Luxembourg privacy policy: temporary workers, clients and suppliers | Legal

This is a context-specific part of the Tessero Luxembourg privacy policy. Read it together with the general part of that policy, which covers who we share data with, how we keep it safe, how long we keep it, your rights, cookies and how to contact us (Annex 1).

2. Temporary Workers

This section of the Privacy Policy applies to Temporary Workers.

Temporary Workers include someone who becomes employed or engaged by Tessero for the purposes of undertaking temporary work for a Client or other Tessero group company. If you are a Temporary Worker, we will also continue to process your personal data as a Candidate throughout the duration of your temporary work assignment and thereafter, in accordance with the terms of this Privacy Policy. Temp Relationship means our contractual relationship with Temporary Workers while they are employed or engaged directly by us.

What kind of personal information do we collect?

If we employ or engage you as a Temporary Worker directly, we will, depending on the relevant circumstances and applicable local laws and requirements, collect some or all of the information listed below (in addition to the data collected about Candidates) in order to ensure that our Temp Relationship runs smoothly and that we are able to comply with our contractual and other duties to each other, and to our Clients, as part of our Temp Relationship and our duties to third parties such as tax authorities and government agencies. In some jurisdictions, we are restricted from processing some of the data outlined below. In such cases, we will only process the data in those jurisdictions to the extent and under the circumstances permitted by law:

Temporary worker information
- Staff number/social security number/other identifier;
- Location of your workplace at the Client;
- Details of any complaints, whether brought by or against you or in which you are or have been otherwise involved;
- Details of any leave you take or request during our Temp Relationship;
- Details of travel undertaken;
- Details of resident/work permit;
- Where applicable:
  - Details of any grievance or disciplinary matters, whether brought by or against you or in which you are or have been otherwise involved; and
  - Information about your performance in your role during our Temp Relationship, including details of any bonuses or promotions you receive performance assessments and other information that relates to your employment, your interaction with colleagues and employment-related issues that arise; and
Special category information
- Details of any sickness absence including health-related information.

Please note that the above list of categories of personal data we collect is not exhaustive.

A number of elements of the items listed above are required to enable us to fulfil our contractual duties to you or to others. Some, for example your social security number (or equivalent) are required by statute or other laws. Other items may simply be needed to ensure that our Temp Relationship can run smoothly, or to run our business.

Depending on the type of personal data in question and the grounds on which we may be processing it, should you decline to provide us with such data, we may not be able to fulfil our contractual requirements or, in extreme cases, may not be able to continue with our Temp Relationship.

How do we collect your personal data?

If we employ or engage you as a Temporary Worker directly, we collect your data (in addition to the data already collected about Candidates) in the following ways:

Personal data that you give to us; and
Personal data that we receive from other sources.

Below are some more details about each of these methods.

Personal data you give to us

Tessero needs to know certain information about you in order to fulfil our obligations to you, to ensure that you are properly fulfilling your obligations to us, and to ensure that we are both fulfilling our obligations to others. This information will enable us to operate a usual Temp Relationship, along with all that entails.

There are numerous ways that you can share your information with us in addition to the information you share as a Candidate. Where appropriate and in accordance with any local laws and requirements, these may include:

when you complete registration forms at the beginning of our Temp Relationship; or
in meetings or communications with your consultant, our HR team or other colleagues.

The types of information that we receive from you in this way include:

Temporary worker information; and
Special category information,

as described in the section entitled “What Kind of Personal Information Do We Collect?” above.

Personal data we receive from other sources

We also receive personal data about you from other sources. Depending on the relevant circumstances and applicable local laws and requirements, these may include personal data received in the following situations:

if you were referred to us through a recruitment agency or other work agencies, they may have shared personal information about you with us;
information obtained about you from third party service providers who undertook background checks about you on our behalf at the start of our Temp Relationship;
your colleagues may share personal information about you with us;
medical professionals may (in appropriate and limited circumstances) share personal information about you with us;
your pension and benefits providers may share relevant personal information about you with us; and
other third parties like your local tax authority may share your personal data with us.

The types of information that we receive about you in this way include:

Temporary worker information; and
Special category information,

as described in the section entitled “What Kind of Personal Information Do We Collect?” above.

How do we use your personal data?

If we employ or engage you as a Temporary Worker directly, we use your data for the following purposes:

To ensure the smooth running of our Temp Relationship, including all of the activities that need to be undertaken in a usual relationship of that type, such as:
- facilitating payroll and invoicing processes, if relevant to your jurisdiction;
- determining the terms on which you work during your Temp Relationship;
- keeping a record of any promotions, salary rises or bonuses you are awarded; and
Assessing your performance.

Temp Relationship Activities

We've listed below various ways in which we will use and process your personal data in connection with our Temp Relationship, where appropriate and in accordance with any local laws and requirements. Please note that this list is not exhaustive.
In most cases, we will use your personal data for the purposes below if it is necessary for us to carry out our obligations under a contract that we have entered into with you or if we deem it necessary to do so for our legitimate interests.
Article 6(1)(b) of the GDPR says that we can process your data where it “is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract.”
Article 6(1)(f) of the GDPR says that we can process your data where it “is necessary for the purposes of the legitimate interests pursued by us or by a third party, except where such interests are overridden by the interests or fundamental rights or freedoms of you which require protection of personal data.”
We don't think that any of the activities in relation to which we rely on the legitimate interests condition prejudice Temporary Workers in any way – in fact, they help us to offer you a more tailored, efficient service. However, you do have the right to object to us processing your personal data on this basis. If you would like to know more about how to do so, please refer to the section entitled “How can you access, amend or take back the personal data that you have given to us” in the General Privacy Information section of this Privacy Policy.
When we process your information for recruitment activities based on your consent, you have the right to withdraw your consent at any time without affecting the lawfulness of processing based on such consent before the consent is withdrawn. You can find out more about how to do so by referring to the section entitled “How can you access, amend or take back the personal data that you have given to us” in the General Privacy Information section of this Privacy Policy.
Please note that in certain of the jurisdictions in which we operate, we comply with additional local law requirements.

Why and how we process your information

Collecting and processing data in the course of and to the extent necessary to facilitate the Temp Relationship, including by:

Facilitating payroll and invoicing processes
Determining the terms on which Temporary Workers work during the Temp Relationship
Storing Temporary Worker details on database (including start dates and duration of the length of assignment, hours worked during assignments, and (in some jurisdictions) records of any promotions, salary rises or bonuses awarded)
Assessing Temporary Workers' performance
Giving Temporary Workers feedback in relation to assignments
Managing absences

Types of personal data used

Temporary worker information
Special category information

Legal basis relied upon

If you have entered into a Temp Relationship with us, we will rely on the performance of a contract legal basis to the extent that the processing activity that we are seeking to conduct is necessary for the purposes of the contract that we have entered into with you

We will otherwise rely on legitimate interests, namely it is in our interests and your interests for us to facilitate the Temp Relationship

If we need to process your special category data (e.g. details of any sickness absence including health-related information), we will process your personal data in this way if we have a legitimate interest in and it is necessary for us to process your data for health and social care purposes and local laws allow us to process your data in this way without obtaining your consent. If local law requires us to obtain your consent, we will do so.

Sharing of data

If we employ or engage you directly as a Temporary Worker, we may share your personal data with a number of additional parties in order to ensure the smooth running of our Temp Relationship. For example, we may share your personal data with appropriate colleagues within Tessero (this may include colleagues in overseas offices), with a Client and, if appropriate, medical professionals such as your GP or an occupational health specialist (for instance, for the purpose of any work adjustment assessments if applicable).
We will generally rely on the same legal bases referred to in the section addressing Temp Relationship Activities above depending on the context.
If you would like to see a full list of who we will share your personal data with, please refer to the section entitled “Who do we share your personal data with” in the General Privacy Information section of this Privacy Policy.
Please note that in certain of the jurisdictions in which we operate, we comply with additional local law requirements. For more information in relation to your jurisdiction, please see Annex 3.

3. Clients

This section of the Privacy Policy applies to Clients.

Clients include our customers, clients, and others to whom Tessero provides services in the course of its business or whom Tessero reasonably considers would be interested in our services. In certain circumstances, Tessero provides services to individual employees who work for Client organisations, such as training courses to teaching staff who work for Clients in the education sector. Please note that in this context, Tessero requires Clients to communicate the relevant parts of this Privacy Policy (namely the sections directed at Clients, Visitors and Website Users) to their employees.

What kind of personal information do we collect?

So you're looking for a bit more insight into what data we collect about you? Here's a more detailed look at the sorts of information that we will collect. The information described below is, of course, in addition to any personal data we are required by law to process in any given situation.

The data we collect about Clients is actually very limited. We generally only need to have your contact details or the details of individual contacts at your organisation to enable us to ensure that we can reach out to you about our services, ensure our relationship runs smoothly and in certain circumstances, provide services to your employees. We also hold information relating to your online engagement with Candidate profiles and other material published by Tessero, which we use to ensure that our marketing communications to you are relevant and timely. We may also hold extra information that someone in your organisation has chosen to tell us. In certain circumstances, such as when you engage with our Finance and Debt Recovery teams, our calls with you may be recorded, depending on the applicable local laws and requirements. If we need any additional personal data for any reason, we will let you know:

Key identification and contact information

About yourself or individual contacts at your organisation, including:

Names;
Job titles;
Telephone numbers;
Email addresses;

Automatically collected information
- Information relating to your online engagement with Candidate profiles;
- Information relating to your online engagement with other material published by Tessero;
- IP address;
- Extra Usage information that you choose to tell us; including the dates, times and frequency with which you access our services;
- User choices (e.g. marketing preferences);
- User reports;
- Log and troubleshooting information;
- Device information when you install, access or use our services;
- Website browsing data e.g. pages viewed (limited to Tessero websites);
- Email engagement with Tessero;
- Location information (inferred from jobs, IP address, application history or system stored data);
- Account access information (e.g. PIN numbers for account verification purposes);
Information that others provide about you
- Extra information that our Candidates may tell us about you, or that we find from other third party sources; and
Additional information that you choose to tell us
- Extra information that you or someone in your organisation has chosen to tell us, including when corresponding with us via email or otherwise.

Please note that the above list of categories of personal data we collect is not exhaustive.

To the extent that you access our website or click through any links in an email or text message from us, we will also collect certain data from you. If you would like more information about this, please refer to the Context-Specific section of this Privacy Policy that applies to Website Users.

How do we collect your personal data?

We collect Client personal data in the following ways:

Personal data that we receive from you;
Personal data that we collect or receive from other sources; and
Personal data that we collect automatically.

Personal data that we receive directly from you

We both share the same goal – to make sure that you have the best staff for and at your organisation. We will receive data directly from you in two ways:
- Where you contact us proactively, usually by phone or email; and/or
- Where we contact you, either by phone or email, or through our consultants' business development activities more generally.
The types of information that we receive from you in this way include:
- Key identification and contact information; and
- Additional information that you choose to tell us,

as described in the section entitled “What Kind of Personal Information Do We Collect?” above.

Personal data we receive from other sources

Where appropriate and in accordance with any local laws and requirements, we will seek more information about you or your colleagues from other sources generally by way of due diligence or other market intelligence:
- From third party market research and by analysing online and offline media (which we will do ourselves or employ other organisations to do for us);
- From reputable vendors of business-to-business data lists to the extent we are able to use such data from such sources in compliance with the GDPR;
- From delegate lists at relevant events; and
- From other limited sources and third parties, for example, from our Candidates to the extent that they provide us with your details to act as a referee for them or where they give feedback on a particular assignment.
The types of information that we receive about you in this way may include information that others provide about you as described in the section entitled “What Kind of Personal Information Do We Collect?” above.

Personal data we collect via our website or through links and emails

To the extent that you access our website or read or click on an email or text message from us, where appropriate and in accordance with any local laws and requirements, we will also collect your data automatically or through you providing it to us. For more information, please refer to the Context-Specific section of this Privacy Policy that applies to Website Users.
The types of information that we collect about you in this way include the automatically collected information as described in the section entitled “What Kind of Personal Information Do We Collect?” above.

How do we use your personal data?

We use Client information for:

Providing our services;
Marketing Activities; and
To help us to establish, exercise or defend legal claims.

Providing our services

Our services broadly consist of: (i) providing you with Candidates; (ii) RPO services; (iii) MSP programmes; and (iv) consultancy and advisory services. We've listed below the various ways in which we use your data in order to facilitate this.
We also provide services to your employees such as training courses to teaching staff who work for our Clients in the education sector, which will require us to use their personal data in order to grant them access to these services.
In most cases, we will use your personal data for the purposes below if we deem it necessary to do so for our legitimate interests.
Article 6(1)(f) of the GDPR says that we can process your data where it “is necessary for the purposes of the legitimate interests pursued by us or by a third party, except where such interests are overridden by the interests or fundamental rights or freedoms of you which require protection of personal data.”
We don't think that any of the activities in relation to which we rely on the legitimate interests condition prejudice Clients in any way. However, you do have the right to object to us processing your personal data on this basis. If you would like to know more about how to do so, please refer to the section entitled “How can you access, amend or take back the personal data that you have given to us” in the General Privacy Information section of this Privacy Policy.
Please note that in certain jurisdictions in which we operate, we comply with additional local law requirements.

Collecting and processing data in the course of and to the extent necessary to reach out to Clients about our services, including by:

Storing Client details (and updating them when necessary) on Tessero’s database, so that Tessero can contact Clients in relation to our services;
Keeping records of Tessero’s conversations and meetings with Clients, so that Tessero can provide targeted services to Clients

Types of personal data used:

Key identification and contact information
Information that others provide about you
Additional information that you choose to tell us

Legal basis relied upon:

Legitimate interests, namely it is in our interests and your interests:

for us to reach out to you about our services in order to provide you or your organisation with suitable Candidates, an MSP programme; RPO services and/or consultancy and advisory services

Collecting and processing data in the course of and to the extent necessary to:

provide services to colleagues/employees of Tessero’s Clients
make video recordings of Clients' (and colleagues/employees of Clients) participation in training sessions or meetings for internal training/monitoring purposes and/or maintaining internal compliance standards

Types of personal data used:

Key identification and contact information
Additional information that you choose to tell us
Video recording footage

Legal basis relied upon:

Legitimate interests, namely it is in our interests and your interests:

for us to, in certain circumstances, reach out to your colleagues/employees about our services, such as training courses

To the extent that we record a video of you, we will ask for your consent before we start recording, but will rely on legitimate interests in relation to our use of the data for training/monitoring and for maintaining compliance standards

Collecting and processing Client data in the course of carrying out:

customer satisfaction surveys
Tessero market research which Tessero will use to inform its marketing materials and other informational materials, such as whitepapers, reports and articles (e.g. Tessero’s salary guides)

To the extent that any data is published, this will be in aggregated/anonymised form only

Types of personal data used:

Key identification and contact information
Automatically collected information
Additional information that you choose to tell us

Legal basis relied upon:

Legitimate interests, namely it is in our interests and your interests to:

improve and develop the recruitment services that we provide to you by considering your feedback and feeding this into our processes where we deem necessary

Processing Client data in the course of carrying out Tessero’s obligations arising from any contracts entered into between Tessero and third parties in relation to recruitment, such as potential Candidates who Tessero identifies as suitable for a role in a Client organisation

Types of personal data used:

Key identification and contact information
Information that others provide about you
Additional information that you choose to tell us

Legal basis relied upon: Legitimate interests, namely it is in our interests and your interests to fulfil our obligations under agreements with third parties such as potential Candidates, so that we can help you find suitable employees

In certain jurisdictions, using a web-based video identity verification process to verify a Client's identity and document this process

Types of personal data used:

Key identification and contact information (including a copy of driving licence and/or passport/identity card)
Additional information that you choose to tell us
Video recording footage

Legal basis relied upon:

To the extent that this is carried out in your jurisdiction, we will ask for your consent before we start recording but rely on compliance with a legal obligation to the extent that we are compelled by applicable law to verify your identity (e.g. in the context of payments services)

For more information in relation to your jurisdiction, please see Annex 3

Collecting and processing Client data in the course of obtaining Candidate references from Clients, and sharing this data with third parties who require these references where appropriate

Types of personal data used:

Key identification and contact information
Additional information that you choose to tell us
Reference about a Candidate

Legal basis relied upon: Legitimate interests, namely it is in our interests to obtain Candidate references in the course of carrying out our services, and to verify details they have provided

Marketing Activities

Subject to any applicable local laws and requirements, we will not, as a matter of course, seek your consent when sending marketing materials such as our Global Skills Index to a corporate postal or email address.
If you are not happy about this, you have the right to opt out of receiving marketing materials from us and can find out more about how to do so by referring to the section entitled “How can you access, amend or take back the personal data that you have given to us” in the General Privacy Information section of this Privacy Policy.
Please note that in certain of the jurisdictions in which we operate, we comply with additional local law requirements regarding marketing activities.

Why and how we process your information

Processing Client data for the purpose of targeting appropriate marketing campaigns for Tessero’s services

Types of personal data used

Key identification and contact information
Automatically collected information

Legal basis relied upon

Legitimate interests, namely if we wish to reach out to you to tell you about our services, and we consider that it would be in your interests to hear about similar services to those that you have already expressed an interest in.

Profiling, Algorithms and Automated Decision Making

Profiling is a type of processing activity which enables us better to understand the information that we collect about you, to help us to develop a personalised “profile” for you. This helps us to gain a better idea of how you like to interact with us and our services, the sorts of requests you like to make of us and, of course, the sorts of things you don’t like. The purpose of our building this personalised profile is to enable us to provide the best possible service to you and maximise the chances that we will be able quickly and efficiently to provide you with access to content that is most likely to be relevant and helpful to you.
We will use profiling methods in relation to your personal data if we consider this is necessary for our legitimate interests as detailed in the table below. If you are not happy about this, in certain circumstances you have the right to object and can find out more about how and when to do this by referring to the section entitled “How can you access, amend or take back the personal data that you have given to us” in the General Privacy Information section of this Privacy Policy.
As new and better technology becomes more prevalent, some of our profiling activities and our processing activities which use automated systems such as those described above, may amount to Automated Decision Making within the meaning of Article 22 of the GDPR. This means a process of making a decision by automated means with limited, or even no, human intervention in reaching the decision. We will only use automated decision making in relation to your personal data where we consider this is necessary for the completion of pre-contractual steps taken at your request.
Please note that in certain of the jurisdictions in which we operate, we comply with additional local law requirements.

Collection of data via personalisation cookies/pixels and use of this data for profiling purposes so that Tessero can show Clients both targeted and personalised content

This will include:

personalising Clients' website experience, including in relation to the roles that are brought to their attention when visiting the website
making recommendations for editorial content that we think may be of interest to Clients (e.g. reports about developments in the relevant industry)
personalising the marketing content that Clients receive via the website, email and other marketing channels (where they have consented to that marketing)

These personalisation cookies/pixels are used to understand how Clients engage with the website by recording their visit to the website, the pages they have visited, the interactions they have made and the links they have followed. Tessero will use this information to understand what they may be interested in and tailor what it shows and sends to them accordingly

Types of personal data used:

Key identification and contact information
Automatically collected information

More specifically, this will include:

Personal information and information about the Client's job search (i.e. as submitted via form or pulled through from our Systems)
Details of Clients' interactions with the website (e.g. applications, web page visits), and other information pulled through from the Systems (e.g. job title, past applications)
Location data - either inferred from jobs, IP, or application history, or system stored data
Digital identifiers - IP address, personalisation cookies
Website browsing data, form submission data and email engagement data
Marketing preferences

Legal basis relied upon:

We will obtain your consent via the Cookie Preferences link on our website before we place personalisation cookies/pixels on your device and enable this functionality.

If you do not wish to provide your consent to us placing a personalisation cookie on your device, please turn off the “Functionality Cookies” and “Advertising Cookies” options (please refer to our Cookies Policy)

Please note that if you access Tessero’s services across multiple devices, you may need to adjust your settings via the Cookie Preferences link on each of your devices

Notwithstanding our collection of consent prior to placing personalisation cookies/pixels onto your device, we will rely on the legitimate interests condition in relation to the personalisation activities that we subsequently carry out

We consider that it is in our interests (and sometimes your interests) to:

increase engagement with and improve the experience of using our services by increasing the relevance of the content that you see across the Tessero websites and email campaigns
increase application numbers, conversion rates and application usefulness through providing tailored job recommendations to you
encourage you to come back to our website by making this most helpful experience possible
reduce website bounce rate
increase email engagement rate (i.e. the frequency with which users click through)

Tessero may capture and analyse Clients' web-based behaviours using various items of data e.g. number of web visits made, number of candidates searched) in order to award a Client a weighted “approachability score” with a view to providing insights into Clients' needs and to allow Tessero to follow up where needed

Consultants will use these scores as part of the shortlisting and ranking activities described in more detail below and as a factor in determining whether to approach/show roles to a Client (and what to show them), which will serve to supplement other data that Tessero holds about the Client

Tessero collection of web-based data will rely on the personalisation cookies/pixels that it places on Clients' devices as part of the personalisation activities described above

Types of personal data used:

Key identification and contact information
Automatically collected information
Information that others provide about you
Additional information that you choose to tell us

Legal basis relied upon:

We will obtain your consent via the Cookie Preferences link on our website before we place personalisation cookies/pixels on your device

Please note that if you access Tessero’s services across multiple devices, you may need to adjust your settings via the Cookie Preferences link on each of your devices

However, please note that we may still carry out engagement scoring activities even if a personalisation cookie is not placed on your device (e.g. we may consider the data that we already hold on our systems about you with a view to allocating you an engagement score even if you have opted out of the personalisation cookie)

Notwithstanding our collection of consent prior to placing personalisation cookies/pixels onto your device, we will rely on the legitimate interests condition in relation to allocating you an engagement score and our subsequent use of this score

We consider that it is in our legitimate interests to allocate you with an engagement score in order to help our consultants to make decisions in relation to suggesting relevant services and sending relevant communications to you

Tessero may use the data that it collects via personalisation cookies/pixels e.g. web-based behaviours such as details of Clients' interactions with the website (e.g. applications, web page visits), to enrich the Client data and existing profiles about them that Tessero already holds on its Systems

Types of personal data used:

Key identification and contact information
Automatically collected information

Legal basis relied upon:

We will obtain your consent via the Cookie Preferences link on our website before we place personalisation cookies/pixels on your device

Please note that if you access Tessero’s services across multiple devices, you may need to adjust your settings via the Cookie Preferences link on each of your devices

Notwithstanding our collection of consent prior to placing personalisation cookies/pixels onto your device, we will rely on the legitimate interests condition in relation to using data that we collect about you to enrich your existing profile on our Systems

We consider that it is in our legitimate interests to enrich the data that we hold about you to help our consultants to make decisions in relation to suggesting relevant services and sending relevant communications to you

Sharing of data

We will share your data: (i) primarily to ensure that we provide you with a suitable pool of Candidates; (ii) to provide you with an MSP programme (or assist another organisation to do so); (iii) to provide you with RPO services (or assist another organisation to do so); to (iv) provide you with consultancy and advisory services and/or (v) to provide services to your employees, such as training courses to teaching staff who work for our Clients in the education sector. Unless you specify otherwise, we will share your information with any of our group companies and associated third parties such as our service providers to help us meet these aims.
If you would like to see a more detailed list of who we will share your personal data with, please refer to the section entitled “Who do we share your personal data with” in the General Privacy Information section of this Privacy Policy. Please note that in certain of the jurisdictions in which we operate, we comply with additional local law requirements. For more information in relation to your jurisdiction, please see Annex 3.

Why and how we process your information

Disclosing Clients' data to the recipients listed in the section entitled “Who do we share your personal data with”, including the transfer, storage and processing of such data outside of the UK/European Economic Area for the purposes listed in the preceding tables

Types of personal data used

The actual information used depends on the factual circumstances, but could include any of the following:

Key identification and contact information
Automatically collected information
Information that others provide about you
Additional information that you choose to tell us

Legal basis relied upon

The disclosure (e.g. to our professional advisers) is necessary to help us to establish, exercise or defend legal claims
The disclosure is necessary for the purposes of ‘legitimate interests’ pursued by us (as detailed in the tables above)

To help us to establish, exercise or defend legal claims

In more unusual circumstances, we will use your personal data in reliance on the legitimate interests legal basis to help us to establish, exercise or defend legal claims.

Why and how we process your information

Preserving, sharing and otherwise processing Client data to establish, exercise or defend legal claims

Types of personal data used

The actual information used depends on the factual circumstances, but could include any of the following:

Key identification and contact information
Automatically collected information
Information that others provide about you
Additional information that you choose to tell us

Legal basis relied upon

Legitimate interests, namely it is in our interests to seek and receive legal advice should we need it and to protect ourselves in the context of litigation and other disputes

4. Suppliers and other third parties

This section of the Privacy Policy applies to Suppliers.

Suppliers include partnerships and companies (including sole traders), and atypical workers such as independent contractors and freelance workers, who provide services to Tessero. In certain circumstances Tessero will sub-contract the services it provides to Clients to third party suppliers who perform services on Tessero’s behalf. In this context, suppliers that are individual contractors, freelance workers, or employees of suppliers will be treated as Candidates for data protection purposes. Please note that in this context, Tessero requires Suppliers to communicate the relevant parts of this Privacy Policy (namely the sections directed at Candidates) to their employees.

This section of the Privacy Policy also applies to other parties with which we have a business or other type of relationship (ranging from investors to charitable organisations).

What kind of personal information do we collect?

We don't collect much data about Suppliers and other third parties with which we conduct a business relationship (e.g. investors) – we simply need to make sure that our relationship runs smoothly. We'll collect the details of contacts within your organisation, such as names, telephone numbers and email addresses. In the case of Suppliers, we'll also collect bank details, so that we can pay you. We may also hold extra information that someone in your organisation has chosen to tell us. In certain circumstances, such as when a Supplier engages with our Finance and Debt Recovery teams, our calls with you may be recorded, depending on the applicable local laws and requirements:

Key identification and contact information

About yourself or individual contacts at your organisation, including:

Names;
Job titles;
Telephone numbers;
Email addresses;
Business account bank details;
Identification number;

Information that others provide about you
- Extra information that our Candidates or Clients may tell us about you, or that we find from other third party sources; and
Additional information that you choose to tell us
- Extra information that you or someone in your organisation has chosen to tell us, including when corresponding with us via email or otherwise.

Please note that the above list of categories of personal data we collect is not exhaustive.

How do we collect your personal data?

We collect Supplier and other third party personal data in the following ways:

Personal data that we receive from you; and
Personal data that we collect or receive from other sources.

Personal data that we receive directly from you

We will receive data directly from you in two ways:
- Where you contact us proactively, usually by phone or email; and/or
- Where we contact you, either by phone or email.
The types of information that we receive from you in this way include:
- Key identification and contact information; and
- Additional information that you choose to tell us,

as described in the section entitled “What Kind of Personal Information Do We Collect?” above.

Personal data we receive from other sources

Where appropriate and in accordance with any local laws and requirements, we will seek more information about you or your colleagues from other sources generally by way of due diligence or other market intelligence:
- From third party market research and by analysing online and offline media (which we will do ourselves or employ other organisations to do for us);
- From delegate lists at relevant events; and
- From other limited sources and third parties.
The types of information that we receive about you in this way may include information that others provide about you as described in the section entitled “What Kind of Personal Information Do We Collect?” above.

How do we use your personal data?

In most cases, we will use your personal data for the purposes below if we deem this to be necessary for our legitimate interests.
We will not, as a matter of course, seek your consent when sending marketing messages to a corporate postal or email address.
In most cases, we will use your personal data for the purposes below if we deem it necessary to do so for our legitimate interests. Article 6(1)(f) of the GDPR says that we can process your data where it “is necessary for the purposes of the legitimate interests pursued by us or by a third party, except where such interests are overridden by the interests or fundamental rights or freedoms of you which require protection of personal data.”
We don't think that any of the following activities prejudice Suppliers or other third parties in any way. However, you do have the right to object to us processing your personal data on this basis. If you would like to know more about how to do so, please refer to the section entitled “How can you access, amend or take back the personal data that you have given to us” in the General Privacy Information section of this Privacy Policy.
Please note that in certain of the jurisdictions in which we operate, we comply with additional local law requirements. For more information in relation to your jurisdiction, please see Annex 3.

Storing Supplier and other third party details (and updating them where necessary) on Tessero’s database, so that Tessero can contact Suppliers and third parties in relation to Tessero’s agreements and business relationships with these parties

Types of personal data used:

Key identification and contact information
Information that others provide about you
Additional information that you choose to tell us

Legal basis relied upon:

Legitimate interests, namely it is in our interests and your interests:

for us to reach out to you about the arrangements that we have in place

Collecting and processing data in the course of and to the extent necessary to receive support and services from Suppliers and maintain business relationships with other third parties

Types of personal data used:

Key identification and contact information
Additional information that you choose to tell us

Legal basis relied upon:

Legitimate interests, namely it is in our interests and your interests to:

for us to, in certain circumstances, receive information from you about your services
conduct our business relationship with you

If you are an individual (e.g. a Supplier that operates as a sole trader) or you have entered or are about to enter into a contract with us or if you are making a request in the course of doing so, we may rely on the performance of a contract legal basis

In limited circumstances, we may need to rely on the compliance with a legal obligation legal basis to the extent that we are compelled by applicable law to conduct various checks in relation to our Suppliers and other third parties e.g. in relation to verifying that social contributions are being paid and obtaining lists of overseas employees)

Preserving, sharing and otherwise processing Supplier and third party data to establish, exercise or defend legal claims

Types of personal data used:

The actual information used depends on the factual circumstances, but could include:

Key identification and contact information
Information that others provide about you
Additional information that you choose to tell us

Legal basis relied upon: Legitimate interests, namely it is in our interests to seek and receive legal advice should we need it and to protect ourselves in the context of litigation and other disputes

In certain jurisdictions, using a web-based video identity verification process to verify a Supplier or third party's identity and document this process

Types of personal data used:

Key identification and contact information (including a copy of driving licence and/or passport/identity card)
Additional information that you choose to tell us
Video recording footage

Legal basis relied upon:

To the extent that this is carried out in your jurisdiction, we will ask for your consent before we start recording but rely on:

compliance with a legal obligation to the extent that we are compelled by applicable law to verify your identity (e.g. in the context of payments services)
the legitimate interests condition to the extent that we are not legally required to verify your identity but it is in our legitimate interests to do so in order to maintain internal compliance standards

For more information in relation to your jurisdiction, please see Annex 3

Sharing of data

Where we have identified you as a Supplier or other third party and unless you specify otherwise, we may share your information with any of our group companies and associated third parties such as our service providers in order to get in touch with you about our services.
We will generally rely on the same legal bases that we have referred to in the section above.
If you would like to see a full list of who we will share your personal data with, please refer to the section entitled “Who do we share your personal data with” in the General Privacy Information section of this Privacy Policy.
Please note that in certain of the jurisdictions in which we operate, we comply with additional local law requirements.