We are Endava plc, incorporated in England with registered number 05722669 with our registered office at 125 Old Broad Street, London, EC2N 1AR, United Kingdom.

When we say “we”, “us”, or “our”, we mean Endava plc or any of its affiliated group companies (“Endava Group”), which may act as a data controller in respect to your personal information.

This notice covers information we collect about you in connection with www.endava.com (this “Website”) and applies to visitors to this Website as well as job applicants.

Unless otherwise stated in this notice, Endava plc is the provider of this Website. Endava Group is the data controller of the personal information which we collect about you through this Website and our relationship with you.

When someone visits www.endava.com, we collect standard internet log information and details of visitor behaviour patterns. We do this to find out things such as the number of visitors to the various parts of the site. We collect this information in a way which does not identify anyone. We do not make any attempt to find out the identities of those visiting our Website. We will not associate any data gathered from this site with any personal information from any other source. If we do want to collect personal information data through our Website, we will be up front about this. We will make it clear when we collect personal information and will explain what we intend to do with it.

When you complete our “Contact Us” form on this Website or when attending an event, we may ask you to give us some personal information including:

■ name,
■ email address,
■ telephone number,
■ company,
■ country/region, and

any other information that you choose to provide.

When you apply for a role with the Endava Group

If you choose to apply for a job advertised on the Careers pages of this Website, you will be asked to provide your:

■ First name
■ Last name
■ Email address and
■ Phone number 

You can also import a profile of your personal and professional information from LinkedIn, in which case the information contained in your LinkedIn profile (such as your current job role and employer) will be provided to us by LinkedIn and used to populate our online recruitment form, or upload your curriculum vitae (CV).

When you complete a “Contact Us” form

■ We use the personal information that you provide on our online contact form to respond to and follow up on your query.
■ When you complete a contact form, we ask you if you would like to subscribe to our newsletter. If you select the respective box, you will receive a copy of our newsletter on a monthly basis by email. This is optional, and choosing not to subscribe will not affect your use of this Website. You can opt out of receiving this newsletter at any time by following the link provided in the email containing the newsletter or by contacting us. In some circumstances, we collect information about you from our partners or from publicly available websites to help us better understand our audience and enhance the relevance of our content.
■ We maintain a record of any opt-out requests that we receive.

When you apply for a role with the Endava Group

■ We use the personal information that you submit to us on our recruitment page to decide on your suitability for the role that you have applied for.
■ If you are successful and accept the role, we will use your personal information provided during the online application process to carry out pre-employment screening (further details of which will be provided to you at the time), and this information will also form part of your employment file.
■ If you are unsuccessful or choose not to accept the role, we will retain your details for a as long as required for the purpose of processing your application. You have the option to consent for us to keep your data for longer periods so we can keep in touch. In such cases we will not keep your details for longer than 24 months from the date of your application. Please note that in certain countries in which we operate, we may be required by local laws to keep your details on file for a longer period. You can ask us to delete your data at any time.  

Other ways in which we may use your personal information

We may use your personal information:
■ to provide you with any other information, products, and services that you request from us;
■ to ensure that content from our Website is presented in the most effective manner for you and your device, and to fulfil other business purposes, such as product development and website administration;
■ to allow you to participate in interactive features on our Website when you choose to do so;
■ for record keeping, statistical analysis, internal reporting, analytics, and research purposes;
■ to ensure data security and to provide you with access to any secure areas of our Website;
■ to investigate any complaint you make;
■ to train our staff;
■ to provide evidence in any dispute or anticipated dispute between you and us;
■ to support the effective operation of our Website and to make improvements to it;
■ for internet and other network activity information including information regarding your interaction with our Website or use of certain online tools;
■ for business and disaster recovery, document retention/storage, IT service continuity (e.g. backups), and
■ to protect the rights, property, and/or safety of the Endava Group, our customers, and our personnel.

We take appropriate measures to ensure that all processing of your personal information by us or by our service providers is lawful. The lawful basis for the processing of your personal information will depend on the purposes for which we process your information.

The legal grounds for our processing of your personal information are as follows:

 ■   where you have provided your consent for receipt of our newsletter by email;
 ■   to the extent that you have given us your permission to do so, we will use relevant personal information to enable us to provide you with information about products, special offers, and services that may be of interest to you;
 ■   to comply with our legal obligations when recruiting staff (e.g. we will request proof of the right to work);
 ■   where this is necessary for the performance of a contract with you, or in order to take steps at your request before entering into a contract with you; and
 ■   where necessary for our legitimate interests:
 ■   in responding to contact requests and making follow-up communications,
 ■   in recruiting staff, and 
 ■   in carrying out the purposes listed under “Other ways in which we may use your personal information” above. 

You can object to processing carried out on the basis of our legitimate interests at any time by contacting our Data Protection Officer. See also “Your Rights – The right to object”.

Where we are legally required to obtain your consent including in relation to processing special categories of personal information (including data concerning your health, racial or ethnic origin), we will ask you for it at the relevant time. If you choose to give your consent you have the right to withdraw your consent at any time. If you choose not to give your consent, or decide to withdraw your consent we may not be able to perform some of the tasks we need to in order to provide certain products or services to you and may in some cases need to end our relationship with you as a consequence.

We may share your personal information with other companies in the Endava Group for the purposes of:
■   marketing and business-winning purposes, either between various business sectors or geographies, so that the most suitable people can follow up on the opportunities;
■   internal and external audits;
■   data hosting; and
■   potential recruitment opportunities within the Endava Group.

We also share your personal information with
■   third-party provider(s) who provide the following types of services to us: website hosting, support and maintenance, and pre-employment screening;
■   our accountants, auditors, lawyers or similar advisers when we ask them to provide us with professional advice;
■   investors and other relevant third parties in the event of an actual or potential sale or other corporate transaction related to an entity in the Endava Group;
■   relevant third parties for the purposes of doing what a court, regulator or government, or crime prevention agency (including the police) requires us to do, for example, complying with a search warrant or court order or acting as required or permitted by applicable laws or regulation; and
■   any other third parties if authorised by you to do so in relation to a specific disclosure.

The performance of services by a third-party service provider may be subject to a separate privacy statement provided to you by such third party. You should read this statement carefully.

The security and confidentiality of your personal information is extremely important to us. We have technical, administrative, and physical security measures in place to:
 ■   protect your personal information from unauthorised access and improper use,
 ■   secure our IT systems and safeguard the information, and
 ■   ensure we can restore your information in situations where the data is corrupted or lost in a disaster recovery situation.

Where appropriate, we use encryption or other security measures which we deem appropriate to protect your personal information. We also review our security procedures periodically to consider appropriate new technology and updated methods. While no measure is impenetrable, we do our best to ensure that your personal information remains safe.

We may transfer your personal information to other countries. The countries in the European Economic Area are considered to provide the same level of protection to personal information as the UK does. Companies outside the European Economic Area with whom we may share your personal information include our other Endava Group companies, IT providers, and other suppliers. If your personal information is transferred to any country outside the UK and the European Economic Area, either to another Endava Group company or a third party, we make sure that this is done using specific, legally approved safeguards.

We keep your personal information for no longer than is necessary for the purposes for which the personal information is collected. When deciding how long we should keep your personal information, we take into account factors such as

 ■   legal obligation(s) under applicable law to retain data for a certain period of time,
 ■   (potential) disputes, and
 ■   guidelines issued by relevant data protection authorities.

Otherwise, we securely erase your information once it is no longer needed.

If you would like further information about how long we keep your personal information for a particular purpose, please contact us.

When you use our Website, we will process your personal information collected by cookies in accordance with our Cookie Policy.

This section explains your rights in relation to your personal information. These rights are not absolute, and each is subject to certain exceptions or qualifications.

Right	What does it mean?
1. The right to be informed	You have the right to be provided with clear, transparent, and easily understandable information about how we use your personal information and your rights. This is why we are providing you with the information in this Privacy Notice.
2. The right of access	You have the right to obtain access to your personal information (if we are processing it) and certain other information (similar to that provided in this Privacy Notice).
3. The right to rectification	You are entitled to have your personal information corrected if it is inaccurate or incomplete.
4. The right to erasure	This is also known as ‘the right to be forgotten’ and enables you to request the deletion or removal of your personal information if there is no compelling reason for us to keep using it. This is not a general right to erasure; there are exceptions.
5. The right to restrict processing	You have the right to ‘block’ or suppress further use of your personal information. When processing is restricted, we can still store your personal information but may not use it further. We keep lists of people who have asked for further use of their information to be ‘blocked’ to make sure the restriction is respected in future.
6. The right to data portability	You have the right to obtain and reuse your personal information for your own purposes across different services.
7. The right to object	You have the right to object to certain types of processing, including processing for direct marketing (which we do only with your consent).
8. The right not to be subject to a decision based solely on automated processing, including profiling	You have the right not to be subject to a decision based solely on automated processing, including profiling. There are exceptions to this for example if required to enter into a contract with you, or where based on your explicit consent or where required under applicable law. In some circumstances you will also have the right to human intervention to express your point of view and to contest the decision made.

Further information and advice about your rights can be obtained from the Information Commissioner’s Office (ICO): https://ico.org.uk/ or the relevant data protection regulator in your jurisdiction.

We usually act on requests and provide information free of charge but may charge a reasonable fee to cover our administrative costs of providing the information for
 ■   baseless or excessive/repeated requests, or
 ■   further copies of the same information.

Alternatively, we may be entitled to refuse to act on the request.

Please consider your request responsibly before submitting it. We will respond as soon as we can. Generally, this will be within one month from when we receive your request, but if the request is going to take longer to process, we will come back to you and let you know.

If you are unhappy with how we have handled your information, please contact our Data Protection Officer at Privacy Enquiries.

If you are not satisfied with our response to your complaint or believe our processing of your personal information does not comply with data protection laws, you can make a complaint to the Information Commissioner’s Office (ICO) or the relevant data protection regulator in your jurisdiction.