ANGLO AMERICAN PLC APPLICANT PRIVACY NOTICE

1. INTRODUCTION

1.1 Anglo American plc and our associated companies ("Company", "we", "us" and "our") hold and process data on all applicants, interview candidates and third parties whose information you provide to us in connection with your job application (e.g. next of kin, emergency contact information and/or dependents) ("applicants" or "you" or "your").

1.2 The Company or relevant associated company of the Company to which you are submitting a job application will be the data controller of your personal data. In addition, where processing of personal data is undertaken by other associated companies of the Company for their own independent purposes, these associated companies may also be controllers of your personal data.

1.3 We take your data protection rights and our legal obligations seriously. Your personal data will be treated in a secure and confidential manner and only as set out below or otherwise notified to you in writing.

1.4 The following Privacy Notice describes the categories of personal data we may process, how your personal data is processed, for what purposes we process your data and how your privacy is safeguarded in the course of our relationship with you. It is intended to comply with our obligations to provide you with information about the Company's processing of your personal data under privacy laws.

1.5 If you have any questions about this Privacy Notice or would like to access the information it contains in a different format please contact our Data Protection Team at dataprotection@angloamerican.com.

2. PROCESSING OF PERSONAL DATA

The Company collects and processes your personal data for the purposes described in this Privacy Notice. "Personal data" means any information describing or relating to an identified or identifiable individual. An identifiable individual is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that individual.

3. WHAT DATA DO WE PROCESS?

3.1 We collect various types of personal data about you for the purposes described in this Privacy Notice including:

3.1.1 Personal details: your name, gender, nationality, civil/marital status, date of birth, age, personal contact details (e.g. address, telephone or mobile number, e mail), national ID number, immigration and eligibility to work information, driving licence, languages spoken; next of kin/dependent/emergency contact information, details of any disability and any reasonable adjustments required as a result, union affiliation and religious denomination;

3.1.2 Recruitment and selection data: skills and experience, qualifications, references, CV and application, interview and assessment data (including results of psychometric tests, if appropriate), information related to the outcome of your application, interview notes and records, details of any offer made to you;

3.1.3 Financial information: your bank details, tax information, NI number, student loan information and P45 details;

3.1.4 Vetting and verification data: vetting and verification information (e.g. results of credit reference check, global watch list check and a basic disclosure criminal record check relating to unspent convictions where carried out and permitted by applicable law) and right to work verification;

3.1.5 Role information: including job title, start date and salary;

3.1.6 Equality and diversity data: where permitted by law and provided voluntarily, data regarding gender, age, race, nationality, religious belief and sexuality (stored anonymously for equal opportunities monitoring purposes); and

3.1.7 Any other personal data which you choose to disclose to us during the course of your application whether verbally or in written form.

3.2 Certain additional information may be collected where this is necessary and permitted by local applicable laws.

4. SPECIAL CATEGORIES OF DATA

4.1 To the extent permitted by applicable laws the Company collects and processes a limited amount of personal data within the above data listed at 3.1 falling into special categories, sometimes called "sensitive personal data". This term means information relating to:

4.1.1 racial or ethnic origin;

4.1.2 political opinions;

4.1.3 religious or philosophical beliefs;

4.1.4 physical or mental health (including details of accommodations or adjustments);

4.1.5 trade union membership;

4.1.6 sex life or sexual orientation;

4.1.7 biometric and genetic data; and

4.1.8 criminal records and information regarding criminal offences or proceedings.

5. HOW DOES THE COMPANY COLLECT DATA?

5.1 The Company collects and records your personal data from a variety of sources, but mainly directly from you. You will provide this information directly to Human Resources, enter it into our systems (for example, the Company's job application portal) or the individuals with whom you interact during the job application process. In addition, further information about you will come from the individuals with whom you interact during the job application process.

5.2 We also obtain some information from third parties: for example, references from a previous employer, information from tax authorities, referrals from existing employees, or where we employ a third party to carry out a background check (where permitted by applicable law) or occasionally from clients.

5.3 Where we ask you to provide personal data to us on a mandatory basis, we will inform you of this at the time of collection and in the event that particular information is required by the contract or statute this will be indicated. Failure to provide any mandatory information will mean that we cannot carry out certain HR processes. For example, if successful in your application, if you do not provide us with your bank details we will not be able to pay you. In some cases it may mean that we are unable to continue with your application as the Company will not have the personal data we believe to be necessary for the effective and efficient administration and management of our future relationship with you.

5.4 Apart from personal data relating to you, you may also provide the Company with personal data of third parties, notably your dependents and other family members, for purposes of HR administration and management. Before you provide such third party personal data to the Company you must first inform these third parties of any such data which you intend to provide to the Company and of the processing to be carried out by the Company, as detailed in this Privacy Notice.

6. WHAT ARE THE PURPOSES FOR WHICH DATA IS PROCESSED AND WHAT IS OUR LEGAL BASIS FOR CARRYING OUT THE PROCESSING?

Your personal data are collected and processed for various business purposes, in accordance with applicable laws and any applicable collective bargaining agreements. We have set out in this Privacy Notice the purposes we may use your personal data for. Data may occasionally be used for purposes not obvious to you where the circumstances warrant such use. We may, where we think it is necessary, provide you with additional information to ensure that you understand how your personal data may be used.

6.1 The legal basis on which we process your personal data

6.1.1 Whenever the Company processes your personal data we do so on the basis of a legal basis or justification for that processing. Processing of special categories of data is always justified on the basis of an additional lawful condition. In the majority of cases, the processing of your personal data will be justified on one of the following basis:

6.1.1.1 The processing is necessary for compliance with a legal obligation to which the Company is subject (for example, disclosing the information to HMRC or any other relevant tax and social security authorities, avoiding unlawful discrimination, meeting statutory record keeping requirements or health and safety obligations); and/or

6.1.1.2 Where there is no legal obligation we will process your data where the processing is necessary in order to take steps at your request prior to entering into an employment contract or contract for services or similar (for example collecting bank details to pay your remuneration or processing information to provide you with the contractual benefits you are entitled to); and/or

6.1.1.3 Where the above two grounds do not apply we may process your personal data where the processing is necessary for the legitimate interests pursued by the Company, except where such interests are overridden by your interests or fundamental rights and freedoms which require protection of personal data. The Company considers that it has a legitimate interest in processing data for the purposes set out above. This is necessary to ensure fair and effective recruitment of suitable personnel and the effective reward, administration, support, development and management of applicants. This is important to ensure that the Company continues to meet its business objectives and goals both in the short and long term; maintains its reputation; and continues to attract and retain high calibre applicants.

6.1.2 We may on occasion process your personal data for the purpose of legitimate interests pursued by a third party, except where such interests are overridden by your interests or fundamental rights and freedoms which require protection of personal data (for example to meet the security requirements of our clients).

6.1.3 In exceptional circumstances where we have no legitimate interest in processing but you ask us to process data for a particular purpose we may carry out the processing on the basis of your consent. Where we rely on this we will make this clear at the time.

6.1.4 We have set out below the purposes we may use your personal data for and the legal basis we rely on in each case.

6.2 The purposes we use personal data for and the legal basis that applies

We have identified a number of purposes for collecting and processing your personal data. These are set out below together with the legal basis we rely on in each case:

No.

Purpose for processing

The lawful basis we rely on

  1.  

Recruitment and selection

Considering your suitability to work for us in the role you have applied for, comparing you to other candidates and making recruitment decisions

This processing is necessary for the compliance with legal obligations to which the Company is subject including the requirement to ensure we do not unlawfully discriminate in our recruitment decision.

Processing beyond legal compliance  is necessary for takings steps at your request to enter into a contract with you. Where you have applied to work for us we need to use your personal data to ensure that are suitable for the role you have applied for and to make an offer of employment to you where appropriate.

Additional processing is necessary for the purpose of the legitimate interests pursued by the Company.  The Company it has a legitimate interest in fully assessing applicants to ensure that only suitable and appropriate candidates are selected, to compare candidates and make a fair decision on the most appropriate candidate for the position.

  1.  

Pre-employment verification and screening

Appropriate pre-employment screening.

This processing is necessary for the compliance with legal obligations to which the Company is subject including  establishment of the right to work in the country in which you are employed.

Screening which is not legally required is necessary for the purpose of the legitimate interests pursued by the Company.  Company has a legitimate interest in ensuring that candidates for employment or engagement do not pose an unacceptable risk to the business or its customers and considers the verification carried out necessary to prevent crime and other unlawful acts and to protect the business and customers from fraud, dishonesty or incompetence.

  1.  

Offers of employment and on-boarding

Making job offers, providing contracts of employment or engagement and preparing to commence  your employment or engagement where you accept an offer from us

This processing is necessary for the compliance with legal obligations to which the Company is subject including the requirement to issue written particulars or terms of employment and the requirement not to unlawfully discriminate in the terms of any offer to you.

Additional processing is necessary to take steps to enter into the contract between you and the Company and to perform that contract because we will need information to make an appropriate offer to you and administer your employment contract if you join us.

The remainder of the processing is necessary for the purpose of the legitimate interests pursued by the Company.  The Company has a legitimate interest in ensuring the effective engagement of applicants on appropriate terms and conditions of employment and that there is a smooth transition into employment for successful candidates and that information supplied in the recruitment process which is relevant to ongoing employment is maintained.

  1.  

Future job opportunities

To contact you if you are not successful in your initial application should another potentially suitable vacancy arise during the six months following completion of the recruitment process for the role you originally applied for

This processing is necessary for the purpose of the legitimate interests pursued by the Company.

The Company has a legitimate interest in maintaining an appropriate pool of talent who have shown an interest in working for the Company and who are potentially suitable candidates for employment.  This will potentially benefit both initially unsuccessful candidates and the Company. It will contribute towards the Company continuing to meet its business objectives, maintain its reputation and attract high calibre employees.

  1.  

Recruitment feedback and complaints

To deal with any query, challenge or request for feedback received in relation to our recruitment decisions

This processing is necessary for the compliance with legal obligations to which the Company is subject including  ensuring that the Company is able to demonstrate its compliance with data protection laws and anti-discrimination laws

Beyond legal compliance processing is necessary for the purpose of the legitimate interests pursued by the Company.  The Company has a legitimate interest in being able to provide feedback to candidates and to be able to defend any challenge or claim made in connection with our recruitment decision.  This will assist the Company to avoid the risk of financial exposure or costs incurred through challenges to recruitment decisions and to maintain its reputation.

  1.  

Legal compliance

Complying with laws and regulation applicable to the Company (for example maternity or parental leave legislation, working time and health and safety legislation, taxation rules, worker consultation requirements, other employment laws, and regulation to which the Company is subject in the conduct of its business)

This processing is necessary for the compliance with legal obligations to which the Company is subject including those laws set out.

 

  1.  

Ensuring equality of opportunity

Monitoring programmes to ensure equality of opportunity and diversity with regard to personal characteristics protected under applicable anti-discrimination laws

This processing is necessary for the compliance with legal obligations to which the Company is subject including anti-discrimination laws.

Beyond the above processing is also necessary for the purpose of the legitimate interests pursued by the Company.  The Company has a legitimate interest in ensuring that it takes action to prevent discrimination and promote an inclusive and diverse workplace.

 

6.3 Additional legal basis we rely on where we process special category data

The special categories of personal data that are processed by the Company are set out above. Where we process special categories of data it will be justified by a condition set out at 6.2.1 above and also by one of the following additional conditions:

6.3.1 The processing is necessary for the purposes of carrying out the obligations and exercising the rights of you or the Company in the field of employment law, social security and social protection law, to the extent permissible under applicable laws;

6.3.2 The processing is necessary to protect your vital interests or of another person where you are physically or legally incapable of giving consent (for example in exceptional emergency situations, such as a medical emergency);

6.3.3 The processing is necessary for reasons of substantial public interest;

6.3.4 The processing is necessary for the establishment, exercise or defence of legal claims; or

6.3.5 In exceptional circumstances the processing is carried out subject to your explicit consent.

6.4 The purposes we use special category personal data for and the additional legal basis that applies

We have identified a number of purposes for collecting and processing your special category personal data. These are set out below together with the additional legal basis we rely on in each case:

No.

Purpose for processing

Additional lawful basis for special category data processing

  1.  

Making adjustments to the recruitment and selection process, as needed

This processing is necessary for the purposes of carrying out the obligations and exercising the rights of you or the Company in the field of employment law, social security and social protection law, to the extent permissible under applicable laws. In particular compliance with anti-discrimination legislation.

 

  1.  

Pre-employment verification and screening

.

We process this personal data on the basis of substantial public interest.

  1.  

Ensuring equality of opportunity

 

This processing is necessary for the public interest of ensuring equality of opportunity or treatment between people of different racial or ethnic origins, holding different religious or philosophical beliefs, people with different states of physical or mental health or people of different sexual orientation with a view to enabling such equality to be promoted or maintained.

 

6.5 We may seek your consent to certain processing which is not otherwise justified under one of the above basis. If consent is required for the processing in question, it will be sought from you separately to ensure that it is freely given, informed and explicit. Information regarding such processing will be provided to you at the time that consent is requested, along with the impact of not providing any such consent. You should be aware that it is not a condition or requirement of your employment to agree to any request for consent from the Company.

6.6 Processing data relating to criminal convictions and offences

Personal data relating to criminal convictions and offences will only be processed where authorised by applicable laws. For example, a criminal record check may be carried out on your recruitment.

7. AUTOMATED DECISION MAKING

In a limited number of cases, we may automatically reject applicants if they do not achieve a pass score in an assessment test that they take as part of the application process. If this applies, the candidate will be unsuccessful in their job application.

8. RETENTION OF PERSONAL DATA

8.1 The Company endeavours to ensure that personal data are kept as current as possible and that irrelevant or excessive data are deleted or made anonymous as soon as reasonably practicable.

8.2 We generally retain personal data for as long as is required to satisfy the purpose for which it was collected. This will usually be the period of your application and, if successful, your employment/contract with us plus the length of any applicable statutory limitation period following your departure, although some data, such as pension information, may need to be kept for longer. We may keep some specific types of data, for example, tax records, for different periods of time, as required by applicable law. However, some personal data may be retained for varying time periods in order to comply with legal and regulatory obligations and for other legitimate business reasons. Please see the Company's HR/Document Retention Policy for further information.

9. DISCLOSURES OF PERSONAL DATA

9.1 Within the Company, your personal data can be accessed by or may be disclosed internally on a need to know basis to:

9.1.1 local, regional and global Human Resources, including managers and team members;

9.1.2 local, regional and executive management responsible for managing or making decisions in connection with application to the Company or when involved in an HR process concerning your application to the Company;

9.1.3 system administrators; and

9.1.4 where necessary for the performance of specific tasks or system maintenance by applicants in the Company teams such as the Finance and IT Department and the Global HR information systems support team.

9.2 Certain basic personal data, such as your name, contact information, and any published skills and experience profile may also be accessible to other employees. The security measures in place within the Company to protect your data are set out below.

9.3 Your personal data is also accessed by third parties whom we work together with for providing us with services. For example:

9.3.1 Screening and referencing providers;

9.3.2 Assessment providers (e.g. for psychometric tests);

9.3.3 External software / data hosting providers;

9.3.4 Insurance providers;

9.3.5 Pensions providers;

9.3.6 External payroll providers;

9.3.7 Healthcare providers; and

9.3.8 Other benefits providers.

9.4 In addition, your data will be shared include tax authorities, regulatory authorities, the Company's bankers, IT administrators, lawyers, auditors, investors, consultants and other professional advisers. The Company expects such third parties to process any data disclosed to them in accordance with applicable law, including with respect to data confidentiality and security.

9.5 Personal data will also be shared with certain interconnecting systems such as the main HR system and local payroll and benefits systems. Data contained in such systems may be accessible by providers of those systems, their associated companies and sub contractors.

9.6 Where the third parties described above act as a "data processor" they carry out their tasks on our behalf and upon our instructions for the above mentioned purposes. In this case your personal data will only be disclosed to these parties to the extent necessary to provide the required services.

9.7 In addition, we may share personal data with national authorities in order to comply with a legal obligation to which we are subject. This is for example the case in the framework of imminent or pending legal proceedings or a statutory audit.

10. SECURITY OF DATA

The Company is committed to protecting the security of the personal data you share with us. The Company uses a variety of technical and organisational methods to secure your personal data in accordance with applicable laws.

11. INTERNATIONAL TRANSFER OF PERSONAL DATA

11.1 From time to time your personal data (including special categories of personal data) will be transferred to associated companies of the Company to process for the purposes described in this Privacy Notice. This will be applicable for example where the relevant company or a manager from that company is responsible for conducting or approving the relevant process or the data is part of a global directory where other individuals need to have access.

11.2 These associated companies or managers may be located within the European Union and elsewhere in the world (for example, South Africa and Australia).

11.3 Personal data may also be transferred to third parties (e.g. service providers or regulators as set out above), who may have systems or suppliers located outside the European Union.

11.4 As a result, your personal data may be transferred to countries outside of the country in which you are located or outside of the European Union to countries whose data protection laws may be less stringent than yours.

11.5 The Company will ensure that appropriate or suitable safeguards are in place to protect your personal data and that transfer of your personal data is in compliance with applicable data protection laws.

11.6 Where required by applicable data protection laws, the Company has ensured that service providers (including other Company associated companies) sign standard contractual clauses as approved by the European Commission or other supervisory authority with jurisdiction over the relevant Company exporter. You can obtain a copy of any standard contractual clauses in place which relate to transfers of your personal data by contacting dataprotection@angloamerican.co.uk.

11.7 You have a right to request a copy of any data transfer agreement under which your personal data is transferred, or to otherwise have access to the safeguards used. Any data transfer agreement made available to you may be redacted for reasons of commercial sensitivity. To request sight of these contact contacting dataprotection@angloamerican.co.uk.

12. YOUR RIGHTS AS A DATA SUBJECT

12.1 Right to access, correct and delete your personal data

12.1.1 The Company aims to ensure that all personal data are correct. You also have a responsibility to ensure that changes in personal circumstances are notified to the Company so that we can ensure that your data is up to date.

12.1.2 You have the right to request access to any of your personal data that the Company may hold, and to request correction of any inaccurate data relating to you. You furthermore have the right to request deletion of any irrelevant data we hold about you.

12.1.3 You can see and update some of this data yourself via the ESS/MSS portal. To amend data in relation to a job application, please log into our recruitment system, Page Up, via the Company’s careers page, or by contacting the recruitment team you have been liaising with.

12.2 Data portability

Where we are relying upon your consent or the fact that the processing is necessary for the performance of a contract to which you are party as the legal basis for processing, and that personal data is processed by automatic means, you have the right to receive all such personal data which you have provided to the Company in a structured, commonly used and machine readable format, and also to require us to transmit it to another controller where this is technically feasible.

12.3 Right to restriction of processing:

You have the right to restrict our processing of your personal data where:

12.3.1 you contest the accuracy of the personal data until we have taken sufficient steps to correct or verify its accuracy;

12.3.2 where the processing is unlawful but you do not want us to erase the data;

12.3.3 where we no longer need the personal data for the purposes of the processing, but you require them for the establishment, exercise or defence of legal claims; or

12.3.4 where you have objected to processing justified on legitimate interest grounds (see below) pending verification as to whether the Company has compelling legitimate grounds to continue processing.

Where personal data is subjected to restriction in this way we will only process it with your consent or for the establishment, exercise or defence of legal claims.

12.4 Right to withdraw consent

Where we have relied on your consent to process particular information and you have provided us with your consent to process data, you have the right to withdraw such consent at any time. You can do this by (i) in some cases deleting the relevant data from the relevant HR system (although note that in this case it may remain in back ups and linked systems until it is deleted in accordance with our data retention policy) or (ii) contacting your local Human Resources contact. It will only however be rarely that we rely on your consent to process personal data for your employment or engagement.

12.5 Right to object to processing justified on legitimate interest grounds

Where we are relying upon legitimate interest to process data, then you have the right to object to that processing. If you object, we must stop that processing unless we can either demonstrate compelling legitimate grounds for the processing that override your interests, rights and freedoms or where we need to process the data for the establishment, exercise or defence of legal claims. Where we rely upon legitimate interest as a basis for processing we believe that we can demonstrate such compelling legitimate grounds, but we will consider each case on an individual basis.

12.6 Right to object to automated decision making

You have the right to object to any decision that significantly affects you being taken solely by a computer or other automated process. In such a case, you have the right to obtain human intervention, to express your point of view, and to contest the automated decision.

12.7 Right to complain

You also have the right to lodge a complaint with a supervisory authority if you consider that the processing of your personal data infringes applicable law.

12.8 For further information regarding your rights, or to exercise any of your rights, please contact our Data Protection Team at dataprotection@angloamerican.co.uk.

13. ADDITIONAL PRIVACY NOTICES

We may undertake certain processing of personal data which are subject to additional Privacy Notices and we shall bring these to your attention where relevant.

14. NOTICE OF CHANGES

14.1 The Company may change or update this Privacy Notice at any time.

14.2 Should we change our approach to data protection, you will be informed of these changes or made aware that we have updated the Privacy Notice so that you know which information we process and how we use this information.

14.3 This Privacy Notice was last updated and reviewed on 21/05/2018.