Privacy Notice

This notice is designed to help you understand how Thalia uses your personal information. We encourage you to read the whole notice. Alternatively, if you wish to read about specific privacy practices that interest you, please click on the relevant links below. We are Thalia Services Limited and its subsidiary companies. Our use of personal information We are a leading provider of public services, primarily in the UK but also in other countries. We collect, use and share information, including personal information, in connection with providing our services and running our business. This is our main general privacy notice that applies across our business, although we may publish additional privacy statements for certain services or for certain groups of individuals. We have a separate privacy notice on how we process the personal information of our staff, which current and former members of staff should refer to.

Updating this privacy notice
This notice may be updated from time to time. This version is dated 13 October 2021.

What is personal information?
Personal information is information that relates to you or allows us to identify you. This includes obvious things like your name, address and telephone number but can also include less obvious things like analysis of your use of our websites. There are some types of personal information which have additional protections when compared to information such as your name and address. These are referred to in this policy as special category information: this is personal information about your health, racial or ethnic origin, political opinions, religious or philosophical beliefs and trade union membership, your genetic data and biometric data, and information concerning your sex life or sexual orientation. criminal records information: this is personal information relating to your criminal convictions and offences.

Our responsibility to you
We are responsible for ensuring that we comply with relevant data protection laws when processing your personal information (including any special category information or criminal records information).

Data governance manager
We have a data governance manager whose job is to oversee our data protection compliance. You can contact our data governance manager by sending: an email to: peopleservices@thalia.co.uk

Your personal information

Why are we collecting personal information about you?
We only collect personal information about you in connection with providing our services and running our business. We will hold personal information about you if:

you use the services of local authorities, utility companies and similar organisations where we are responsible for providing or managing those services (this might be services such as waste collection, street cleaning, management of recycling centres, road works, and installation of utility meters)
you contact our customer service centre (by any means)
you visit offices or buildings where we are responsible for managing the visitors
you visit our offices or our websites
you represent of one of our customers or potential customers
you represent of one of our suppliers or potential suppliers • you represent a regulator, certification body or government body which has dealings with us
you are a friend, colleague, legal personal representative, partner or relative of a Thalia employee (or former employee) who is a member of an employee benefit scheme

What personal information do we collect about you?
The types of information we process about you may include: Types of Personal Information Details Individual details Name, address (including proof of address), other contact details (e.g. email and telephone numbers), gender, marital status, date and place of birth, nationality, employer, job title, and family details, including their relationship to you

Identification details
Identification numbers issued by government bodies or agencies, such as your national insurance number, passport number, tax identification number and driving licence number

Financial information
Bank account or payment card details, income or other financial information, credit history and credit score

Special category information
Information about your health, racial or ethnic origin, political opinions, religious or philosophical beliefs and trade union membership; your genetic and biometric data; and information about your sex life or sexual orientation

Criminal records information
Information relating to your criminal convictions and offences

Children's personal data
Information relating to children's birth certification

Identifiers
Information which can be traced back to you, such as an IP address, a website tracking code or electronic images of you

Where do we collect your personal information from?
We collect your personal information from various sources, including:

you (such as when you complete a form for us or contact our customer service centre)
our customers (who are local authorities, government bodies, utility companies and similar organisations)
our service providers
government agencies
publicly accessible registers or sources of information
website cookies and similar website based devices
Friends, colleagues, a legal personal representative, solicitor, agent, partner or relative of a Thalia employee (or former employee)

Which of the sources apply to you will depend on why we are collecting your personal information. Where we obtain your personal information from our customers, we may ask them to provide you with a copy of this privacy notice (or a shortened version of it) to ensure you know we are processing your information and the reasons why.

Our use of your personal information

How do we use your personal information?
In this section, we set out in more detail:

the main purposes for which we use your personal information
the legal bases upon which we are using your personal information

Purpose Legal Basis Managing services to residents
Where we provide services to individuals on behalf of our customers, we obtain information about these individuals (and, where relevant, about their guardians and relatives). For all personal information – contract performance or performance of a task carried out in the public interest or in the exercise of official authority or legitimate interests. We have a legitimate interest in using your personal information where it enables us to carry out the required work and to provide appropriate assistance if you are individual with mental or health issue. We also have a legitimate interest in communicating with you as part of managing the provision of our customer's services. Where we are responsible for access to premises (such as work sites, offices, and recycling centres), we obtain information about the individuals who are visiting the premises or using the facilities at the premises. We have a legitimate interest in using your personal information to ensure that access is only granted to those individuals who are entitled to be on the premises or to use the facilities. This entails identifying individuals and keeping records of when they are on the premises. For criminal records information – preventing unlawful acts consent (where applicable).

Managing security
We use video cameras on our vehicles, and on our staff who interact with the public or who are working in high risk environments. Where we are responsible for access to premises, we use video cameras to record the immediate surrounding area of premises, and the entrance and communal areas of premises. We also collect information about individuals who deliberately and persistently attempt to prevent us from undertaking our lawful activities. We do not generally look to collect special category information or criminal records information for this purpose.

Managing requests, reports and complaints
We receive communications from individuals by a variety of means (including telephone, email, and social media). These communications cover a range of issues raised by individuals, including requests for services, reporting of issues, and complaints. We have a legitimate interest in using your personal information to address each request, report or complaint in an appropriate manner and to inform you of the outcome.

Conducting investigations into accidents and other incidents
Where there is an accident or other incident which involves our staff or our vehicles or which takes place at premises where we are responsible for access, we obtain information about the individuals involved in the accident or incident. Where appropriate we may pass relevant information to the police or to government bodies responsible for health and safety. We have a legitimate interest in using your personal information to understand the events of the accident or incident, to identify any patterns between accidents and incidents, and to assist the police and other authorities with investigations and prosecutions.

Managing tenants
Where we manage the letting of premises on behalf of our customers, we obtain information about individuals who are renting those premises (or the individuals who represent the companies which are renting those premises). For all personal information – contract performance or legitimate interests. We have a legitimate interest in using your personal information to ensure that you meet our customers' criteria for acceptable tenants and to ensure that we deal with you in an appropriate manner if you are an individual with mental or health issues. We also have a legitimate interest in communicating with you as part of managing your lease or licence.

Managing our suppliers
We collect information about you in connection with your provision of services to us or your position as a representative of a provider of services to us. We do not generally look to collect special category information or criminal records information for this purpose. We have a legitimate interest in using your personal information to manage the provision of your services or the services of your employer.

Marketing
We use relationship management software to understand the strength of our relationship with our customers and potential customers, which includes individual representatives of those customers – for example records of frequency of contact with those individuals. Where we have an opportunity to bid for work, we may obtain information about relevant decision makers to improve the prospects of our bid being successful. This information may come from a variety of public databases. As part of our marketing analysis, we track how individuals interact with our marketing activities – whether they click on any of the links in our marketing materials. We can record this information against individual email addresses by using 'cookies'. You can control cookies. We have a legitimate interest in using your personal information to understand our relationship with our customers and potential customers. Using the frequency of your contact with our business and analysing how you interact with our marketing activities is a reasonable means of doing so. We also have a legitimate interest in understanding relevant information about you where you are likely to be involved in deciding whether we are awarded contracts through the settings or preferences of your browser, as well as through dedicated browser extensions or add-ons. For more information on how we use cookies, please see our separate cookies notice. We do not generally look to collect special category information or criminal records information for this purpose.

Legal proceedings
We obtain information about individuals where this is necessary or appropriate to bring or defend legal proceedings. We have a legitimate interest in using your personal information where this is necessary or appropriate as part of legal proceedings.

Acquisitions and commercial agreements
We obtain information about individuals where this is necessary or appropriate to structure and implement agreements for the acquisition or disposal of businesses or for other commercial agreements We have a legitimate interest in using your personal information where this is necessary or appropriate to undertake these type of ordinary business arrangements and activities.For special category information – obligations and rights in the field of employment.

Managing visitors to our websites
Our websites use a small number of non-intrusive cookies to help them work more efficiently and to provide us with information on how the website is being used. In particular, the sites useGoogle Analytics, a web-based analytics tool that tracks and reports on the manner in which the website is used to help us to improve it. Google Analytics does this by placing ‘cookies’ on your device. Note that Google will also have its own control of this information, and will hold it on its servers in the United States in accordance with its own privacy policies. You can control cookies through the settings or preferences of your browser, as well as through dedicated browser extensions or add-ons. For more For all personal information – legitimate interests. We have a legitimate interest in using your personal information to understand how our websites are used and the relatively popularity of the content on our websites. Privacy Notice | October 2021 8 information on how we use cookies, please see our separate cookies notice. We do not generally look to collect special category information or criminal records information for this purpose.

Consent
We do not generally process your personal information based on your consent (as we can usually rely on another legal basis). But we might ask you to provide special category information about yourself (particularly information about mental or health issues), where this will assist us to provide services to you or communicate with you in an appropriate manner. But it is your choice as to whether to provide us with this information. We might also ask you to provide criminal records information about yourself, where it is necessary to prevent unlawful acts occurring. Where we do process your personal information based on your consent, you have the right to withdraw your consent at any time. To withdraw your consent please email us at peopleservices@thalia.co.uk

Do we share your information with anyone else?
We do not sell your information nor make it generally available to others. But we do share your information in the following circumstances:

our business is made up of a number of different entities, a small number of which are outside the UK. Where it is necessary or appropriate for the purposes for which we hold your information, we share your relevant information across our group of companies. All of our companies manage your personal information in the manner and to the standards set out in this notice, subject to any local jurisdictional compliance requirements
where your personal information is collected in the course of our work for our customers, then this information will normally be shared with our customer
we may need to provide your personal information to external companies in order to obtain specific services from them. Examples of this would be lawyers, credit reference agencies, and insurance companies. Where we provide your personal information to these companies, they will be responsible for complying with data protection laws in respect of their use of your personal information
we use also the services of various external companies to help us run our business efficiently, particularly in relation to our IT systems. Some of these services (such as email hosting and data backups) involve the service provider holding and using your personal information. These service providers are required to keep your personal information safe and secure, and are not permitted to use it for their own purposes
if we sell our business, then your information will be transferred to the new owner to enable the continuation of the business
we share your personal information with other third parties where we are required to do so to comply with legal or regulatory requirements

Other important things you should know
Keeping your personal information safe
We take security issues seriously. We implement appropriate steps to help maintain the security of our information systems and processes and prevent the accidental destruction, loss or unauthorised disclosure of the personal information we process. Profiling and automated decision making We do not use profiling (where an electronic system uses personal information to try and predict something about you). We do use automated decision making (where an electronic system uses personal information to make a decision about you without human intervention) in relation to processing some of our staff information only, please refer to our Staff Privacy Notice for more information on this.

How long do we keep your personal information?
We do not keep your personal information forever. We keep your personal information in accordance with our global data retention policy which categorises all of the information held by us and specifies the appropriate retention period for each category of information. Those periods are based on the requirements of relevant data protection laws and the purpose for which the information is collected and used, taking into account legal and regulatory requirements to retain the information for a minimum period, limitation periods for taking legal action, good practice and our business purposes.

Cross border transfers of your personal information
The international aspects of our business means that your personal information might be transferred across national boundaries, including, potentially, to countries that do not require organisations by law to look after your personal information in the way in which you have come to expect in your own country. Where we transfer your personal information across national boundaries, we will protect your personal information by ensuring that those transfers are made in compliance with all relevant data protection laws. Generally, this means where we transfer your personal information to a third party that is located in a country which does not have adequate privacy protection, we will put in place a contract with the third party that includes the standard international data transfer contractual terms approved by the European Commission. If you would like further details of how your personal information is protected when transferred from one country to another then please email us at peopleservices@thalia.co.uk

Local differences
Whilst this notice describes the data protection practices adopted by us generally across the world, local data protection laws vary and some countries may place restrictions on our processing activities. This means our actual data protection practices in certain countries may vary from those described here in order to help us ensure we comply with local requirements.

Your rights
Contacting us and your rights If you have any questions in relation to our use of your personal information, please email us at peopleservices@thalia.co.uk. Under certain conditions, you may have the right to require us to:

provide you with further details on the use we make of your personal information
provide you with a copy of the personal information we hold about you
correct any inaccuracies in the personal information we hold about you
delete any of your personal information that we no longer have a lawful ground to use
where processing is based on consent, stop that particular processing by withdrawing your consent
object to any processing for marketing purposes, or processing based on public interest or our legitimate interests
restrict how we use your personal information whilst a complaint is being investigated
transfer your personal information to a third party in a standardised machine-readable format

Please note that some of these rights might be subject to limitations or exceptions. Your right to complain If you are not satisfied with our use of your personal information or our response to any request by you to exercise your rights, or if you think that we have breached any relevant data protection laws, then you have the right to complain to the authority that supervises our processing of your personal information or, where you are based in the EU, the data protection authority in your country. We view the UK data protection regulator, the Information Commissioner's Office (ICO), as our lead data protection supervisory authority. Details of the ICO can be found at https://ico.org.uk