Hamilton Lane (UK) Ltd. Privacy Policy for Candidates

Privacy Policy Relating to the Personal Data of Candidates within the European Union

This Privacy Policy for Personal Data outlines how Hamilton Lane (UK) Ltd meets their obligations towards candidates for employment under the General Data Protection Regulation (GDPR). In particular, it details how all personal data held on candidates is treated with respect to confidentiality, privacy and security. 

This policy should be read in conjunction with the Candidate Privacy Notice that is provided to all candidates when they apply for a position directly (not through a third party) with Hamilton Lane (UK) Ltd. However, if after reading both you have any questions or concerns, in the first instance speak to your HR Representative. 

Reasons for holding candidate data 

There are a number of reasons why we need to collect, process and hold your data; the primary one is that we will need your details in order for us to manage your candidacy for a position. 

There are many regulatory, legal and statutory obligations that the company has to fulfil either for themselves or on your behalf that require us to collect, use and hold your personal data. 

Your rights 

The GDPR provides individuals with a number of rights: 

1. The right to be informed 

As your prospective employer, we need to provide you with information on the personal data we collect from you; the purpose for us to collect and use this; how we store it and for how long; and whom we might need to share it with. We need to provide this information when we collect your data. Hamilton Lane UK Ltd do this through the Privacy Notice provided to all staff when they are offered employment. This is also stored in their personnel file and published on the Company Intranet. 

It is important that you understand the information in your Privacy Notice and therefore, if you have any concerns or need the information provided in a different format, please contact the Data Protection Officer or HR Representative. 

2. The right of access 

You have the right to access the personal data that we hold on you as one of our candidates. If you would like to view your personnel file, please speak to the Data Protection Officer or HR Representative who will arrange for this to happen and provide you with facilities to read your file in a confidential surroundings. 

In addition, you can raise a Subject Access Request (SAR) with us through sending a request in writing to the Data Protection Officer or HR Representative. We will provide you with copies of the personal data that we hold either in paper or electronic format as quickly as possible however, this will not take longer than one month unless an extension in the timeframe is needed. There will be no charge made for doing this unless the request is repeated, excessive or multiple copies are required. In these cases, a reasonable charge will be made to cover the administrative resources required to do this. 

3. The right to rectification 

It is important for both the company and its candidates to ensure that we hold up to date and accurate information and that the accuracy is maintained. Candidates therefore have the right to ensure that inaccurate data is rectified as soon as possible. 

If you become aware of any inaccuracies or you change address, telephone number, email or the like, it is your responsibility to inform the HR Representative immediately. 

4. The right to erasure  

In certain circumstance such as when there is no longer any need for us to hold or process certain data or where in certain circumstances you have provided consent and now wish to withdraw this, you have the right for all or some personal data that we hold on you to be deleted. 

If you wish to exercise this right, you should send a request in writing to the Data Protection Officer or HR Representative which we will respond to as quickly as possible however, we confirm it will not take longer than one month unless an extension in the timeframe is needed. There will be no charge made for doing this unless the request is complicated. In this case, a reasonable charge will be made to cover the administrative resources required to do this. 

There may be occasions such as where we need to comply with a legal or regulatory obligation or where we may need data to establish, exercise or defend a legal claim when we will refuse a request to delete personal data however, we will explain this to you in writing should this occur. 

5. The right to restrict processing 

In certain circumstances such as an issue with the content, accuracy or nature of processing, you have the right to request that we restrict the processing of your data. In this instance, processing means collecting, storing, sharing or deleting your data. This may be a request to temporarily restrict the processing to allow other rights to be exercised. 

If you wish to exercise this right, you should send a request in writing to the Data Protection Officer or HR Representative which we will respond to as quickly as possible. There will be no charge made for doing this unless the request is complicated. In this case, a reasonable charge will be made to cover the administrative resources required to do this. 

There may be occasions such as where we need to comply with a legal or regulatory obligation or process your data to establish, exercise or defend a legal claim when we will refuse a request to restrict the processing of your personal data however, we will explain this to you in writing should this occur. 

6. The right to data portability 

You have the right to obtain and reuse your personal data for your own purposes across different services allowing you to move, copy or transfer the personal data we hold on you easily from one IT environment to another in a safe and secure way. 

If you wish us to transfer your data to another organisation, you should send a request in writing to the Data Protection Officer or HR Representative which we will respond to as quickly as possible however, we confirm it will not take longer than one month. There will be no charge made for doing this. 

There may be occasions when we may be unable to do this due to technical difficulties or when another’s rights would be adversely impacted however, we will explain this to you in writing should this occur. 

7. The right to object  

You have the right to object where the reason for us to process your personal data is based on legitimate aims only. In addition, if you have any general concerns or complaints about the processing of personal data, you should raise this with the Data Protection Officer or HR Representative who should be able to resolve the matter informally. 

In the unlikely event that we have been unable to address your concern internally, you may call the Information Commissioner’s Office (ICO) helpline on 0303 123 1113. 

Security of data 

We are committed to restricting access to personal data to just those individuals who may need it to meet their or the company’s obligation. Specific details regarding this is provided in the Candidate Privacy Notice. 

Records are kept securely: 

• on Applicant Tracking Systems ; 

• on the company’s IT system where it is retained in a secure and limited-access area; and 

• in hard-copy files kept in Personnel. 

In order to fulfil our regulatory and contractual obligations the company may also need to share your personal data with third parties. We have chosen to outsource some of our operational requirements and therefore some of our outsourced suppliers also need access to your personal data. Specific details regarding this is provided in the Candidate Privacy Notice however, in all cases we have committed to limiting the personal data that we share to only that which is necessary for them to be able to carry out the function we have contracted with them to perform. 

We are committed to minimising the risk of data breaches affecting your personal data. For that reason, we have a data security policy and when sharing data we: 

• use where possible direct password protected portals; 

• password protect documents; 

• never store personal data on portable storage devices such as USB sticks; 

• limit the use of emails when sharing information containing personal data; and 

• limit the number of places that personal data is stored within the company. 

Should a security breach occur where Hamilton Lane (UK) Ltd believe that candidate’s personal data may have been lost or stolen, they will inform you within 24 hours of becoming aware of the breach and the ICO in line with statutory guidelines. 

Retention of Data 

We will retain all your personal data for the duration of your candidacy and then for a further 6 months to enable us to meet our legal obligations and to establish, exercise or defend a legal claim.