection law. This Notice explains what personal data is collected, the purposes for which it is used, the third parties to whom it may be disclosed and how individuals can exercise their rights in relation to their personal data. The Privacy Notice may form among other documents an integral part of the master agreement we have with you.

About Us

The Firm is the Controller of your personal data as part of our relationship. The Firm is located in the Abu Dhabi Global Market (“ADGM”) and therefore is required to comply with the ADGM Data Protection Regulation 2021 (“ADGM DPR”).

We may engage third party service providers to process personal data on our behalf and those third parties act as processors. We have appointed a Data Protection Officer, and if you have any questions about the use of your personal data, your data protection rights or if you want to exercise those rights, please contact ataprotection@x12capital.com

Scope

This Notice applies to you, whether you are an applicant, a current (or former) employee, partner, worker, intern, transition year student, secondee, temporary worker, agency worker, consultant, individual contractor, applicant or director. It also applies to third parties whose information you provide to us in connection with our relationship with you (for example, in respect of emergency contact information).

Where we refer to 'employee personal data' or 'employment' in this Notice, we do so for convenience only, and this should in no way be interpreted as purporting to confer employment status on non-employees to whom this Notice also applies. This Notice does not form part of any contract of employment and does not confer any contractual right on you, or place any contractual obligation on us.

It applies to all personal data collected, maintained, transmitted, stored, retained, or otherwise used (i.e. processed) by us regardless of the media on which that personal data is stored. We may update this Notice at any time and will notify you in writing, or other ways of any substantial changes.

Processing Personal Data

‘Personal data’ means any information relating to an identified or identifiable living natural person, who can be identified directly from that data or indirectly in conjunction with other information.

The ADGM DPR requires us to demonstrate that any Personal Data we hold about you is processed lawfully, fairly and transparently processed for specified, explicit and legitimate purposes adequate, relevant and limited to what is necessary accurate and, where necessary, kept up to date kept for no longer than is necessary kept securely.

We are required to keep and process your Personal Data for employment purposes. The information that we hold, and process will be used for management and administrative use only. We will keep and use your Personal Data to enable us to carry out our business and management of the employment relationship with you effectively, lawfully, and appropriately, during the recruitment process, whilst you are employed by us and at the time your employment ends. This includes information that enables us to comply with the employment contract, any legal requirements, and for us to protect our legal position in the event of any legal proceedings. If you do not provide this data, we may in some circumstances be unable to comply with our legal and regulatory obligations. Under such circumstances, we will inform you of the implications of that decision.

We may from time to time need to process your data in order to pursue legitimate business interests. However, we will not process your data where these interests are overridden by your own interests.

Purposes of Processing and Legal Basis

Personal Data type:

• Personal details such as:
  • name
  • last name
  • identification number
  • date of birth
  • gender
  • contact details (such as phone number(s), email address(es))
  • residential and/or business address(es)
• Residence ID details, previous ID and new ID details (ID number, name, expiry date)
• Residence visa details, previous visa and new visa copy and details:
  • visa number
  • employer name
  • issue date
  • expiry date
• Emergency contact details:
  • name
  • relationship
  • address
  • contact number
• Financial information such as:
  • salary
  • bank account details
  • payroll records
  • bonus records
• Employment contract between us and the employee that includes:
  • name
  • agreement date
  • start date
  • position
  • salary ({basic wage, benefits, bonuses, allowances reporting line manager)
• Start date and, if different, the date of your continuous employment. Leave information and reason for leaving
  • sick leave
  • annual leave
  • personal leave
• Data contained in identification documents such as:
  • Passport
  • residence visa
  • national identity card
  • labor card
  • other similar documents
• Personal photograph
• Education certificate photocopy
• Recruitment information such as:
  • copies of right to work documentation references
  • other information included in a CV or cover letter or as part of the application process.
• Employment records including:
  • job titles
  • work history
  • working hours
  • holidays
  • training records
  • professional memberships.
• Compensation history
• Performance information
• Disciplinary and grievance information
• Information about your use of our information and communications systems
• Results of background check, including screening and previous employer cancelation details
• Religion (for Visa application purposes)
• Dependent information and details such as:
  • name
  • identification details
  • passport
  • residence visa
  • national identity card
  • health care insurance
• Health care insurance certificate
• Non disclosure agreement
• No competition agreement
• Declaration of fitness
• Information about your health, including:
  • any medical condition
  • health records
  • sickness records
• Where you leave employment and under any share plan operated by a group company the reason for leaving is determined to be ill-health, injury or disability, the records relating to that decision
• Details of any absences (other than holidays) from work including time on statutory parental leave and sick leave
• Where you leave employment and the reason for leaving is related to your health, information about that condition needed for pensions and permanent health insurance purposes
• Information about criminal convictions and offences
• Outside business interests declarations ? refers to appointments/positions that employees hold outside the firm. The purpose of these declarations is to manage conflicts of interests
• Office access control using biometrics
• Driver collection and drop off using home address
• Receiving birthday greetings
• Get well/celebratory greetings using home address

Purpose

• In order to meet and carry out our employment obligations under applicable law.
• For our legitimate interest in using your details to share information for the efficiency of business communications.
• Where we need to share your information in a life-or-death situation.
• In order to enter into a contract with you at your request or to perform our contract with you.
• For our legitimate interest - Where it is necessary to share such information to protect the public against dishonesty, malpractice or other improper behavior.
• Processing is necessary for the purposes of carrying out the obligations and exercising specific rights of the Controller or of the Data Subject in the field of employment law

The above list is by no means exhaustive and should be used merely as a point of reference from which a working definition of business purposes can be established and further developed.

We may process personal information lawfully for a number of reasons, including in order to:

• Perform an employment contract
• Comply with a legal obligation
• Protect your right as an employee or another individual’s vital interests (for example, medical data during a health emergency)
• Carry out a task in the public interest, or in exercising official authority vested in the employer
• Protect the legitimate interests of the employer or a third party, except where this is overridden by the interests or rights of the employee
• Employees family members / dependants are also covered under this notice to the extent they form part of the benefits under the employment contract

Special Categories of Personal Data

There are certain types of more sensitive Personal Data which require a higher level of protection, such as information relating to your health, which could include reasons for absence, medical certificates, and/or other health reports. This data may be used in order to comply with health, safety and occupational health obligations to consider how your health affects your ability to do your job and whether any adjustments may be required. The Firm also uses this information to administer its policy relating to sick leave for employees, as well as any health and life insurance policies (if applicable). We may also conduct screening of employees which could highlight any criminal convictions.

Where we are required to process Special Categories of Personal Data, we may need to obtain your explicit consent to those activities unless another legal basis is available, or the information is required to protect your health in an emergency.

Processing may also be necessary for the purpose of carrying out obligations and exercising specific rights in relation to employment, or where necessary to comply with applicable laws and regulations such as ADGM Employment Regulations 2019.

Sharing and Transferring Personal Data

The Firm will only disclose your Personal Data to third parties if we are legally obliged to do so or where there is a need to comply with its contractual obligations to you, for instance we may need to pass on certain information to any external Service Providers including group companies, HR and payroll provider, pension, benefits or health insurance providers.

Where there is a requirement to use an intermediary, we will ensure that the Personal Data is exported to one who is either located in a jurisdiction that is deemed by the ADGM Commissioner of Data Protection as an adequate jurisdiction or we have safeguard in place such as standard contractual clauses or a legal derogation. You may request further information on this from the Data Protection Officer.

Record Keeping and Data Retention Periods

The Firm will maintain clear and accessible records of all data processing activities.

Your Personal Data will only be kept for as long as is necessary to fulfil the purpose we collected it for or as required by law. Where there is a legal requirement to keep the data, we will comply with the statutory retention periods. In general:

• All personnel and pay records will be retained for a period of 6 years from the last date of employment
• All employee leaver information will be retained for a period of 6 years

Where the data is required to defend a potential claim, the data will be retained for the required period of time.

Any data relating to unsuccessful application forms and CVs will be destroyed and no longer retained after a period of 1 year.

Your Rights as a Data Subject

Under the ADGM DPR, as a Data Subject, you have a number of rights with regard to your Personal Data. You have the right to request to access and rectify your data as well as for it to be erased and to restrict the processing of your data in certain circumstances.

You also have the right to lodge a complaint with the ADGM Commissioner of Data Protection if you feel that we have not complied with the ADGM DPR requirements regarding how we deal with your Personal Data.

Your rights pursuant to ADGM DPR amongst others:

• Request access to your personal information (commonly known as a "Data Subject access request"). This enables you to receive a copy of the personal information we hold about you and to check that we are lawfully processing it
• Request correction of the personal information that we hold about you. This enables you to have any incomplete or inaccurate information we hold about you corrected.
• Request erasure of your personal information. This enables you to ask us to delete or remove personal information where there is no good reason for us to continue to process it. You also have the right to ask us to delete or remove your personal information where you have exercised your right to object to processing (see below)
• Object to processing of your Personal Data. You have the right to object where we are processing your personal information for direct marketing purposes
• Request the restriction of processing of your personal information. This enables you to ask us to suspend the processing of personal information about you, for example, if you want us to establish its accuracy or the reason for processing it
• Data portability enables you to receive or request transfer of the data you have provided us in a structured, commonly used and machine-readable format
• Object to automated processing, including profiling which produces legal or other seriously impactful consequences concerning you

Consent

Under ADGM DPR, consent may not be required, for example to fulfil legal or contractual obligations as an employer, to provide an employment contract, process salary payment, set up pension schemes, life cover etc. However, for other scenarios, employers may need to show that employees give their explicit consent to process the data and the consent will need to be clearly connected to the processing.

In the limited circumstances where you may have provided your consent to the collection, processing and transfer of your personal information for a specific purpose, you have the right to withdraw your consent for that specific processing at any time and this will not affect the lawfulness of processing before the consent has been withdrawn.

To withdraw your consent, please contact us using the email provided below. Once we have received notification that you have withdrawn your consent, we will no longer process your information for the purpose or purposes you originally agreed to, unless we have another legitimate basis for doing so under an applicable law.

To Inform Us of Changes

It is important that the personal information we hold about you is accurate and, where necessary, kept up to date. Please keep us informed if your personal information changes during your working relationship with us and respond promptly to our request for updates of your data.

Contact Us

You can contact our Data Protection Officer by any of the following means for any privacy-related questions, including regarding how we collect, store, and use your Personal Data.:

Email: dataprotection@x12capital.com

Telephone: +971 43 230 800

Address: Unit 1, Floor 24, Al Khatem Tower, Abu Dhabi Global Market, Al Maryah Island,

Abu Dhabi United Arab Emirates

Complaints

You have the right to make a complaint at any time to the relevant authority that safeguards your interests.

ADGM Commissioner of Data Protection Contact Details

• Email: data.protection@adgm.com
• Telephone: +971 23 338 888
• Address: ADGM Commissioner of Data Protection ADGM Authorities Building, ADGM Square, Al Maryah Island, PO Box 111999, Abu Dhabi, UAE