Russell Reynolds Associates | Workforce and Applicant Privacy Notice

1. Introduction

Russell Reynolds Associates, Inc., and its global affiliates ("RRA", "we" or "us") have issued this Workforce and Applicant Privacy Notice ("Notice") to describe how we manage personal information that we hold about our Workforce Members and applicants for employment (collectively referred to as "you"). The term "Workforce Member" includes all full-time and part-time employees of RRA, as well as individuals who work on a non-permanent basis, including contingent workers (e.g., temporary employees, independent contractors, professional advisors, directors, and interns).

We respect the privacy rights of individuals and are committed to handling personal information responsibly and in accordance with applicable law. This Notice sets out the personal information that we collect and process about you, the purposes of the processing and the rights that you have relating to it.

Please note, the controller of your personal information is typically the local RRA entity that employs or retains you, or if you are an applicant, the RRA entity to whom you apply for a role.

If you are in any doubt regarding the applicable standards or have any comments or questions about this Notice, please contact us using the contact details in Section 12 below.

2. What personal information do we collect?

Information you provide to us: During your employment at or assignment to RRA, or in applying for employment with RRA, we may process personal information about you and your dependents, beneficiaries, and other individuals whose personal information has been provided to us.

The types of personal information we may process include, but are not limited to: 

• Identification data – such as your civil/marital status, photograph, date of birth, gender, national origin, corporate identifier, and national identifier (i.e., social security number or equivalent in your country, driver’s license, national ID/passport number)
• Contact details – such as home and business address, telephone/email addresses and emergency contact details
• Employment details – such as job title, office location, employment contract, performance and disciplinary records, grievance procedures, sickness/holiday records and employee referee details
• Background information – such as academic/professional qualifications, education, CV/résumé, references from previous employers and criminal records data (for vetting purposes, where permissible and in accordance with applicable law)
• Information on your spouse/partner and/or dependents – such as your marital status, identification data on them and information relevant to any RRA benefits extended to such individuals. If you choose to provide us with this information, you must provide your spouse, partner and/or dependents with a copy of this Notice to ensure they are fully informed about how RRA may process their personal data and the privacy rights available to them
• Financial information – such as bank details, tax information, withholdings, salary, benefits, expenses, company allowances, stock and equity grants, and other compensation information
• IT information – information required to provide access to company IT systems and networks (and information collected by/through those systems) such as IP addresses, video meeting recordings, log files and login information
• Lifestyle preferences and personality profiles – such as community involvement and memberships, hobbies, social activities and/or individual preferences, intellectual capacity, personality, behavior and/or character traits
• Other information – such as your prior military service, performance history, details of any dependents, immigration status and, of course, any other relevant information you may choose to share with us

If you are a contingent worker, intern, director or advisor, the type of personal information we process is limited to that needed to manage your particular work assignment and/or relationship with RRA.

Sensitive Personal Information: We may also process sensitive personal information relating to you (and your spouse/partner and/or dependents). Sensitive personal information includes any information that reveals your racial or ethnic origin, sexual orientation, religious, political, or philosophical beliefs, genetic data, and biometric data for the purposes of unique identification, trade union membership or information about your health ("Sensitive Personal Information"). Generally, we try not to collect or process any Sensitive Personal Information about you, unless authorized by law or where necessary to comply with applicable laws.

However, in some circumstances, we may need to collect, or request on a voluntary disclosure basis, some Sensitive Personal Information for legitimate employment-related purposes. For example, information about your racial/ethnic origin and disabilities for the purposes of equal opportunities monitoring, to comply with anti-discrimination laws and for government reporting obligations; or information about your physical or mental condition to provide work-related accommodations, health and insurance benefits to you and your dependents, or to manage absences from work.

Information we collect from third-party sources: We may also obtain information about you from third parties. For example, your referees, publicly available information from social media sites (e.g., LinkedIn, news reports, press releases), third-party data providers (e.g., BoardEx, Bloomberg) and degree verification/background check providers (e.g., Mintz Group). When we obtain information about you from third-party providers or vendors, we take appropriate steps to ensure that such third parties are legally permitted or required to disclose such information to us.

3. Monitoring

Once you become a Workforce Member, RRA will carry out automated monitoring of its information and communications systems through automated tools such as anti-malware software, website filtering and spam filtering. RRA will also carry out monitoring of its physical premises, for example by using CCTV and badge scans.

The primary purpose of this monitoring is to protect RRA, its Workforce Members, clients, and business partners, for some of the following reasons: 

For general network operation and security, including the security of RRA’s IT systems and assets, and the optimal operation of its network and devices

• For proof of business transactions and archiving
• For coaching, training, and evaluation of Workforce Members
• For the protection of confidential information and intellectual property
• For investigating breaches of internal policies, fraud or other unlawful or wrongful activity, or to respond to a personnel or company incident
• For business continuity (such as monitoring business-related emails following a Workforce Member’s departure)
• For physical security of its premises
• For measuring in-person attendance at and use of RRA’s physical premises

Monitoring activities are likely to be continuous and ongoing. However, they will always be proportionate, for legitimate purposes and as required or permitted by applicable law. Before undertaking any monitoring activities, we will consider your reasonable expectations of privacy and assess whether there are any less invasive options.

You should be aware that any messages, files, data, documents, telephone conversations, social media posts or instant message communications, or any other types of information transmitted to or from, received or printed from, or created, stored or recorded on our IT and communications systems and assets are presumed to be business-related and may be monitored by us in accordance with applicable law.

You must clearly identify private emails and messages by adding the term "personal & confidential" in the email or message’s subject line and/or by storing those emails/messages/files in a separate folder marked "personal & confidential". Where we must access content that is clearly identifiable as being private, we will do so only if there is a risk or threat to the company or person, or if we have been legally authorized to do so, for example by a court order.

(i) Electronic monitoring notice:

Any and all telephone conversations or transmissions, electronic mail or transmissions, or internet access or usage by an employee by any electronic device or system, including but not limited to the use of a computer, telephone, wire, radio or electromagnetic, photoelectronic or photo-optical systems may be subject to monitoring at any and all times by any lawful means.

4. How do we use your personal information?

(i) Recruitment purposes

If you are applying for a role at RRA, then we collect and use your personal information primarily for recruitment purposes, in particular to determine your qualifications for employment and to reach a hiring decision. This includes assessing your skills, qualifications, and background for a role, verifying your information, carrying out reference checks or background checks (where applicable), and to generally manage the hiring process and communicate with you about it.

If you are accepted for a role at RRA, the information collected during the recruitment process will form part of your ongoing Workforce Member record.

If you are not successful and if you do not object, we may keep your application to allow us to consider you for other suitable openings within RRA in the future.

(ii) Employment or work-related purposes

Once you become a Workforce Member at RRA, we collect and use your personal information for the purpose of managing our employment or working relationship with you; for example, your employment records and contract information (so we can manage our employment relationship with you), your bank account and salary details (so we can pay you), your equity grants (for stock and benefits plans administration) and details of your spouse and dependents (for emergency contact and benefits purposes).

We may also use your professional details and contact information for the purposes of preparing and sharing your bio for our marketing and general business purposes (e.g., for inclusion on client pitch documents).

We process our Workforce Members’ personal information through a human resources information system ("HR System"), which is a tool that helps us to administer Workforce Member compensation and benefits, and which allows Workforce Members to manage their own personal information in some cases. This will involve transferring your personal information to our HR System provider’s servers in the United States. Our parent company, Russell Reynolds Associates, Inc., may host these servers or utilize third-party servers, but in either case will be responsible for the security access of personal information on the HR System.

(iii) The RRA global directory

We maintain a global directory of Workforce Members which contains your professional contact details (such as your name, location, photo, job title and contact information). This information will be available to everyone in RRA to facilitate global cooperation, communication, and teamwork.

(iv) Other legitimate business purposes

We may also collect and use personal information when it is necessary for other legitimate purposes, such as to help us conduct our business more effectively and efficiently; for example, for general human capital resourcing, IT security/management, accounting purposes or financial planning. We may also process your personal information to investigate violations of law or breaches of our own internal policies.

(v) Law-related and other purposes

We may also use your personal information where we consider it necessary for complying with laws and regulations, including collecting and disclosing Workforce Member personal information as required by law (e.g., for tax, health and safety, anti-discrimination and other employment laws), under judicial authorization, to protect your vital interests (or those of another person), or to exercise or defend the legal rights of the RRA global group of companies.

(vi) Consent

In some limited circumstances, we may use your personal and Sensitive Personal Information where we have obtained your consent to do so. Where we seek your consent, you will always have an opportunity to refuse.

5. How we share your information

We take care to allow access to personal information only to those who require such access to perform their tasks and duties and to third parties who have a legitimate purpose for accessing it. Whenever we permit a third party to access personal information, we will implement appropriate measures to ensure the information is used in a manner consistent with this Notice and that the security and confidentiality of the information is maintained.

(i) Transfers to other group companies

As mentioned above, we will share your personal information with other members of the RRA group of companies around the world to administer human resources, Workforce Member compensation and benefits at an international level on the HR System, as well as for other legitimate business purposes such as IT services/security, tax and accounting, and general business management.

(ii) Transfers to third-party service providers

We may make certain personal information available to third-party service providers (vendors) who provide services to us. We do so on a "need-to-know basis" and in accordance with applicable data privacy laws.

For example, some personal information will be available to our Workforce Member stock and benefit plans service providers and third-party companies who provide us with payroll support services, tax and travel management services, background check and I-9 verification services, as well as the providers of our HR Systems and other cloud computing vendors.

(iii) Transfers to other third parties

We may also disclose personal information to third parties on other lawful grounds, including:

• To comply with our legal obligations, including where necessary to abide by law, regulation, or contract, or to respond to a court order, administrative or judicial process, including, but not limited to, a subpoena, government audit or search warrant
• In response to lawful requests by public authorities (including for national security or law enforcement purposes)
• With our clients if we include your bio or other personal information in marketing materials (such as client pitches)
• As necessary to establish, exercise or defend against potential, threatened or actual litigation
• Where necessary to protect the vital interests of you or another person
• Relating to the sale, assignment or other transfer of all or part of our business
• With your consent

6. Legal basis for processing personal information (EEA Workforce Members/applicants only)

If you are a Workforce Member in the European Economic Area, our legal basis for collecting and using the personal information described above will depend on the personal information concerned and the specific context in which we collect it.

However, we will normally collect personal information from you only where we have your consent to do so, where we need the personal information to perform a contract with you (i.e., to administer an employment or work relationship with us), or where the processing is in our legitimate interests and not overridden by your data protection interests or fundamental rights and freedoms. In some cases, we may also have a legal obligation to collect personal information from you or may otherwise need the personal information to protect your vital interests or those of another person.

If you have questions about or need further information concerning the legal basis on which we collect and use your personal information, please contact us using the contact details provided in Section 12 below.

7. International data transfers

Your personal information may be transferred to, and processed in, countries other than the country in which you are resident. These countries may have data protection laws that are different from the laws of your country (and, in some cases, may not be as protective).
Specifically, our servers are located in the United States, Germany and Singapore, and our group companies and third-party service providers and partners operate around the world. This means that when we collect your personal information, we may process it in any of the countries where our group companies and service providers are located.

However, we have taken appropriate safeguards to require that your personal information will remain protected in accordance with this Notice. These include implementing the European Commission’s Standard Contractual Clauses for transfers of personal information between our group companies, which require all group companies to protect personal information they process from the EEA in accordance with European Union data protection law. 
Our Standard Contractual Clauses can be provided on request. We have implemented similar appropriate safeguards with our third-party service providers and partners, and further details can be provided upon request.

8. How long do we keep your personal information?

Personal information will be stored in accordance with applicable laws and kept as long as needed to carry out the purposes described in this Notice or as otherwise required by applicable law. Generally, if you are a Workforce Member, this means your personal information will be retained until the end or your employment or work relationship with us, plus a reasonable period of time thereafter (typically 10 years) to respond to employment or work-related inquiries or to deal with any legal matters (e.g., judicial or disciplinary actions), document the proper deductions during and upon termination of your employment or work relationship (e.g., to tax authorities), or longer than 10 years if we need to provide you with ongoing pensions or other benefits.

9. Your data privacy rights

You may exercise the rights available to you under applicable data protection laws in the country where you live, as follows:

• If you wish to access, correct, update or request deletion of your personal information, you can do so at any time by contacting us using the contact details provided in Section 12 below. 
  
  
• In addition, if you are a resident of the European Union, you can object to processing of your personal information, ask us to restrict processing of your personal information or request portability of your personal information. Again, you can exercise these rights by contacting us using the contact details provided in Section 12 below.
  
  
• If we have collected and processed your personal information with your consent, then you can withdraw your consent at any time. Withdrawing your consent will not affect the lawfulness of any processing we conducted prior to your withdrawal, nor will it affect processing of your personal information conducted in reliance on lawful processing grounds other than consent.
  
  
• You have the right to complain to a data protection authority about our collection and use of your personal information. For more information, please contact your local data protection authority. (Contact details for data protection authorities in the European Economic Area are available here.)

We respond to all requests we receive from individuals wishing to exercise their data protection rights in accordance with applicable data protection laws.

10. Application of local laws

If local laws in a country require different or stricter standards for the processing of data than those described in this policy, the relevant RRA entities will treat such data in accordance with local laws.

11. Updates to this Notice

This Notice may be updated periodically to reflect any necessary changes in our privacy practices. In such cases, we will inform you on the intranet and/or where appropriate, by company-wide email. We shall indicate at the top of the Notice when it was most recently updated. We encourage you to check back periodically to ensure you are aware of the most recent version of this Notice.

12. Contact details

Please address any questions or requests relating to this Notice to privacy@russellreynolds.com or, alternatively, you can raise any concerns with your line manager or the People Department.

Full details of all RRA entities are set forth below: 

EAA Entities 

Non-EAA Entities