1.1 Brain Source International is registered at 42-44 Bishopsgate, London, EC2N 4AH, United Kingdom, with company registration number 3845281, and ACUM WORKFORCE GLOBAL SOLUTIONS LIMITED is registered at Floor 5, Flat/Office 502, Themistokli Dervi 39, 1066 Nicosia, Cyprus, with company registration number C424720, and both are trading under the Acumen International™ trademark, herein referred to as “Acumen”.
This data privacy notice (“Notice”) sets out the types of information that Acumen collects about you, the purposes for which it is collected, the basis on which we process it.
This Notice does not form part of any contract and does not confer any contractual right on you or place any contractual obligation on Acumen. Acumen may update or otherwise amend this Notice at any time.
1.2 Acumen collects and processes personal details that you provide as part of the provision of HR services (payroll calculation, assistance in obtaining work permits and visas, and communication on employment issues).
It is Acumen practice to comply with our obligations under the European General Data Protection Regulation (“GDPR”), the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, including other applicable local laws. But you also you should be careful to whom you disclose personal data, and how you protect communications and devices.
1.3 “Personal data” refers to information that relates to an identified or identifiable natural person, such as a name, an identification number, location data, an online identifier, or one or more factors specific to the physical, economic, or social identity of that individual. Personal data includes, for example, contact details and date of birth.
Acumen processes personal data. In this context, “processing” means dealing with the data in any way, such as using, disclosing, or destroying it.
The variety of personal data that Acumen processes will differ depending on role, location, and any terms and conditions of contract relevant to each person.
The types of personal data that Acumen processes will include, but may not be limited to, the following:
- Identity Data– for example name, date of birth, gender, personal contact details, emergency contact/next of kin details, immigration and eligibility to work data and languages spoken;
- HR Data – for example your work contact details (corporate email address and telephone numbers), employee number, photograph, job title, professional qualifications primary work location, working hours and your terms and conditions of employment, details of pay and benefits package, bank account details, grade, social security number, tax information, holiday and family-related leave records, absence records, medical forms, reason for leaving, termination arrangements;
- Recruitment Data – for example, any personal data contained in your CV, application form, and other verification documentation, visa, work permit and other migration supporting documents;
- Any other personal data which you choose to disclose to Acumen personnel during the course of provided HR services,
1.4 To the extent permitted by local laws, Acumen may also collect and process a limited amount of personal data falling into special categories. Within this category, Acumen collects and records information relating to health (sick leaves and other medical documents for the migration service) and police background check as permitted by applicable laws.
1.5 In general, the personal data Acumen processes about individuals has been provided by themselves when submitting a registration form during the period of providing services by Acumen.
Acumen may also receive your personal data from employers, if permitted by applicable law.
If Acumen necessarily asks you to provide us with personal data, we will inform you of this at the time of data collection, and if certain information is required by contract or law, this will be indicated. Failure to provide any mandatory information will mean that we will not be able to perform certain processes and provide services. In some cases, this may mean that we will not be able to continue working or collaborating because Acumen will not have the personal data that we believe is necessary for the efficient and effective provision of services.
Acumen may also process personal data of other third parties that you provide, including dependents and other family members, for the purpose of administering benefits and for contacting them in emergencies. Before providing such personal data of other individuals to Acumen, you must first notify such individuals of any such data you intend to provide to Acumen and of the processing that Acumen will perform as set out in this Notice.
1.6 Your personal data is collected and processed for different business purposes, in accordance with applicable laws. Data may occasionally be used for purposes not obvious to you where the circumstances warrant such use.
Acumen generally processes your personal data under one of the following bases:
- you have given your consent for one or more specific purposes (GDPR, Article 6 1. (a));
- the processing is necessary for the legitimate interests pursued by Acumen (being those purposes described in the section below), except where such interests are overridden by your interests or fundamental rights and freedoms which require protection of personal data (GDPR, Article 6.1(f));
- the processing is necessary for compliance with a legal obligation to which Acumen is subject (GDPR Article 6.1(c)); or
- the processing is necessary for the performance of a contract (GDPR Article 6.1(b)).
We may on occasion process your personal data for the purpose of the legitimate interests pursued by a third party (GDPR Article 6.1(f)), except where such interests are overridden by your interests or fundamental rights and freedoms which require protection of personal data.
We process your personal data for performance of the HR service contract or employment. These purposes each relate to a lawful basis for processing, as required under applicable law. These purposes include:
- Recruitment: this processing is necessary to take steps at the clients’ request to enter a contract of employment or contract of services. This processing is also necessary for the purpose of the legitimate interests pursued by Acumen for performing HR service contracts;
- Employment: to comply with legal obligations, such as those related to labor protection laws;
- Immigration process: this processing is required for the purpose of the legitimate interests pursued by Acumen for performing HR service contracts in terms of immigration support;
- Administration of remunerations: this processing is obligatory for the purpose of the legitimate interests pursued by Acumen for performing HR service contracts;
- Communications: this processing is necessary for the purpose of the legitimate interests pursued by Acumen for performing HR service contract
- Protecting the confidential information: this processing is binding for the compliance with Acumen legal obligations;
- Complying with applicable regulations: this processing is obligatory for the purpose of the legitimate interests pursued by Acumen for performing HR service contracts;
- Business Management: this processing is also necessary for the purpose of the legitimate interests pursued by Acumen. Acumen has a legitimate interest in sharing information with its owners, investors, auditors, lawyers, courts in dispute resolution processes and asset managers for them to be able to carry out the necessary reviews and analyses in their capacities;
- Maintenance of IT systems: this processing is obligatory for the purpose of the legitimate interests pursued by Acumen for performing HR service contracts and in managing the IT function, which is crucial.
Please note that this not an exhaustive list and we may process your personal data for other purposes that are consistent with the legal acts.
1.7 Also Acumen may process special categories of personal data. This will always be justified on the basis of an additional lawful condition.
The processing of special categories of personal data (for example, data relating to health, police records etc) will be justified by one of the following special conditions:
• the processing is necessary for the purposes of carrying out obligations under employment law, social security law and for social protection, if there is no reason to believe that your legitimate interests for excluding the processing of your personal data prevails (Article 9 2. (b) GDPR) (for example, complying with health and safety rules, statutory sick pay);
• the processing is voluntary and is carried out subject to your explicit consent for one or more specific purposes (Article 9 2. (a) GDPR);
• the processing is necessary for the establishment, exercise or defence of legal claims (Article 9 2. (f) GDPR) (whether a claim is made by you or a third party);
• the processing is necessary for an assessment of your working capacity carried out by a health professional (Article 9 2. (h) GDPR) (for example, health report for migration).
These purposes each relate to a lawful basis for processing, as required under applicable law. These purposes include:
- Immigration process: this processing is required for the purpose of the legitimate interests pursued by Acumen for performing HR service contracts in terms of migration support;
- Administration of remunerations: this processing is obligatory for the purpose of the legitimate interests pursued by Acumen for performing HR service contracts.
We may seek your consent to certain processing which is not otherwise justified under one of the above bases. If consent is required for the processing in question, it will be sought from you separately to ensure that it is freely given, informed and explicit. Information regarding such processing will be provided to you at the time that consent is requested, along with the impact of not providing any such consent.
We will process criminal data relating to you should any criminal activity take place in connection with immigration, in order to obtain documents for work permission or visa.
If such personal data constitutes criminal data as defined under Article 10 of the GDPR, we will only process such data if necessary to establish, exercise legal procedures.
1.8 Acumen only retains contractors’ employee’s personal data for as long as required to satisfy the purpose for which it was collected by us or provided by you. We therefore will retain your personal data as a minimum for the duration of your employment with the contractor or for a shorter period if your personal data is no longer necessary for the purpose for which it was collected or no longer accurate/up to date.
In certain cases, legal or regulatory obligations (for example in the case of tax related matters) require us to retain specific records for a set period of time, including following the end of legal relations.
We are using the following criteria to establish our retention period: (i) as long as we have an ongoing contract relationship with clients or contractors; (ii) as required by legal obligations to which we are subject (such as tax and accounting obligations); (iii) as advisable in light of our legal position (such as applicable statutes of limitations) in order to establish, exercise and defend against legal claims; and (iv) as necessary to meet our legitimate business needs (such as for forecasting, planning, follow-up etc).
1.9 The global nature of our business means that your personal data may be disclosed to members of the Acumen group outside of the EEA, particularly in the UK and Ukraine. Certain suppliers and service providers may also have personnel or systems located outside of the EEA. As a result, your personal data may be transferred to countries outside of the country in which you work to countries whose data protection laws may be less stringent than yours.
In this context, your personal data may be transferred outside the European Economic Area (EEA) for the purposes set forth in this Notice, to countries that may not offer a level of protection of personal data equivalent to that offered within the EEA.
Where third parties transfer your personal data outside of the EEA, Acumen will take steps to ensure that your personal data receives an adequate level of protection, including by, for example, entering into data transfer agreements or by ensuring that third parties are certified under appropriate data protection schemes. Acumen will comply with applicable personal data protection laws and take appropriate measures to ensure that your personal data is protected in accordance with the laws.
1.10 Within your organisation, access to your personal data will be limited to your direct and indirect line managers, HR professionals, and, where appropriate, other colleagues who require such information to perform their duties. We may also be required to disclose your personal data to third parties were permitted under local law. This will include suppliers which help us provide HR services, tax or other authorities, a regulator or a professional adviser.
Examples of third parties with whom your data may be shared include tax authorities, medical/occupational health professionals, regulatory authorities, law enforcement and regulatory bodies, Acumen’s insurers, bankers, IT administrators, lawyers, accountants, data centre providers, auditors, notaries, investors, lenders, office access providers, consultants and other professional advisors, payroll/tax providers, and administrators of Acumen’s benefits programs. Your personal data is also accessed by third parties whom we work together with in connection with IT services, such as hosting, supporting and maintaining the framework of our information systems.
Acumen expects such third parties to process any data disclosed to them in accordance with applicable law, including with respect to data confidentiality and security in line with applicable law restrictions and signed NDA.
1.11 Acumen aims to ensure that all personal data we store are correct. You also have a responsibility to ensure that changes in personal circumstances (for example, change of address) are notified to Acumen so that we can ensure that your data is up to date.
You have the right to request access to any of your personal data that Acumen may hold and ask us to: (i) confirm whether we are processing your personal data; (ii) give you a copy of that data; (iii) provide you with other information about your personal data.
Also, you have the following rights:
- to request us to rectify any inaccurate personal data relating to you;
- to withdraw consent – where you have provided us with your consent to process data, you have the right to withdraw such consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal;
- to request erasure of any irrelevant personal data we hold about you, but only where:
- it has been processed unlawfully;
- it is no longer needed for the purposes for which it was collected or otherwise processed;
- you have withdrawn your consent (where the data processing was based on consent) and there is no other legal ground for the processing;
- following a successful right to object;
- for comply with a legal obligation to which we are subject.
We may not be able to comply with your request to erase your personal data where the processing is required to comply with a legal obligation or is necessary for the establishment, exercise, or defence of legal claims.
- to restriction of processing where:
- you contest the accuracy of the personal data until we have taken sufficient steps to correct or verify its accuracy;where we no longer need the personal data for the purposes of the processing, but you require them for the establishment, exercise or defence of legal claims;
- where we no longer need the personal data for the purposes of the processing, but you require them for the establishment, exercise or defence of legal claims;
- where you have objected to processing justified on legitimate interest grounds (see below) pending verification as to whether Acumen has compelling legitimate grounds to continue processing.
You also have the right to lodge a complaint with a supervisory authority, in particular in your country of residence, if you consider that the processing of your personal data infringes applicable law.
You may contact Acumen at any time if you have general concerns about the processing of your personal data, or any data protection issue. The email address is privacy.enquiries@expressglobalemployment.com.
1.12 Acumen may undertake certain processing of personal data which are subject to additional Privacy Notices, and we shall bring these to your attention where they engage.
Acumen may change or update this Privacy Notice at any time. Should we change our approach to data protection, you will be informed of these changes or made aware that we have updated this Notice so that you know which information we process and how we use this information.
This Notice was last updated and reviewed in September 2025