Privacy Policy
1. Introduction
Getronics provides managed ICT services and solutions that may involve the processing of personal data in areas such as digital workplace support, service desk operations, endpoint and device management, infrastructure and cloud services, cybersecurity monitoring, network services, software development, application support, customer relationship management and related professional services. The type of personal data processed will depend on the specific service, customer environment and contract in place.
Getronics and its affiliated companies ("Getronics", "we", "us" and "our") are committed to protecting personal data and respecting the privacy rights of individuals.
This Privacy Notice explains how Getronics collects, uses, shares, stores and protects personal data in connection with its websites, managed ICT services and solutions, customer and supplier relationships, recruitment activities, events and marketing activities, business operations, digital workplace services, cloud and infrastructure services, cybersecurity services, software and application services, and relevant technology platforms.
This notice is intended to support compliance with applicable data protection laws, including the EU General Data Protection Regulation (GDPR), UK GDPR, applicable national data protection laws and other privacy laws applicable to Getronics operations globally.
2. Who we are
Getronics is a global ICT services and solutions provider operating through a network of affiliated companies, business units and service delivery centres worldwide.
The Getronics entity with which you interact will normally be the controller of your personal data. Where multiple Getronics companies jointly determine the purposes and means of processing, they may act as joint controllers.
For information about Getronics group entities, see: Getronics Affiliates and Compliance Information
For controller questions or privacy requests, contact the Data Protection Officer at dpo@getronics.com.
3. Individuals covered by this notice
Where Getronics processes personal data on behalf of a customer as part of contracted services, the customer will normally determine the purposes and means of that processing and Getronics will act as a processor or service provider under the applicable contract. In those circumstances, the customer’s own privacy notice will usually provide the main transparency information for the relevant end users, and this Privacy Notice explains Getronics’ own processing activities and general privacy approach.
This Privacy Notice applies to the following categories of individuals, unless a separate privacy notice applies:
- website visitors
- prospective customers and customer contacts
- customer end users where applicable
- supplier and partner contacts
- job applicants and candidates
- event attendees
- prospective employees
- former employees where applicable
- contractors and agency workers
- whistleblowers and ethics reporters
- individuals who communicate with Getronics.
Separate or supplementary notices may apply to employees, whistleblowing reports, customer-specific services, products or applications, and local country-specific processing activities.
4. Personal data we collect
Depending on your relationship with Getronics, we may process the following categories of personal data:
- Identity data name, title, username, employee ID, candidate ID, nationality where required.
- Contact data email address, telephone number, business address and postal address.
- Professional information employment details, job title, qualifications, certifications, professional experience and CV information.
- Technical information IP address, device identifiers, browser information, operating-system information, authentication logs, security events and website usage information.
- Communications data emails, meeting records, support tickets, surveys, feedback and chat messages.
- Recruitment information CVs, applications, interview notes, assessments, references, background screening results, eligibility-to-work documentation and security clearance information where applicable.
- Financial information payment details, bank details, tax information and invoicing information.
- Compliance information regulatory correspondence, audit records, due diligence records, conflict declarations and ethics or compliance reports.
- Special category data health, diversity, disability, criminal-record or biometric information where permitted by law and subject to additional safeguards.
5. How we collect personal data
We collect personal data directly from you, automatically through technology, and from third parties.
- Directly from you: when you contact us, request information, purchase services, register for events, submit applications or complete questionnaires.
- Automatically: through cookies, website analytics, security monitoring tools, log files and device telemetry.
- From third parties: including recruitment agencies, professional networking platforms, public registers, references, background screening providers, technology providers, customers and partners.
6. Purposes and legal bases for processing
The table below summarises the main purposes for which Getronics processes personal data and the legal bases generally relied upon. The applicable basis may vary depending on the country, relationship and specific processing activity.
Processing purpose
Examples of personal data
Legal basis
Customer relationship and service delivery
Business contact details, service tickets, project information, communications, account records
Contract performance, legitimate interests, legal obligations
Marketing and business development
Contact details, marketing preferences, event attendance, website analytics
Consent and/or legitimate interests, with opt-out rights
Recruitment and talent acquisition
CVs, applications, interview notes, assessment results, right-to-work details, references
Legitimate interests, steps prior to contract, legal obligations, consent where required
Supplier and partner management
Supplier contact details, due diligence records, contract and payment information
Contract performance, legitimate interests, legal obligations
Security, fraud prevention and incident management
Authentication logs, device identifiers, access records, security events, incident records
Legitimate interests, legal obligations
Legal, regulatory and compliance management
Audit records, DSAR records, compliance correspondence, investigation records
Legal obligations and legitimate interests
AI-enabled and productivity services
Inputs, outputs, user prompts, metadata or operational records where personal data is included
Legitimate interests, contract performance, legal obligations and/or consent where required
7. Recruitment and candidate processing
Getronics processes candidate information to manage recruitment, assess suitability, verify eligibility, communicate with candidates and maintain recruitment records.
Candidate information may include CVs, applications, employment history, education details, qualifications, interview notes, assessment results, psychometric results where used, right-to-work documentation, salary expectations, background screening results, references, LinkedIn or other professional profile information, and recruitment correspondence.
We may receive candidate data directly from candidates or from recruitment agencies, referrers, referees, professional networking platforms, background screening providers and other sources permitted by law.
We process recruitment data for candidate sourcing, application management, interview and assessment processes, talent pooling, future vacancy matching, workforce planning, security vetting, legal and regulatory compliance, client-specific screening where required for customer environments, diversity monitoring and fraud prevention.
Where Getronics uses recruitment partners, applicant tracking systems, interview platforms or background screening providers, those parties may process candidate data on behalf of Getronics or as otherwise described in their own applicable privacy notices.
Unless a longer period is required by law or necessary to manage a claim, unsuccessful candidate records will normally be retained for up to 24 months. Successful candidate records will be transferred into the relevant employee record and retained in accordance with the applicable employee privacy notice and retention schedule.
8. Artificial intelligence and automated processing
Getronics may use artificial intelligence, machine-learning enabled technologies and AI-assisted productivity tools to support service delivery, customer support, knowledge management, software development, cybersecurity operations, recruitment administration, document review, internal productivity and business operations.
Where AI systems process personal data, Getronics applies governance, security, access control, contractual and risk-management measures appropriate to the nature and risk of the processing.
Unless explicitly stated in a separate notice, Getronics does not make solely automated decisions that produce legal or similarly significant effects on individuals without appropriate human involvement.
Where specific AI systems require additional transparency, Getronics may provide supplementary privacy notices or system-specific information.
9. Collaboration and digital workplace services
Getronics uses collaboration and digital workplace technologies including Microsoft 365, Microsoft Teams, SharePoint, OneDrive, Exchange Online, Copilot and AI-enabled productivity services, telephony and unified communications platforms.
Personal data processed through these services may include communication records, meeting recordings, meeting transcripts, shared content, user profiles, service usage data, diagnostic information and security records.
Processing is undertaken to deliver communication services, support collaboration, improve service reliability, protect security, manage incidents, comply with legal obligations and operate Getronics business processes.
Relevant Microsoft references: Microsoft Privacy Statement; Microsoft Trust Center
10. Sharing personal data
Getronics may share personal data with the following categories of recipients where necessary and lawful:
- Getronics group companies: for operational, management, reporting, service delivery and administrative purposes.
- Service providers: including cloud providers, hosting providers, recruitment providers, professional advisers, technology vendors, security service providers, payment processors and support providers.
- Customers: where necessary to provide contracted services or comply with customer security, onboarding or service requirements.
- Regulators, authorities and courts: where required by law or necessary to protect legal rights.
- Corporate transaction parties: in connection with mergers, acquisitions, investments, restructuring or similar corporate events.
Getronics does not sell personal data.
11. International transfers
Getronics operates globally and personal data may be transferred internationally, including between Getronics group entities and to service providers in other jurisdictions.
Where personal data is transferred outside the European Economic Area, the United Kingdom or another jurisdiction with transfer restrictions, Getronics will implement appropriate safeguards where required, such as adequacy decisions, the European Commission Standard Contractual Clauses, the UK International Data Transfer Agreement, the UK Addendum to the SCCs, transfer risk assessments and supplementary technical and organisational measures where appropriate.
Relevant transfer references: EU Standard Contractual Clauses; ICO International Transfers guidance
Copies of relevant safeguards may be requested from the Data Protection Officer, subject to appropriate confidentiality protections.
12. Data retention
Getronics retains personal data only for as long as necessary for the purposes for which it was collected, including to meet legal, regulatory, contractual, accounting, reporting, audit and dispute-resolution requirements.
Category
Typical retention approach
Customer records
Contract term plus applicable limitation periods.
Supplier records
Contract term plus applicable limitation periods.
Recruitment records
Normally between 12 to 24 months after recruitment activity, unless a longer period is required by law or the candidate becomes an employee.
Marketing contacts
Until withdrawal of consent, opt-out, suppression requirement or inactivity-based deletion.
Support tickets and service records
In accordance with operational retention schedules and customer contract requirements.
Security logs and incident records
In accordance with security, legal and regulatory retention requirements.
Financial records
Applicable statutory accounting and tax retention periods.
Legal claims, audits or investigations
For as long as necessary to manage the matter and any related limitation, regulatory or evidence-retention period.
13. Information security
Getronics applies appropriate technical and organisational measures to protect personal data against unauthorised access, improper use or disclosure, unauthorised modification, unlawful destruction and accidental loss.
- encryption and secure transmission where appropriate
- role-based access controls
- authentication and monitoring controls
- incident management processes
- vulnerability management
- security testing and assurance
- supplier assurance and contractual controls
- staff confidentiality and security obligations
Access to personal data is restricted to authorised personnel with a legitimate business need.
14. Your privacy rights
Subject to applicable law and any relevant conditions, exemptions or limitations, individuals may have the right to:
- request access to personal data
- request rectification of inaccurate personal data
- request erasure of personal data
- request restriction of processing
- object to processing
- withdraw consent where processing is based on consent
- request data portability
- object to direct marketing
- challenge solely automated decision-making where applicable
- lodge a complaint with a competent supervisory authority
Requests should be submitted to dpo@getronics.com. Getronics may request appropriate proof of identity before disclosing personal data or acting on a request.
External rights guidance: ICO UK GDPR guidance and resources
15. Cookies and similar technologies
Getronics uses cookies and similar technologies to operate its websites, improve functionality, analyse usage, enhance security and support marketing activities.
Cookies may be categorised as strictly necessary, functional, performance and analytics, advertising and targeting cookies. Non-essential cookies are used where permitted by law and in accordance with consent choices made through the Cookie Preference Centre.
Visitors can manage or withdraw cookie preferences through the Cookie Preference Centre available on Getronics websites. Disabling certain cookies may affect website functionality. If you cannot see the Cookie Preference Centre on the website please clear your browser and reload the Getronics website.
16. Third-party websites
Getronics websites may contain links to third-party websites. Getronics is not responsible for the privacy practices, security or content of those websites. Individuals should review the privacy notices of third parties before providing personal data.
17. Changes to this privacy notice
Getronics may update this Privacy Notice to reflect changes in law, services, technology, business operations or data processing activities. The latest version will be made available on the Getronics website. Where required by law, Getronics will notify affected individuals of material changes.
18. Contact us
If you have any questions about this Privacy Notice or how Getronics processes personal data, please contact:
Getronics Data Protection Officer: dpo@getronics.com