Privacy Notice for Third Party Service Providers

1. Purpose: This Notice describes how we collect and use personal data about you, during and after your working relationship with us, in accordance with the General Data Protection Regulation (GDPR).

2. Applicability: This Notice applies to all third-party service providers including trainers, company SPOC, landlord, office help, etc. This Notice does not form part of any contract to provide services. We may update this Notice at any time, subsequent to which, a copy of the updated Notice will be furnished to every third-party service provider at the earliest.

3. Relationship and Purpose of Processing Data: WNSA responsible for deciding how we hold, use and process your personal data. We need to keep and process data about you for normal administrative purposes including hiring, for entering into a service contract with you, for complying with legal obligations and for record keeping purposes including contacting you for suitable opportunities that may arise in future. Processing will include collection, recording, organisation, structuring, storage, adaptation, alteration, retrieval, consultation, and use, disclosure by transmission, erasure or destruction of your personal data. The data we hold and process will be used for management, operational and administrative purposes only. We will keep and use it to enable us to run the business and manage our relationship with you effectively, lawfully and appropriately, whilst you would be working for us, at the time when your service ends and after you have left us. This includes using data to enable us to comply with the service contract that we would be executing with you in case of your selection and any legal and customary requirements, pursue our legitimate interests, protect our workforce and stakeholders against injury, theft, legal liability, fraud, abuse and protect our legal position in the event of legal proceedings and compliance including compliance with government authority requests for information, liens and management compliances. If you do not provide this data or request for the deletion of data we may be unable in some circumstances to comply with our legal obligations and we will tell you about the implications of that decision.

4. Personal data we will process about you:

WNSA may process the following categories of personal data about you:

• Personal details including name, title, address, mobile number, phone number, corporate/personal email address, signatures, etc.;
• National ID details including identification numbers.
• CCTV footage and other data obtained through electronic means such as swipe card records, etc.

We may also process the following “special categories” of data, wherever applicable in accordance with the laws and requirements of each jurisdictions:

• Medical data including injury details.

5. How is your personal data collected

WNSA collects personal data about third party service providers through application, forms that are required to be filled at the time of third-party/vendor on-boarding either directly from the service provider or sometimes indirectly from third party service including background check provider/agency, credit reference agencies, etc. We may collect additional personal data in the course of job-related activities throughout the period you would be associated with us. All data including any additional data collected during the on-boarding process will be used and stored for performance of hiring activity and the service agreement, as well as for complying with the legal obligations or legitimate interests of WNSA.

6. How will we use personal data about you/Our basis of processing

WNSA will only use your personal data when the law allows us to. Most commonly, we will use your personal data in the following circumstances:

• Where we would be required to execute the service contract with have entered into with you.
• Where we need to comply with a legal obligation. (For example, where it is required to check a service provider’s eligibility to work in the country before services start).
• Where it is necessary for our legitimate interests (or those of a third party) and your interests and fundamental rights do not override those interests. (For example, we need to process for administrative and record keeping purposes, etc.)
• Where we need to protect your interests (or someone else’s interests).
• Where it is needed in the public interest (or for official purposes).
• Where we have sought your explicit consent.

7. If you fail to provide personal data

If you fail to provide certain data when requested, we may not be able to perform the contract that we have entered into with you (such as paying you or providing a benefit), or we may be prevented from complying with our legal obligations.

8. Change of purpose

WNSA will only use your personal data for the purposes for which we collected it. If we need to use your personal data for an unrelated purpose, we will notify you and will explain the legal basis which allows us to do so without undue delay. Please note, that we may process your personal data without your knowledge or consent, in compliance with the above rules, where this is required or permitted by law.

9. Special categories of data

Special categories of data require higher levels of protection. We need to have further justification for collecting, storing and using this type of personal data in accordance with Articles 6 and 9 of GDPR. We may process special categories of data in the following circumstances:

• Where processing is necessary for the performance of contract to which you will be a party;
• Where processing is necessary for the purpose of legitimate interest pursued by WNSA or third party with appropriate safeguards;
• Where processing is necessary for the purpose of carrying out the obligations and exercising specific rights of WNSA and employees in fields of employment and social security and social protection law in so far as is authorised by Union or Member State law or a collective agreement providing appropriate safeguards for your fundamental rights and interests;
• Less commonly, we may process this type of data where it is needed in relation to legal claims or where it is needed to protect your interests (or someone else’s interests) and you are not capable of giving your consent, or where you have already made the information public;
• Where processing is necessary for the establishment, exercise or defence of legal claims or whenever courts are acting in their judicial capacity.

10. Data sharing

WNSA may share your personal/special categories of data with the following recipients:

• Third parties with whom we have a contractual relationship, including payroll vendor, medical vendor, pension vendor, benefits vendor, law firm, data shredding, background check vendor, etc. We require third parties to respect the security of your data and to treat it in accordance with our instructions and as per the law.
• Other WNS entities for internal administrative purposes. We may transfer your personal data outside the EU for processing in accordance with the Standard Contractual Clauses executed between Controller Entity and WNS Global Services Private Limited (India).

11. Transferring personal data outside the EU

WNSA may transfer the personal data that it collects about you to internal group companies located in India, outside the EU, for the purpose of legitimate interests, performance of employment contract and internal administration.

However, to ensure that your personal data does receive an adequate level of protection, we have executed Standard Contractual Clauses with WNS Global Services Private Limited (India) to ensure that your personal data is treated by those WNS entities in a way that is consistent with and which respects the EU and regional laws on data protection.

12. Data security

WNSA has put in place measures to protect the security of your data.

Third parties will only process your personal data on our instructions and where they have agreed to treat the data confidentially and to keep it secure. We do enter into specific agreements with such third parties to ensure compliance.

We have put in place procedures to deal with any suspected data security breach and will notify you and any applicable regulator of a suspected breach where we are legally required to do so.

13. Data retention

WNSA will only retain your personal data for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements. To determine the appropriate retention period for personal data, we consider the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means and the applicable legal requirements.

In some circumstances we may anonymise your personal data so that it can no longer be associated with you, in which case we may use such data without further Notice to you. Once you are no longer a service provider or contractor of the company, we will retain and securely destroy your personal data in accordance with [our Data Retention Policy OR applicable laws and regulations].

14. Data Controllers

The following is the list of Data Controllers across WNSA entities which are involved in the processing of your data. Depending on the location, any one of the following will act as Data Controller/Joint Controller for the personal data that is being processed by WNSA:

15. Data Protection Officer

WNSA has appointed a Data Protection Officer (DPO) to oversee compliance with this Notice. If you have any questions about this Notice or how we handle your personal data, please contact the DPO at privacy@wns.com. You have the right to make a complaint at any time to the regional supervisory authority for data protection issues.

16. Your duty to inform us of changes

It is important that the personal data we hold about you is accurate and current. Please keep us informed if your personal data changes during your working relationship with us.

17. Rights Available to you

Your rights in connection with personal data: Under certain circumstances, by law, you have the:

• Right of Access to your personal data (commonly known as a “data subject access request”). This enables you to receive a copy of the personal data we hold about you.
• Right to Rectification of the personal data that we hold about you. This enables you to have any incomplete or inaccurate data we hold about you corrected.
• Right to be Informed about the collection and use of personal data.
• Right to be Forgotten will enable you to ask us to delete or remove personal data which we process about you subject to limited circumstances in accordance with the GDPR requirements.
• Right to Object to Processing of your personal data where we are relying on a legitimate interest (or those of a third party) and there is something about your particular situation which makes you want to object to processing on this ground. You also have the right to object where we are processing your personal data for direct marketing purposes.
• Request the Restriction of Processing of your personal data. This enables you to ask us to suspend the processing of personal data about you, for example if you want us to establish its accuracy or the reason for processing it.
• Right of Data Portability/Transfer to another party.
• Right to Withdraw Consent for processing of personal data where explicit consent has been sought. In the limited circumstances, where you may have provided your consent to the collection, processing and transfer of your personal data for a specific purpose, you have the right to withdraw your consent for that specific processing at any time. To withdraw your consent, please contact DPO at privacy@wns.com. Once we have received notification that you have withdrawn your consent, we will no longer process your data for the purpose or purposes you originally agreed to, unless we have another legitimate basis for doing so in law.
• Right Related to Automated Decision Making Including Profiling. You will have a right not to be subjected to a decision based solely on automated processing including profiling. Such decisions can be made only if, they are necessary for the entry into or performance of a contract or authorized by the Union or member state law applicable to WNSA or based on your explicit consent.

All the above-mentioned rights can be exercised by contacting the DPO at privacy@wns.com.

18. No fee usually required

You will not have to pay a fee to access your personal data (or to exercise any of the other rights). However, we may charge a reasonable fee if your request for access is clearly unfounded or excessive. Alternatively, we may refuse to comply with the request in such circumstances.

If you have any questions about this Notice, please contact DPO at privacy@wns.com.