Privacy Notice

Introduction

Aware Super UK Limited (‘ASUK’, ‘us’, ‘our’, or ‘we’) is committed to protecting the personal data we process, including of our prospective candidates, potential investees, brokers/distributors, advisors, business contacts, business and industry peers and partners, vendor providers, regulatory and governmental contacts, board meeting attendees, and the general public (‘you’) and takes our responsibility regarding the security of this data very seriously. We are committed to being clear and transparent about the personal data we collect and what we do with that data.

This Privacy Notice explains:

• what personal data we collect, how and why we use it, the lawful basis for processing it and our retention standard;
• who we transfer/disclose your personal data to;
• your data protection rights;
• how we secure your personal data;
• who you can contact if you have a query, concern or complaint about your personal data; and
• changes to this Privacy Notice.

All personal data is collected and processed by us in accordance with applicable data protection and privacy laws.
 

What personal data we collect

We will take reasonable measures to ensure that your personal data we handle is accurate, complete, and current. Personal data will not be kept longer than is necessary for its intended purpose. This means that personal data will be securely destroyed, or erased, from our systems when it is no longer required for business, statutory or regulatory purposes, or is out-of-date. This will be done in accordance with our policies and retention standards. See section 7 below for further information.

Your personal data is either provided by you (e.g., from the application forms or other materials you submit to us, and your interactions with us and others as part of your relationship with us), or obtained from third parties (e.g., recruitment consultants, background check providers or from publicly available sources such as LinkedIn).

Depending on your relationship with us, we collect the following types of personal data about you:

Candidates

• Contact information such as name, phone number, residential and email address;
• Background screening/pre-employment check information such as tax or government identification documents and/or numbers, immigration status/work eligibility, birthdate, other information necessary to conduct screenings and results of background screenings and professional references;
• Professional information such as curriculum vitae/resume and corporate biography;
• Employment information such as remuneration, bonus, pension entitlements, insurance and other benefits information, employment dates such as dates of hiring/promotion/position change, performance evaluation, position information such as position, title and reference number, attendance information, language skills, and training, education and development information.
• Criminal convictions, such as data about alleged or proven criminal offences, where required or permitted by, and in compliance with applicable law.
• Written signature;
• Visual and voice recordings such as recorded Teams/WebEx calls;
• Safeguarding utilities such as CCTV and landlord-controlled visitor’s log.

In some cases, the personal data that we collect will also include ‘special categories of data’ (also known as ‘sensitive personal data’ or ‘sensitive information’, such as:

• Health data, such as disabilities and information about your physical and/or mental health (for example, where you provide this to us in order to make any necessary adjustments);
   

Investee & Portfolio Companies

• Contact information such as name, phone number, residential and email address;
• Professional information such as curriculum vitae/resume and corporate biography;
• Screening information such as tax or government identification documents and/or numbers, birthdate, other information necessary to conduct screenings and results of background screenings and professional references;
• Relationship information such as details about your relationship with us and our interactions with you;
• Written signature;
• Visual and voice recordings such as recorded Teams/WebEx calls;
• Safeguarding utilities such as CCTV and landlord-controlled visitor’s log.
   

Business/Industry Partners and Peers (Fund Managers, Brokers and Custodians, and other business contacts), Vendors, Advisors, and Regulatory and Governmental Contacts

• Contact information such as name, phone number, residential and email address;
• Professional information such as curriculum vitae/resume and corporate biography;
• Relationship information such as details about your relationship with us and our interactions with you;
• Written signature;
• Visual and voice recordings such as recorded Teams/WebEx calls;
• Safeguarding utilities such as CCTV and landlord-controlled visitor’s log.
   

Board Meeting Attendees and General Public

• Contact information such as name, phone number, residential and email address;
• Relationship information such as details about your relationship with us and our interactions with you;
• Visual and voice recordings such as recorded Teams/WebEx calls;
• Safeguarding utilities such as CCTV and landlord-controlled visitor’s log.

The provision of some of your personal data is a requirement necessary to enter and/or maintain our contract with you. For example, if you fail to provide your written signature, we may not be able to enter into a contract with you.
We will be clear with you either at the time of collection or, if you are required to provide data, when such personal data is so required.

If you are a current or former employee, secondee or contractor of ASUK, our Employee Privacy Notice sets out the details of our processing of your personal data.
 

How we use your personal data

We may use your personal data for the following purposes:
 

• To communicate with you;
• To evaluate your application, qualifications, and eligibility for employment;
• To verify the accuracy of information provided and conducting background screening and reference checks;
• To ensure we comply with our statutory and/or regulatory obligations and/or to reply to a request from a public or judicial authority with the necessary authorization;
• To facilitate Human Resources (HR) functions and administration;
• To communicate and interact with the Aware Super group, and enabling us ability to operate effectively;
• To enter into legally binding agreements;
• To complete due diligence and for other legitimate business purposes in compliance with our applicable policies and procedures;
• To perform obligations to which our client is subject to such as AML and other screenings and checks;
• To safeguard the security of our premises and employees; and
• To enable a transfer to a potential buyer, transferee, merger partner or seller and their advisers in connection with an actual or potential transfer or merger of part of all of ASUK’s business or assets, or any associated rights or interests, or to acquire a business or enter into a merger with it.
   

The lawful basis on which we process your personal data

We rely on the following lawful bases to process your personal data (including sharing such data with service providers and third parties):

• Performance of a contract – where the processing is necessary for a contract we have with you or your business or because you have asked us to take specific steps before entering into a contract;
• Legal obligation – where the processing is necessary for us to comply with the law, such as keeping records for tax purposes or providing information to a public body or law enforcement agency;
• Vital interests – the processing is necessary to protect the vital interests of the relevant individual or of another natural person, such as providing disability access to places of work where applicable;
• Public interest – the processing is necessary for the purpose of a task carried out in the public interest;
• Your consent – in some cases, where you have given us clear consent for us to process your personal data for a specific purpose. You may request additional information about your consent and/or withdraw your consent at any time. Please see section 6 below for further information;
• Legitimate interests – where the processing is necessary for our legitimate interests (for example, to run our business, meet our corporate and social responsibility obligations, prevent fraud or criminal activity and to safeguard out IT systems, assets and places of work) or the legitimate interests of a third party, and your interests or fundamental rights and freedoms don’t override those legitimate interests.

Where we process “special categories of data” about you (e.g. your health information), we do so either because:

• You have given us your explicit consent;
• We are permitted or required by law to do so (including by employment law);
• It is in your vital interests to do so;
• The processing is necessary for reasons of substantial public interest, such as protecting our workforce from discrimination, harassment and bullying; or
• The processing is necessary for the establishment, exercise or defence of a legal claim.

We will only use your personal data for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose. If we need to use your personal data for an unrelated purpose, we will (where necessary) notify you and explain the legal basis which allows us to do so.
 

Who we transfer/disclose your personal data to

Over the course of your candidacy or business relationship with us, your personal data may be transferred to, and stored, outside the UK, within our group of companies and to service providers and/or other third parties recipients. We provide more detail on these parties below.

Additionally, in certain instances, we may disclose your personal data to third parties located in the European Economic Area (“EEA”), the UK or outside of the EEA and/or the UK. The countries where these third parties located outside of the EEA or the UK are located include, but are not limited to, Australia. While countries outside of the EEA or the UK may not have data protection laws as stringent as the UK GDPR, we require all partners and services providers to process your personal data in a secure manner and in accordance with UK GDPR requirements. We mainly rely on European Commission and UK Information Commissioner approved standard contractual clauses that ensure protection for your data even when it leaves the EEA and/or the UK. Details regarding these safeguards can be obtained from us on request using the information set out in section 9 below.

5.1. Aware Group - your personal data may be shared with Aware Super Pty Ltd as trustee for Aware Super and Aware Super Services Pty Ltd.

5.2. Service Providers - we may share your personal data with third parties who we have appointed to provide goods and/or services to us. We will only share the most minimal amount of data which still enables the providers provide the required services to you or us.

These service providers include:

• Recruitment services providers,
• Payroll services providers,
• Banking services providers,
• Background screening providers,
• Informational Technology (IT) providers,
• Events managements providers,
• Professional advisors, i.e. auditors and lawyers,
• Social media platforms.

5.3. Third Parties Recipients - we may share your data with other third party recipients, including:
 

• Courts, tribunals and regulators such as Financial Conduct Authority (FCA), National Crime Agency (NCA), Information Commissioner Office (ICO);
• Employee Representative Bodies
  
• Professional Services Advisors such as auditors and lawyers;
• A purchaser of, or successor to, us or our business;
• Insurers; and
• Investment Third Parties such as custodians, brokers and fund managers.

Your data protection rights

We would like to make sure you are fully aware of all of your data protection rights. As such, your rights include the following:

The right to access - You have the right to request access to the personal data we hold about you. This is sometimes called a “Subject Access Request”. If we agree that we are obliged to provide personal data to you, we will provide a copy to you free of charge. Before providing personal data to you, we may ask for proof of identity and sufficient information about your interactions with us that we can locate your personal data.

The right to rectification - You have the right to request that we correct any personal data you believe is inaccurate. You also have the right to request us to complete any personal data you believe is incomplete.

The right to erasure - You have the right to request that we erase your personal data, under certain conditions.

The right to restrict processing - You have the right to request that we restrict the processing of your personal data, under certain conditions.

The right to object to processing - You have the right to object to us processing your personal data, under certain conditions. This includes the right to object to automated decision-making including profiling, which produces a legal effect or similarly significant effects.

The right to data portability - You have the right to request that we transfer the data that we have collected to another organisation, or directly to you, under certain conditions.

Withdraw consent. In the limited circumstances where you have provided your consent to the collection, processing and transfer of your personal data for a specific purpose, you have the right to withdraw your consent for that specific processing at any time.

To submit a request for any of the above rights, you should contact us via the following channels:

Data Privacy Champion
Email: dataprivacychampion@awaresuper.co.uk
Phone: +442039172131
Postal address: Charles House, Level 5, 5 – 11 Regent Street SW1Y 4LR

Data retention

We keep your personal data for as long as necessary in connection with the purposes identified within this notice, and for a reasonable period thereafter, in accordance with any local retention periods. In general, candidacy data is kept for 1 year.

Business or contractual relationships are kept for the duration of the relationship, and then 7 years after the termination of a business or contractual relationship or 1 year if a relationship or investment did not proceed.

In certain circumstances, data may be retained for a longer period of time, for example, where we are in ongoing correspondence.

Visual and voice recordings are kept for 60 days.

Safeguarding utilities are kept for 30 days.

How we secure your personal data

We are committed to ensuring the security and confidentiality of your personal data. Taking into account the nature of your personal data and the risks of processing, we have put in place appropriate technical and organizational measures as required by applicable legal provisions to ensure an appropriate level of security and to prevent any accidental or unlawful destruction, loss, alteration, disclosure, intrusion of or unauthorized access to these data. We (or our auditors) may conduct audits to ensure the appropriate security measures are in place to safeguard the personal data for which it is responsible.

Where we disclose your personal data to third parties for the purposes set out above, we require all third parties to have appropriate technical and operational security measures in place to protect your personal data, in line with applicable data protection rules.

In the event that ASUK suffers a breach involving your personal data, we will do a risk assessment and determine if this breach is unlikely to result in a risk to your rights. If we consider that is not the case, we will inform the ICO and you in accordance with our legislative requirements.

How to contact us

If you have any questions about privacy or would like to enquire or make a complaint about a breach of your privacy, please contact our Privacy Officer at:

Data Privacy Champion
Email: dataprivacychampion@awaresuper.co.uk
Phone: +442039172131
Postal address: Charles House, Level 5, 5 – 11 Regent Street SW1Y 4LR

If you are unhappy with the response from our Privacy Officer, then you have the right to lodge a complaint with the ICO whose contact details are:

Postal address: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF
Email: casework@ico.org.uk
Live chat: https://ico.org.uk/global/contact-us/live-chat
Online: https://ico.org.uk/global/contact-us/email/

Notification of changes

We may update this Privacy Notice from time to time. Our up-to-date Privacy Notice is published on our intranet. Any changes affecting you will be communicated through an appropriate channel, depending on how we normally communicate with you. All personal data about you which is held by us, will be governed by our most recent Privacy Notice. If you are unsure whether you are reading the current version of this Privacy Notice, please contact us and can provide a copy of the current version on request. Should you request our Privacy Notice in a particular form, we will take steps to provide you with a copy in that form unless it is not reasonable to do so.