Privacy Notice

Employee, Candidate, Vendors, Contractors’ and Sub-Contractors’ Privacy Notice

This privacy notice sets out the ways in which Jones Engineering Holdings Ltd CRO 393931 and its subsidiaries (“company” “we” “us “our”) processes personal data. This notice principally applies to current, past and future employees and third parties such as vendors, contractors and sub-contractors when they are processing personal data on our behalf. This notice describes the following:

• Who we are.
• The personal data we process.
• Compliance with the principles relating to processing of personal data.
• How and where we obtain your personal data.
• Automated decision making or the automated processing of personal data.
• How long do we retain your personal data.
• Recipients of personal data transfers.
• Your rights in respect of our processing of your personal data.

Who we are

Compliance with the principles relating to processing of personal data

Jones Engineering complies with the principles of the General Data Protection Regulation. That means our processing of your personal will be:

• Processed lawfully, fairly and in a transparent manner.
• Collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes.
• Adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed.
• Accurate and, where necessary, kept up to date.
• Kept in a form which permits identification of data subjects for no longer than is necessary.
• Processed in a manner that ensures appropriate security of the personal data.

The personal data we process

Jones Engineering may process the following categories of personal data of its employees, candidates, vendors, contractors and sub-contractors. The table below also lists the purpose and lawful basis for the processing.

Personal data categories	Purposes of the processing	Lawful basis of the processing
Employee: Financial information such as bank account details, salary, expenses, pension payments, PPSN, contact details.	For salary, expenses and pension payment purposes.	Processing is necessary for the performance of a contract with the employee.
Employee: Employment details, skills, education and continuous professional development, performance reviews, passport or visa details, photos or videos, equipment issued, previous employment, leave.	For general employment and employee progression purposes.	Processing is necessary for the performance of a contract with the employee.
Employee: Next of Kin and family details.	For health and safety reasons.	Processing is necessary to protect the vital interests of the employee or their family.
Employee: Special Categories of Data such as trade union membership, biometric data for the purpose of uniquely identifying a natural person, data concerning health and religious belief may be processed.	To fulfil trade union related obligations, control area access, health and safety requirements, incident and accident recording and government documentation or visa requirements.	Processing is necessary for the performance of a contract with the employee.
Candidate: Job candidate details including CVs, qualifications, experience, interview notes, contact details.	To evaluate and recruit talent.	Processing is necessary for the performance of a contract with the employee.
Vendor: Contact details, account details, invoices, quotations, pricing lists, schedules, specifications, products.	To procure materials required by Jones Engineering.	Processing is necessary for the purposes of the legitimate interests pursued by Jones Engineering.
Contractor and Sub-contractor: Contact details, contracts, invoices, CVs, account details, employee timesheets, identity and contact details, CCTV image details.	To perform contractual obligations of contractors or ensure contractual obligations of sub-contractors.	Processing is necessary for the purposes of the legitimate interests pursued by Jones Engineering.

How and where we obtain your personal data

Direct interactions

Jones Engineering may process personal data obtained directly from you in the form of CVs, forms, documents, emails, communications, electronic portals, conversations, phone calls, video calls, instant messaging, interviews, passports, business cards, photos etc.

Indirect interactions

Jones Engineering may also process personal data obtained indirectly such as from recruitment professionals that are involved in your recruitment with us, or who put you forward as a candidate or where our own staff provide us with your CV and/or other details, as part of a referral, tax authorities, pension schemes, employee supplied referees, LinkedIn pages or other employment related third parties in the case of employee or candidate personal data. Vendor, contractor and subcontractor data may be obtained indirectly through recommendations, referrals, publicly available information, business cards etc. Any indirectly obtained personal data will only be processed if there is a lawful basis to do so.

Automated decision making or the automated processing of personal data

Jones Engineering does not use automated decision-making technologies for the processing of personal data or to profile employees, candidates, vendors, contractors or sub-contractors.

How long do we retain your personal data

We retain personal data in line with legally defined time periods or as long as necessary to administer and carry out our employment or business relationship including our post-employment or post-business obligations.

In the event of litigation or investigations certain personal data may be retained beyond the legally defined time periods or when it is in the legitimate interests of the company to do so.

We may keep personal data that has been anonymised indefinitely as it will no longer identify you and it is no longer is categorised as personal data.

Recipients of personal data transfers

Personal data recipient categories

Jones Engineering provides personal data to government bodies when legally obligated and to third party vendors to process on our behalf. These providers may process personal data related to pensions, expenses, employment visas, personal taxes, human resources, recruitment, qualifications, training and certifications, biometric data, vendor details, employment history, next of kin and family information.

International transfers to third countries

Jones Engineering is a global organisation with offices, affiliates, subsidiaries, and employees located around the world. It operates in and processes the personal data that it uses predominantly within the EEA. All processing of personal data is by default carried out within the EEA or countries with an EU privacy adequacy decision.

Jones Engineering may occasionally be required to transfer or disclose personal data outside the EEA to entities in third countries when it is legally obligated to or necessary for the purposes mentioned in this privacy notice. Jones Engineering operates the following companies in third countries.

Company	Country
Jones Engineering Group LLC	Qatar
Jones Engineering Saudi Arabia Ltd	Kingdom of Saudi Arabia
Jones Engineering Group Ltd	Abu Dhabi
Jones Engineering Group Ltd	Dubai
JEG Bahrain Holding S.P.C	Bahrain
JEG Acamar Bahrain Co. W.L.L.	Bahrain

Jones Engineering only transfers your personal data to third countries using necessary contractual safeguards i.e. Standard Contractual Clauses. This ensures that there is a lawful basis and adequate technical and organisational measures to protect your personal data.

Your rights in respect of our processing of your personal data

Withdrawal of Consent: If you have provided personal data to us where consent was used as the lawful basis for processing you may withdraw this consent at any time if there is no other legal grounds for Jones Engineering’s processing of this data.

Right of access: You have the right to obtain from the controller confirmation as to whether or not personal data concerning you are being processed, and, where that is the case, access to the personal data.

Right to rectification: You have the right to obtain from the controller without undue delay the rectification of inaccurate personal data concerning you. Taking into account the purposes of the processing, you shall have the right to have incomplete personal data completed, including by means of providing a supplementary statement.

Right to erasure (‘right to be forgotten’): You may under certain circumstances have the right to obtain from the controller the erasure of personal data concerning you and Jones Engineering shall have the obligation to erase personal data without undue delay.

Right to restriction of processing: You may under certain circumstances have the right to obtain from Jones Engineering restriction of the processing of your personal data.

Notification obligation regarding rectification or erasure of personal data or restriction of processing: Jones Engineering will communicate any rectification or erasure of personal data or restriction of processing carried out to each recipient to whom the personal data has been disclosed unless this proves impossible or involves disproportionate effort. Jones Engineering will inform you about those recipients if you request it.

Right to data portability: You may under certain circumstances have the right to receive the personal data concerning you, which you have provided to Jones Engineering, in a structured, commonly used and machine-readable format and have the right to transmit those data to another controller without hindrance from Jones Engineering to which the personal data that has been provided.

Right to object: You may under certain circumstances have the right to object, on grounds relating to your particular situation, at any time to processing of personal data concerning you including profiling. Jones Engineering will no longer process the personal data unless it demonstrates compelling legitimate grounds for the processing which override the interests, rights and freedoms of you or for the establishment, exercise or defence of legal claims.

Automated individual decision-making, including profiling: You may under certain circumstances have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you.

Contact Details for Privacy Rights Requests

If you have any privacy questions or comments or want to exercise your privacy rights please contact Jones Engineering’s Data Privacy Officer at:

Data Privacy Officer
Jones Engineering
83 Pembroke Rd
Dublin 4
D04 HN50
Ireland
E: privacy@joneseng.com

Jones Engineering tries to respond to all legitimate requests within one calendar month. It may take us longer than this if your request is particularly complex or you have made a number of requests. If this is the case, we will notify you and keep you updated as your request is being processed.

If you have submitted a privacy request and are not satisfied with the way in which Jones Engineering responded, you have the right to lodge a complaint with your national supervisory authority. The Data Protection Commissioner is Ireland’s supervisory authority. They can be contacted at:

Data Protection Commission
21 Fitzwilliam Square South
Dublin 2
D02 RD28
Ireland
T: +353 1890 252 231
E: info@dataprotection.ie

Effective date: 25 SEPT 2023
Last Update: 25 SEPT 2023