HARIS Group Ltd — Privacy Notice
Who we are and how to contact us
HARIS Group Ltd is registered in England and Wales, company number 17221982. HARIS is the controller of the personal data described in this notice: it determines why and how that information is used.
Registered office
128 City Road, London, United Kingdom, EC1V 2NX
Privacy enquiries, rights requests and complaints
General and institutional enquiries
Research collaboration
Work with HARIS / expressions of interest
You can also write to the registered office, marking your correspondence “Data protection”.
What this notice covers
This notice covers personal data received through the HARIS website and the correspondence associated with its general and institutional enquiries, research collaboration enquiries and Work with HARIS page.
It applies to individuals contacting HARIS, people representing organisations, and people expressing interest in employment, contract work, research, collaboration or specialist advisory work.
It does not describe the handling of datasets supplied for a separate research or evaluation project.
Website: https://harisgroup.co.uk/
Information we receive
When you email HARIS, we receive your email address and the contents of your message, together with any sender name, signature, links or attachments it contains. You may include your organisation, role, other contact details or information about a proposed discussion.
An expression of interest may contain:
- a description of your work, professional interests and relevant experience;
- a representative paper, repository, report, test suite or other work sample;
- the type of arrangement you would like to discuss;
- a CV and professional history, if you choose to provide them.
Submitting an enquiry or expression of interest is voluntary. A CV is optional. Please send only information relevant to your enquiry or expression of interest and material you are entitled to share. Without enough information about your enquiry or work, we may be unable to respond meaningfully or consider a possible arrangement.
If we ask for further information needed to progress a possible employment or other contract with you, we will explain what is needed. Without that information, we may be unable to progress the proposed arrangement.
HARIS does not request special-category personal data, such as health information, religious or philosophical beliefs or political opinions, or information about criminal convictions or offences as part of the ordinary initial expression-of-interest process. Please do not include sensitive personal information unless it is relevant and HARIS has explained why it is needed and how it will be handled. HARIS does not conduct criminal-record or background checks as part of the expression-of-interest process. HARIS will only use sensitive or criminal-offence information where there is a legitimate need and the appropriate legal conditions have been established.
How and why we use personal data
Purpose
Lawful basis
Reading and responding to general enquiries and maintaining the related correspondence
Legitimate interests under Article 6(1)(f): understanding and answering requests addressed to HARIS and keeping track of the discussion.
Considering institutional or research enquiries and corresponding with representatives of organisations
Legitimate interests under Article 6(1)(f): assessing potential working relationships and communicating with the people involved.
Considering an expression of interest against HARIS’s current and planned requirements and responding to the individual
Legitimate interests under Article 6(1)(f): identifying whether the person’s work and experience are relevant to possible work with HARIS.
Retaining unsuccessful expressions of interest for six months after initial consideration ends to consider individuals if relevant opportunities arise
Legitimate interests under Article 6(1)(f): maintaining a limited, time-bound record of recent expressions of interest and considering relevant individuals against planned requirements.
Taking necessary steps, at your request, towards an employment contract or another contract with you personally
Article 6(1)(b): steps requested by you before entering into a contract. This applies to those steps, rather than to every enquiry or expression of interest.
Handling data-protection rights requests and complaints, and keeping the records needed to demonstrate how they were handled
Legal obligation under Article 6(1)(c): meeting HARIS’s duties under UK data-protection law.
Establishing, exercising or defending legal claims where necessary
Legitimate interests under Article 6(1)(f): protecting HARIS’s legal rights and responding to disputes or claims.
If you represent a university, company or other organisation, a possible contract with that organisation does not itself make the contract basis applicable to your personal data.
Expressions of interest and prospective work
The Work with HARIS page invites expressions of interest by email. Not every area listed corresponds to a current vacancy. HARIS considers each expression of interest against its current and planned requirements.
The use of your information for that initial consideration is described above. Retaining it for later opportunities is a separate matter.
HARIS retains unsuccessful expressions of interest for six months after initial consideration ends so that it can consider the individual if a relevant opportunity arises during that limited period. We rely on legitimate interests under Article 6(1)(f) for this use, as described in the table above. After six months, the information is deleted unless another lawful reason requires retention and the individual has been appropriately informed. HARIS does not maintain a permanent or indefinite talent pool.
You can tell us that you no longer wish to be considered, object to processing based on legitimate interests, or ask for your information to be deleted. Use the privacy contact above. The rights section explains when those requests apply.
Expressions of interest are reviewed and assessed by people at HARIS authorised to do so. HARIS does not use AI or automated tools to summarise, analyse, assess, rank, score or make decisions on expressions of interest.
Work samples submitted with an expression of interest are reviewed for the purpose of considering that expression of interest and any related discussion about working with HARIS. They are not used for AI model training or as evaluation data.
HARIS does not use expression-of-interest submissions for direct marketing.
Information from other sources
HARIS reviews information and professional material that you provide, including links you send. It does not search for additional information about you from other sources as part of the expression-of-interest process.
Who receives personal data
HARIS uses service providers for email, website hosting and document/file storage. These providers receive or process personal data to the extent relevant to their services.
Where necessary, HARIS may also disclose personal data to legal advisers, courts, regulators or public authorities in connection with legal claims, data-protection complaints, or where disclosure is required by law.
International processing and transfers
Some service providers process personal data outside the UK or allow access from outside the UK. Where this involves a restricted transfer, HARIS relies on UK adequacy regulations where they apply, or otherwise puts in place the appropriate safeguards required by UK data-protection law.
You can contact [email protected] for information about safeguards applicable to a particular transfer.
How long we keep information
Information
Retention period or criteria
General enquiries and related correspondence
24 months after the last substantive contact, unless the correspondence forms part of an ongoing relationship, legal matter or another record with a separately applicable retention requirement.
Institutional and research correspondence
24 months after the relevant discussion closes, unless it becomes part of an ongoing relationship, agreement or other record subject to a different justified retention requirement.
Expressions of interest that do not lead to an engagement
Six months after initial consideration ends, for consideration if a relevant opportunity arises during that period. The information is then deleted unless another lawful reason requires retention and the individual has been appropriately informed.
Unsolicited CVs that HARIS does not decide to consider
Deleted within 30 days of receipt.
Records of a successful recruitment or engagement process
Where an expression of interest leads to employment or another engagement, relevant information may become part of the records for that relationship and will then be subject to the applicable privacy information and retention arrangements for that relationship.
Information retained to establish, exercise or defend a legal claim
Retained for as long as reasonably necessary for the claim, taking account of the relevant limitation period and any related proceedings.
Rights requests and privacy complaints
The relevant request or complaint and outcome record is retained for three years after closure.
Website and security logs
Retained for the period reasonably required for website operation, security, troubleshooting and investigation of incidents, taking account of the settings and retention arrangements of the relevant hosting service.
Website technology
When you visit the HARIS website, the website hosting service may process technical information needed to deliver, protect and operate the site. This may include IP address, request information, timestamps, browser or device information and security or server logs.
Where HARIS processes this information to operate and protect the website, we rely on legitimate interests under Article 6(1)(f): keeping the site available, diagnosing faults and protecting it against misuse.
Your rights
You can ask for access to your personal data and correction of inaccurate information. Depending on the circumstances, you can also ask for information to be erased or for its use to be restricted.
Where we rely on legitimate interests, you can object for reasons relating to your circumstances. We must stop that use unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing is needed for legal claims.
For information you have provided that we process by automated means on the contract basis, you can request a portable copy and, where technically feasible, transfer to another controller.
Contact us using the details above to exercise a right. We will respond without undue delay and within one month of receiving your request, subject to the timing rules below. If we have reasonable doubts about your identity and need further information to confirm it, the response period starts when we receive that information. A necessary extension for complex or multiple requests can add up to two months; we will tell you and explain why within the first month.
For an access request, the response period can pause while we await clarification reasonably needed to identify the information or processing your request concerns. We will explain any effect on the deadline.
Complaints
You can raise a concern or make a data-protection complaint using the privacy contact above or by writing to the registered office. We will acknowledge your complaint within 30 days, investigate it as appropriate, keep you informed of progress and tell you the outcome without undue delay.
You also have the right to complain to the Information Commissioner’s Office, the UK data-protection regulator. You do not have to complete HARIS’s complaints process before exercising that right.
Make a complaint to the ICO: https://ico.org.uk/make-a-complaint/
Changes to this notice
We will update this notice when the processing it describes changes. The date at the top identifies the current version.
Before using personal data for a new purpose, we will provide the further privacy information required by law. Updating this page does not, by itself, authorise a new use of your information.