Global Data Privacy Notice for Personnel

Issued: May 25, 2018

1.              Introduction

Rocket Software ("Rocket", "we" or "us") has issued this Global Data Privacy Notice (“Notice”) to describe how we handle personal information that we hold about our personnel and job applicants (collectively referred to as "you"). The terms "personnel" or “employee” include those who work on a non-permanent basis, including contingent workers, temporary and contract workers, independent contractors, consultants, professional advisors, secondees and interns. The term “employment” as used in this Notice includes Rocket’s engagement with personnel in any of the previously mentioned relationships.

We respect the privacy rights of individuals and are committed to handling personal information responsibly and in accordance with applicable law. This Notice sets out the personal information that we collect and process about you, the purposes of the processing and the rights that you have in connection with it.

If you are in any doubt regarding the applicable standards, or have any comments or questions about this Notice, please contact us at the contact details in Section 10 below.

 

2.              Types of personal information we collect

In the course of your employment with Rocket, or when making an application for employment, we may process personal information about you and your dependents, beneficiaries and other individuals whose personal information has been provided to us.

The types of personal information we may process include, but are not limited to:

  • Identification data – such as your name, gender, photograph, date of birth, individual’s IDs.
  • Contact details – such as home and business address, telephone/email addresses, emergency contact details.
  • Employment details – such as job title/position, office location, employment contract, performance and disciplinary records, grievance procedures, sickness/holiday records.
  • Background information – such as academic/professional qualifications, education, CV/résumé, criminal records data (for vetting purposes, where permissible and in accordance with applicable law).
  • National identifiers – such as national ID/passport, immigration/visa status, social security numbers.
  • Spouse & dependents’ information, marital status.
  • Financial information – such as banking details, tax information, withholdings, salary, benefits, expenses, and company allowances.
  • IT information – information required to provide employees’ access to company IT systems and networks such as IP addresses, log files and login information.  For further information on how employee IT information is processed, employees will be provided with Rocket’s Information Security Program.

If you are a contingent worker, the type of personal information we process is limited to that needed to manage your particular work assignment with Rocket.

Sensitive personal information includes any information that reveals your racial or ethnic origin, religious, political or philosophical beliefs, genetic data, biometric data for the purposes of unique identification, trade union membership, or information about your health/sex life ("Sensitive Personal Information"). As a general rule, we try not to collect or process any Sensitive Personal Information about you, unless authorized by law or where necessary to comply with applicable laws.

However, in some circumstances, we may need to collect, or request on a voluntary disclosure basis, some Sensitive Personal Information for legitimate employment-related purposes: for example, information about your racial/ethnic origin, gender and disabilities for the purposes of equal opportunities monitoring, to comply with anti-discrimination laws and for government reporting obligations; or information about your physical or mental condition to provide work-related accommodations, health and insurance benefits to you and your dependents, or to manage absences from work.

We may collect information that you have made publicly available on a third-party site, such as Indeed, LinkedIn, or GlassDoor. We may contact third parties that you have voluntarily provided to us for reference checks, to verify the information you have provided to us, such as regarding prior employment or education.

 

3.              Purposes for processing personal information

(i)              Recruitment purposes

If you are applying for a role at Rocket, then we collect and use this personal information primarily for recruitment purposes – in particular, to determine your qualifications for employment and to reach a hiring decision. This includes assessing your skills, qualifications and background for a particular role, verifying your information and determining authorization to work, complying with legal requirements, carrying our reference checks or background checks (where applicable) and to generally manage the hiring process and communicate with you about it. 

If you are accepted for a role at Rocket, the information collected during the recruitment process will form part of your ongoing personnel record.

If you are not accepted as an employee in first application with Rocket, we may still keep your application information for approximately one year to allow us to consider you for other suitable openings with Rocket and contact you in the future.  If you do not wish for us to maintain your information or contact you in the future, please notify the Human Resources department as specified in Section 10 below.

(ii)            Employment or work-related purposes

Once you become employed at Rocket, we collect and use this personal information for the purpose of managing our employment or working relationship with you – for example, your employment records and contract information (so we can manage our employment relationship with you), your bank account and salary details (so we can pay you), your details and details of your spouse and dependents (for emergency contact and benefits purposes).

We process personnel personal information through a global human resources system ("HR System"), which includes tools that helps us to administer HR and employee performance, compensation and benefits at an international level and which allows personnel to manage their own personal information in some cases. This will involve transferring your personal information to our servers in the U.S.  Our parent company in the U.S., Rocket Software, Inc., may host these servers or utilize third-party servers, or service providers, but in either case will be responsible for the security access of personal information on the HR System.

In addition to the corporate global HR System, we collect and process personnel personal information through systems in each country in which an individual is employed, as well as transferring personal information to Rocket offices in other countries for management purposes, in order to administer local employment related requirements such as country-specific onboarding, payroll, taxes, and benefits. These systems and servers may be hosted by a Rocket subsidiary, or by a third-party service provider.

(iii)           The Rocket global directory

We maintain a global directory of personnel which contains your professional contact details (such as your name, location, photo, job title and contact details). This information will be available to everyone in the Rocket Group to facilitate global cooperation, communication and teamwork.

(iv)           Other legitimate business purposes

We may also collect and use personal information when it is necessary for other legitimate purposes, such as to help us conduct our business more effectively and efficiently – for example, for general HR resourcing on a global level, IT security/management, accounting purposes, or financial planning. We may also process your personal information to investigate violations of law or breaches of our own internal policies.

(v)             Law-related purposes

We also may use your personal information where we consider it necessary for complying with laws and regulations, including collecting and disclosing personnel personal information as required by law (e.g. for tax, health and safety, anti-discrimination laws), under judicial authorization, or to exercise or defend the legal rights of the Rocket global group of companies.

(vi)           Cookies

Some of our websites and IT applications use cookies. Most browsers allow you to turn off cookies or to receive a warning before a cookie is stored on your hard drive.

 

4.              Who we share your personal information with

We take care to allow access to personal information only to those who require such access to perform their tasks and duties, and to third parties who have a legitimate purpose for accessing it. Whenever we permit a third party to access personal information, we will implement appropriate measures to ensure the information is used in a manner consistent with this Notice and that the security and confidentiality of the information is maintained.

(i)              Transfers to other group companies

As mentioned above, we will share your personal information with other members of the Rocket group around the world in order to administer human resources, employee compensation and benefits at an international level on the HR System, as well as for other legitimate business purposes such as IT services/security, tax and accounting, and general business transactions and management.

Rocket’s subsidiaries include: Rocket Software (Beijing) Co., Ltd., Rocket Software Canada, Inc., Rocket Software Pty. Ltd., S.A.S. Rocket Software France, Computer Corporation of America (Intl) Ltd., Rocket Software B.V., Rocket Software Deutschland GmbH, Rocket Software UK Limited, Rocket Software Japan Ltd., Computer Corporation of America, and Rocket Software Development India Pvt. Ltd. (For a list of Rocket global locations, please see: http://www.rocketsoftware.com/company/locations.)

(ii)            Transfers to third party service providers

As mentioned above, we make certain personal information available to third parties who provide services to us. We do so on a "need to know basis" and in accordance with applicable data privacy law.

For example, some personal information will be available to our employee benefit plans service providers and third-party companies who provide us with payroll support services, tax and legal services, travel management and expense reporting and reimbursement services, personnel training, insurance providers, fuel card and leasing companies. 

To the extent that Rocket uses third party service providers in it business operations (such as customer relationship management, corporate communications, or development partners), particularly if such services are provided on a hosted basis, you or Rocket may provide your personal information in order to use such services. Rocket, or you, may also provide your personal information to Rocket’s customers or business partners in order to transact business on Rocket’s behalf.

Current subprocessors for applicant personal information is available here:  Rocket Applicant Subprocessors.
A list of Rocket’s current subprocessors for employee personal information is available on the HR Team Site specified above.

(iii)           Transfers to other third parties

We may also disclose personal information to third parties on other lawful grounds, including:

  • To comply with our legal obligations, including where necessary to abide by law, regulation or contract, or to respond to a court order, administrative or judicial process, including, but not limited to, a subpoena, government audit or search warrant.
  • In response to lawful requests by public authorities (including for national security or law enforcement purposes).
  • As necessary to establish, exercise or defend against potential, threatened or actual litigation.
  • Where necessary to protect the vital interests of another person.
  • In connection with the sale, assignment or other transfer of all or part of our business.
  • With your consent.

 

5.              Legal basis for processing personal information (EEA personnel only)

If you are an individual residing in the European Economic Area, our legal basis for collecting and using the personal information described above will depend on the personal information concerned and the specific context in which we collect it. 

However, we will normally collect personal information from you where we need the personal information to perform a contract with you (i.e. to administer an employment or work relationship with us; process your application according to your request), or where the processing is in our legitimate interests and not overridden by your data protection interests or fundamental rights and freedoms; or otherwise, where we have your consent to do so, as required by applicable law.  In some cases, we may also have a legal obligation to collect personal information from you or may otherwise need the personal information to protect your vital interests or those of another person.

If you have questions about or need further information concerning the legal basis on which we collect and use your personal information, please contact us using the contact details provided at Section 10 below.  

 

6.              Transfer of personal information abroad

As we operate at a global level, we may need to transfer personal information to countries other than the ones in which the information was originally collected. When we export your personal information to a different country, we will take steps to ensure that such data exports comply with applicable laws. For example, if we transfer personal information from the European Economic Area to a country outside it, such as the United States, we will implement an appropriate data export solution such as entering into EU standard contractual clauses with the data importer, or taking other measures to provide an adequate level of data protection under EU law.

The Rocket global group of companies described in Section 4(i) above will transfer and disclose personal information from the EU countries to the parent company in the United States, and within the other specified subsidiaries under its control, subject to a global intercompany agreement under the EU standard contractual clauses. Rocket will transfer and disclose personal information to the third-party service providers that provide the categories of services described in Section 4(ii) above, subject to appropriate Data Processing Addendum in accordance with applicable law.

 

7.              Data retention periods

Personal information will be stored in accordance with applicable laws and kept as long as needed to carry out the purposes described in this Notice or as otherwise required by applicable law. Generally this means your personal information will be retained until the end or your employment, employment application, or work relationship with us plus a reasonable period of time thereafter to respond to employment or work-related inquiries or to deal with any legal matters (e.g. judicial or disciplinary actions), document the proper termination of your employment or work relationship (e.g. to tax authorities), to provide you with ongoing pensions or other benefits, or as otherwise specified above.

Employment data retention periods are generally based upon termination date +6/7 years, as applicable under local law.

 

8.              Your data privacy rights

You may exercise the rights available to you under applicable data protection laws as follows:

  • If you wish to access, correct, update or request deletion of your personal information, you can do so at any time by contacting us using the contact details provided at Section 10 below. 
  • In addition, if you are a resident of the European Union, you can object to processing of your personal information, ask us to restrict processing of your personal information or request portability of your personal information. Again, you can exercise these rights by contacting us using the contact details provided at Section 10 below.
  • If we have collected and process your personal information with your consent, then you can withdraw your consent at any time.  Withdrawing your consent will not affect the lawfulness of any processing we conducted prior to your withdrawal, nor will it affect processing of your personal information conducted in reliance on lawful processing grounds other than consent.
  • You have the right to complain to a data protection authority about our collection and use of your personal information.  For more information, please contact your local data protection authority. (Contact details for data protection authorities in the European Economic Area, Switzerland and certain non-European countries are available at:
    http://ec.europa.eu/justice/article-29/structure/data-protection-authorities/index_en.htm

We respond to all requests we receive from individuals wishing to exercise their data protection rights in accordance with applicable data protection laws.

 

9.              Updates to this Notice

This Notice may be updated periodically to reflect any necessary changes in our privacy practices. In such cases, we will inform you by providing an updated version of the Notice on the Rocket Careers web page and the Rocket Human Resources Team Site, as applicable, and indicate at the top of the Notice when it was most recently updated. We encourage you to check back at those locations periodically in order to be aware of the most recent version of this Notice.

 

10.           Contact details

If you have any questions about this Notice, or wish to make a complaint about our data handling practices, you may contact:

Data Protection Officer
Rocket Software UK Limited
4 The Square, Stockley Park
Uxbridge, UB11 1ET   United Kingdom
0800 520 0439 (toll free)
Email: [email protected]

We will investigate any complaints received in writing and do our best to resolve them with you as soon as possible.

Alternatively, you can raise any concerns by emailing the Human Resources Department at [email protected].