Personal Information Protection Management Policy
Overview of Policy
The JAC Group ("JAC") are committed to protecting the confidentiality of information and privacy of our candidates, clients and other users of our websites and services.
Where you provide JAC with your personal data, in person, by email, through our websites or offices, we will use our best efforts to ensure that the information you submit to us remains private and is only used in accordance with this policy. By providing us with your personal data, you also consent for us to collect, hold, use and disclose your personal data in accordance with this policy.
If you do not agree to our processing of your data in the manner outlined in the Policy, please do not submit any personal data to us.
JAC Group must comply with the applicable privacy laws and similar laws in the countries in which we operate.
If you do not agree to our processing of your data in any manner then please do not submit any personal data to us via any means.
Collection of Personal Data
In order to carry out our business as recruitment consultants, JAC may collect your personal information from you, including but not limited to your name, contact details, qualifications, work history, your right to work in a particular country, language skills, professional qualifications and memberships, your work objectives and other information from your CV. If you are to be considered for a particular position, we may also collect references from your nominated referees. All the personal data we collect is held, used and disclosed for the purposes set out below.
Purpose and Disclosure of Personal Data
JAC will hold and use your personal data for the following purposes:
- To provide our services to you to allow your potential or actual placement into a job.
- To match your relevant skills, experience and qualifications with job vacancies.
- To assist us in finding a position that is most suitable to you and for us to send your personal data to our clients in order to apply for jobs where you have provided your prior consent to us.
- For us to direct-market our services to you and to advise you of relevant news and industry updates and other information. Where we send such information you will be able to unsubscribe from such communications.
- To generally maintain our business relationship with you as a client or a candidate where you are a user of our website.
JAC may disclose your personal data to third parties for the following purposes:
- For potential employers to be able to judge your suitability as an applicant for a position within their organisation.
- To a professional association or registration body that has a legitimate interest in the disclosure of your personal and sensitive information.
- In order to comply with any requests from regulatory or law enforcement authorities to release such personal data if they so require.
We may also seek your consent to collect, hold, use and disclose your personal data for any other purpose not listed above.
Privacy on Our Websites
You have the option to submit your CV to JAC through our websites for either general consideration by our recruitment consultants for any current or future positions suited to your experience and qualifications or against an application for specific advertised position(s). When you submit your CV it will be sent to the relevant recruitment consultants who will review the details of your submission and who will advise you whether you are to be accepted by JAC for registration on our database. Such data can be accessed by any of our recruitment consultants working in other offices of JAC, both within and outside of the country where you submitted the data to. Your CV can be updated at any time by following the same procedure to submit a new CV on our websites.
Job Alerts by Email
You may agree to opt in to receive emails that alert you to new jobs on our website. To subscribe to such alerts you will need to provide your email address, which will be used for the purpose of keeping you informed by email of the latest jobs and/or news in your nominated industry. If you no longer wish to receive such emails unsubscribe links are provided in every such email that you receive from us.
Aggregate Information about Website Visitors
JAC gathers statistics about all visitors to our websites worldwide. We only use such data in aggregate so that the information we gather does not identify individual behavior. We use such information to monitor the most effective parts of our websites in order for us to be able to improve our online offering for the benefit of our users.
When you visit JAC's web site, upon your consent, we will access your browser cookies. We use them to remember your login details, to track overall web traffic and to access information in cache about your session to assist you in the use of our website. Information such as your last search will be cached however, this kind of information is deleted each time you close your web browser. JAC also uses 'analytical' cookies to enable us to improve the way our website functions, for example, by making sure users can find what they need easily. Most browsers will allow you to block access to your cookies. However, by blocking JAC's access to your cookies, your use of our websites will be restricted.
More information about cookies can be found here.
You can also view how to control your cookie settings from the following links:
- Internet Explorer
- Mozilla Firefox
- Google Chrome
Management of Personal Information
Our staff are trained to respect the confidentiality of customer information and the privacy of individuals. We have an appointed a Data Protection Officer to ensure that our management of personal information is in accordance with this statement.
Maintenance of Data
Our aim is to make sure that the personal information which we hold is accurate and up to date. We realise that information changes frequently with changes of address and other personal circumstances. We generally update your customer information over the telephone. Please advise your consultant when your personal details change.
If you have created a profile with JAC through our website, then you are able to update or delete your personal information whenever you apply for a new position advertised. In order to do this, log into your profile and edit or delete the information you have submitted.
Access to your Personal Data
Subject to certain exceptions you may request access to or the updating of your personal data held at JAC by contacting the Data Protection Officer whose details are below.
We will refuse access to your personal data if it would affect the privacy rights of other persons or if it breaches any confidentiality that attaches to that information.
In order for us to provide any personal data we will need to verify your identity and may request further information about your request. We may refuse your request where we are legally permitted to do so and give you such reasons. You should be aware that it may take a reasonable time to process your application for access as we may need to retrieve information from storage and review information in order to determine what information may be provided.
You may request that JAC stops using your information and contacting you and we will comply with your request. However, if this involves a request for deletion of your file, please be aware that we may not be required or able to do so, particularly where your file also holds information about our clients. Where permitted to do so, we may charge a fee to cover our administration costs when accessing and updating requests.
JAC takes reasonable steps to keep personal data secure, accurate and up to date. The Internet is not always a secure method of transmitting information. Accordingly, while we seek to protect your personal data by implementing digital security systems in various parts of our website, JAC cannot accept responsibility for the security of information you send to or receive from us over the Internet or for any unauthorised access or use of that information. Where we have links to websites outside the JAC website, we cannot ensure that your privacy will be protected in accordance with this policy. You should consult these other websites' privacy policies as we have no control over them and are not responsible for any information that is submitted to or collected by these third parties.
Implementation of Policy
This Policy shall be deemed effective as of 2nd October 2023. No part of this Policy shall have retroactive effect and shall thus apply only to matters occurring on or after this date.
Overview Of Your Rights Under GDPR
JAC Group is committed to protecting the confidentiality of information and privacy of our candidates, clients and other users of our websites and services.
All organisations that process personal data are required to comply with data protection legislation. This includes in particular the Data Protection Act 1998 (or its successor) and the EU General Data Protection Regulation (together the 'Data Protection Laws'). The Data Protection Laws give individuals (known as 'data subjects') certain rights over their personal data whilst imposing certain obligations on the organisations that process their data.
JAC considers your right to privacy and the careful handling of your personal data to be extremely important. We make every effort to ensure that the information you provide us with remains private and is only used strictly in accordance with the policy detailed below.
Throughout this policy the following terms have the following meanings:
- 'consent' means any freely given, specific, informed and unambiguous indication of an individual's wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her;
- 'data controller' means an individual or organisation which, alone or jointly with others, determines the purposes and means of the processing of personal data;
- 'data processor' means an individual or organisation which processes personal data on behalf of the data controller;
- 'personal data' means any information relating to an individual who can be identified, such as by a name, an identification number, location data or an online identifier. Please refer to the section below regarding what comprise "personal data" within the scope of JAC's services;
- 'personal data breach' means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data;
- 'processing' means any operation or set of operations performed on personal data, such as collection, recording, organisation, structuring, storage (including archiving), adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction;
- 'profiling' means any form of automated processing of personal data consisting of the use of personal data to evaluate certain personal aspects relating to an individual, in particular to analyse or predict aspects concerning that natural person's performance at work, economic situation, health, personal preferences, interests, reliability, behaviour, location or movements;
All of these definitions are italicised throughout this policy to remind the reader that they are defined terms.
What Is Personal Data?
Personal data means any information relating to an identified or identifiable natural person (data subject). An identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, telephone number, postal address, e-mail address, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.
Collection Of Personal Data
JAC collects the following personal data to process your enquiry.
- Email address
To the extent that you access our website or read or click on an email from us, we may also collect certain data automatically or through you providing it to us, such as a browser cookie.
JAC requires you to provide signed consent (including digital signing) to enable us to collect personal data from you or third parties.
Purpose Of Use
The reason that JAC uses your personal data is so that we can process your request, questions or provide information when you contact or request us.
Our Legal Bases For Processing Your Data
JAC processes personal data in relation to its own staff and is a data controller for the purposes of the Data Protection Laws. The Company has registered with the ICO and its registration number is Z1555967.
JAC will only process personal data where it has a legal basis for doing so:
JAC requires that you give your consent to the processing of your personal data in relation to your enquiry. We believe this explicit consent is essential for both JAC and you and ensures both parties clearly understand their rights and the intentions of all involved in the consultation process. This basis for processing is in accordance with Article 6(1)(a) of the GDPR, which states "[you] have given consent to the processing of his/her personal data for one or more specific purposes"
As a recruitment consultancy, it is in both JAC's interest and yours, as a candidate, for JAC to process your information in order to provide you with the most effective and efficient service. This basis for processing is in accordance with Article 6(1)(f) of the GDPR, which states "processing is necessary for the purposes of the legitimate interests pursued by [JAC] or by a third party, except where such interests are overridden by the interests or fundamental rights or freedoms of [you] which require protection of personal data."
Disclosure Of Personal Data
JAC may disclose your personal data to third parties:
- To a professional association or registration body that has a legitimate interest in the disclosure of your personal and sensitive information
- In order to comply with any requests from regulatory or law enforcement authorities to release such personal data if they so require.
- To utilise third party service providers who perform functions on our behalf (including external consultants and professional advisers such as lawyers, auditors and accountants, technical support functions and IT consultants carrying out testing and development work on our IT systems) where we have an appropriate processing agreements (or similar protections) in place
- Third party outsourced IT and document storage providers where we have an appropriate processing agreements (or similar protections) in place
- Marketing technology platforms and suppliers
- If JAC Group or its business merges with or is acquired by another business or company, we may share personal information with the new owners of the business or company. You would be sent notice of such event.
Transfer Of Information Internationally
JAC is an international company, headquartered in Japan. Our databases are located in Singapore, Malaysia, Indonesia, Thailand, Korea, Vietnam, India, UK, Germany, USA and Tokyo and as such, upon receipt of your personal information, it will be transferred quickly (and securely) to our systems hosted in these 11 countries. Further, in order to ensure that your data is secure, when we transfer data outside of the EU, we will only transfer to those locations where the target location is compliant with data protection legislation and by means of transfer which have adequate safeguards applied.
Management And Security Of Personal Data
JAC takes the responsibility of the management and security of your personal data extremely seriously. And in accordance with the General Data Protection Regulation, JAC, acting as a data controller and data processor, follows the key principles of data protection. These require that personal data be:
- Processed lawfully, fairly and in a transparent manner;
- Collected for specified and legitimate purposes and not further processed in a manner that is incompatible with those purposes;
- Adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed;
- Accurate and kept up to date; every reasonable step is taken to ensure that personal data that are inaccurate, having regard to the purposes for which they are processed, are erased or rectified without delay;
- Kept for no longer than is necessary for the purposes for which the personal data are processed;
- Processed in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures; and that
- JAC shall be responsible for, and be able to demonstrate, compliance with the principles.
JAC will not retain your personal data beyond the limit necessary for the purpose of collection personal data. But at any time, should you wish for your data to be erased, JAC will act promptly to delete your data from all of our databases.
Our aim is to make sure that the personal information that we hold is accurate and up to date. We realise that information changes frequently with changes in personal circumstances. Should your details change, please contact us to inform them.
Privacy On Our Websites
Aggregate Information about Website Visitors
JAC gathers statistics about all visitors to our websites worldwide. We only use such data in aggregate so that the information we gather does not identify individual behaviour. We use such information to monitor the most effective parts of our websites in order for us to be able to improve our online offering for the benefit of our users.
A cookie is a simple text file that is stored on your computer or mobile device by a website's server. Each cookie is unique to your web browser. It will contain some anonymous information, such as a unique identifier and the site name.
JAC also use 'analytical' cookies in order to enable us to improve the way our website functions, for example, by making sure users are able to find what they need easily.
More information about cookies can be found here: https://www.aboutcookies.org.uk/
When you visit JAC's web site, upon your consent, we will access your browser cookies. We use them to remember your login details, to track overall web traffic and to access information in cache about your session in order to assist you in the use of our website. Information such as your last search will be cached however, this kind of information is deleted each time you close your web browser. Most browsers will allow you to block access to your cookies. However, by blocking JAC's access to your cookies, your use of our websites will be restricted.
Your Rights Under GDPR
Under GDPR, the data subject has certain important rights. These include (but are not limited to) the following:
The right for access to data and data portability
- You have the right to receive your personal data, which you have provided to us previously, in a structured, commonly used and machine-readable format. Further you have the right to request us to transmit your personal data to another data controller in circumstances where:
- The processing is based on your consent or a contract; and
- The processing is carried out by automated means
- Where feasible, JAC will send the personal data to a named third party upon your request.
The right to have data rectified
- You may request JAC to rectify any inaccurate or incomplete personal data concerning yourself. If JAC has given your personal data to any third parties we will tell those third parties that we have received a request to rectify your personal data unless this proves impossible or involves disproportionate effort. Those third parties should also rectify the personal data they hold. However, JAC is not in a position to audit those third parties to ensure that the rectification has occurred.
The right to "be forgotten"
- This refers to your right to have your personal data completely deleted from our database, including from any third parties who may have access to that data. Further, the request to "be forgotten" must be as easy as it was to give consent.
- You may request, at any time, to have your personal data deleted completely from all JAC's databases. Upon receipt of such a request, we will ask you whether you want your personal data to be removed entirely or whether you are happy for your details to be kept on a list of individuals who do not want to be contacted in the future (for a specified period or otherwise). We cannot keep a record of individuals whose data has been erased completely so you may be contacted again by JAC should we come into possession of your personal data at a later date.
- If JAC has given the personal data to any third parties, it will tell those third parties that we have received a request to erase the personal data, unless this proves impossible or involves disproportionate effort. Those third parties should also rectify the personal data they hold. However, JAC is not in a position to audit those third parties to ensure that the rectification has occurred.
- It should be noted that where there are legal requirements for JAC to store data for a certain period of time, related to our business, which includes elements of your personal data, we will not be able to delete that data until after the statutory retention period.
The right to restrict the processing of your data
- You have the right to ask JAC to restrict its processing of your personal data where:
- You challenge the accuracy of the personal data we are storing;
- The processing is unlawful but you oppose its erasure;
- JAC no longer needs your personal data for the purposes of the processing, but your personal data is required for the establishment, exercise or defence of legal claims; or
- You have objected to processing (on the grounds of a public interest or legitimate interest) pending the verification of whether the legitimate grounds of JAC override those of the individual.
- If JAC has given your personal data to any third parties we will tell those third parties that we have received a request to restrict the personal data, unless this proves impossible or involves disproportionate effort. Those third parties should also rectify the personal data they hold. However, JAC is not in a position to audit those third parties to ensure that the rectification has occurred.
The right to lodge a complaint
- You have the right to object to your personal data being processed based on a public interest or a legitimate interest. You also can object to the profiling of your data based on a public interest or a legitimate interest.
- Upon receiving a claim from you, JAC shall cease processing unless it has compelling legitimate grounds to continue to process the personal data which override the individual's interests, rights and freedoms or for the establishment, exercise or defence of legal claims.
- You also have the right to object to your personal data being used for direct marketing
The right to object to automated decision making
- JAC will not subject individuals to decisions based on automated processing that produce a legal effect or a similarly significant effect on the individual, except where the automated decision:
- Is necessary for the entering into or performance of a contract between the data controller and the individual
- Is authorised by law; or
- The individual has given their explicit consent.
- JAC will not carry out any automated decision-making or profiling using the personal data of a child.
The right to receive damages in the event of a breach of regulations
- Under the GDPR, should there be a breach of the regulations and it is judged that breaches occurred due to causes within the control of the data controller or data processor, and that the breach has caused material damage, the data subject may be due to receive compensation.
Enforcement Of Rights
All requests regarding individual rights should be sent to the person whose details are listed at the bottom of this policy document. JAC shall act upon any data subject access request, or any request relating to rectification, erasure, restriction, data portability or objection or automated decision making processes or profiling within one month of receipt of the request. JAC may extend this period for two further months where necessary, taking into account the complexity and the number of requests.
Where JAC considers that a request is manifestly unfounded or excessive due to the request's repetitive nature then we may either refuse to act upon the request or may charge a reasonable fee, taking into account the administrative costs involved.
Implementation of Policy
This Policy shall be deemed effective as of 30th August 2023. No part of this Policy shall have retroactive effect and shall thus apply only to matters occurring on or after this date.
You can contact our Data Protection Officer by email using this address: firstname.lastname@example.org
or in writing at the following address:
JAC Group Head Office (Japan)
14F Jinbocho Mitsui Building 1-105 Kanda-Jinbocho, Chiyoda-ku Tokyo, Japan, 1010051