DATA PRIVACY STATEMENT

1.    INTRODUCTION

1.1   Shepper Limited and its group companies (“we”, “our” or “us”) provide this Data Privacy
      Statement to inform our contractors of our policy relating to the processing of their personal
      information.

1.2   This statement sets out the basis on which we will process your personal information. Please
      read it carefully to understand our practices regarding your personal information and how
      we will use it.

1.3   This statement does not form part of any contract of employment or contract to work or
      provide services and may be amended at any time.

2.    ABOUT US

2.1   We are the data controller of the personal data of contractors, and are subject to applicable
      data protection laws.

      Contacting us:
      If you have any questions about this data privacy statement or your Information, or wish to
      exercise any of your rights as described in this statement or under applicable data protection
      laws, you can contact our Operations team:

      By email:        support@shepper.com


      By phone:        0345 3194535


3.    WHAT TYPES OF DATA ARE PROTECTED

3.1   Personal data

      This Data Privacy Statement applies to your “personal data”, which is any information
      relating to you as an identified or identifiable person. This data is referred to in this Data
      Privacy Statement as “Information”).

3.2   Special categories of personal data

      Within the broad range of personal data, the following are “special categories of personal
      data” which are subject to a greater degree of protection:

         •    physical or mental health;
         •    racial or ethnic origin;
         •    political opinions;
         •    trade union membership;
         •    religious beliefs;
         •    sexual life; and
         •    genetic and biometric data.

4.    WHAT INFORMATION WE COLLECT

4.1   Information you give us

      4.1.1       You may give us Information by filling in forms online or by corresponding with
                  us by phone, email, in person, or otherwise. This includes Information you
                  provided when you first applied to work with us.
     4.1.2      To assist us in complying with our obligation to maintain accurate Information,
                 you should immediately notify the Operations team in writing of any changes to
                 your personal details. Such changes may include, but are not limited to:

                  •   your name, change of address, phone number or mobile phone number;
                  •   your nationality or immigration status;
                  •   any change of address, phone number etc.;
                  •   your bank details.

                 Failure to comply with this requirement may constitute a disciplinary offence.

      4.1.3      Where you have notified us or we otherwise become aware of an inaccuracy in
                 Information, we will take steps to ensure that Information is erased or rectified
                 without delay.

4.2   Information we collect about you

      4.2.1      We collect Information to operate our business and manage your work (where
                 applicable), to meet service level agreements (SLA’s) and to comply with our
                 legal and regulatory obligations as a contracting party.

      4.2.2      We may collect, store and use Information relating to your use of our IT systems.

      4.2.3      The Information that we may collect about you includes, but is not limited to,
                 the following:

                  •   name;
                  •   home address;
                  •   contact details (such as phone numbers and email addresses);
                  •   copies of your passport, driving licence and similar documents;
                  •   languages spoken and level of proficiency;
                  •   IP addresses.

4.3   Using your information to target online advertising at other prospective Shepherds

      When we advertise on the internet for the recruitment of Shepherds, we may share your
      information with our advertising partners, so that they can target our ads at their other
      users who have a similar profile to you. For example, when we use social media for
      marketing purposes, your name and other identifier such as email address may be shared
      with the social media platform, so that they can check if you also hold an account with
      them. If you do, we may ask the advertising partner or social media network:

         •    to exclude you from receiving our adverts (as you are already a Shepherd!)
         •    To advertise to people who have a similar profile to you, e.g. if we believe that the
              idea of becoming a Shepherd will appeal to people with similar interest to the ones
              on your social media profile, we may ask our advertising partner to send our adverts
              to people who share your interests.

      You can contact us to object to us sharing your personal data in this way for online
      advertising. Social media platforms also allow you to indicate your preferences to them
      about the advertising you receive on their platforms. Please contact your social media
      platforms for more information.

4.4   Special categories of personal data

      Information includes such “special categories of personal data” (see the description
      provided above).

5.    INFORMATION PROVIDED BY THIRD PARTIES

5.1   We may also collect Information from external sources, such as those that are commercially
      available to us.
5.2   Some of the Information we collect (as described in section 4), and additional Information,
      may be provided to us by recruitment agencies with whom you have registered an interest.
      Such recruitment agencies support our recruitment processes under a duty of
      confidentiality.

5.3   We may also receive Information from organisations such as credit reference agencies, fraud
      prevention agencies and referees.

6.    DATA RELATING TO CRIMINAL CONVICTIONS & OFFENCES

6.1   We may also collect and store personal data relating to criminal convictions and offences.
      This data is only processed:

           •     if you have given your consent to the processing; or
           •     if it is necessary for the purposes of performing or exercising our or your obligations
                 or rights under law; or
           •     if it is necessary for the prevention or detection of an unlawful act and it is
                 necessary for reasons of substantial public interest; or
           •     in connection with any legal proceedings (including prospective legal proceedings)
                 and/or the obtaining of legal advice.

7.    WHAT WE DO WITH YOUR INFORMATION AND ON WHAT BASIS

7.1   We process Information (other than special categories of personal data) for the reasons
      listed below. The legal justification for the processing of the Information is, in each case,
      one or more of these reasons. Specific examples are given – some of which may overlap, as
      there may be more than one reason for processing Information.

7.2   Processing is necessary for the performance of your contract

      We have obligations towards you under the terms of your contract (for example, we are
      contractually obliged to pay you any money due under your contract). Equally, you have
      contractual obligations to us, both as part of entering into your contract and in the ongoing
      performance of it. In order for us to ensure that both we and our contractors can perform
      our contractual obligations, we may process Information for the following purposes (where
      applicable):

       •       onboarding processes (e.g. communicating with you in relation to your application);
       •       considering your suitability for work, taking up your references and conducting
               appropriate checks;
       •       induction processes;
       •       scheduling;
       •       complying with our legal and regulatory obligations;
       •       training and training records;
       •       payment processes and administration of your contract;
       •       monitoring SLA’s;
       •       Shepper’s Strike Policy;
       •       criminal records checks;
       •       undertaking business analysis activities.

7.3   Where we have a legal or regulatory obligation

      UK and EU law and certain rules and regulations require us to process Information in order
      to comply with our legal or regulatory obligations. In order for us to do so, we may process
      Information for the following purposes (where applicable):

       •       preventing illegal working;
       •       complying with health and safety obligations;
       •       ensuring the safety and security of our systems;
       •       carrying out equal opportunities monitoring;
       •       responding to government statistical monitoring (Office for National Statistics);
       •       assessing Fitness and Propriety of individuals for regulatory purposes;
       •       providing regulatory references; and
       •       communicating with the PRA, FCA or other public or regulatory bodies.
7.4   Where we have a legitimate interest

      7.4.1      Data protection law allows us to process Information where it is necessary for
                 the purposes of our legitimate interests. We consider it to be in our legitimate
                 interests to process Information for the following purposes:

                   •   onboarding processes (including negotiation and communicating with you
                       in relation to your application);
                   •   considering your suitability for work, taking up references, and conducting
                       appropriate checks;
                   •   administering our IT system including troubleshooting, data analysis,
                       testing, research, statistical and survey purposes;
                   •   dealing with any legal disputes involving you or other current, prospective
                       or former contractors;
                   •   improving our IT system to ensure that content is presented in the most
                       effective manner for you and for your computer, mobile device or other
                       item of hardware through which you access our IT system;
                   •   ensuring the safety and security of those working for us;
                   •   as part of our efforts to keep our IT system safe and secure and to monitor
                       compliance with our related policies;
                   •   reporting to government entities.

7.5   If you do not agree with the processing of Information on the basis that it is in our legitimate
      interests to do so, please inform us using the contact details at the beginning of this Data
      Privacy Statement, following which we shall cease to process Information for that purpose,
      unless certain exceptions apply: see “Right to object to processing in certain circumstances”
      under “Your rights” below.

7.6   Special categories of personal data

      7.6.1      We may process “special categories of personal data” for the purposes of:

                   •   performing or exercising our or your obligations or rights under law,
                       including for assessing suitability for particular jobs and considering
                       whether adjustments may need to be made to accommodate an individual
                       with a disability;
                   •   where it is in the public interest, such as for equal opportunities
                       monitoring;
                   •   establishing, bringing or defending legal claims.

      7.6.2      We may also process “special categories of personal data” in other limited
                 circumstances, with your explicit written consent. We do not need your consent
                 to process “special categories of personal data” in circumstances where we
                 already have a legal right to do so and we carry out such processing in accordance
                 with this statement. If we do ask you for your written consent, we will provide
                 you with full details of the information we are seeking from you and the reason
                 why, in order for you to make an informed decision. It is not a condition of your
                 contract that you agree to any such request by us.

8.    DISCLOSURE OF YOUR INFORMATION TO THIRD PARTIES

8.1   For the purposes set out in section 7 above, we may share Information with:

          •   our group companies;
          •   professional advisors (including lawyers, accountants and auditors);
          •   legal and regulatory authorities such as the PRA and FCA; and
          •   HM Revenue & Customs and other government/state related entities.

8.2   We may also share Information with other parties which provide products or services to us,
      such as our software providers, in order to enable us to comply with our overriding legal
      and regulatory obligations to you and to ensure that we comply with your contract. These
      third parties will also be data controllers of Information, which will be processed in
      accordance with the third party’s data privacy policy.

8.3   We may also disclose Information to third parties where it is in our legitimate interest to do
      so, including for the following reasons:
         •    in the event that we sell or buy any business or assets, in which case we may disclose
               Information to the prospective seller or buyer of such business or assets; or
          •    if we are under a duty to disclose or share Information in order to comply with any
               legal obligation.

8.4    Save as set out in this Data Privacy Statement, or as required by law, we do not sell
       Information or disclose it to any third parties without your consent.

9.     POLICIES AND PROCEDURES

9.1    We have a number of additional policies, which are updated from time to time, in relation
       to data privacy and data security. Please familiarise yourselves with these additional
       policies. If you have any questions about such policies and procedures, you should speak to
       the Operations team.

9.2    Any new or updated policies or manual will be communicated to you by email, or any other
       appropriate method.

10.    SECURITY OF YOUR INFORMATION

10.1   We are committed to ensuring that your Information is safe and we will take all steps
       reasonably necessary to ensure that your Information is treated securely and in accordance
       with this Data Privacy Statement.

10.2   All Information you provide to us electronically is stored on our secure servers within the
       United Kingdom and the U.S.A.

10.3   Where we have given you (or where you have chosen) a password which enables you to
       access certain parts of our IT system, you are responsible for keeping this password
       confidential. We ask you not to share your passwords with anyone.

10.4   Unfortunately, the transmission of information via the internet is not completely secure.
       Although we will do our best to protect your Information, we cannot guarantee the security
       of your Information transmitted to or stored on our IT system, and any transmission is at
       your own risk. Once we have received your Information, we will use strict procedures and
       security features to try to prevent unauthorised access.

11.    HOW LONG WE KEEP YOUR INFORMATION

       We will keep your Information for as long as necessary to fulfil the purposes described in
       this Data Privacy Statement or in the terms of your contract, or for as long as we are
       required to do so by law or in order to comply with a regulatory obligation.

12.    YOUR RIGHTS

12.1   Access to your Information and updating your Information

           •   You have the right to access Information that we hold about you, subject to certain
               limited exceptions provided by law. If you so request, we shall provide you with a
               copy of Information which we are processing and hold about you (“data subject
               access request”). Further details about data subject access requests can be found
               in our Data Protection Policy. For any further copies which you request, we may
               charge a reasonable fee based on administrative costs.

           •   You also have the right to receive such Information in a structured and commonly
               used format so that it can be transferred to another data controller (“data
               portability”).

           •   We want to make sure that your Information is accurate and up to date. You may
               ask us to correct or remove information which you think is inaccurate.

12.2   Right to object to processing in certain circumstances

       You also have the right to object, on grounds relating to your particular situation, at any
       time to the processing of your Information which is based on our legitimate interests. Where
       you object on this ground, we shall no longer process your Information unless:
         •     the processing is nevertheless necessary for the performance of your contract or
                contract to work or provide services; or
          •     the processing is necessary for the establishment, exercise or defence of legal
                claims; or
          •     we have a legal or regulatory obligation for which the processing of the Information
                is necessary; or
          •     we can demonstrate that our legitimate interest is sufficiently compelling to override
                your fundamental rights and freedoms.

12.3   Your other rights

       12.3.1       You also have the right to request that we rectify your Information if it is
                    inaccurate or incomplete.

       12.3.2       In certain limited circumstances, you have the right to request the erasure of
                    your Information (‘right to be forgotten’).

13.    EXERCISING YOUR RIGHTS

13.1   You can exercise any of your rights as described in this Data Privacy Statement and under
       data protection laws by contacting us via the details given in the “Contacting us” box above.

13.2   Save as described in this Data Privacy Statement or provided under data protection laws,
       there is no charge for the exercise of your legal rights. However, if your requests are
       manifestly unfounded or excessive, in particular because of their repetitive character, we
       may either: (a) charge a reasonable fee, taking into account the administrative costs of
       providing the information or taking the action requested; or (b) refuse to act on the request.

13.3   Where we have reasonable doubts concerning the identity of the person making the request,
       we may request additional information necessary to confirm your identity.

14.    INTERNATIONAL TRANSFERS

14.1   As an international organisation, authorised personnel may access your Information in any
       country in which we operate. Therefore, it may be necessary to transfer your details to
       members of our group located in countries that may not offer equivalent data protection or
       privacy laws to those in the UK or the EU.

14.2   Regardless of where your Information is transferred, we shall ensure that your Information
       is safe and shall take all steps reasonably necessary to put in place appropriate safeguards
       to ensure that your Information is treated securely and in accordance with this statement
       and applicable law. Details regarding these safeguards can be obtained from the Operations
       team, whose details are given above.

15.    COMPLAINTS

       You also have the right to complain to the Information Commissioner’s Office
       (https://ico.org.uk/) about our data processing activities. The Office has a dedicated
       helpline at 0303 123 1113.

16.    CHANGES

16.1   This Data Privacy Statement may be amended by us at any time in our sole and absolute
       discretion. Any changes which may be made to this Statement in the future will be notified
       to you by email and on our intranet.

16.2   This Data Privacy Statement was last updated on 25th March 2019.

Did this answer your question?