Privacy & Data Protection Policy

Contents

01. Overview

Howden Group Services Limited (HGSL), part of Howden, is committed to protecting the privacy and security of your personal information. In this Policy, “we”, “us” and “our” means HGSL. This Policy explains how we collect, use, store and protect personal information in line with applicable data protection law, including UK data protection law and, where relevant, other privacy, electronic communications and AI and financial services regulatory requirements.

This Policy explains how we process personal information about individuals that we collect during the normal course of business. It explains what information we collect, why we use it, who we may share it with, how long we keep it and what rights you have.

02. Processing Your Data

We are the controller for the personal data covered by this Policy. This means we decide why and how that information is used.

Our registered office is One Creechurch Place, London, United Kingdom, EC3A 5AF. The data protection contact is the Data Protection Officer: [email protected]

When we use personal information, we follow the main data protection principles. In practical terms, this means we use your information fairly and transparently, only for clear purposes, only where we need it, keep it accurate, protect it, and keep appropriate records showing how we comply.

We may update this Policy from time to time. If we make a material change to how we use personal information, we will let you know or make the updated Policy available to you.

Where we process personal data to support an FCA- or PRA-regulated Howden entity, we identify the relevant controller, purpose and legal basis. A regulatory requirement does not remove the need to comply with data protection principles, including fairness, transparency, necessity, proportionality and data minimisation.

03. Departmental Data Processing Tables

The tables below explain, in practical terms, the main types of information different departments may process. They are examples rather than a complete list. Where more than one lawful basis is shown, the basis we use depends on the specific activity. We do not rely on all of them at once or apply them without review. For higher-risk activities, such as legitimate interests, sensitive data, criminal offence data, AI, monitoring or tracking, the applicable basis and any extra-legal condition should be assessed and recorded where required. The exact information used, lawful basis and retention period will depend on the activity, the people affected and any relevant notice, policy or contract.

3.1 Human Resources (HR)

HR uses personal data as part of the recruitment process, to manage the employment relationship, to administer pay and benefits, support employees and meet applicable legal & contractual obligations. 

3.2 Legal

The Legal team may use information about employees, clients, directors, officers, suppliers, claimants, witnesses, complainants, shareholders and other third parties where this is needed for legal work, governance, advice, claims, investigations or regulatory matters.

3.3 Finance

Finance may use information about employees, clients, suppliers, payees, advisers and other business contacts where this is needed for payroll, payments, expenses, tax, audit and financial controls.

3.4 Procurement

Procurement may use information about supplier contacts, bidders, consultants, agency representatives, referees and internal business owners to manage sourcing, onboarding, contracts and supplier risk and, where applicable, support regulatory reporting on material third-party arrangements.

3.5 Corporate Services

Corporate Services may use information about visitors, employees, contractors, event attendees, travel bookers and facilities contacts to run offices safely and effectively.

This includes reception, facilities, office administration, business continuity and physical security. CCTV, access control and visitor records should be clearly signposted, kept only for a defined period and accessed only by people who need them.

3.6 IT

IT may use information about employees, clients, contractors, visitors using guest systems, supplier support contacts and other authorised users of our systems to keep systems secure and working properly.

3.7 Internal Audit

Internal Audit may use information about employees, clients, directors, process owners, suppliers, whistleblowers, complainants, witnesses and others where this is needed for audit work, assurance, investigations or tracking actions.

3.8 Business Services

Business Services may use information about employees, contractors, internal requestors, supplier contacts, service recipients, consultants, visitors and others involved in shared-service or operational support.

3.9 Company Secretariat

Company Secretariat may use information about directors, officers, shareholders, persons with significant control, board and committee attendees, authorised signatories, advisers and governance contacts.

04. Legal Basis

We need a lawful reason to process your personal data. The main reasons we rely on are set out below and in the tables above. In plain terms, we may use your personal data because it is needed for your employment or engagement, because the law or regulation requires it, because it is needed for legal claims, because it protects someone in an emergency, or because we or another party has a legitimate business reason that does not unfairly override your rights.

• For the performance of a contract relating to you
• For compliance with a legal or regulatory obligation to which we are subject
• To initiate/defend legal claims
• To protect the vital interests of individuals
• For our Legitimate Interests (or those of a third party)
• With your consent

When we rely on legitimate interests, we consider whether the use is necessary, proportionate and fair to the people affected. Where required, we record this assessment. Our legitimate interests include recruiting suitable people, managing and supporting staff, running the business effectively, protecting our systems and premises, meeting governance standards and defending legal claims. Where more than one lawful basis could appear relevant, we choose the most appropriate basis for the purpose and check whether any extra condition is needed for sensitive or criminal offence data.

Where personal data is processed to meet an FCA or PRA requirement, legal obligation is relied on only where that obligation applies to HGSL or the relevant controller. Where HGSL supports another Howden entity, the controller and processor roles, lawful basis and decision-making responsibilities are documented.

Some activities may be explained in more detail in local notices, contracts or other policies. We may also use information from corporate systems, such as system logs, email/Teams records, CCTV and building access records, where this is needed for security, compliance, business continuity or legitimate investigations.

05. Processing Special Categories of Personal Data

Some personal data is more sensitive and is defined as “special category data”. This includes information about health, disability, race or ethnic origin, political opinions, religious or philosophical beliefs, sexual orientation, trade union membership, or similar information.

We only use this type of data where the law allows it, where we have a lawful reason and where an additional condition for sensitive data applies. Depending on the situation, this may include explicit consent, employment or social security law, health and safety, occupational medicine, equality monitoring, legal claims, substantial public interest or protecting someone in an emergency. Where the law requires an appropriate policy document or extra safeguards, we will put those in place.

Examples include checking right to work, supporting reasonable adjustments, managing sickness absence, administering benefits, meeting equality and diversity obligations, handling trade union-related rights, or managing grievances and complaints where the information is relevant. Diversity, equality and social mobility monitoring will be voluntary where appropriate and reported on an aggregated or anonymised basis where possible.

Where we process vulnerability-related information in support of a regulated activity, it may include special category data and other sensitive information about health, disability, financial difficulty, bereavement, communication needs or other circumstances affecting the support an individual requires. We seek to record the support need rather than unnecessary underlying detail, use structured indicators where appropriate, restrict access and periodically review whether the information remains accurate and necessary. We do not systematically collect new protected-characteristic data solely for regulatory outcome monitoring unless this is necessary, lawful and proportionate.

Access to special category data is limited to people who genuinely need it. We expect this information to be handled carefully, confidentially and only for the relevant purpose.

06. Criminal Conviction Data

In some circumstances, and only where the law allows it, we may need information about criminal allegations, offences or convictions. This may be relevant for pre-employment screening, regulated roles, policy risk assessments, fit and proper assessments, fraud enquiries, whistleblowing or misconduct investigations, safeguarding concerns or legal claims.

We only use criminal offence data where we have a valid legal basis and specific authority under data protection law. This may include employment or regulatory requirements, preventing or detecting unlawful acts, safeguarding, legal claims or substantial public interest. We do not rely on consent for criminal offence data unless this has been separately assessed as appropriate and lawful. Where required, we keep an appropriate policy document, restrict access and apply extra safeguards. The information is only used where it is reasonable and necessary.

07. Consent

Most of the time, we do not rely on consent to process personal data and instead, we usually rely on another lawful reason, such as contract, legal obligation or legitimate interests.

Where we do need your consent, we will ask for it separately and explain what we are asking you to agree to. We will also explain what happens if you choose not to give consent and, where the law allows, you may be able to withdraw consent at a later stage.

08. Data Collection

We usually collect information directly from you. We may also collect information from other people or organisations where this is necessary and lawful.

This may include information from your manager, family members or representatives, previous employers, recruitment agencies, screening providers, benefit providers, professional bodies, government agencies such as HMRC, courts or regulators, other insurance related entities & claims providers.

We do not deliberately collect more information than we need. If we ask you to provide information that is mandatory, we will tell you. If you do not provide information that is needed for a legal, contractual or essential business reason, we may not be able to complete the relevant process. For example, without bank details we cannot pay you.

You may sometimes provide information about other people, such as dependents, beneficiaries, emergency contacts or next of kin. Before giving us their information, please make sure they understand that you are sharing it with us and why.

09. Data Retention

We keep personal data for as long as we need it for the reason it was collected, and for any related legal, regulatory, audit or business requirement.

As a general rule, we keep most business records for seven years following the end of our relationship with you. This is a default position only and may be overridden by the HGH UK Retention, Archiving and Disposal (RAD) Policy, any applicable legal or regulatory requirement, local record schedules, system-specific retention rules or the purpose for which the data is held. Some records may be kept for shorter periods, such as CCTV, access logs or unsuccessful recruitment records, and some for longer periods, such as statutory, tax, pension, corporate governance, legal hold or claims records. More details are available in the HGH UK Retention, Archiving and Disposal (RAD) Policy.

If there is a legal hold, investigation, dispute, audit or regulatory request, deletion may be paused until the matter is resolved. When information no longer needs to be kept, it will be securely deleted, anonymised or destroyed using an appropriate method.

10. Data Sharing

We only share personal data where there is a proper reason to do so. Internally, we look to ensure that access is limited to people who need the information for their role.

This may include HR, your managers, senior management, Business Risk/Compliance, Legal, Information Security, IT, Finance, system administrators and other teams who need access for a specific task, system support, security, legal, regulatory or business reason.

Some basic work information, such as your name, role, contact details, location, employee number, photograph and published skills or experience profile, may be visible to other employees through internal systems.

We may also share information with trusted third parties that support our business, such as recruitment providers, screening providers, payroll and benefits providers, professional advisers, insurers, auditors, tax advisers, global mobility providers, employee survey providers, IT and HR system providers, government bodies and regulators.

Third parties may act as processors, independent controllers or, in limited cases, joint controllers depending on the service and the purpose of the sharing. Where a third party processes information on our behalf, they must follow our instructions and meet appropriate contractual, confidentiality and security requirements. Where a third party acts as an independent controller, we only share personal data where it is lawful and fair to do so, and where appropriate we provide or signpost relevant privacy information.

Where personal data is shared across a regulated product or distribution chain, or with a regulator, we limit the disclosure to what is necessary for the relevant purpose. We consider whether anonymised or aggregated information is sufficient, document the parties’ roles and apply appropriate data-sharing arrangements.

We may disclose limited personal data to the FCA, PRA, ICO or another competent authority when reporting or responding to an operational incident, personal data breach, material third-party arrangement or regulatory enquiry. Separate regulatory tests may apply, and reporting to one authority does not automatically satisfy any obligation to another.

11. Transfer of Personal Information

Your personal data may be accessed or used by other Howden group companies and by trusted service providers that support us. Some of these organisations, systems or support teams may be based outside the UK or the European Economic Area.

Where personal information is transferred internationally, we take steps required by applicable data protection law to protect it. Depending on the circumstances, this may include recognised transfer safeguards, transfer risk assessments, encryption, access controls, audit rights and technical separation of data.

If you would like more information about the safeguards used for transfers of your personal data, please contact the Data Protection Officer.

12. Use of Artificial Intelligence and Automated Decision-Making

Some approved tools used by us may include artificial intelligence (AI), machine learning, algorithms, profiling, automated decision-support, automated decision-making or general-purpose AI. These tools may be used to support activities such as recruitment administration, candidate assessment support, meeting transcription and summarisation, workforce administration, information retrieval, security, analytics and operational support.

AI can be useful, but it can also create risks such as unfair outcomes, bias, discrimination, inaccurate results, lack of transparency, over-reliance on automated outputs, security risks and confidentiality issues. Before approved AI tools process personal data, we assess the intended purpose, data used, necessity and proportionality, the people affected, accuracy, security, retention, access controls, human oversight, supplier arrangements, international transfers and whether a DPIA, legitimate interests assessment or AI governance review is required. AI outputs must not be treated as final where they may affect individuals unless there has been appropriate human review. Where AI supports an FCA-regulated activity, the assessment also considers Consumer Duty outcomes, the treatment of customers in vulnerable circumstances, senior management accountability and applicable FCA rules or guidance.

We do not use AI for practices prohibited by applicable law, such as unlawful manipulation, social scoring, prohibited biometric categorisation or workplace emotion recognition, unless a narrow lawful exception has been confirmed by Legal and Data Protection. We do not make significant decisions about you based solely on automated processing, including profiling, unless the use is lawful, approved, explained to you and subject to the safeguards required by law. Where those safeguards apply, you can ask for human involvement, make representations and challenge the decision.

AI use-case transparency - Where an approved AI tool processes personal data, we should describe the relevant use case in plain English where this is necessary and appropriate. This may include the personal data used, the purpose of use, the lawful basis, any relevant supplier or sharing arrangement, retention, safeguards and whether the tool only assists staff or materially supports decisions about individuals.

Human involvement, automated decision-making and profiling - Where AI is used only as a staff-support or decision-support tool, meaningful human involvement should remain in place and staff must not treat AI outputs as final without appropriate review. Where automated processing, profiling or AI is used to make, or materially support, a decision with legal or similarly significant effects, we assess that use against the applicable automated decision-making requirements and apply the required safeguards.

Data protection assessment and DPIA - New initiatives involving personal data, including AI-enabled processing, should be assessed before go-live. A full DPIA is required where the processing is likely to result in a high risk to individuals. This may include new technology, profiling, large-scale processing, sensitive data, criminal offence data, monitoring or decisions affecting individuals. The level of assessment should be proportionate to the risk and supported by the relevant operational controls and approval process.

13. Server-Side Tracking and Storage/Access Technologies

We may use cookies, tags, pixels, scripts, link tracking, tag management tools and similar technologies to support business operations. Server-side tracking means information about how someone uses a website, application, email or online service may be sent to a server or tag-management environment before it is shared with approved internal teams or approved third-party providers. The information processed may include IP address, device and browser details, identifiers, login or session data, page views, button clicks, form events, referral information, timestamps, consent choices, security events and email open or click information. Where technology stores information on, or accesses information from, a user’s device, we assess whether consent is required. Where consent is required, we obtain it before using non-essential technologies and provide information about the technologies used and how choices can be managed.

14. Your Rights

You have rights over your personal data. These rights are not always absolute, and there may be situations where we cannot fully meet a request, but we will explain our position if that happens.

Access - you can ask for a copy of personal information we hold about you.

Correction - you can ask us to correct information that is wrong or incomplete, if you cannot correct yourself.

Erasure - you can ask us to delete information where there is no longer a valid reason for us to keep it, where consent has been withdrawn and no other lawful basis applies, where you have successfully objected, or where the information has been used unlawfully.

Portability - where we use information you provided to us based on consent or contract and the processing is automated, you can ask to receive it in a structured, commonly used and machine-readable format. You can also ask us to transfer it to another controller where technically possible.

Restriction - you can ask us to restrict how we use information in certain circumstances, for example while accuracy is being checked, where the use is unlawful, but you do not want deletion, where you need the information for legal claims, or while we assess an objection.

Objection - where we rely on legitimate interests, you can object to that use. We will stop unless we have compelling legitimate grounds that override your interests, rights and freedoms, or we need the information for legal claims.

Withdraw consent - where we rely on your consent, you can withdraw it at any time. This will not affect processing that took place before consent was withdrawn.

Automated decision-making and profiling - where a significant decision is made about you based solely on automated processing, including profiling, we apply the safeguards required by law. This includes giving you meaningful information about the decision and a route to make representations, ask for meaningful human intervention and challenge the decision, unless a lawful exemption applies.

Complaints - if you are unhappy with how we use your information, please contact us first so we can try to resolve it. You also have the right to complain to the Information Commissioner’s Office (ICO). The ICO contact details are below.

Data protection complaints process - If you make a data protection complaint, you can raise it with the Data Protection Officer. We acknowledge eligible data protection complaints within 30 days, take appropriate steps to investigate and respond without undue delay, keep you informed where appropriate, record the complaint and tell you the outcome. Complaints received through the DPO mailbox, HR, Legal, Compliance, IT or another route should be triaged and escalated to the appropriate data protection owner. This does not affect your right to complain to the ICO.

15. Queries

If you have a question, want to exercise your rights, or want to raise a concern about how your personal information is used, please contact the Data Protection Officer at [email protected]

Routing and ownership - Where a complaint relates to another Howden operating business or another controller, we may route or coordinate the complaint with the relevant business or controller so that it is handled by the correct owner.

You can raise privacy concerns or complaints, including electronically where appropriate. Eligible data protection complaints will be acknowledged within 30 days and responded to without undue delay.

16. Version control

17. Policy Approval History

This is an internal document intended for use by Howden and should not be relied upon, cited or used by any third party without express permission.