Privacy Policy

Personal Data Protection Privacy Notice and Consent

(Pursuant to sections 7 and 6, respectively, of the Personal Data Protection Act 2010)

This Privacy Notice outlines how Rentokil Initial collects, processes, maintains and discloses your personal data in respect of commercial transactions and how Rentokil Initial safeguards the personal data.

For more information, you may contact:

Rentokil Initial (Việt Nam) 

4th Floor, Aloha Building

No 68 Hong Ha, Ward 2,

Tan Binh District, Ho Chi Minh, Viet Nam.

Email: [email protected]

Hotline: 1800 54 54 83

Colleague Data Protection Notice

Version Date: May 2023

Owner: Data Protection Office

rReview Frequency: Bi-annual

Classification: Internal Notice

________________________________________________________________________________

Purpose and Scope

Rentokil Initial PLC, and its relevant subsidiaries (we, our, us, RI) is committed to protecting the privacy of colleagues' personal data. RI has implemented a global privacy program to establish and maintain high standards for collecting, creating, using, disclosing, storing, securing, accessing, transferring, or otherwise processing Personal Data. This Notice describes how the company collects and processes your personal data and outlines rights colleagues’ may have in relation to their personal data.

RI shall comply with applicable colleague data protection and privacy laws and requirements worldwide.

Where applicable colleague data protection and colleague privacy laws may require a higher standard of protection for personal data than presented in this Global Privacy Notice, the requirements of applicable personal data protection law shall prevail. Where applicable colleague data protection and colleague privacy laws establish a lower standard of protection for personal data than presented in this Global Privacy Notice , the requirements of this Global Privacy Notice shall prevail.

If there are applicable local laws, this Notice may be adapted to include the local requirements with approval from the Group Data Protection Officer at [email protected]. If any local notice is created to meet local laws, it will be owned by and the responsibility of the relevant business or country that has created such a notice to manage and update that Notice.

This Notice applies to all RI colleagues (you, your, we) as colleagues and as owners of colleague personal data. If you are unclear about this Notice or how it impacts your role you should speak to your manager, your Local Privacy Officer (LPO) or the Data Protection Officer (DPO) ([email protected]).

Data Protection Principles

RI is committed to processing colleague personal data in accordance with its responsibility under privacy and protection legislation. RI is committed to keep colleagues informed about how and why we are collecting and using your personal information. Personal information does not include data where the identity has been removed (anonymous data).

Your personal data, and the personal data of all colleagues will:

a. Be used lawfully, fairly and in a transparent manner.

b. Be collected only for valid purposes that we have clearly explained to you and not used in any manner that is incompatible with those purposes.

c. Be adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed.

d. Be accurate and, where necessary, kept up to date.

e. Be kept for no longer than is necessary for the purposes for which the personal data are processed or as otherwise required by applicable laws.

f. Be processed in a manner that ensures appropriate security of the personal d

g. Allow for Data Subjects to exercise their rights as set forth in applicable Privacy and Data Protection Legislation.

More information about the Data Protection Principles is found in the Data Protection Policy.

Personal Data

Personal data is data that identifies, describes, or may be associated with an individual. The specific definition may vary by political or geographic region. RI considers the data listed in this Notice to be personal data, it shall be processed in a manner consistent with the data protection principles. If privacy or data protection laws differ in your region, the more stringent definition should be used.

RI may obtain or create personal data about you, including but not limited to the following:

● Personal details: names, date of birth, age, nationality, unique identifiers such as passport number, national insurance number, social security number, and driving licence number; Contact details: home and work addresses, telephone numbers, email addresses, and where appropriate, social media profile details.

● Employment records: background and substance checks, references, CVs, qualifications, professional memberships, appraisal and performance information, corrective action, disciplinary and grievance documentation, absence and leave records, health questionnaires, special accommodations, medical examination reports, immigration status, benefits choices, emergency contacts, compensation history, payroll and banking accounts, working hours or pattern details, safety records, and photographs.

● Records from monitoring:

o Personal information taken from building, network, and print management systems; records from equal opportunities monitoring; interview notes, building entry, exit records, post interview feedback.

o Records in the form of images or video footage taken at one of our locations.

o Personal data gathered whilst used for monitoring the use of our electronic information and communication systems, including telephone systems.

o Personal data, such as location or driving behaviour, gathered from vehicle trackers or fleet management applications.

Special Categories of Personal Data

Some personal data is categorized as more sensitive in nature and requires a higher level of protection. RI may process the following Special Categories of Personal Data:

● Information about your race or ethnicity

● religious or philosophical beliefs

● sexual orientation

● political opinions

● trade union membership

● Information about your health and, where appropriate, that of your dependant(s), including any medical condition, health and sickness records

● Genetic information and biometric data

● Information about criminal convictions and offences

Sources of personal information

RI may obtain your personal data from various sources including the following:

● You

● Other entities within our corporate group

● Providers of background and other checking and vetting services

● Statutory, government, or other official entities

● Our careers application portal and websites

● Our share plan administrators

● Recruiters including employment agencies

● Payroll provider

● Insurance companies

● Occupational health companies

● Other medical professionals

● Past employers

● Referrals

● Public sources including social media

● Created in the course of business such as appraisal or review documentation

Legal basis for collecting and processing your personal information

RI will only process your personal information where there is a reason allowed by law. We will rely commonly on one or more of the following legal basis (highlighted in bold):

● The processing is necessary in connection with your employment with us or any other contract with us, which may include the following:

o Payroll and banking account information

o Benefits administration

o Hiring information, including previous employment, background check and substance check

● The processing is required for compliance with a legal obligation, which may include the following:

o Verifying work eligibility

o As required by applicable legislation and laws

o As required by governing entities such as equal opportunity monitoring regulatory compliance, and legal actions

● We have a legitimate interest in carrying out the processing, which is not overridden by your interests, fundamental rights, or freedoms. When we rely on this legal basis our legitimate interests may include the following:

o The efficient running of our business

o Meeting external and internal governance obligations

o Management of employment and engagement of staff including promotions, grievances, disciplinaries, performance management, recruitment and dismissals

o Employee relations, including recruiting, rewarding, retaining and/or motivating employees

o Aligning the interests of our employees with the best interests of our shareholders

o Enabling the business to share information intra group

o Through the course of communicating with customers such as through our call centres and notifying customers of site visits

o Marketing purposes including using your personal details and details of your work on our website

o Network and information security

o The transmission of relevant personal data relating to criminal acts or threats to public security to a competent authority

o The protection of our business from unlawful competition

o Enabling disposal, reorganisation or sale of the business or the integration of an acquired business

o To prevent fraud

o Protection and security of property and rights

In rare circumstances we may rely on the following legal basis:

o The processing is necessary to protect your vital interests or the interests of someone else

o The processing is necessary for the performance of a task carried out in the public interest

We do not need your consent if we process your data under one or more of the other legal basis set out above. In limited circumstances, however, we may approach you for your written consent to allow us to process certain data. This is not a condition of your employment with us that you agree to any request for consent from us.

Legal basis for collecting and processing Special Categories of Personal Information.

RI will only process Special Categories of your personal information where there is a reason allowed by law. The following are the most common legal basis:

● We have obtained your explicit written consent

● The processing is necessary to carry out our rights and obligations under employment law

● The processing is needed in the public interest, such as for equal opportunities monitoring

● The processing is needed to assess your working capacity on health grounds, subject to appropriate confidentiality safeguards

We may process Special Categories of Personal Information for reasons that may include the following:

● Complying with employment laws, right to work requirements, equal opportunity reporting, and other legal obligations

● Ensuring health and safety in the workplace

● Administering and monitoring leave and benefits

● Managing employee relations issues related to these types of data

● Health related emergencies where there is a need to protect yours or someone else’s vital interest and you are not capable of giving consent

● Defending legal claims

● Where you have already made it public

Purposes for processing your personal information

RI will use your personal information for a variety of different purposes including the following:

● Making a decision about your recruitment or appointment and promotions;

● Determining the terms on which you work for us;

● Checking you are legally entitled to work in the country or region in which you seek employment;

● Paying you and, if you are a colleague, deducting tax and other contributions;

● Providing benefits to you;

● Administering the contract we have entered into with you;

● Monitoring your holidays and other leave taken;

● Monitoring the hours you work, the hours you spend driving where applicable, start and finish times, timekeeping;

● Keeping general colleague records such as contact details and bank account details on your file;

● Business management and planning, including accounting and auditing;

● Financial planning including budgeting;

● Conducting performance reviews, managing performance and determining performance requirements;

● Monitoring productivity, targets, sales;

● Making decisions about salary reviews and compensation;

● Gathering evidence in relation to customer complaints, or possible grievance or disciplinary hearings;

● Dealing with whistleblowing disclosures;

● Making decisions about your continued employment or engagement;

● Making arrangements for the termination of our working relationship;

● Education, training and development requirements;

● Dealing with legal disputes involving you, or other colleagues, contractors, including accidents at work;

● Ascertaining your fitness to work;

● Managing sickness absence, adjustments and return to work;

● Keeping in touch with you when you are absent;

● Complying with health and safety obligations;

● Issuing or requesting references;

● To prevent fraud;

● To monitor your use of our information and communication systems to ensure compliance with our IT policies;

● To ensure network and information security, including preventing unauthorised access to our computer and electronic communications systems and preventing malicious actions which could cause harm to company information systems and/or data ;

● Backing up data on our servers;

● To conduct data analytics studies to review and better understand employee retention and attrition rates;

● Equal opportunities monitoring;

● Protecting and defending our rights or property;

● Monitoring compliance with post termination restrictions;

● Selling, making ready for the sale or disposal of our business in whole or in part, including to any potential buyer or their advisers;

● Using your personal information, such as your name, to notify our customers as required under a contract we have entered into with them and where you might be visiting their site;

● Using your personal information in life or death situations

● Dealing with internal consultation for reorganisations, redundancies, changing terms and conditions or transfers of the business;

● Succession and organisational planning; and

● Marketing purposes including using your personal details and details of your work on our website.

What is special category information and why is it needed?

● Special Categories of information require higher levels of protection. The company need to have

further justification for collecting, storing, and using this type of information. In each case, where we

process Special Categories of information, we rely on one or more of the following additional legal basis:

● We have obtained your explicit written consent;

● The processing is necessary to carry out our rights and obligations under employment law;

● The processing is needed in the public interest, such as for equal opportunities monitoring;

● The processing is needed to assess your working capacity on health grounds, subject to appropriate confidentiality safeguards.

● Less commonly, the company may process Special Categories of information where it is needed in

relation to legal claims or where it is needed to protect your vital interests (or someone else’s interests) and you are not capable of giving your consent, or where you have already made the information public.

● The company may lawfully process Special Categories of information in certain ways, including for the following purposes:

● We will use information relating to leaves of absence (including sickness absence or family related leaves) to comply with employment and other laws;

● We will use information about your physical or mental health or disability status (sickness/injury records, doctor’s reports, occupational health reports, health questionnaires or medical assessments) to ensure your health and safety in the workplace, provide you with medical services, manage return to work after sickness, get a prognosis for possible return to work when off sick, confirm reasons for absence in order to pay sick pay, facilitate adjustments for disabled employees/workers, to administer benefits, to monitor and manage sickness absence;

● We will use information from drugs and alcohol testing to ensure health and safety in the workplace;

● We will manage employee relations including grievance, disciplinary and dismissal situations to the extent they relate to Special Categories of information;

● We will use our knowledge of your health-related personal data in the event of illness or injury or some other related emergency;

● We will use our knowledge of your membership of a trade union in our dealings with the relevant trade union to pay trade union premiums, register the status of a protected employee and comply with employment law obligations;

● We may use some Special Categories of information when bringing or defending a legal claim;

○ We will use information about your race or national or ethnic origin, religious, philosophical or moral beliefs, or your sexual orientation, to ensure meaningful equal opportunity monitoring and reporting;

● We will use information about your race or national or ethnic origin when carrying out right to work checks, retaining immigration documents and complying with our obligations as a sponsor as required.

Personal Information relating to criminal convictions

RI will only collect and hold information about criminal convictions if it is appropriate given the nature of the role and where we are legally able to do so.

RI will only use information relating to criminal convictions where the law allows us to - usually processing is necessary in order to carry out our obligations in connection with your employment. Less commonly, we may use information relating to criminal convictions:

● where it is necessary in relation to legal claims

● where you have already made the information public

● to protect your vital interests (or someone else’s interests) and you are not capable of giving your consent or we cannot reasonably be expected to obtain your consent

Disclosure of Personal Information

RI chooses our service providers carefully; we require service providers to take appropriate security measures to protect your personal information. We may share your personal information with the following recipients:

● HR administration company

● Benefits Providers

● Insurance companies

● Government entities, including law enforcement agencies, courts, legal and regulatory authorities

● Online appraisal company

● Occupational health provider and other health professionals

● Cloud based email partner

● Telecoms provider

● Payroll provider

● In relation to share plans: share portal provider, trustees, registrars, brokers, administrators, regulators and external advisors;

● External professional advisers such as accountants, auditors, lawyers and other outside professional advisers, subject to binding obligations of confidentiality

● Any relevant party for the purposes of prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties

● Any relevant third-party acquirer(s), in the event that we sell or transfer all or any portion of our business or assets (including in the event of a reorganisation, dissolution or liquidation)

● Other third-party processors that process data on our behalf to enable us to carry out our usual business practices for the same legitimate reasons mentioned above.

Transfer of personal information outside of geographic or political regions

RI may transfer the personal information we collect about you to other countries or outside of your political region to perform our obligations with you as an employer, as necessary to comply with our legal obligations in pending litigation, administrative claims, or regulatory matters; or as required/requested by government agencies.

We treat your data in manners consistent with applicable laws, some political regions may require the use of Standard Contractual Clauses or your explicit consent.

Retention of your personal information

RI will hold your personal data only for so long as is necessary for us to do so, or as otherwise required by applicable laws, details of retention periods for different aspects of your personal data are available in our Retention policy which is available from your Local Privacy Officer or the Data Protection Officer. To determine the appropriate retention period for personal data, we consider the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure, the purposes for which we process your personal data and whether we can achieve those purposes through other means, as well as the applicable legal requirements.

When we no longer need to process your personal data for the purposes set out in this notice then we will delete your personal data from our systems or anonymise it.

Automated decision making

Automated decision-making takes place when an electronic system uses personal data to make a decision without human intervention. We may use automated decision-making in the following circumstances:

● Where we have notified you of the decision and given you time to request a reconsideration

● Where it is necessary to perform a contract with you and appropriate measures are in place to safeguard your rights

● In limited circumstances, with your explicit written consent and where appropriate measures are in place to safeguard your rights.

If we make an automated decision on the basis of any sensitive personal data, we will ask for your explicit written consent or it must be justified in the public interest .

You will not be subject to any decisions about you using automated means unless we explicitly tell you otherwise.

Your rights in relation to personal information

You may have rights in connection with the processing of your personal data. Refer to your local LPO or the Data Protection Officer about the rights specific to you. You may exercise your rights by contacting your LPO or Data Protection Officer, or by filling out the online form.

You may have the right to:

● Request access to your personal data. This enables you to receive a copy of the personal data we hold about you and to check that we are lawfully processing it.

● Request the correction of the personal data that we hold about you. This enables you to have incomplete or inaccurate data we hold about you corrected.

● Request the erasure of your personal data. This enables you to ask us to delete or remove personal data where there is no further legitimate reason for us continuing to process it.

● Ask us to stop processing personal data where we are relying on a legitimate interest and where we do not have compelling reasons to override your rights and there is something about your situation which makes you want to object to processing on this ground.

● Request the restriction of processing of your personal data. This enables you to ask us to suspend the processing of personal data about you, for example if you want us to establish its accuracy or the reason for processing it.

● Request the transfer of personal data that you have provided to us to another party.

● Lodge a complaint regarding the processing of your data with your relevant local data protection authorities.

● In the limited circumstances where you have provided your consent to the collection, processing and transfer of your personal data for a specific purpose, you have the right to withdraw your consent for that specific processing at any time. To withdraw your consent, please contact your Local Privacy Officer or the Data Protection officer in writing. After we have received notification that you have withdrawn your consent in relation to a particular purpose, we will no longer process your information for that purpose, unless we have another legitimate basis for doing so in law which we shall notify you of.

● If you want to review, verify, correct or request erasure of your personal data, object to the processing of your personal data, or request that we transfer a copy of your personal data to another party, please contact your Local Privacy Officer or the Data Protection Officer in writing.

Related policies: Data Protection Policy

Revisions to the policy

Date Changes May 2023 Substantial – all sections revised to reflect a global policy