Personnel Records and Data Protection Policy

QuadX is committed to complying with applicable privacy and data protection laws in relation to all those who work for QuadX, job applicants and those who no longer work for QuadX.

Privacy and data protection laws vary between countries. You should read this policy in conjunction with local requirements. Details of any applicable local rules can be obtained from your local/regional People Operations or Human Resources team.

This policy applies to all processing of personal data by QuadX in relation to all aspects of the employment relationship and which is governed by applicable laws relating to privacy and data protection.

Personal data is information where individuals can be identified either from that data or that data combined with other information QuadX already holds about that individual.

Processing includes anything that can be done with or in relation to data including obtaining, recording or holding the data and carrying out any operation on the data such as reading or reviewing or considering it, using it for a decision, organizing or amending it, transmitting it, erasing it or disclosing it.

QuadX will collect and process personal data regarding all individuals who work for QuadX or apply to work for QuadX for the following purposes subject to applicable local privacy and data protection laws:

• Recruitment, training, development, promotion and succession planning;
• Providing remuneration, benefits and incentive schemes for those who work for QuadX and liaising with tax and social security authorities;
• Managing conduct, performance, absence and grievance related reviews, investigations and processes and making related management decisions;
• Consultations or negotiations with representatives of the workforce where applicable;
• Processing information about absence or medical information;
• Where applicable for carrying out restructuring or redundancies including appropriate consultation, selection, alternative employment searches and related management decisions;
• Complying with reference requests where QuadX is named by the individual as a referee;
• Operating email, IT, internet, social media, HR related and other company policies and procedures;
• Monitoring programs to ensure equality of opportunity with regard to personal characteristics protected under local laws;
• At an appropriate stage and level in relation to a commercial transaction by QuadX that impacts on an individual's employment (for example confidential disclosure in relation to any potential sale or transfer at an appropriate stage in the transaction);
• Where reasonably necessary for business documentation such as annual reports or tenders for work;
• Disclosure of basic personal data and contact information to third party contacts including corporate customers, suppliers and other business associates in order to operate the relationship with those third parties;
• Maintaining and processing general records necessary to manage the employment or worker relationship and operate the contract of employment or engagement;
• Other purposes permitted by applicable privacy and data protection legislation including legitimate interests pursued by QuadX where this will not cause unwarranted prejudice to the rights, freedoms or legitimate interests of those who work for QuadX.

The above processing may include transmitting data to third parties where appropriate. All processing of employment or work- related data by QuadX or those who work for QuadX should comply with the following principles:

• Data should be processed fairly and lawfully.
• Particular care should be taken with sensitive personal data (as defined in applicable privacy and data protection legislation).
• Data which is obtained for one legitimate purpose should not be processed in a manner which is incompatible with that purpose.
• Data should be adequate, relevant and not excessive in relation to the purposes it is processed for.
• Data should be accurate and kept up to date.
• Data should not be retained for longer than needed for the purposes it is stored for. This will vary between countries and depend on the nature of the data, why it is held and whether it is anticipated that it will be needed in the future for a particular legitimate purpose.
• Data should be processed in a way which complies with the rights of the data subjects.