Privacy Notice

J M Baxi Group (hereinafter referred to as “we”, “our”, “us”) is committed to protecting the privacy and security of your personal data. It is important that you read this Privacy Notice (“Notice”) so that you are aware of how and why we use such personal data.

1. Purpose

This Notice describes how we process the personal data that you share with us during and after your tenure of employment with us.

2. Applicability

This Notice applies to all J M Baxi Group entities, subsidiaries, contractors, and third-party processors handling employee data, including current and former employees of J M Baxi Group.

This Notice does not form part of any contract of employment or other contract to provide services. We may update this Notice at any time, subsequent to which you will be made aware of the change.

This Privacy Notice uses the DPDP Act 2023 as a baseline, along with the privacy laws applicable as per the law of the land for J M Baxi Group offices.

3. Relationship

Data Fiduciary — any person who, alone or in conjunction with other persons, determines the purpose and means of processing of personal data.

Data Processor — any person who processes personal data on behalf of a Data Fiduciary.

We are the Data Fiduciary of your personal data. This means that we are responsible for deciding how we process personal data about you. As your employer, we need to process data about you for acceptable employment purposes, including recruitment and on-boarding. Processing includes collection, recording, organisation, structuring, storage, adaptation, alteration, retrieval, consultation, use, disclosure by transmission, erasure, or destruction of your personal data. The data we hold and process is used for management and administrative purposes only. We keep and use it to enable us to run the business and manage our relationship with you effectively, lawfully, and appropriately, while you are working for us, at the time when your employment ends, and after you have exited the organisation. This includes using personal data to enable us to comply with recruitment requirements and legal requirements, to pursue our legitimate interests, and to protect our legal position in the event of legal proceedings. If you do not provide this data, or request the deletion of data shared, we may in some circumstances be unable to comply due to legal obligations. We will tell you about the implications of such a decision.

4. What Personal Data Do We Collect?

We collect and process the following categories of personal data about you:

Personal details — including but not limited to full name, title, temporary and permanent residential addresses, post code, telephone and mobile numbers, personal and corporate email addresses, date of birth, gender, age, bank account details, emergency contact information (including their name, home address, and contact number), country, nationality, citizenship, marriage certificate, marriage date, marital status, spouse details (including name, date of birth, and passport details, and the work permit if required), children’s details (including name, date of birth, and passport details), dependants’ details, siblings and nominee details, photographs, languages known, education details, trainings attended, certifications, details of extra-curricular activities, and signatures.
National ID details — including but not limited to passport number, driving licence, tax identification numbers, and national identification numbers.
Current employment details — including information about your current level of remuneration and benefit entitlements.
Previous employment details — including information about your employment history and the name and contact details of your referee and immediate superior.
Recruitment information — including copies of right-to-work documentation and details of your qualifications, skills, experience, and past employment.
CCTV footage of you in J M Baxi Group office work areas, wherever cameras are located, for security reasons, for the protection of our property, and for health and safety reasons.

i) Depending on the requirements, J M Baxi Group may also need to process certain special categories of personal data. Currently, only criminal records are processed, as part of background verification.

ii) If we process any other sensitive or special categories of personal data during the course of your employment with J M Baxi Group, we will inform you about the processing. These include:

Racial or ethnic origin
Political opinions
Religious or philosophical beliefs
Trade union membership
Processing of genetic data
Biometric data for the purpose of uniquely identifying a natural person
Data concerning health
Data concerning a natural person’s sex life or sexual orientation
Financial data (including Bank Name, Account Holder Name and Number, SWIFT Code, bank account transfer authorisation for direct deposit, Tax Number, and previous employment compensation details)
Official identifiers
Transgender or intersex status
Caste or tribe
Social security documents
Social status

We may have collected and processed personal data for various business purposes, including:

Auditing related to interactions with consumers in connection with the professional services J M Baxi Group provides.
Detecting security incidents, protecting against malicious, deceptive, fraudulent, or illegal activity, and taking appropriate action as a result.
Debugging to identify and repair errors that impair existing intended functionality.
Short-term, transient uses where the personal data is not disclosed to another third party and is not used to build a profile about a consumer or otherwise alter an individual consumer’s experience outside the relevant interaction.
Performing professional services for our clients.
Undertaking internal research for technological development and demonstration.
Undertaking activities to verify or maintain the quality or safety of our services, and to improve, upgrade, or enhance our services.

5. How is Your Personal Data Collected?

The processing of your personal data is for the specified purpose and is limited to such personal data as is necessary for that purpose.

J M Baxi Group collects personal data about employees through applications, forms, and interviews as part of the recruitment process, and personal information with supporting documents collected during the joining formalities and on-boarding process, either directly from the employees or sometimes indirectly from third-party service providers, including an employment agency or background check provider, former employers, credit reference agencies, and medical clinics.

We will collect additional personal data in the course of job-related activities throughout the period you are working for J M Baxi Group. All data collected during the recruitment process, and additional data collected during the course of your employment, will be used and stored for the performance of the employment agreement and for complying with the legal obligations or legitimate interests of J M Baxi Group.

6. How We Will Use Personal Data About You

We will only use your personal data when the law allows us to. Most commonly, we will use the collected personal data for purposes such as:

To maintain and develop our relationship with you.
To update our records and keep your contact details up to date.
For our internal business processing, administrative, marketing, and planning requirements.
For other purposes that are permitted under any agreement with you or made apparent to you at the time of collection.
For visa stamping or immigration processing.
To maintain accurate and up-to-date employee, worker, and contractor records and contact details, including details of whom to contact in an emergency.
To assess your suitability for engagement or promotion.
To comply with mandatory statutory and regulatory requirements and obligations.
To maintain an accurate record of your employment or engagement terms.
To administer the contract we have entered into with you.
To make decisions about pay reviews and bonuses.
To ensure compliance with your statutory and contractual rights.
To ensure you are paid correctly and receive the correct benefits and pension entitlements, including liaising with external benefits or pension providers or insurers.
To ensure compliance with income tax requirements, for example, deducting income tax and insurance contributions where applicable.
To operate and maintain a record of disciplinary, grievance, and capability procedures and action taken.
To operate and maintain a record of performance management systems.
To record and assess your education, training, and development activities and needs.
To plan for career development and succession.
To manage, plan, and organise work, and to enable effective workforce management.
To operate and maintain records of annual leave and sickness absence procedures.
To operate and maintain a record of maternity, paternity, adoption, shared parental, and parental leave, and any other type of paid or unpaid leave or time off work.
To make decisions about continued employment or engagement, and to operate and maintain a record of dismissal procedures.
To provide references on request for current or former employees, workers, or contractors.
To ensure network and information security and prevent unauthorised access to and modification of systems.
To ensure effective HR, personnel management, and business administration, including accounting and auditing.
To ensure adherence to company rules, policies, and procedures.
To enable us to establish, exercise, or defend possible legal claims and prevent fraud.
Where we need to perform a contract we have entered into with you, for example, providing you with an employment contract, paying you in accordance with it, and administering benefits, pension, and insurance entitlements.
Where we need to comply with a legal obligation, for example, checking your entitlement to work, deducting tax, complying with health and safety laws, and enabling employees to take entitled leave periods.
Where it is necessary for our legitimate interests (or those of a third party) and your interests and fundamental rights do not override those interests, for example, administrative activities such as issuing laptops and creating access and identity records.
To share your profile and background verification status with our clients and their customers, where required, as per contractual obligations.
To consider corporate transactions such as a merger, acquisition, or reorganisation.
Where we need to protect your vital interests or those of someone else.
Where it is needed in the public interest or for official purposes.

7. If You Fail to Provide Personal Data

If you choose not to provide personal data that is mandatory to process your request, or that is required for processing under our legitimate interests or any other purpose, we may not be able to provide the corresponding service.

8. Change of Purpose

We will only use your personal data for the purposes for which we collected it. If we need to use your personal data for an unrelated purpose, we will notify you and explain the legal basis that allows us to do so, without undue delay. Please note that we may process your personal data without your knowledge or consent, in compliance with the above rules, where this is required or permitted by law.

9. Special Categories of Personal Data

Special categories of personal data require higher levels of protection. We have in place an appropriate policy document and safeguards, as required by law, for the processing of such data. Your criminal records are processed by our background verification vendor. We do this as it is in our legitimate interests.

We may also process special categories of personal data in the following circumstances:

Where we need to carry out our legal obligations or exercise rights in connection with employment.
Where processing is necessary for the performance of a contract to which you are a party.
Where processing is necessary for the purpose of a legitimate interest pursued by us or a third party, with appropriate safeguards.
Where processing is necessary for carrying out obligations and exercising specific rights in the field of employment, social security, and social protection law, in so far as is authorised by the applicable data protection law, providing appropriate safeguards for the fundamental rights and interests of the individual.
Where processing is necessary for the establishment, exercise, or defence of legal claims, or whenever courts are acting in their judicial capacity.
Where you have provided your explicit consent for us to process the data.

10. Data Sharing

We may share your personal data with the following recipients:

Third parties with whom we have a contractual relationship, including clients and background check vendors. We require third parties to respect the security of your data and to treat it in accordance with our instructions and the law.
Other J M Baxi Group entities, for the performance of the employment contract. We may transfer your personal data transnationally if required for the purpose of processing, wherever there is a requirement of the job to be performed, in accordance with the agreements executed among J M Baxi Group offices and their clients.
Internal departments, including interviewers, the recruitment team, and hiring managers.

Disclosure of personal data within J M Baxi Group: your personal information will be made available only to those teams that require it, such as visa information to our Visa Processing Team, tax details to our Taxation Team, and bank details to our Payroll and Benefits Team.

Disclosure to third parties: we will share your personal information with the following categories of third parties:

1) Other parties, such as legal and regulatory authorities, accountants, auditors, lawyers, and other outside professional advisors.

2) Companies that provide products and services to us, such as:

Payroll and benefits providers.
Pension providers.
Insurance companies, including those providing medical insurance and group income protection.
Human resources services, such as pre-employment checks and employee monitoring.
Recruitment agencies.
Parties requesting an employment reference.
Travel agencies and transport providers.
Information technology systems suppliers and support, including email archiving, telecommunication suppliers, back-up and disaster recovery, and cyber security services, and psychometric testing providers.
Other outsourcing providers, such as off-site storage providers and cloud services providers.

We will disclose your personal data to third parties:

Where it is in our legitimate interests to do so to run, grow, and develop our business.
If we sell or buy any business or assets, in which case we may disclose your personal information to the prospective seller or buyer.
If we are under a duty to disclose or share your personal information to comply with any legal obligation, any lawful request from government or law enforcement officials, or as required to meet national security or law enforcement requirements or to prevent illegal activity.
To enforce our contract with you, to respond to any claims, to protect our rights or the rights of a third party, to protect the safety of any person, or to prevent illegal activity.
To protect the rights, property, or safety of J M Baxi Group, our employees, customers, suppliers, or other persons.

Restrictions on the use of personal data by recipients:

Any third parties with whom we share your personal information are limited (by law and by contract) in their ability to use it for the specific purposes identified by us.
We will ensure that any third parties with whom we share your personal information are subject to privacy and security obligations consistent with this Notice and applicable privacy laws.
We will not share, sell, or rent any of your personal information to any third party without notifying you.

J M Baxi Group will never share, sell, or rent any of your personal information to any third party without notifying you and obtaining your consent. Where you have given your consent for us to share your information but later change your mind, you can contact us at [email protected] and we will stop doing so.

11. Transnational Data Transfer

J M Baxi Group may transfer personal data transnationally, depending on the requirements for the performance of the contract with the employee or for other related activities.

To ensure that the employee’s personal data receives an adequate level of protection, we have executed Standard Contractual Clauses with our J M Baxi Group head office in India, to ensure that personal data is treated in a way that is consistent with and respects the applicable data protection and privacy laws, including in relation to third parties.

12. Data Protection

J M Baxi Group has put in place measures for the protection of your personal data. We have internal policies, procedures, and controls in place to try to prevent your personal information from being accidentally lost or destroyed, altered, disclosed, or used or accessed in an unauthorised way. In addition, we limit access to your personal information to those employees, workers, agents, contractors, and other third parties who have a business need to know in order to perform their duties and responsibilities.

Where your personal information is shared with third-party service providers, we require all third parties to implement appropriate technical and organisational security measures to protect it, to treat it subject to a duty of confidentiality, and to handle it in accordance with applicable data protection and privacy laws. They are authorised to process your personal information for specified purposes and in accordance with our written instructions.

13. Data Retention

We will only retain your personal data for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements. To determine the appropriate retention period, we consider the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure, the purposes for which we process it and whether we can achieve those purposes through other means, and the applicable legal requirements.

In some circumstances, we may anonymise your personal data so that it can no longer be associated with you, in which case we may use such data without further notice to you. Once your data is no longer required, we will securely destroy it in accordance with the Personal Data Retention Guideline.

14. Data Protection Officer

J M Baxi Group has appointed a Data Protection Officer (DPO) to oversee privacy compliance with this Notice. If you have any questions about this Notice or how we handle your personal data, please contact the DPO at [email protected].

15. Your Duty to Inform Us of Changes

It is important that the personal data we hold about you is accurate and current. Please keep us informed if your personal data changes during your working relationship with us.

16. Rights Available to You

Under certain circumstances, by law, you have the following rights:

Right to be informed

The right to be provided with clear and concise information about what we do with your personal data.

Right of access

The right to access your personal data (commonly known as a “data subject access request”). This enables you to receive a copy of the personal data we hold about you, as well as other supplementary information. It helps you to understand how and why we are using your data, and to check that we are doing so lawfully.

Right to rectification

The right to have any inaccurate personal data we hold about you rectified. You may also have any incomplete personal data we hold about you completed.

Right to erasure

The right to ask us to delete or remove personal data we process about you, subject to limited circumstances in accordance with privacy law requirements.

Right to object

The right to object to the processing of your personal data, which effectively allows you to stop or prevent us from processing it where we are relying on a legitimate interest (or those of a third party) and there is something about your particular situation that makes you want to object on this ground. You also have the right to object where we are processing your personal data for direct marketing purposes.

Right to restrict processing

The right to ask us to suspend the processing of your personal data where you have a reason for wanting the restriction, for example, if you have issues with the content of the information we hold or how we have processed your data.

Right to data portability

The right to receive the personal data concerning you, which you have provided to us, in a structured, commonly used, and machine-readable format. It also gives you the right to request that we transmit this data directly to another controller in a safe and secure way, without affecting its usability.

Right related to automated decision-making, including profiling

J M Baxi Group does not currently carry out any automated decision-making. However, if in future we do so, you will have the right not to be subject to a decision based solely on automated processing, including profiling. Such decisions can be made only if they are necessary for the entry into or performance of a contract, are authorised by applicable law, or are based on your explicit consent.

Withdrawal of consent (or opt-out)

In the limited circumstances where you have provided your consent to the collection, processing, and transfer of your personal data for a specific purpose, you have the right to withdraw that consent at any time. Once we have received notification that you have withdrawn your consent, we will no longer process your data for the purpose or purposes you originally agreed to, unless we have another legitimate basis for doing so in law.

Right of access and data portability

You may have the right to request that we disclose to you information about our collection and use of your personal data in the preceding 12 months, including: (a) the categories and specific pieces of personal data we collect; (b) the categories of sources from which we collect or sell personal data; (c) the business or commercial purpose for which we collect personal data; (d) the categories of third parties with whom we share personal data; and (e) the categories of personal data disclosed for a business purpose or sold to third parties, and the categories of third parties to whom such personal data was sold or disclosed.

Right to deletion

You may request that we delete certain personal data we have collected about you. This is subject to our right to maintain your personal data for specific purposes permitted under the law. If we are unable to comply with any such request, we will notify you.

Right to opt-out

You may have the right to request that your personal data not be sold to third parties.

17. Exercising Your Rights and Registering Complaints or Grievances

You may use any of the following methods to exercise your rights, or to register any grievance or complaint related to our processing of your personal data:

Send an email to [email protected].
Exercise your right to opt out of sale via the ‘Do not sell my personal information’ link on our website, or directly by opting out of third-party cookies.

18. No Fee Usually Required

You will not have to pay a fee to access your personal data, or to exercise any of your other rights. However, we may charge a reasonable fee if your request for access is clearly unfounded or excessive. Alternatively, we may refuse to comply with the request in such circumstances.

19. Changes to this Notice

We reserve the right to update this Notice at any time, and we will provide you with a new Notice when we make any substantial updates. We may also notify you in other ways from time to time about the processing of your personal data. This Notice is reviewed annually, or upon any significant regulatory change.

Questions about this Notice?

If you have any questions about this Notice, please contact the Data Protection Officer at [email protected].