Whitepaper Cut the middlemen: Advantages of an EOR platform with local entities

XML Group Online Privacy Notice

4 May 2020

XML Group and its group companies, (collectively, “XML Group”, or “we”) are committed to safeguarding your privacy. In this Online Privacy Notice (“Notice”) we explain to you what information we may collect, use, share, and store about you, and the choices and rights that are available to you. If you have any questions about this Notice, please contact us using the contact details provided below.

About XML Group

XML Group forms partnerships with organisations across the globe to optimise talent attraction and retention. We work with clients to help them achieve their talent strategies and business goals, and we help potential candidates fulfil their career aspirations.

Our services include:

Staffing and Recruiting: Contract, contact-to-hire, and direct placement solutions 

Managed Delivery: Managed, project-based, and outsourced delivery services

Workforce Management: Permanent and contingent workforce solutions, including recruitment process outsourcing (RPO), managed service provider (MSP) solutions, and vendor management system (VMS) implementation to optimise your human capital strategies. 

When this Notice Applies

“Personal information” consists of information which may directly or indirectly identify you. This Notice applies to our collection, use, and disclosure of your personal information:

●  through our website and related applications and content that link or refer to this Notice

●  in connection with any of our events or sales, marketing, advertising, and recruitment activities, or in the course of providing other XML Group Services to you (collectively with the Sites, the “XML Services”); and

●  when receiving services from you.


In some cases, we may provide additional data privacy notices specific to certain products, practices, or regions. Those terms are to be read in conjunction with this Notice. This Notice does not apply to the practices of third parties that XML Group does not own or control. 



Collection and Use of Personal Information

Categories of Individuals Whose Personal Information We Process Includes:

●  Visitors: ​individuals who visit or use our Site(s) or any other XML Group Services, so that we can provide them with the Site(s) or XML Group Services they require;

●  Job seekers: ​individuals that apply for job opportunities with XML Group to fill our internal positions or as part of our staffing and recruiting services or with XML Group’s customers through our search, workforce management, or talent advisory services (in each case, whether such applications are made online or offline);

●  Customers, vendors, service providers, and other suppliers: ​employees, representatives and/or agents of our customers, service providers, vendors, and other suppliers or individuals with whom we have a business relationship and/or manage on behalf of our customers; and

●  Referees and others who advise on the suitability of job seekers: ​If you submit any personal information relating to other people to us or to our service providers in connection with the XML Services, you confirm that you have the authority to do so and to permit us to use the information in accordance with this Notice

How We Collect Information Includes:

  • Information submitted directly: XML Group collects personal information that individuals provide to us through our Services, for instance by completing an online form or creating an account on our Site(s). Where we request information from you, we will inform you prior to collection whether the provision of the personal information may be provided on a voluntary basis, and the consequences of not providing the information

  • Information we collect automatically: XML Group and our service providers may automatically collect certain technical information from visitors to our site(s) and users of our app(s) by, for example, our use of cookies placed on your device.

  • Information we obtain from other sources or third parties: We may receive or acquire information about our visitors, job seekers, customers, and service providers from third-party partners (such as background check providers and providers of professional databases) or a job seeker’s, customer’s, or vendor’s third-party reference. Additionally, we collect information from our social media online forums, blogs, and message boards when you choose to interact with them. In addition, we collect personal information you make available on your public social network profiles and other public locations, including, for example, Facebook, LinkedIn, Twitter, Instagram, or other company websites and/or job boards. 

The Types of Personal Information We Collect Includes:

Category of personal Information

Types of personal Information

Business Purposes


Identifying Information:

includes name, username and password, citizenship status, and government issued IDs


Contact Information:

includes email address, telephone number, postal address, and contact information of referrals, references, or emergency contacts

-To create, manage, and administer the XML Group Services and for internal operations. 
-To provide information on goods and services you have requested. 
-To match job seekers to job positions. 
-To match job positions to job seekers.
– To meet our legal obligations when acting as an employer and potential employer
-To make contact in an emergency. 
-To help you search and enrol in career education classes. 
-To notify you about changes to our Site(s) or other XML Group Services.
-To personalise and deliver content about our Services to you. 
To send you e-mails, SMS messages, and other promotional communications about XML Group through marketing, advertising, and promotions, for example, newsletters, surveys, articles of interest, press releases, and job fair or other event announcements according to your marketing preferences. 
-To comply with applicable laws and government regulations. 
-To create anonymuzed aggregated statistics. 
-To deal with disputes and take legal action or other professional advice. 

Professional Employment-related, and Educational

Professional Information: 

includes resume or C.V., employment history, education history, certifications, language proficiencies, awards, security clearance information, work authorization, and other work- related skills

Preference Information:

includes career interests, desired compensation, desired work location, hobbies, interests and benefits

-Same as above. 

Audio Visual, or Similar Information 

Audio, Visual, or Similar Information: includes video interviews, phone call recordings, and video captured by our security systems

– Same as above.


Inference Information: 
includes assessments of attitudes and abilities

– Same as above. 
-To combine information within this table to create holistic profiles of our customers and talent to personalise our Services and tailor them to each customer’s and talent’s preferences and habits.

Commercial Information 

Transactional Information:

includes purchasing, sales, transactions, taxes, purchases and spending habits

-Same as above. 
-To enhance, improve, or modify the provision of our Services and Sites, for our customers. 
-To identify usage or purchase trends
-To maintain market awarness.

Characteristics of Protected Classes 

Demographic Information: 
includes race and national or ethnic origin, gender, disability status, and veteran status

-To deal with disputes and take legal action or other professional advice 
-Where we are required to or permitted to do so by law for equal opportunity monitoring or affirmative action programs.

Sensitive Personal Information

You may be asked for types of personal information that are viewed by some countries as sensitive personal information. Sensitive personal information includes, for example, government- issued identification numbers (such as national insurance numbers), information relating to a person’s race or ethnic origin, political opinions or religious or philosophical beliefs, physical or mental health or condition, sexual orientation, trade union membership, genetic data, and any related legal actions. XML Group will process that personal information in accordance with applicable data protection laws.

Failure to Provide Information Where Required

There will be times when we request information from you in order to provide Services. If you do not provide the information that we have identified as required, we may be unable to properly provide you with these Services.

Legal Basis for Processing Personal Information

Our legal basis for processing personal information about individuals from the European Economic Area will depend on the type of personal information and the purpose for which we collect it. However, we will normally collect personal information from you only where:

●  We need the personal information to perform a contract with you;

●  the processing is in our legitimate interest and not overridden by your rights;

●  we have your consent to do so; or

●  there is a legal obligation to collect personal information from you.

If we ask you to provide personal information to comply with a legal requirement or to perform a contract with you, we will make this clear at the relevant time and advise you whether the provision of your personal information is mandatory or not (as well as of the possible consequences if you do not provide your personal information).

If we collect and use your personal information in reliance on our legitimate interests (or those of any third party), this interest will normally be to operate our platform and to communicate with you as necessary to provide our services to you and for our legitimate commercial interest; for instance, when responding to your queries, improving our services, undertaking marketing, or for the purposes of detecting or preventing illegal activities. We may have other legitimate interests and if appropriate we will make clear to you at the relevant time what those legitimate interests are.

You may choose to provide your personal information with XML Group for a particular position for which you are not successful. In such a situation, as you have indicated that you are looking for opportunities beyond your current role, XML may retain your personal information in order to present you with other opportunities for which your experience may be suitable. If you have concerns about XML Group retaining this data for these purposes, please discuss them with your contact at XML Group.

If you would like further information on our legitimate interests as applied to your personal information, please Contact Us.

Sharing Your Personal Information

XML Group does not sell your personal information. XML Group may share and disclose personal information about you in the following circumstances:

  • Potential employers or potential customers – We may share your personal information at your direction if you are a job seeker with a customer for the purpose of providing Services (such as staffing and recruiting services, or search, workforce management, or talent advisory services). To the extent you are employed by a customer of XML Group through our search, workforce management, or talent advisory services, the XML Group customer will process such personal information in accordance with its own policies and procedures.
  • Compliance with laws, government, and law enforcement – We may disclose personal information where we are legally required to do so in order to respond to or comply with any applicable law, regulation, subpoenas, court orders, legal process, or government requests, including in response to public authorities to meet national security or law enforcement requirements.
  • Vendors, consultants, and other service providers – We use vendors, consultants, and other service providers to assist us in providing the XML Services, and it may be necessary for us to provide access to your personal information (for example, IT vendors who support our systems, background check vendors, and premises security management for video security and badge access).
  • Business transfers and corporate reorganization – Circumstances may arise where, whether for strategic or other business reasons, XML Group decides to sell, buy, merge, or otherwise reorganize businesses. Such a transaction may involve, in accordance with applicable law, the disclosure of personal information to prospective or actual purchasers, or the receipt of it from sellers. It is XML Group’s practice to seek appropriate protection for information in these types of transactions.
  • Vital interests and legal rights – We may collect and possibly share personal information and any other additional information available to us in order to investigate, prevent, or take action regarding illegal activities, suspected fraud, situations involving potential threats to the physical safety of any person, violations of XML Group’s terms of use, or as otherwise required by law, including without limitation to meet national security or law enforcement requirements. We also may disclose your personal information when we choose to establish or exercise our legal rights or defend against legal claims.
  • With your consent – We may disclose your personal information for other purposes with your consent.

Sharing Your Personal Information within XML

XML Group may disclose your personal information to any affiliate within XML Group for use in accordance with this Privacy Notice. This includes our subsidiaries, affiliates, and our ultimate holding company.

This sharing of personal information with XML Group affiliates may include combining the personal information gathered by certain XML Group Sites with information independently gathered on other XML Group Sites as well as information gathered offline into one or more database(s) useable by XML Group. Again, this combined information will only ever be used for the purposes disclosed within this Notice.

Your Privacy Rights and Choices

We respect your right to access and control your information and we comply with applicable data protection laws and regulations. We will process your rights requests in compliance with applicable data protection laws and regulations. The availability of these rights and the ways in which you can exercise them are set out below.

European Privacy Rights

For individuals located in the European Economic Area (“EEA”), United Kingdom, or Switzerland your rights include:

●  Access: You have the right to request access to your personal data. This enables you to receive a copy of the personal data we hold about you and certain other information about it.

●  Rectification: You are entitled to request that we correct inaccuracies of your personal data.

●  Erasure: You have the right to request erasure of your personal data in certain circumstances.

●  Restriction: You are entitled to ask us to suspend the processing of certain of your personal data.

●  Data Portability: You may request to receive information you provided to us in a machine-readable portable format or the transfer of certain personal data to another party.

You have the right to make a complaint to a Data Protection Authority where you are a resident, where we are based, or where an alleged infringement of data protection law has taken place.

Other Jurisdictions

Under the laws of some jurisdictions you may have the right to request additional information about the personal data we collect, request access to the personal data we process, correct an error or omission, delete personal data, or object or limit further processing. XML Group will respect individual rights requests under those laws.

Additionally, if we have collected and processed your personal information with your consent, then you can withdraw your consent at any time. This will not affect any processing of your personal information done before you withdrew your consent.

How to Exercise Your Privacy Rights

If you would like to exercise your privacy rights, please : Call +44(0) 2039498321 to submit your request.


To protect your privacy and security, we may take steps to verify your identity. We will abide by all applicable legal requirements for deadlines for responding to your request. If you experience any issues with the web form or phone number, please
contact datasecurity@xml-int.com

Your Choices:

Marketing Communications: Where it is in accordance with your marketing preferences and applicable data protection laws, we may periodically send you updates via e-mail about promotional opportunities or services we think may interest you, such as jobs in our database that match your selection criteria, newsletters, white papers, surveys and event information. You can opt-out of receiving marketing emails from us.

Cookies and Online Tracking

XML Group websites use “cookies” and similar technologies to help personalise your online experience and for analytics purposes.

Security of Your Personal Information

XML Group is committed to protecting the personal information you share with us. XML Group uses appropriate physical, technical, organizational and administrative security measures to help protect your personal information from unauthorized or unlawful access, use, or disclosure, and from accidental loss, destruction, or damage.

Data Retention

We retain personal information we collect from you where we have an ongoing business need to do so (for example, to provide you with the service you have requested or to comply with applicable legal, tax or accounting requirements).

When we have no ongoing business need to process your personal information, we will either delete or anonymize it or, if this is not possible (for example, because your personal information has been stored in backup archives), then we will securely store your personal information and isolate it from any further processing until deletion is possible.

International Data Transfers

As a global company, we may transfer personal information within XML Group and third parties located in the United Kingdom and in other countries that may be outside your country of residence for storage and processing in order to provide the Services. These countries may not necessarily have data protection laws as comprehensive as those in your country or residence. In addition, we will have taken appropriate safeguards to protect your personal information in accordance with this Notice and applicable law wherever it is processed. These safeguards include implementing the European Commission Standard Contractual Clauses for transfers of personal information between XML Group companies and our self-certification to the Privacy Shield Frameworks.

Children's Privacy

This site is not intended for use by children under the age of 13. XML Group does not knowingly collect personal information from children under the age of 13. If we learn that we have collected personal information from a child under the age of 13, we will delete that data from our systems.

Links to Other Sites and Public Forums

Our Sites may contain links to other sites for your convenience and information. If you access those links, you will leave our Sites. XML Group does not control those sites or their privacy practices, which may differ from XML Group’s practices. XML Group is not responsible for the privacy practices or the content of other websites outside of XML Group. The personal information you choose to provide or that is collected by these third parties is

not covered by this Notice. We encourage you to review the policies of such third parties before submitting your personal information.

XML Group may make message boards, news groups, and/or public forums available to users on its Sites. Any information that you disclose in these areas becomes public information that may be accessed by third parties; therefore, you should use caution before deciding to disclose any personal information in these forums.

Contact Us

If you have any questions, please contact:

XML Group, Inc.

Derbyshire House, St chad’s Street London WC1H 8AG

ATTN: Privacy Officer datasecurity@xml-int.com
Or if you are resident in the EEA, United Kingdom, or Switzerland:

XML Group Limited c/o Legal Department, Derbyshire House, St Chad’s Street London WC1H 8AG
ATTN: Legal Team


Our Data Protection Officer

The Data Protection Officer is an advisor and supervisor of XML Group’s data protection compliance. The DPO’s advice is directed towards XML Group in the first instance. The DPO can be contacted at:

Attention: GDPR Data Protection Officer c/o Legal Department Derbyshire House, St Chad’s Street London WC1H 8AG

ATTN: The Data Protection Officer


Changes to this Notice

If we change this Notice, we will post the revised Notice on our sites, with an updated revision date. If we make significant changes to our Notice, we may also notify you by other means, such as sending an email or posting a notice on our home page. We will update the “Effective Date” at the top of this page to indicate the date from which any changes take effect.