November 2021
1. Purpose and content
1.1 Nuveen Europe & APAC, excluding the non-real estate affiliates of Nuveen ("Nuveen" or "we" or the "Company") are committed to protecting the privacy and security of your personal information. This privacy notice contains information about how the Company as a controller or processor, respectively, collects and processes your personal data (as defined by the EU General Data Protection Regulation 2016/679 ("EU GDPR") and the UK implementation of the EU GDPR ("UK GDPR") (each Regulation is referred to as the "GDPR" unless otherwise stated) and other UK and European data privacy laws (together the "Privacy Laws") during and after your working relationship with the Company or any of the Company's affiliates. The Company is a controller when processing personal data of its employees or other Nuveen affiliate employees for its own business purposes and it will be a processor when processing affiliate employee data for that affiliate. This privacy notice only applies to the extent that the Company is acting as a controller.
1.2 This privacy notice applies to current and former employees, workers and contractors, and does not form part of any contract of employment or other contract to provide services.
1.3 The Company is committed to protecting and respecting your privacy and to being transparent about how it collects and uses the data and meets its data protection obligations. The Company strives to provide a high level of protection in all processing of personal data. All processing of personal data is carried out pursuant to applicable Privacy Laws.
1.4 The relevant data controllers are listed in the Appendix.
1.5 It is important that you read and retain this notice, together with any other privacy notice that we may provide on specific occasion when we are collecting or processing personal information about you. It is also important that you are aware of how and why we collect, use and process your personal information and what your rights are under the Privacy Laws. We may update this notice at any time but if we do so, we will notify you by email with a link to an updated copy of this notice as soon as reasonably practical.
2. What personal data will be processed?
2.1 The Company shall ensure that the personal information the Company holds about you will be:
(a) Used lawfully, fairly and in a transparent way;
(b) Collected only for valid purposes that the Company has clearly explained to you and not used in any way that is incompatible with those purposes;
(c) Relevant to the purpose the Company has told you about and limited only tothose purposes;
(d) Accurate and kept up to date;
(e) Kept only as long as necessary for the purposes the Company has told youabout; and
(f) Kept securely.
2.2 We may hold the following types of personal data about you:
- Contact information (name, address, e-mail, phone number);
- Recruitment information (including references and information contained in your resume or CV, and other documents related to the recruitment process and your onboarding to the Company);
- Personal identity number;
- Employment information (terms and conditions of employment, date of employment, position, salary and other benefits, information about your training, professional memberships and performance (including appraisals, performance reviews, performance improvement plans and related correspondence) and details of any disciplinary or grievance procedures in which you have been involved including any live warnings that have been issued to you and related correspondence);
- Information about your nationality and entitlement to work in the UK;
- Information about your next of kin, marital status, dependents and emergency contacts;
- Information about medical or health conditions, including whether or not you have a disability for which the organisation needs to make reasonable adjustments, and, if Nuveen decides it is legitimate and proportionate and accordance with Privacy Laws in the relevant jurisdiction for your employment, COVID-vaccination and COVID-test information;
- Details of trade union membership;
- Equal opportunities monitoring information, including information about your ethnic origin, sexual orientation, health and religion and belief;
- Bank account information, payroll records and tax status information;
- National insurance number;
- Start date and, if different, the date of your continuous employment;
- Leaving date and your reasons for leaving; Information on holiday, sick leave and other absences as well as potential rehabilitation activities;
- CCTV footage and electronic communication or records, such as access and log-in information, e-mail and data traffic, information on entry and exit at the office premises; and
- Information about the Nuveen office or other location at which you are working.
2.3 During the course of your employment we may take your picture for your security pass and where relevant we may also take your pictures and undertake filming for marketing purposes on behalf of the Company. All of the information we collect, hold and process about you is in accordance with local law and applicable Privacy laws.
2.4 In most cases, the Company collects any personal data directly from you through, for example, application forms, CVs or resumes, from your passport or other identity documents such as driving licence and from forms completed by you at the start of or during employment (such as benefit nomination forms). In some cases, processed/stored personal data may originate from other, external sources, e.g. from publicly accessible sources, such as your local tax authority or other public authorities, references supplied by former employers and information from employment background checks.
2.5 We will not collect sensitive information or "special categories of sensitive personal data" (as defined by the Privacy Laws) about you (such as information about your health or medical history; ethnic origin; political or religious beliefs; trade union, guild or other professional associations memberships; sexual orientation; or criminal record) except where set out in this privacy notice or where you have voluntarily provided it to us or where it is required by law.
3. Legal basis for the processing of your personal data
3.1 We process your personal data to the extent necessary to fulfil our obligations under the contract with you, and where processing your personal data is necessary for the purpose of complying with the Company's legal obligations or meeting the legitimate interests of the Company, or of a third party. In certain situations, we may also process your personal data where we need to protect your interests (or someone else's interests), where it is needed in the public interests or for official purposes, or based on your consent (e.g. to publish your picture).
3.2 We process your personal data for the following purposes:
- To run recruitment and promotion processes (e.g. your CV or application);
- To comply with applicable laws, regulations and court orders including checking an employee's right to work in the UK;
- To administer, manage and plan the employment relationship and ensure fulfillment of contractual obligations between the Company and you, e.g. to pay salary and provide other benefits and to operate and keep a record of all types of leave to allow effective workforce management and to ensure the Company complies with its duties in relation to leave entitlement;
- To make necessary deductions for tax and National Insurance contributions;
- To ensure safety and health concerns, and register a contact person in case of accidents/emergencies;
- To keep the company phone and address registry up-to-date;
- To enable you and other Nuveen employees, workers and contractors to locate and contact each other;
- To manage work-related complaints;
- To evaluate and carry out performance management processes;
- To operate and keep a record of disciplinary and grievance processes so as to ensure acceptable conduct in the workplace;
- To maintain and promote equality in the workplace;
- To implement health and safety measures, for public health purposes and related contact tracing processes;
- To maintain accurate training records;
- To provide references on request for current or former employees;
- To administer and provide access to the company IT systems;
- Ascertaining your fitness to work, managing sickness absence, complying with health and safety obligations;
- To prevent fraud and to monitor the use of the Company's information and communications systems and preventing malicious software distribution; and
- Equal opportunities monitoring.
3.3 Some special categories of data, such as information about health or medical conditions, is processed to carry out employment law obligations (such as those relating to employees with disabilities and for health and safety purposes). All of the information we collect, hold and process about you is in accordance with local law and applicable Privacy laws.
3.4 There is a statutory obligation to enumerate all purposes for which personal data is processed, and only those purposes. Consequently, this list will be continuously updated, as information may be processed for new purposes in the future, whereas some purposes may become obsolete.
4. If you fail to provide personal information
If you fail to provide certain information when requested, the Company may not be able to perform the contract we have entered into with you, such as paying you or providing a benefit, or the Company may be prevented from complying with its own legal obligations.
5. Who has access to your Personal Data?
5.1 The Company has implemented appropriate technical and organisational safeguards (through the introduction and use of internal policies, systems and controls) to protect your personal data. The number of persons with access to your personal data is limited. Only individuals associated with the Company that need to process your personal data in accordance with the purposes above, for example HR and recruitment staff (including payroll), your line manager and managers in your business area and IT staff will have access to your personal data if necessary for the performance of their roles.
5.2 The Company may share your personal data with other companies within the Nuveen group and with third party suppliers providing services to the Company in the areas mentioned above. You should be aware that your personal information may be transferred to, stored, and processed in a country outside of the UK/EU/EEA area, such as the United States, that is not regarded by the European Commission or UK's Information Commissioner's Office (as applicable) as ensuring an adequate level of protection for personal information under European or UK law. The Company has put in place appropriate safeguards (such as contractual commitments) in accordance with Privacy Laws and other applicable legal requirements to ensure that your personal information is adequately protected.
6. For how long will your personal data be stored?
6.1 The Company applies different retention periods for different categories of personal data. The Company will retain your personal data in accordance with its Record Keeping Policy. When it is no longer necessary to process your personal data in relation to the purposes for which the data were collected, the Company will erase that personal data.
7. What are your rights?
7.1 The Company is the data controller with respect to the processing of your personal data. As a result, we shall ensure that your personal data are processed in a correct manner, in accordance with, the Privacy Laws.
7.2 You are entitled to know what personal data of yours are being processed, and you can request a copy of your personal information. You are entitled to have any incorrect personal data of yours corrected. In some cases, you may request the erasure of your personal data which enables you to ask the Company to delete or remove your personal information where there is no good reason for the Company to continue to process it. Moreover, you have the right to object to certain processing of your personal data and can request that the processing of your personal data shall be restricted. Please note that restriction or erasure may result in us not being able to fulfil our commitments toward you under our contractual relationship. You also have the right to obtain any of your personal data in a machine-readable format, or have that data transferred to another data controller (so-called "data portability").
8. Questions and complaints
8.1 If you have questions regarding how we process your Personal Data, or if you would like to exercise any of your rights as listed above, please contact the HR Advisory Team (Dawn Kempson, Joanna Singh and Jo Chamkani).
8.2 If you believe that the Company has not complied with your data protection rights, you can complain to the relevant data protection authority in your country of residence whilst working for the Company.
Appendix
List of Nuveen Data Controller Affiliates
- Cityhold Euro S.à.r.l.
- Cityhold Office Partnership S.à.r.l
- Cityhold UK Holding S.à.r.l
- Herald Level 2 Lux Holding S.a.r.l
- Megatrends European Holdings S.à.r.l.
- ND Europe S.a.r.l.
- Neptune Property Venture S.a.r.l.
- Outlet Mall Group Holding S.à.r.l.
- Outlet Mall Holding S.à.r.l.
- TIAA-CREF Luxembourg, S.à.r.l
- Nuveen Real Estate Australia Limited
- Nuveen Hong Kong Limited
- TIAA Global Asset Management LLC SG
- Nuveen UK Limited
- Nuveen Japan Company Limited
- Nuveen Asset Management Europe S.à.r.l Denmark
- Nuveen Administration Limited
- Nuveen Alternatives Europe S.à.r.l
- Nuveen Asset Management Europe S.à.r.l
- Nuveen France SAS
- Nuveen Investment Consulting (Shanghai) Co Ltd
- Nuveen Italy S.r.l
- Nuveen Management Austria GmbH
- Nuveen Management Finland Oy
- Nuveen Real Estate Management Limited, Sucursal en Espana
- Nuveen Real Estate Management Limited, Sweden Filial
- Nuveen Singapore Private Limited