Privacy & Data Protection Policy

Last revised: June 2, 2023

Purpose

Talent Beyond Boundaries (TBB) collects, stores and uses personal data in order to deliver our services, monitor and evaluate our outcomes and perform other essential organizational functions including communications and fundraising. TBB is committed to treating the personal data we collect and use in a responsible manner. This policy guides how we ensure privacy and protection of personal data, in accordance with data protection regulations and best practices.

Scope

This policy sets out how we collect, store and use personal data from data subjects including:

Talent Catalog registrants

  • Past and current active candidates

  • Other contacts

    • supporters, donors and newsletter subscribers

    • employment and referral partners

    • personnel (staff, volunteers, interns, contractors)

  • Website visitors

This policy applies to all of TBB’s operations globally and is mandatory for all TBB personnel.

Principles 

We are guided by the following data protection principles:

  • Transparency and consent: We are transparent about why, how, and when we make use of personal data and seek explicit consent of data subjects for uses of their data. 

  • Necessity and proportionality: We seek only to collect, store or otherwise use that personal data which is necessary for the fulfillment of our mission.

  • Lawfulness and integrity: We comply with legal requirements in each of our countries of operation and act with integrity in our use of personal data.

  • Privacy and security: We uphold and protect the privacy of all data subjects.

Definitions

Active candidates: Individuals who have undergone an “intake” process with TBB.

  • Contacts: Non-service users who have an involvement in TBB’s activities in another respect. This includes

    • Supporter and donors

    • Visitors to our website and social media pages (including newsletter recipients)

    • Employment partners and referral partners

    • TBB personnel

  • Consent: Freely given and informed agreement by a data subject to the processing of their data in writing, verbally, or by a clear affirmative action.

  • Data processing: Any operation or set of operations, automated or not, which are performed on personal data, including but not limited to collection, recording, organization, structuring, storage, adaption, use, transfer, dissemination, destruction, etc.

  • Data Protection Officer: Staff person who supervises, monitors and reports on compliance with this policy. 

  • Data subject: An individual whose personal data is subject to processing.

  • Intake: An interview conducted by TBB personnel with active candidates to assess their eligibility for our program, visa eligibility and suitability for an employment opportunity.

  • Partner: An independent organizational entity from TBB that TBB engages in an agreement with to advance its mission.

  • Personal data: Information related to an individual who can be personally identified from that information and may include: name, sex, marital status, date and place of birth, country of origin, country of asylum, individual registration number, religion, ethnicity, race, occupation, and biometric data. It does not include aggregated, anonymized and otherwise de-identified data. 

  • Personal data breach: The accidental, unlawful, or illegitimate destruction, loss, alteration, unauthorized disclosure, transfer or storage of personal data.

  • Talent Catalog registrants: Individuals who have created profiles on TBB’s Talent Catalog whose names and contact details are held by TBB but who have not undergone an “intake” process with TBB.

Personal Data Collected

Talent Catalog registrants

Talent Catalog registrants are invited to share:

  • First and last name

  • Gender

  • Contact information

  • Date of birth

  • Nationality

  • Country of origin 

  • Country of asylum

  • UNHCR or other refugee registration status

  • Educational background

  • Employment history

Active candidates

Active candidates are asked to share the above personal information as well as:

  • Information about their need for international protection (in order to ensure eligibility for TBB’s program)

  • Proof of UNHCR or other refugee registration, if relevant

  • Personal identification documents 

  • Marital status

  • Number, ages and relationship of dependents 

  • Other personal data relating to visa eligibility considerations including history of visa applications, potential security or health concerns.

Active candidates who have successfully secured a job offer and are proceeding to apply for a visa may be asked to provide additional personal information in order to assist them through the visa application process. Normally personal information collected for visa purposes is collected by immigration lawyers or migration agents acting on behalf of the candidate, however, often TBB will be asked to assist with the collection and certification of documents, translation of documents and other activities that give rise to the sharing and storage of personal information. 

TBB may also collect information from candidates regarding their income situation, banking arrangements and financial needs in order to assist them to secure finance necessary for relocation. 

Once active candidates have successfully secured a visa to their destination country TBB also collects personal information regarding their relocation experience, job satisfaction and settlement circumstances in the form of pre-departure and post-arrival surveys.

Contacts

  • Supporters, donors and newsletter recipients may be asked for:

    • First and last name

    • Contact information

  • Personnel

    • First and last name

    • Contact information

    • Banking, financial or tax information as needed for issuing payment

    • History of employment

Website Visitors

TBB’s website and email marketing platform is hosted by Squarespace, that collects the following personal data from visitors:

  • Information about browser, network, and device

  • Web pages visited prior to coming to this website

  • IP address

This information may also include details about visitor use of this website, including:

  • Clicks

  • Internal links

  • Pages visited

  • Scrolling

  • Searches

  • Timestamps

    This website also uses cookies and similar technologies. Information about the cookies dropped on visitor devices is available at: The cookies Squarespace uses.

Data collection 

When collecting data from all data subjects, TBB must communicate:

  • The specific purpose for collecting that data

  • Whether that data will be shared with any partners and under what circumstances

  • How subjects can later alter, delete, request, or correct their data

  • The subject’s right to decline to provide any personal data

  • Any consequences for failing to share that personal data

  • A contact and process for lodging a complaint about how their data has been collected, used, or processed

All platforms used by TBB uphold high levels of data protection and are General Data Protection Regulation (GDPR) compliant.

Talent Catalog registrants

  • When registering on the Talent Catalog, individuals consent to their data being used in line with this policy. 

  • We collect data from Talent Catalog registrants using our online Talent Catalog. Registrants can independently access the Talent Catalog on their personal devices at tbbtalent.org. TBB’s Talent Catalog is hosted on Amazon Web Services (AWS) and uses its security.

  • Text on the Talent Catalog is explicit about the collection and use of data for Talent Catalog registrants. 

Active candidates 

  • All active candidates sign a participant collaboration agreement which provides written consent for collection and use of their additional personal data.

  • TBB stores additional personal information about active candidates on GoogleDrive, SurveyMonkey, Slack and Salesforce and uses their security.

  • All active candidates participating in a pre-departure or post-arrival surveys provide explicit written or verbal consent to be surveyed about their experience with our program.  

Contacts

  • Details of personnel, employment and referral partners, and donors are stored on TBB’s Salesforce, Gmail, and Google Drive. All storage platforms are password controlled.

  • Contact details for newsletter recipients are stored on SquareSpace with recipients’ permission, which was provided when signing up to the newsletter. No contact details are shared without explicit permission.

Website visitors

  • Visitors to our website are notified that by using the site they agree to our use of cookies. 

  • Data relating to website visitors is held by Squarespace. 

Data use 

Talent Catalog registrants

  • Personal information on the Talent Catalog is used for the purpose of Identifying suitable employment opportunities for registrants.

  • TBB shares information provided on a Talent Catalog profile with employers or formal employment/referral partners for the sole purpose of identifying potential employment opportunities. 

  • Where TBB seeks to share a Talent Catalog profile with an additional third party beyond employers or formal employment/referral purposes, we will only do so in a de-identified form removing all identifying information (such as full name, contact information, date of birth, etc.).

  • TBB uses aggregate, de-identified data from the Talent Catalog for the purposes of advocacy and communication about the breadth and depth of talent in displaced populations. 

  • TBB only uses the contact information on the Talent Catalog for the purpose of contacting an individual about gathering further information relevant to a potential employment or immigration opportunity, or to offer capacity building resources, or candidate surveys, or to notify individuals of a data breach.

  • These uses are made explicit to registrants on the Talent Catalog. Registration on the Talent Catalog provides TBB consent to use data in accordance with the above uses. Any changes to these uses will be reflected in this policy and on the Talent Catalog.

Active candidates 

  • Personal information collected in TBB’s “intake” process is used for the purpose of identifying eligibility for TBB’s assistance, suitability for employment opportunities, and eligibility for visa schemes.

  • Personal information collected in Salesforce is to record the support active candidates have received from TBB and planned next steps.

  • Personal information recorded through surveys is intended to document the outcomes candidates have achieved through TBB support for monitoring and evaluation purposes. 

  • Where active candidates have signed a participant collaboration agreement TBB may share their  personal information, as necessary, with the following third parties:

    • employers and employer partners in relation to the recruitment and selection process; 

    • destination country immigration officials and experts in relation to assist in a visa application process; 

    • third party service providers in relation to the settlement planning, travel booking and other relocation preparation; and 

    • with financial service providers in order to provide candidates with access to finance required for migration. 

  • TBB asks candidates for explicit permission before sharing any personal data about them with any host country government official or UNHCR.

  • TBB may submit information about active candidates as programme evidence to donors and global TBB Team.

  • TBB draws on personal information about active candidates in its data analysis to inform our future programming, providing monitoring and evaluation reports to be shared both internally and externally.

  • TBB will use an active candidate’s personal data to ensure they are not a “target person” on relevant international sanctions lists as outlined in TBB’s Official Sanctions Policy.

Contacts

  • TBB uses personnel’s personal data to ensure appropriate and lawful payment and administration.

  • TBB uses contact information collected from SquareSpace for distribution of e-newsletter including funding appeals and requests for donations, or promotion of events and opportunities.

Website visitors

  • TBB shares website visitor information with Squarespace, our website analytics provider, to learn about site traffic and activity so we can tailor our website content effectively. 

  • Squarespace also uses the data to protect and improve its platform and services.

  • Squarespace analyzes the data in a depersonalized form.

  • TBB’s website uses cookies in order to improve site function and performance. 

Data storage, rectification & security 

Organizational security measures 

  • All incoming personnel or partner representatives are required to sign the TBB Confidentiality Agreement which outlines the need to protect personal data against loss, accidental destruction, misuse, or disclosure, and to ensure that data is not accessed, except by employees, contractors or interns in the ordinary and proper performance of their duties.

  • All incoming personnel with access to personnel data must read this policy and undergo training on proper use of each of TBB’s data collection and storage platforms.

Technical security measures 

  • Passwords - All systems that store personal data TBB must be password protected. TBB sets a strong password safety requirement through its technology providers, Google and Salesforce. TBB requires staff to change their password on the Talent Catalog annually. 

  • Account sharing - TBB does not allow the use of account sharing for any platform that contains personal data.

  • Personnel departure - TBB deletes relevant storage accounts for all departing personnel within 3 months of their departure, and transfers their data to appropriate personnel still within the organization.

  • Paperless working - TBB will seek to reduce the use of paper records of individuals’ personal data to reduce vulnerability to data breaches.

  • Data destruction - TBB will only keep data as long as it is relevant to our operations and program. A data subject has the right to have their personal data erased at their request. This data will be deleted or destroyed as follows:

    • Personal data stored electronically will be deleted.

    • Personal data stored in hard copy will be shredded.

  • Individual data rectification - All individuals who provide personal data to TBB have the right to rectify, alter, request, delete, or request cessation of processing of that data. TBB ensures this function is enabled on the Talent Catalog so that Talent Catalog registrants have full control over their data. For data held on other platforms (Google, Salesforce, Squarespace, etc) any subject may request access to or deletion of their data. We may limit our responses in cases where it would be necessary for safeguarding the safety and security of personnel or partners, or there is an overriding operational need and priority of TBB in pursuing its mission.

  • Security breach - If we find that there has been a breach which poses a risk to the rights of any individual whose personal data has been exposed, TBB will report this to any relevant country’s Information Commissioners within 72 hours of discovery. We will record all data breaches regardless of their effect. If the breach is likely to result in a high risk to the rights and freedoms of individuals, we will tell affected individuals that there has been a breach, and provide them with information about its likely consequences and the mitigation measures we have taken. Breaches might include the loss of a computer or phone, an incident of hacking or password loss, or other unintentional data loss or destruction.

Data-sharing partnerships 

TBB will require all partners who will be recipients of TBB’s personal data to comply with this policy or a policy that affords a similar level of data protection. Partnership agreements will specify the nature of personal data that is to be shared and the purpose for sharing. TBB will ensure that representatives of the partner organization sign confidentiality agreements.

Where TBB receives personal data about a data subject from a partner, TBB will uphold this policy.

Email and Marketing 

From time to time TBB will contact individuals at organisations to let them know about our events, and programmes. The legal basis for such processing of data and sending mailouts is our legitimate interests in our work, and raising awareness to those who are identifiable as benefiting from our work. 

UK / EU Data Protection 

In compliance with UK and EU GDPR standards TBB ensures transparency where data processing may be undertaken in countries outside of the EU. This may happen via cloud services and external service providers who are located outside of the EU, and process data on our behalf. TBB requires that all of external service partners have rigorous Data Protection safeguards in place to ensure the data is secured. TBB will either:

  • only transfer personal data to countries which are recognised as providing an adequate level of legal protection in accordance with Article 45 of the GDPR; or

  • ensure that transfers outside the European Union are subject to an appropriate legal safeguard - for example, the EU Model Clauses pursuant to Article 46(2) of the GDPR and/or the EU - U.S. Privacy Shield for the protection of personal data transferred to the US.

This policy is subject to change. Any revisions will be reflected on this site. Please reach out to info@talentbeyondboundaries.org (Attn: Data Protection Officer) with any questions about this policy.