In the course of our business as an executive search firm, we have acquired some information about you which we maintain on our systems. As we take your privacy seriously, this notice informs you about our processing of your data.
At Boyden, we work with top-tier clients to help them to find the best talent. We have identified you as someone who is potentially appropriate for an opportunity with one of our clients. By permitting us to retain your information, you enable us to connect you with clients seeking someone with your talents and skills.
If you object to further processing of your personal data based on Legitimate Business Interest by Boyden, please select the “I object to the processing of my data by Boyden” option below. Clicking this button will preclude any retention or use of your contact information by Boyden to share future opportunities with you. Any of your personal data currently stored, shall be deleted.
Should you wish to review our consent policy and open the door to exciting new career opportunities, please select the “I agree to further processing and request a consent link” option below.
Privacy Information
Protecting your privacy is important to Boyden Asia Pacific Limited, 19th Floor, 39 Wellington Street, Central Hong Kong, China, chinasingapore-privacy@boyden.com, +852 29141866 ("Boyden," "we," "us," or "our"). This Privacy Policy explains how Boyden collects, uses, and discloses the personal information as a controller and as joint controller with Boyden World Corporation, 3 Manhattanville Road, Suite 104, Purchase, NY 10577, United States of America, privacy@boyden.com, +1 914 747-0093.
The Data Protection Officer and [if required] data protection representative of Boyden according to Article 27 GDPR (EU General Data Protection Regulation) is Rechtsanwalt Nikolaus Bertermann (attorney at law), daspro GmbH, Kurfürstendamm 21, 10719 Berlin, Germany, phone +49 30 88 77 41 50, Email: boyden@daspro.de.
Please find below the most important information about typical data processing sorted by groups of data subjects. For data processing activities, which relate only to specific groups and processing activities controlled only by local Boyden offices, the obligation to provide information are met separately.
Where the term “data” is used in the text, in each case it refers only to personal data as defined in the GDPR.
(Effective March 18, 2021)
CONTENTS
A. GENERAL DATA PROCESSING PRACTICES
Protecting your privacy is important to Boyden World Corporation, 3 Manhattanville Road, Suite 104, Purchase, NY 10577, United States of America, privacy@boyden.com, +1 914 747-0093 ("Boyden," "we," "us," or "our"). This Privacy Policy explains how Boyden collects, uses, and discloses (“processes”) personal data on its own behalf and in conjunction with individual local Boyden offices, and any additional rights you may have under applicable privacy law. We and/or the local Boyden offices determine the purposes and means of the processing of personal data.
You can exercise your privacy and data protection rights by contacting privacy@boyden.com or your local Boyden office. Additional individual privacy and data protection rights are described in Parts B-F below, depending on the applicable law. Please note that we cannot respond to your request or provide you with personal data if we cannot verify your identity or authority to make the request and confirm the personal data relates to you. Thus, we may require that you submit additional personal data so that we can verify your identity. We will use such additional personal data submitted in connection with our verification process only to verify your identity and authority to make the request.
This Part A provides a general description of the processing of personal data by Boyden and local Boyden offices. The following Parts B-F of this Privacy Policy address specific local privacy regulations and amend this general description for the respective region.
Please find below the most important information about our typical data processing sorted by groups of data subjects and types of data processing. For data processing activities that relate only to specific groups, and processing activities controlled only by local Boyden offices, the obligations to provide information are met separately.
The terms “data”, “personal data” and “personal information” are used interchangeably in this policy, and in each case include any information relating to an identified or identifiable natural person.
We process personal information from or about the following categories of individuals, as more fully described in the sections below:
1. |
|
1.1 |
Web server log data |
1.1.1 |
In the past 12 months we have processed, and may continue to process, personal data from website visitors such as the IP address allocated to their device, the date and time of the request, the time zone, the specific page or file accessed, the HTTP status code and the data quantities transmitted; in addition, the website from which their request originated, the browser used, the operating system of their device and the language used. |
1.1.2 |
We obtain these categories of data directly and indirectly from activity on our website. For example, from submissions through our website portal or website usage details collected automatically. |
1.1.3 |
The purpose of the data processing of web server log data is the online presentation of Boyden and Boyden service. |
1.1.4 |
Web server log data is anonymized before storage. Web server log data will be deleted when it is no longer necessary for the purposes of processing. |
1.1.5 |
Web server log data are not passed on to third parties except under special circumstances. In the event of the suspicion of a crime or in investigative proceedings, data may be transmitted to the police and the public prosecutor’s office. We may also enter into service agreements with other businesses to perform services on our behalf, in particular to provide, maintain, and support IT systems. |
1.1.6 |
Use of the website without disclosure of web server log data is not possible. |
We use Matomo Cloud, a web analytics service of InnoCraft. Matomo Cloud uses small text files (“cookies”) on your device to enable us to analyse your visitor behaviour with a pseudonym. Information about your visitor behaviour stored in such cookies will be transferred to web servers of InnoCraft in Frankfurt, Germany and will be stored there. For this website the function anonymize IP has been activated, therefore Matomo Cloud will automatically anonymize your IP address. InnoCraft will use the information transferred as a processor to analyse your visitor behaviour, to provide reports about web activities and to provide further services in relation to website use and internet use to the controller. Your IP address will not be combined with other data of InnoCraft. You may prevent the storage of cookies (including your IP address) by using appropriate settings in your browser or object to further processing by downloading and installing a browser plugin. Alternatively you may store an opt-out cookie on your device to prevent future analysis of your visitor behaviour. You may also opt-out to prevent this website from aggregating and analyzing your actions on this website by opting out from Matomo cookies by clicking here. Doing so will protect your privacy, but will also prevent Boyden from learning from your actions and creating a better experience for you and other users. |
|
In the past 12 months, we have processed, and in the future may continue to process, personal data about website visitors such as HTTP data, type and version of your Internet browser, the operating system used, the web page, the web page visited previously (referrer URL), date and time of the visit, device data regarding information regarding their interaction with an Internet Web site (Data generated by the web analytics tool Matomo Cloud and assigned to their device (“client ID”)), measurement data (device related raw data) and Matomo Cloud report data (reports based on the analysis of the raw data). On our website a so-called IP anonymization is activated for the use of the web analysis tool Matomo Cloud. |
|
1.2.2 |
We automatically obtain these categories of data directly from you when you browse our website. |
1.2.3 |
The purpose of the data processing is to increase the efficiency of our use of resources for our website and our advertising measures and the satisfaction of our visitors by (usage-based) optimization of our website by measuring the use of our website and (usage-based) optimization of our advertising measures by measuring the success of the advertising media we use in our website (monitoring of advertising media success). |
1.2.4 |
The data is anonymized before storage. The data will be deleted after 14 months. |
The recipient of the data is InnoCraft (Operator of Matomo Cloud), 150 Willis St, 6011 Wellington, New Zealand. Data is processed only in the Matomo Cloud data center in Frankfurt, Germany. |
|
1.2.6 |
There is no obligation on the data subject to provide their data. If you opt-out from Matomo Cloud web analysis as per section 1.2, we will not be able to carry out web analytics using Matomo Cloud. |
2 |
|
When we or a local Boyden office identify a potential candidate, we may collect business card data about such potential candidate from publicly accessible sources, and we and the local Boyden office jointly determine the purposes and means of the processing of such data and have entered into an agreement for that purpose. According to that agreement, the local Boyden office is responsible to ensure the fulfilment of the potential candidate’s rights and will inform them in a privacy notice about the contact details of the local office and the publicly accessible sources of the data. However potential candidates may contact either us or the local Boyden office regarding any claims or complaints. |
|
2.1 |
In the past 12 months, we have processed, and in the future may continue to process personal data about potential candidates such as name, postal address, email address, telephone number, employment, employment history and title. |
2.2 |
We collect data about potential candidates from the following publicly accessible sources: Public business websites, services such as LinkedIn, Xing or other business press or publications. |
2.3 |
Data about potential candidates are processed for the purposes of providing executive search services to potential employers worldwide and identifying salary, market and hiring trends by analyzing aggregated data. |
2.4 |
Data about potential candidates will be deleted upon the potential candidate’s request or in accordance with Boyden's global data retention policy. |
2.5 |
Data about potential candidates is shared with Boyden offices worldwide upon request. A full list of Boyden offices is provided here. |
3 |
|
Whenever an individual authorizes Boyden to list them as a candidate for job offerings, we and the local Boyden office jointly determine the purposes and means of the processing of such candidate’s data and have entered into an agreement for that purpose. According to the agreement, the local Boyden offices are responsible to ensure the fulfilment of the candidate’s rights. However all candidates may contact either us or the local Boyden office regarding any claims or complaints. |
|
3.1 |
In the past 12 months, we have processed, and in the future may continue to process personal data about candidates, such as name, signature, postal address, email address, telephone number, education, employment, employment history, bank account number, race, color, age (40 years and older), ancestry, national origin, citizenship, religion or creed, medical condition, physical or mental disability, sex (including gender), sexual orientation, current and/or past employment history including performance evaluations, education records, files, documents, and other materials directly related to a student maintained by an educational agency or institution or by a person acting for such an agency or institution, such as grades, transcripts, personal interests, hobbies and background check information (like identity verification, criminal, civil and regulatory judgements, financial and credit checks), health insurance information, information used to create a profile about a candidate reflecting the candidate’s intelligence and abilities or any other details a candidate may choose to share with us. |
3.2 |
Data about candidates may be collected from the candidate, from publicly accessible sources like websites (e.g. Company or private websites, LinkedIn) and third parties that the candidate or their testimonials have named as potential references. |
3.3 |
Data about candidates are processed for the purpose of providing the candidates with employment opportunities and job or career related information as well as providing executive search services to potential employers worldwide and identifying salary, market and hiring trends by analyzing aggregated data. |
3.4 |
The data retention period is seven calendar years from the last completion of the client engagement or documented contact with the candidate, whichever is later. |
3.5 |
Data about candidates are shared with Boyden offices worldwide and with potential employers to fulfill clients' or candidates' requests. A full list of Boyden offices is provided here. |
3.6 |
Candidates are not obliged to provide personal data. Without such personal data, however, we will not be able to provide candidates with employment opportunities. |
4 |
|
In the case where individuals have given their consent to participate in surveys or studies (“Participants”), Boyden and the local Boyden offices are processing their personal data for surveys and studies. We and the local Boyden office jointly determine the purposes and means of the processing of Participant data and have entered into an agreement for that purpose. According to the agreement, the local Boyden offices are responsible to ensure the fulfilment of Participant rights. However all Participants may contact either us or the local Boyden office regarding any claims or complaints. |
|
4.1 |
In the past 12 months, we have processed, and in the future may continue to process personal data about Participants, such as profile data requested by survey-service providers like Prophet (ID, name, language, due date of the questionnaire, reminder date of the questionnaire, email address, dates invitation sent, dates notifications of reminders sent, date profile sent, profile details) and survey reports (answers to the questionnaires). Some statistical studies are completely anonymous. |
4.2 |
The personal data about Participants is provided by the Participant or assigned by the survey-service provider. |
4.3 |
Participant personal data are processed for the purpose of conducting and evaluating surveys using questionnaires for business development reasons. |
4.4 |
The data retention period is seven calendar years from the last participation of the surveys or studies. |
4.5 |
We use service providers like Prophet Profiling Ltd. as data processors which are creating individual profiles for the participants and are conducting and evaluating the questionnaires on our behalf. |
4.6 |
Participation in surveys and studies is voluntary. Anyone who does not wish to participate in a survey or study can contact Boyden to discuss alternatives. |
5 |
|
When we or a local Boyden office receive personal data from a candidate or other source about the candidate’s reference, we and the local Boyden office jointly determine the purposes and means of the processing of the data about the candidate’s reference and have entered into an agreement for that purpose. According to the agreement, the local Boyden office is responsible to ensure the fulfilment of the rights of the candidate’s reference and will inform the personal reference in a privacy notice about our contact details and source of their data. However all references of candidates may contact either us or the local Boyden office regarding any claims or complaints. |
|
5.1 |
In the past 12 months, we have processed, and in the future may continue to process personal data about references of candidates, such as name, postal address, email address, telephone number, employment, employment history, position, or any other details that the candidate or the candidate’s reference chooses to share with us. |
5.2 |
Sources of data about a candidate’s reference are the candidate, another reference, or publicly accessible sources like public business websites, services such as LinkedIn, Xing or other business press or publications. |
5.3 |
Data about a candidate’s reference are processed for the purpose of providing executive search services to employers and candidates. |
5.4 |
The data retention period is seven calendar years from the last completion of the client engagement or documented contact with the candidate who named the data subject as a reference, whichever is later. |
5.5 |
We may also enter into service agreements with other businesses to perform services on our behalf, in particular to provide, maintain and support IT systems. |
6 |
|
Boyden and the local Boyden office may process personal data regarding service providers, business partners and their employees. |
|
6.1 |
In the past 12 months, we have processed, and in the future may continue to process personal data about service providers, business partners and their employees, such as name, title, postal address, email address, telephone number, employment, employment history and any other details that they later choose to share. |
6.2 |
Data about service providers, business partners and their employees may be collected from the applicable service provider, business partner, or their employees, or from publicly accessible sources like websites (e.g. Company or private websites, LinkedIn). |
6.3 |
We process data about service providers, business partners and their employees for the purpose of preparation and performance of the contractual relationship and for the fulfilment of legal requirements. |
6.4 |
All contractual data, content of communications and data relevant for accounting are stored in accordance with the Boyden Global Retention Policy. |
6.5 |
Recipients of data about service providers, business partners and their employees may include banks for the processing of payments. Public authorities and offices may receive data within the scope of their duties, insofar as we are obligated or entitled to transmit data. Moreover in specific cases data may be transmitted to a collection of service providers, legal advisors and courts. We may also enter into service agreements with other businesses to perform services on our behalf, in particular to provide, maintain and support IT systems. |
6.6 |
Processing of the contact data from service providers and business partners and their Employees is necessary in order to perform the contract or order. If the data are not provided, the contract cannot be established or carried out. The provision of data is required for prospective service providers, business partners and their employees. The communication is not possible without the data. |
7 |
|
Boyden and the local Boyden office may process personal data regarding Business Contacts and Communication Partners. |
|
7.1 |
In the past 12 months, we have processed, and in the future may continue to process personal data about our business contacts and communication partners, such as name, postal address, email address, telephone number, employment, title or any other details that they later choose to share with us. |
7.2 |
We obtain these categories of personal information from our business contacts and communication partners, from our clients or their agents, and from third-parties that interact with us in connection with the services we perform. |
7.3 |
We process the data from prospective business contacts and communication partners for the purpose of communication with them. |
7.4 |
Inquiries and communication data are automatically deleted after 10 years. |
7.5 |
We may also enter into service agreements with other businesses to perform services on our behalf, in particular to provide, maintain and support IT systems. |
7.6 |
The provision of data is required for prospective business partners and communication partners. The communication is not possible without the data. |
B. INFORMATION FOR EUROPEAN UNION RESIDENTS
Provided the EU General Data Protection Regulation (GDPR) applies to our processing of your data according to Article 3 GDPR, in particular if your data is processed by a Boyden office in the European Union or if you are in the European Union, the following conditions apply to you:
1 |
|
The Data Protection Officer and data protection representative of Boyden and Boyden’s local offices according to Article 27 GDPR (EU General Data Protection Regulation) is Rechtsanwalt Nikolaus Bertermann (attorney at law), daspro GmbH, Kurfürstendamm 21, 10719 Berlin, Germany, phone +49 30 88 77 41 50, Email: boyden@daspro.de. |
|
2 |
|
2.1 |
The legal basis for the processing of your data under GDPR is as follows:
|
2.2 |
The foregoing legal bases for the processing of your data are defined in GDPR as follows: “consent” is specified in Article 6(1)(a) GDPR, “contract” is specified in Article 6(1)(b) GDPR, “legal obligations” is specified in Article 6(1)(c) GDPR and “legitimate interest” is specified in Article 6(1)(f) GDPR. |
3 |
|
Data may be shared with some Boyden offices located outside of the EU. All Boyden offices have entered into EU Standard Contractual Clauses (SCC) and set up internal privacy and data collection policies. Boyden and local Boyden offices have updated their contracts and have implemented additional safeguards after the Schrems II decision of the ECJ (SCC plus) to protect the data. You may request a copy of the SCC from us or a Boyden office at any time. Potential employers may be located outside of the EU and may not have adopted appropriate or suitable safeguards. |
|
4 |
|
No change in the processing purposes described in Section A is planned. |
|
5 |
|
No automated decision-making (Article 22 GDPR) takes place. |
|
6 |
|
You have the following rights under GDPR:
|
C. INFORMATION FOR CALIFORNIA RESIDENTS
Provided that you are a resident of California and the California Consumer Privacy Act (CCPA) applies to our processing of your personal information, the following conditions apply to you:
1 |
|
1.1 |
During the past twelve months, we have collected personal information that falls under the below listed California-designated categories of personal information. For each category listed below, you can find the sources of the data, the purposes for which it is collected, and the third parties with whom it is shared in Part A of this Privacy Policy.
|
2 |
Disclosure or Sale of Personal Information in Past 12 Months |
2.1 |
In the preceding 12 months, we have disclosed or sold to third parties the categories of personal information specified in Part A above. |
2.2 |
We do not sell the personal information of minors under 16 years of age without affirmative authorization. |
3 |
|
3.1 |
Rights to Know. You have the right to request that we disclose to you what personal information we collect, use, disclose, and sell about you. Specifically you have the right to request that we disclose:
|
3.2 |
Right to Request Deletion. You have the right the right to request the deletion of your personal information that we have collected or maintained, subject to certain exceptions; |
3.3 |
Right to Opt-Out of Sale of your Personal Information. You have the right the right to opt-out of the sale of your personal information by us, subject to certain exceptions; |
3.4 |
Right to Non-Discrimination. You have the right the right not to receive discriminatory treatment by us for the exercise of any of the foregoing privacy rights. |
4 |
|
4.1 |
Authority to Make a Request: Only you, or someone legally authorized to act on your behalf, may make a request related to your personal information. You may also make a request on behalf of your minor child. |
4.2 |
How to Submit a Request to Know or Delete: To submit a request under any of your Rights to Know or the Right to Request Deletion, you can visit our website request page, or call us at +1 (855) 426-9336. You will also need to satisfy the verification process requirements described below. You may make up to two requests in any 12-month period. Please note that we cannot respond to your request or provide you with personal information if we cannot verify your identity or authority to make the request and confirm the personal information relates to you, in accordance with the verification process described below. |
4.3 |
How to Submit a Request to Opt-Out of Sale: To submit a request to Opt-Out of the Sale of your Personal Information, you can visit our website opt-out request page or call us at +1 (855) 426-9336. Once you make an opt-out request, we will wait at least twelve (12) months before asking you to reauthorize personal information sales. However, you may change your mind and opt back in to personal information sales at any time by going to our website. |
4.4 |
Process for Verifying Requests to Know or Delete: As part of our verification process, we may require that you submit additional personal information so that we can verify your identity. If we do so, we will use any additional personal information submitted in connection with our verification process only to verify your identity and authority to make the request. Making a consumer request does not require you to create an account with us. We will only use personal information provided in a consumer request to verify the requestor's identity or authority to make the request. |
D. INFORMATION FOR NEVADA RESIDENTS
Provided that you are a resident of Nevada and the Nevada Consumer Privacy Law applies to our processing of your data, the following conditions apply to you:
1 |
|
Nevada residents have the right to request that we not make any sale (as that term is defined the in the Nevada Consumer Privacy Law) of certain categories of personal data that we have collected or will collect about you. |
|
2 |
|
We do not sell the personal information of any Nevada residents, as that term is defined in the Nevada Consumer Privacy Law. |
E. INFORMATION FOR CANADA RESIDENTS
Provided you are a resident of Canada, the following conditions apply to you:
1 |
|
By using our services, submitting information to us in connection with our services, by interacting with us, and by visiting, interacting with or using our website, you are providing your consent to the processing of personal data as set out in this Privacy Policy. You may withdraw consent at any time, subject to legal or contractual restrictions and reasonable notice. If you withdraw your consent, we may not be able to provide you with the requested services, and it may impact the functionality of our website. |
|
2 |
|
You have the right to access and rectify the personal data we hold about you. You can request access or rectification by contacting us at as described under “Contact us” below. |
|
3 |
|
Data about potential candidates is shared with Boyden offices worldwide upon request and personal data we handle may be stored or processed on our behalf by other Boyden offices. A full list of Boyden offices is provided here. Some of our service providers may also access, process or store your personal data outside of the country where we are located and where you reside. Such data may therefore may be available to government authorities under lawful orders and laws applicable in such foreign jurisdictions. |
|
4 |
|
If you have questions about this Privacy Policy and our data-handling practices, you may contact our Data Protection Team at privacy@boyden.com. |
F. INFORMATION FOR TURKEY RESIDENTS
Provided you are a resident of Turkey and the Turkey data protection legislation (TDPL) applies to our processing of your personal information, the following conditions apply to you:
1 |
|
The legal basis for the processing of your data under TDPL is as follows:
The foregoing legal bases for the processing of your data are defined in TDPL as follows: “consent” is specified in Article 5(1) TDPL; processing of personal data belonging to the parties of a contract, is necessary provided that it is directly related to the conclusion or fulfilment of that contract according to Article 5 (2) lit. c) TDPL; processing is mandatory for the controller to be able to perform his legal obligations according to Article 5 (2) lit. ç) TDPL (Legal obligations of employment agencies: Art. 17 and 19 of Law No. 4904) ; data concerned is made available to the public by the data subject according to Article 5 (2) lit. d) TDPL; |
|
2 |
|
You have the following rights according to Article 11 TDPL: |
|
3 |
|
Data about Candidates and Potential Candidates are shared with our Business Partners and Prospective Employers for purpose of making an employment agreement according to Articles 9 and 5 TDPL and the legal obligations according to Art. 17 and 19 of Law No. 4904 . Boyden also shares the personal data of the data subjects to global database of Boyden, Filefinder, with the consent of the data subjects, for the storage purposes according to Article 9 TDPL. |
|
4 |
|
If you have questions about this Privacy Policy and our data-handling practices, you may contact our Data Protection Team at privacy@boyden.com. |