Privacy notice

Introduction

This Privacy Notice relates to the personal data we hold in relation to our customers, potential customers, visitors of our website, research participants, and other parties with whom we do or want to do business or interact with.

We (“Heywood”) are committed to protecting the privacy of these parties, and the information we hold about them. We hold information about individuals in order for us to provide, improve or develop our products and services, which may involve, for example:

• Communications relating to product updates, for example core software and calculations releases, annual allowance guidance, etc.
• Communications relating to feedback and future developments
• Communications relating to our corporate website and our Altair or other product portals
• Invitations to training sessions, conferences, webinars, roundtable discussions and/or other events, held ‘in-person’ or via the Internet
• Information about our products and services, (both new and existing)
• Opportunities to complete surveys, take part in research or enter competitions or other promotions.

Information that we hold about customers and other parties with whom we do business will be used only in accordance with this Privacy Notice.

We are committed to complying with the UK General Data Protection Regulation (“UK GDPR”) and the Data Protection Act 2018 (“DPA 2018”). This Privacy Notice sets out your rights, and the basis by which we collect, use, and disclose personal data. We will always be transparent about how we process personal data.

Heywood Limited, registered at Second Floor, 3 Barrington Road, Altrincham, Greater Manchester, WA14 1GY, UK, is the Data Controller for your personal information.

The person with ultimate responsibility for Data Protection is Chris White, Head of Standards and Compliance, who can be contacted via dataprotection@heywood.co.uk.

If you are a job applicant – please visit here for our Privacy Notice for your data.

How do we collect information?

We collect information about you in various ways, including:

• Information that we ask for, and you provide to us, that is necessary for us to supply your business with our software, support, and other related services
• When you opt to submit personal information, in order for us to send you further information or email alerts; when you request to view certain content, such as white papers, or when you register for an event, conference or webinar
• Information which is collected and stored during normal use of our websites and portals, such as your IP address and the pages you visited.

What information do we collect, why and what is the lawful basis?

Your rights

You are entitled to know whether we hold personal data about you and, if we do, you will have the following rights:

• the right of access to copies of your personal data;
• the right to rectify any of your personal data you think may be inaccurate;
• the right to have your personal data deleted in certain circumstances;
• the right to restrict the processing of your personal data in certain circumstances;
• the right to object to processing in certain circumstances;
• the right to data portability in certain circumstances.

You can also choose to manage any marketing communications you receive by following the opt-out instructions contained in emails that we send to you. In such cases, we will retain the minimum personal data necessary to record that you opted out, in order to avoid contacting you again.

Please contact dataprotection@heywood.co.uk if you would like to:

• find out more about your rights and your personal data;
• object to us processing your personal data; and/or
• opt out of certain communications, such as marketing communications.

Who will the information be shared with?

We will not share your personal information with any third party that intends to use it for their own direct marketing purposes, unless we have specifically informed you and you have given us specific permission to do this.

We may use third parties, such as service providers, agents or contractors to provide us with administration systems, such as those used to provide customer relationship management services, data centres, software support services, finance and billing services, marketing platforms, software development tracking services, training programmes, event registration services, and online advertisements.

These third parties may come into contact with your personal information in the course of providing their services to us. They must provide equivalent levels of security for your personal information as Heywood and, where required, be bound by a data processing or sharing agreement to keep your personal information private, secure and to process it only at our specific instruction.

Where might you transfer my information outside the UK/EEA?

Most of our systems that would store your information are based in the UK/EEA however certain third-party suppliers that we use may store certain personal information outside of the UK/EEA. Where this is the case, we will always ensure that all relevant Data Protection laws including the UK GDPR are complied with, and that appropriate measures are in place to keep your personal data secure.

How long do you keep hold of my information?

We have a Data Retention Policy which mandates how long records, including personal data, are retained. Retention periods are determined by legislation and our business requirements. At the end of any retention period, we will delete your personal data.

In most cases we will hold your data for up to three years after last contact, unless we have a legitimate business need or regulatory obligation which requires that we hold this data for a longer period of time. For example, if your business has a contract with us, we will retain the necessary information, including contact details, for 7 years following the end of any such contract in line with HMRC requirements and our legitimate business need to hold all information in the event of a contractual claim.

All information will be stored securely on our systems. Our Data Retention policy is available upon request via dataprotection@heywood.co.uk.

Security

We are committed to ensuring that your information is secure. In order to prevent unauthorised access or disclosure, we have put in place suitable physical, electronic and managerial procedures to safeguard and secure the information we collect online.

Heywood is certified to ISO 27001, an independent security standard which sets a framework for establishing, operating, reviewing and improving Information Security Management. Protecting information is vital, and achieving the high standards required for ISO 27001 reaffirms our commitment to do so.

Google Analytics

We may use Google Analytics to collect information about visitor behaviour on our website. This stores information about what pages you visit, how long you are on the site, how you got here and what you click on. This data does not contain personally identifiable information and so you cannot be identified from it. We do not make, and do not allow Google to make, any attempt to find out the identities of those visiting our website.

You can choose to opt-out of Google Analytics by notifying us using the ‘Contact Us’ form on our website.

Social media

Our sites include social media features, such as Facebook, Google, and Twitter 'Share' buttons. These features may collect your IP address, which page you are visiting on our site, and may set a cookie to enable the feature to function properly. Your interactions with these features are governed by the privacy policy of the company providing them.

People who email us

We use Transport Layer Security (TLS) to encrypt and protect email traffic. If your email service does not support TLS, you should be aware that any emails we send or receive may not be protected in transit.

We will also monitor any emails sent to us, including file attachments, for viruses or malicious software. Please be aware that you have a responsibility to ensure that any email you send is within the bounds of the law.

The right to complain

If you have any concerns or complaints regarding the processing of your personal data, or our compliance with data protection laws, please contact our Head of Standards and Compliance via dataprotection@heywood.co.uk.

Please provide as much detail as possible, along with any supporting documents or communications, so we can understand and investigate your concerns.

How we handle your complaint

We will acknowledge it as soon as possible (within 30 days of receipt) and following investigation, provide a full response and outcome. We may also need to verify your identity and will look to do this when we send our acknowledgment of your complaint.

We will investigate the issue by reviewing relevant records and speaking with people where needed.

Information Commissioner’s Office

You also have the right to lodge a complaint with the Information Commissioner’s Office at any point, including if you’re not satisfied with how we have handled or responded to your complaint. Their contact details are:

• www.ico.org.uk
• 0303 123 1113
• Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF.

Changes to our Privacy Notice

We may change this notice from time to time.

This Privacy Notice is effective from June 2026.

Job applicant privacy notice

Introduction

As defined by the UK General Data Protection Regulation (UK GDPR) Heywood Limited (Heywood; we) is the Data Controller and ultimately responsible for ensuring the data you provide is kept secure, processed correctly and that you understand your legal rights in relation to the data you provide.

The person with ultimate responsibility for Data Protection is Chris White, Head of Standards and Compliance, who can be contacted via dataprotection@heywood.co.uk.

The recruitment software we use via this website is supplied by IRIS Software Group Limited, who acts as a Data Processor and processes your data in accordance with our instructions.

Purpose and lawful basis for processing

Our purpose for processing this information is to assess your suitability for a role you have applied for and to help us develop and improve our recruitment process.

The lawful bases we rely on for processing your personal data as a job applicant are:

• where necessary to perform a contract or to take steps at your request, before entering a contract;
• where it is in our legitimate interests;
• as required by our legal obligations e.g., to carry out right to work checks or under the Equality Act 2010 where you provide any information about reasonable adjustments.

The lawful basis we rely on to process any information you provide as part of your application which is special category data, such as health, religious, sexual orientation or ethnicity information is that necessary for the purposes of our obligations in employment legislation and the safeguarding of your fundamental rights such as health, safety, and welfare.

What information do we collect from you and why?

We collect information that is specifically provided by you as part of an application process. We will collect the following (but not limited to):

• Name, address, email, telephone number
• CV/application form
• EDI monitoring information (defined as special category data) - this information is purely for statistical analysis and monitoring purposes
• Answers to application/screening questions
• Any other information you wish to provide in support of your application.

The information we request is used to assess your suitability for employment and/or carry out statistical analysis of recruitment. Our lawful bases that we rely on to process your personal data are processing necessary to perform a contract or to take steps at your request, before entering a contract, and processing for the purpose of our legitimate interests.

We do not collect more information than we need to fulfil our stated purposes and will not retain it for longer than is necessary. You need not provide the information that we request, but it might affect your application if you do not.

What will we do with the information you provide?

All the information you provide during the process will be used only for the purpose of progressing your application, or to fulfil legal or regulatory requirements, if necessary.

We will not share any of the information you provide during the recruitment process with any third parties for marketing purposes, or store any of your information outside the European Economic Area. The information you provide will be held securely by us and/or our data processors, whether the information is in electronic or physical format.

We will use the contact details you provide to us to contact you to progress your application. We will use the other information you provide to assess your suitability for the role for which you have applied.

How do we obtain your information?

We will receive your information if you apply for a position as listed on job boards, or if you have provided details to a recruitment agency that we work with. You may also provide information via our website or by way of a referral from a current Company employee. Additionally, further information may be obtained if you attend our offices during the recruitment process.

Application stage

When you apply for a position, we may ask you for your personal details, including name and contact details. We may also ask you about your previous experience, education, and for answers to questions relevant to the role for which you have applied.

Assessments

We might ask you to: complete tests and/or to attend an interview, or a combination of these. Information will be generated by you and by us. For example, you might complete a written test, or we might take interview notes. We also have CCTV in our offices for security purposes. All information is held by Heywood.

If you are unsuccessful following assessment for the position for which you have applied, we may ask if you would like your details to be retained in our talent pool for a period of six months. If you say yes, we may proactively contact you should any further suitable vacancies arise.

Conditional offer

If we make a conditional offer of employment, we will ask you for information so that we can carry out pre-employment checks. You must successfully complete pre-employment checks to secure your offer. We are required to confirm the identity of our employees, and their right to work in the United Kingdom.

We may use third party providers for this. If we do so, we will share your name and email address with them for this purpose. Their privacy policies are available at:

https://www.security-vetting.co.uk/privacy-policy/

https://www.yoti.com/privacy/identity-verification-ukdiatf/

https://www.experian.co.uk/privacy/privacy-policies#businessprivacypolicy

You will be asked to provide various documentation to confirm your identity and right to work directly to us or our providers. We will take copies or be provided with copies and will retain these in line with our Data Retention Policy (a copy of which is available upon request to dataprotection@heywood.co.uk).

Your referees will be contacted, using the details you provide, directly to obtain references and any educational information may also be verified.

How long is your data held for, where is it stored and who has access?

If you are unsuccessful, we may hold your data for a period of up to 12 months, after which your data will be deleted or disposed of. If you are successful and become an employee, you will be provided with an employee privacy notice for the data you share, or we otherwise process during the course of your employment.

We store the data on your application record, in HR management systems and on other IT systems (including email).

Our HR (People) team will have access to all information provided. Interviewers, managers, and IT staff will also have access if necessary for the purpose of the application process or their roles.

Your rights

You are entitled to know whether we hold personal data about you and, if we do, you will have the following rights:

• right of access to copies of your personal data;
• right to rectify any of your personal data you think may be inaccurate;
• right to have your personal data deleted in certain circumstances;
• right to restrict the processing of your personal data in certain circumstances;
• right to object to processing in certain circumstances;
• right to data portability in certain circumstances.

Please contact dataprotection@heywood.co.uk if you would like to find out more about your rights and your personal data.

Use of data processors

We may use data processors are third parties who provide elements of our recruitment service for us. We have contracts in place with all of our data processors, and your personal data will only be processed in line with our instructions.

Use of job boards and recruitment agencies

We may use job boards and recruitment agencies to advertise/manage our vacancies. Any applications made by you through these boards and agencies are initially governed by their privacy notices and the terms and conditions as specified by them. Once you apply via a job website and submit your CV/application, we will have access to any personal data submitted. Recruitment agents will submit your details and CVs to us in line with their own procedures.

Automated decision making

We may use some automated screening tools as part of the application process. The answers you provide to one or more of the questions (excluding any special categories/EDI questions) may result in your application being automatically declined. For example, you will usually be asked to confirm whether you have a right to work in the UK. If you select no, your application will not be taken further as we cannot provide visa sponsorship or work opportunities to those who do not have the right to work in the UK.

This technology is used to help us manage the high volume of applications we receive and can assure applicants the same outcome would occur if we manually reviewed your application. The reason for the decline will be made available to you in your candidate account.

The right to complain

If you have any concerns or complaints regarding the processing of your personal data, or our compliance with data protection laws, please contact our Head of Standards and Compliance via dataprotection@heywood.co.uk.

Please provide as much detail as possible, along with any supporting documents or communications, so we can understand and investigate your concerns.

How we handle your complaint

We will acknowledge it as soon as possible (within 30 days of receipt) and following investigation, provide a full response and outcome. We may also need to verify your identity and will look to do this when we send our acknowledgment of your complaint.

We will investigate the issue by reviewing relevant records and speaking with people where needed.

Information Commissioner’s Office

You also have the right to lodge a complaint with the Information Commissioner’s Office at any point, including if you’re not satisfied with how we have handled or responded to your complaint. Their contact details are:

• www.ico.org.uk
• 0303 123 1113
• Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF.

Changes to our Privacy Notice

We can exercise the right to update this policy as and when required. 

This privacy notice is effective from June 2026.

North America privacy notice

Introduction 

This Privacy Notice explains how Heywood (US) Inc and its affiliates ("Heywood," "we," "our," or "us") collect, use, disclose, and otherwise process personal information relating to:

• Visitors to our websites;
• Prospective customers;
• Customers and their representatives;
• Users of our software products and services;
• Individuals who interact with us in a business capacity;
• Event attendees and webinar participants;
• Other individuals whose personal information we collect directly.

This Privacy Notice applies to personal information collected online and offline throughout the United States and Canada unless a separate privacy notice applies.

Who we are

Heywood (US) Inc. a company registered in the State of Delaware, of 103 Foulk Road, Suite 202, Wilmington, Delaware 19803, USA. Our parent company is Heywood Limited, a company registered in England and Wales.

As Heywood Limited oversees all processes of Heywood (US) Inc. and Heywood Limited is subject to UK privacy laws, this notice should also be read in conjunction with Heywood Limited’s privacy notice.

Scope of our role

Depending on the circumstances, Heywood may act in different capacities when processing personal information.

Business / Controller

Heywood acts as a business, controller, or equivalent role when processing personal information for its own purposes, including:

• Operating and administering our websites;
• Managing customer and supplier relationships;
• Marketing and business development activities;
• Event and webinar administration;
• Product development and improvement;
• Security monitoring and fraud prevention;
• Contract administration;
• Compliance with legal obligations.

Service Provider / Contractor / Processor

When providing software and related services such as hosting, support and maintenance to pension plans, retirement systems, governmental entities, employers, or other customers, Heywood generally processes personal information solely on behalf of and under the instructions of those customers.

In those circumstances:

• Our customer determines the purposes and means of processing;
• We process information pursuant to contractual obligations;
• We act as a service provider, contractor, processor, or equivalent role under applicable law.

Information we process on behalf of our customers

A significant portion of the personal information processed by Heywood relates to pension administration services provided to pension plans, retirement systems, local government entities, employers, and other institutional customers.

In providing our software and related services, Heywood generally processes personal information solely on behalf of and under the instructions of the applicable customer.

The categories of information that may be hosted or otherwise processed on behalf of our customers include:

• Pension member and beneficiary records;
• Employment and payroll information;
• Retirement benefit information;
• Contribution and service history information;
• Beneficiary and dependent information;
• Contact information;
• Financial account information used for benefit administration and payment processing;
• Government-issued identifiers, including Social Security Numbers;
• Tax reporting information;
• Disability-related information and other information necessary for pension administration;
• Authentication and account access information.

When processing information on behalf of a customer, Heywood acts as a service provider, contractor, processor, or equivalent role under applicable law. The applicable customer remains responsible for determining the purposes and means of processing that information.

If you are a pension plan member, retiree, beneficiary, employee, or dependent whose information is processed through a Heywood-hosted system and wish to exercise privacy rights relating to that information, you should contact the relevant pension plan, retirement system, governmental entity, employer, or other organization that administers your benefits.

Heywood may assist its customers in responding to such requests where required by contract or applicable law.

Heywood does not use information processed on behalf of customers for its own marketing purposes.

Categories of Personal Information we collect

Depending upon the nature of our relationship with you, we may collect the following categories of personal information.

• Contact information (such as name, email address, company name, job title, telephone number)
• Account information (such as usernames, authentication information and account preferences)
• Internet and network activity (such as IP address (along with approximate geolocation information); device identifiers; browser information; website usage information; system logs)
• Customer communications (such as support tickets, general emails, meeting records or notes, webinar participation)
• Audio, electronic and visual information (such as webinar or meeting recordings, meetings)
• Preferences and interests derived from interactions with our services

Sensitive Personal Information and retirement administration data

Depending on the services we provide and our relationship with the individual concerned, Heywood may collect or process sensitive personal information as defined under applicable law.

This may include:

• Social Security Numbers and other government-issued identifiers;
• Driver's licence, state identification, passport, or similar identification numbers where required for identity verification;
• Financial account information and payment details;
• Tax identification information and tax reporting information;
• Pension, retirement, and benefits information;
• Beneficiary and dependent information;
• Disability-related information and information concerning health conditions where necessary for pension or retirement administration;
• Authentication credentials, account passwords, and security information;
• Information required to comply with legal, regulatory, or contractual obligations.

Where we process pension administration data on behalf of customers, such information is processed solely for purposes authorized by the applicable pension plan, retirement system, governmental entity, employer, or other customer.

Heywood uses and discloses sensitive personal information only:

• To provide requested products and services;
• To administer pension and retirement benefits;
• To establish, maintain, and secure accounts and systems;
• To detect, investigate, and prevent security incidents, fraud, or unlawful activity;
• To comply with legal, regulatory, contractual, and audit requirements;
• To protect the rights, safety, and security of individuals, customers, and Heywood; and
• For other purposes expressly permitted by applicable law.

Heywood does not use sensitive personal information to infer characteristics about individuals, develop behavioural profiles, or conduct targeted advertising except where permitted by applicable law.

Sources of Personal Information

We may collect personal information from:

• You directly;
• Our customers;
• Pension plans and retirement systems;
• Employers;
• Service providers;
• Business partners;
• Publicly available sources;
• Website technologies including cookies and analytics tools;
• Conferences, webinars, and events.

How we use Personal Information

We may use personal information to:

• provide, maintain, and support our software and services;
• operate customer environments;
• authenticate users;
• respond to enquiries and support requests;
• manage customer and supplier relationships;
• perform contractual obligations;
• improve products and services;
• conduct analytics and research;
• operate websites and online services;
• send service communications;
• send marketing communications where permitted by law;
• detect and prevent fraud or security incidents;
• protect legal rights and interests; and
• comply with legal and regulatory obligations.

Disclosure of Personal Information

We may disclose personal information to service providers, contractors, advisers, government authorities and/or parties involved in corporate transactions.

Sale and sharing of Personal Information

Heywood does not sell personal information for monetary consideration.

Heywood does not sell or share personal information for cross-context behavioural advertising.

Heywood does not knowingly sell or share personal information of individuals under 16 years of age.

Data retention

We retain personal information only for as long as reasonably necessary to provide services, fulfil our business interests or contractual obligations, meet legal, regulatory, accounting, tax, and audit requirements, resolve disputes and enforce agreements.

Retention periods vary depending on the nature of the information and applicable legal requirements.

For pension administration information processed on behalf of customers, retention periods are generally determined by the applicable customer and contractual requirements.

Security

We maintain reasonable administrative, technical, and physical safeguards designed to protect personal information.

International transfers

Heywood operates internationally. Personal information may be transferred to and processed in: the United States; Canada; the United Kingdom; the European Union; and other jurisdictions where Heywood or its service providers operate.

Where required by law, appropriate safeguards will be implemented for international transfers.

Consumer privacy rights

Residents of certain US states may have privacy rights under applicable state laws.

Subject to applicable law, individuals may have the right to:

• Know what personal information we collect;
• Access personal information;
• Correct inaccurate personal information;
• Delete personal information;
• Obtain a portable copy of personal information;
• Opt out of any targeted advertising;
• Opt out of any relevant profiling activities;
• Appeal certain decisions regarding privacy requests.

Information processed on behalf of customers

Certain privacy rights may not apply directly to information that Heywood processes solely on behalf of pension plans, retirement systems, governmental entities, employers, or other customers.

Where we act as a service provider, contractor, or processor, requests relating to such information should generally be directed to the relevant customer that controls the information.

We will assist our customers in responding to verified requests where required by contract or applicable law.

Non-discrimination

We will not discriminate against individuals for exercising privacy rights.

Exercising your rights

Requests may be submitted through: dataprotection@heywood.co.uk.

We may take reasonable steps to verify the identity of individuals making requests before responding.

California privacy rights

This section supplements the rest of this Privacy Notice for California residents.

During the preceding 12 months, Heywood has collected the categories of personal information described above in Section: Categories of Personal Information we collect.

During the preceding 12 months, Heywood has disclosed personal information to the categories of recipients described above in Section: Disclosure of Personal Information.

Sensitive personal information is processed only for purposes permitted under the CCPA/CPRA.

California residents may submit privacy requests using the contact details provided in the preceding Section: Consumer privacy rights.

California residents may designate an authorised agent to submit requests on their behalf, subject to verification requirements.

Cookies and similar technologies

We use cookies and similar technologies to:

• Operate our websites;
• Maintain security;
• Analyse website performance;
• Improve user experience; and
• Support other lawful business purposes.

Additional information is available in our cookie notice.

Minors

Our products and services are not directed to minors under 13 years of age.
We do not knowingly collect personal information directly from minors under 13 except where permitted by law and processed on behalf of our customers.

Accessibility

Individuals requiring this privacy notice in an alternative format may contact: dataprotection@heywood.co.uk. 

Changes to this privacy notice

We may update this privacy notice from time to time.

Any revised version will be posted with an updated effective date.

Effective Date: August 2026

North America job applicant privacy notice

Introduction

Heywood (US) Inc. is the subsidiary of Heywood Limited, a company registered in England and Wales (together, with the affiliates of both entities, “Heywood” / “we”).

The job applicant process in North America is largely managed by Heywood Limited and as such UK law applies to the processing of personal information, as well as applicable United States of America (US) law.

As defined by the UK General Data Protection Regulation (UK GDPR) Heywood Limited is the Data Controller and ultimately responsible for ensuring the personal information you provide is kept secure, processed correctly and that you understand your legal rights in relation to the information you provide.

The person with ultimate responsibility for compliance is Chris White, Head of Standards and Compliance, who can be contacted via dataprotection@heywood.co.uk.

Purpose and lawful basis for processing

Our purpose for processing this information is to assess your suitability for a role you have applied for and to help us develop and improve our recruitment process.

The lawful bases we rely on for processing your personal information as a job applicant are:

• where necessary to perform a contract or to take steps at your request, before entering a contract;
• where it is in our legitimate interests;
• as required by our legal obligations e.g., to carry out right to work checks or under applicable laws where you provide any information about reasonable adjustments.

The lawful basis we rely on to process any information you provide as part of your application which is sensitive personal information, such as health, religious, sexual orientation or ethnicity information is that necessary for the purposes of our obligations in employment legislation and the safeguarding of your fundamental rights such as health, safety, and welfare.

What information do we collect from you and why?

We collect information that is specifically provided by you as part of an application process. We will collect the following (but not limited to):

• personal identification and contact information such as name, email address and telephone number
• resume/application form
• educational and professional qualification/training information and history
• EDI monitoring information (this information is purely for statistical analysis and monitoring purposes (and options of prefer not to state are available))
• other sensitive personal information as may be necessary during the process
• information gathered as part of background screening and reference checks
• answers to application/screening questions as well as interview notes and assessment results
• any other information you wish to provide in support of your application

The information we request is used to assess your suitability for employment and/or carry out statistical analysis of recruitment. Our lawful bases that we rely on to processing your personal information are processing necessary to perform a contract or to take steps at your request, before entering a contract, and processing for the purpose of our legitimate interests.

We do not collect more information than we need to fulfil our stated purposes and will not retain it for longer than is necessary. You need not provide the information that we request, but it might affect your application if you do not.

What will we do with the information you provide?

All the information you provide during the process will be used only for the purpose of progressing your application (including verifying information or conducting background checks), or to fulfil legal or regulatory requirements, if necessary.

We will not share any of the information you provide during the recruitment process with any third parties for marketing purposes. We will not sell any information you have provided to another third party for any reason. The information you provide will be held securely by us and/or our service providers / data processors, whether the information is in electronic or physical format.

We will use the contact details you provide to us to contact you to progress your application. We will use the other information you provide to assess your suitability for the role for which you have applied.

How do we obtain your information?

We will receive your information if you apply for a position as listed on job boards, or if you have provided details to a recruitment agency that we work with. You may also provide information via our website or by way of a referral from a current employee. Additionally, further information may be obtained if you attend meetings via Teams or meet a Heywood employee during the recruitment process.

Application stage

When you apply for a position, we may ask you for your personal details, including name and contact details. We may also ask you about your previous experience, education, and for answers to questions relevant to the role for which you have applied.

Assessments

We might ask you to: complete tests and/or to attend an interview, or a combination of these. Information will be generated by you and by us. For example, you might complete a written test, or we might take interview notes. All information is held by Heywood.

If you are unsuccessful following assessment for the position for which you have applied, we may ask if you would like your details to be retained in our talent pool for a period of twelve months. If you say yes, we may proactively contact you should any further suitable vacancies arise.

Conditional offer

If we make a conditional offer of employment, we will ask you for information so that we can carry out pre-employment checks. You must successfully complete pre-employment checks to secure your offer. We are required to confirm the identity of our employees, and their right to work in North America (specifically in the US).

We may use third party providers for this. If we do so, we will share your name and email address with them for this purpose. Further information regarding third parties will be available as soon as possible.

You will be asked to provide various documentation to confirm your identity and right to work directly to us or our providers. We will take copies or be provided with copies and will retain these in line with our Data Retention Policy (a copy of which is available upon request to dataprotection@heywood.co.uk).

Your referees will be contacted, using the details you provide, directly to obtain references and any educational information may also be verified.

How long is your information held for, where is it stored and who has access?

If you are unsuccessful, we may hold your information for a period of up to 12 months, after which your information will be deleted or disposed of. If you are successful and become an employee, you will be provided with an employee privacy notice for the information you share, or we otherwise process during the course of your employment.

We store the information on your application record, in HR management systems and on other IT systems (including email).

Our HR (People) team will have access to all information provided. Interviewers, managers, and IT staff will also have access if necessary for the purpose of the application process or their roles.

Your rights

You are entitled to know whether we hold personal information about you and, if we do, you will have the following rights:

• right of access to copies of your personal information;
• right to rectify any of your personal information you think may be inaccurate;
• right to have your personal information deleted in certain circumstances;
• right to restrict the processing of your personal information in certain circumstances;
• right to object to processing in certain circumstances;
• right to information portability in certain circumstances.

Additional rights

Residents of certain North American states may have privacy rights under applicable state laws.

Subject to applicable law, individuals may have the right to:

• know what personal information we collect;
• access personal information;
• correct inaccurate personal information;
• delete personal information;
• obtain a portable copy of personal information;
• opt out of any targeted advertising;
• opt out of certain profiling activities;
• appeal certain decisions regarding privacy requests.

Non-discrimination

We will not discriminate against individuals for exercising privacy rights.

Exercising your rights

Requests may be submitted through: dataprotection@heywood.co.uk.

We may take reasonable steps to verify the identity of individuals making requests before responding.

Use of information processors

We may use information processors who are third parties to provide elements of our recruitment service for us. We have contracts in place with all of our information processors, and your personal information will only be processed in line with our instructions.

Use of job boards and recruitment agencies

We may use job boards and recruitment agencies to advertise/manage our vacancies. Any applications made by you through these boards and agencies are initially governed by their privacy notices and the terms and conditions as specified by them. Once you apply via a job website and submit your resume/application, we will have access to any personal information submitted. Recruitment agents will submit your details and your resume to us in line with their own procedures.

Automated decision making

We may use some automated screening tools as part of the application process. The answers you provide to one or more of the questions (excluding any special categories/EDI questions) may result in your application being automatically declined. For example, you will usually be asked to confirm whether you have a right to work in North America. If you select no, your application will not be taken further as we cannot provide visa sponsorship or work opportunities to those who do not have the right to work in North America.

This technology is used to help us manage the high volume of applications we receive and can assure applicants the same outcome would occur if we manually reviewed your application. The reason for the decline will be made available to you in your candidate account.

The right to complain

If you have any concerns or complaints regarding the processing of your personal information, or our compliance with any applicable laws, you should contact our Head of Standards and Compliance via email dataprotection@heywood.co.uk.

You also have the right to lodge a complaint with the UK’s data protection supervisory authority, Information Commissioner’s Office. Their contact details are:

• www.ico.org.uk
• 0303 123 1113
• Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, United Kingdom, SK9 5AF.

Changes to our privacy notice

We can exercise the right to update this policy as and when required.

This privacy notice is effective from August 2026.