Privacy Policy

In this Policy the following terms shall have the following meanings:

"Cookie" means a small text file placed on your computer or device by Our Site when you visit certain parts of Our Site and/or when you use certain features of Our Site. Details of the Cookies used by Our Site are set out in Part 1.14, below.

"Cookie Law" means the relevant parts of the Privacy and Electronic Communications (EC Directive) Regulations 2003 (PECR).

Our Site is owned and operated by Wavex Technology Limited, a limited company registered in England and Wales under company number 4258498.

This Privacy Policy applies only to your use of Our Site. Our Site may contain links to other websites. Please note that we have no control over how your data is collected, stored, or used by other websites and we advise you to check the privacy policies of any such websites before providing any data to them.

Personal data is defined by the UK General Data Protection Regulation (UK GDPR) as 'any information relating to an identifiable person who can be directly or indirectly identified in particular by reference to an identifier'.

Personal data is, in simpler terms, any information about you that enables you to be identified. Personal data covers obvious information such as your name and contact details, but it also covers less obvious information such as identification numbers, electronic location data, and other online identifiers.

Under the UK GDPR, you have the following rights, which we will always work to uphold:

• a) The right to be informed about our collection and use of your personal data.
• b) The right to access the personal data we hold about you (see Part 1.13).
• c) The right to have your personal data rectified if any of it is inaccurate or incomplete.
• d) The right to be forgotten - to ask us to delete or otherwise dispose of any of your personal data.
• e) The right to restrict (i.e. prevent) the processing of your personal data.
• f) The right to object to us using your personal data for a particular purpose or purposes.
• g) The right to data portability - to receive a copy of your personal data in a portable format where processing is based on consent or contract and carried out by automated means.
• h) Rights relating to automated decision-making and profiling. We do not use your personal data in this way.

For more information, please contact us using the details in Part 1.15. Further information can also be obtained from the Information Commissioner's Office (ICO) or your local Citizens Advice Bureau. If you have any cause for complaint, you have the right to lodge a complaint with the ICO.

Depending upon your use of Our Site, we may collect some or all of the following personal and non-personal data:

• IP address;
• Limited server request metadata used to protect website forms, including the source of the IP address, selected Cloudflare request identifiers and selected technical headers. We do not store cookies, authorisation credentials, API keys, or arbitrary request headers for this purpose;
• Web browser type and version;
• Operating system;
• A list of URLs starting with a referring site, and your activity on Our Site;
• The recruitment Google questionnaire captures other areas relevant to making hiring decisions;
• Information collected via cookies, analytics tools or contact forms.

Under the UK GDPR, we must always have a lawful basis for using personal data. Your personal data may be used for the following purposes:

• Analysing your use of Our Site to enable us to continually improve Our Site and your user experience.
• Protecting website forms from spam, abuse and other misuse, and investigating suspected fraudulent or malicious submissions.

We rely on consent (for non-essential cookies and marketing), contractual necessity (for service or recruitment communications), legitimate interests (for analytics and site security), and legal obligation (where applicable).

Third parties (including Microsoft) may use third-party Cookies as detailed in Part 1.14. Please note that we do not control the activities of such third parties, nor the data that they collect and use themselves, and we advise you to check the privacy policies of any such third parties.

We retain personal data only for as long as necessary for the purposes described in this notice and in accordance with our data retention policy.

• Analytics data is normally retained for no longer than 24 months.
• Job application data is retained as set out in Part 2.6 below.

Wavex stores limited personal data securely on our servers and trusted third-party platforms (e.g. PeopleHR, Mailgun, Google Analytics).

Where personal data is transferred outside the UK or EEA, we use approved safeguards such as Standard Contractual Clauses (SCCs) or the UK International Data Transfer Agreement (IDTA) to ensure adequate protection.

We will not share any of your personal data with any third parties for any purposes, subject to one important exception.

In some limited circumstances, we may be legally required to share certain personal data if we are involved in legal proceedings or complying with legal obligations, a court order, or the instructions of a government authority.

Certain trusted service providers (e.g. PeopleHR, Mailgun, Google Analytics, LinkedIn) act as data processors under written contracts and are bound by confidentiality and security obligations.

In addition to your rights under the UK GDPR, when you submit personal data via Our Site, you may be given options to restrict our use of your personal data. You can also change or withdraw your cookie consent at any time through our cookie management tool.

You may also wish to sign up to one or more of the preference services operating in the UK: The Telephone Preference Service ("TPS"), the Corporate Telephone Preference Service ("CTPS"), and the Mailing Preference Service ("MPS"). These may help to prevent you receiving unsolicited marketing. Please note, however, that these services will not prevent you from receiving marketing communications that you have consented to receiving.

You may access certain areas of Our Site without providing any personal data at all. However, to use all features and functions available on Our Site you may be required to submit or allow for the collection of certain data.

You may restrict our use of Cookies. For more information, see Part 1.14.

If you want to know what personal data we have about you, you can ask us for details of that personal data and for a copy of it. This is known as a "subject access request".

All subject access requests should be made in writing and sent to the email or postal addresses shown in Part 1.15.

There is not normally any charge for a subject access request. If your request is 'manifestly unfounded or excessive' a fee may be charged to cover our administrative costs in responding.

We will respond to your subject access request within one month of receiving it. In some cases, particularly if your request is more complex, more time may be required up to a maximum of three months from the date we receive your request. You will be kept fully informed of our progress.

By using Our Site, you may also receive certain third-party Cookies on your computer or device. All Cookies used by and on Our Site are used in accordance with current PECR and UK GDPR requirements.

Before Cookies are placed on your computer or device, you will be shown a pop-up requesting your consent to set those Cookies.

The following third-party Cookies may be placed on your computer or device:

You can choose to enable or disable Cookies in your internet browser. You can also choose to delete Cookies on your computer or device at any time. It is recommended that you keep your internet browser and operating system up-to-date.

To contact us about anything to do with your personal data and data protection, including to make a subject access request, please use the following details:

We may change this Privacy Notice from time to time. This may be necessary, for example, if the law changes, or if we change our business in a way that affects personal data protection.

Any changes will be immediately posted on Our Site and you will be deemed to have accepted the terms of the Privacy Policy on your first use of Our Site following the alterations. We recommend that you check this page regularly to keep up-to-date.

We will only collect and use personal data in ways that are described here and in a manner that is consistent with Wavex obligations, and your rights under the law.

Job Portals

Other job advertising websites (i.e. LinkedIn, Indeed) that Wavex uses to post open vacancies. These portals have their own privacy policies, so please check these before submitting any personal data.

Questionnaires

An online test used to assess your suitability for a role.

ATS

Application Tracking System - a third-party cloud-based solution provided by PeopleHR as a sub-processor of Wavex. By accepting this privacy notice, you agree to your data being stored on PeopleHR.

This Privacy Notice applies only to your use of Our Site in the context of job applications.

When you apply for a vacancy with Wavex, we will ask for specific information including:

• Personal contact details such as name, title, address, telephone numbers and personal email;
• Employment records;
• Salary, remuneration, bonus and benefits history;
• Work history, including job titles and professional memberships;
• Evidence of rights to work in the UK;
• Reference and other information in a CV and/or cover letter.

We may also collect the following "special categories" of more sensitive personal information where required for security checks:

• Information about criminal convictions and offences;
• Information about your race or ethnicity, religious beliefs, sexual orientation and political opinions;
• Information about your health, including any medical condition, health and sickness records.

All information you provide to Wavex is stored on Wavex servers, the ATS system, and some within online test platforms.

The data that we collect about you will not be transferred outside the European Economic Area ("EEA"). Email communication between you and Wavex via the ATS platform is performed by Mailgun, who have certified compliance with the EU-U.S. Privacy Shield Framework.

We retain your information in line with our data retention policy:

• Unsuccessful applicants - 36 months from the date of application (unless you request otherwise);
• Successful applicants - data will be transferred to your staff file.

Retention is based on legitimate interest and statutory obligation to maintain records. You may request earlier deletion at any time.

We will only use your personal information when the law allows Wavex to. Most commonly, we will use your personal data in the following circumstances:

• Where we need to process your application (this may include sharing your data with a third party to complete specific recruitment tests, and we will always ask you for consent to share your information);
• To undertake pre-employment checks;
• To maintain the Wavex recruitment talent pool (we will always ask you for consent to retain your information);
• To use and manage employee data during employment with Wavex;
• Where we need to comply with a legal obligation;
• Where it is necessary for our legitimate interests.

Lawful bases for processing include consent, contractual necessity, legitimate interest and legal obligation under the UK GDPR.

As a Data Subject under the Data Protection Legislation you have the following rights:

• You can exercise your right to prevent Wavex from contacting you at any time by emailing [email protected].
• You have the right to request a copy of the information we hold (data subject access request) - contact [email protected].
• You have the right to ask Wavex to rectify data that is inaccurate or incomplete.
• You have the right to ask us to erase the personal data we hold where it is no longer necessary, you withdraw consent, you object to processing, or you believe we have processed it unlawfully.

To make any request, please contact Wavex at [email protected].

You may also contact the ICO at www.ico.org.uk for further advice or to lodge a complaint.