Effective from 1 July 2024
1 INTRODUCTION
Sibanye-Stillwater European Region (“Sibanye-Stillwater“, “we“, or “us“), is committed to protecting the privacy of its employees and applicants. This HR Privacy Notice (“Notice”) for Europe is applicable to (i) all Sibanye-Stillwater group companies and/or branches located within the EU, European Economic Area (“EEA”) and UK and (ii) processing of personal data relating to your employment and/or recruitment process. This Notice explains how we collect and use personal data and what rights you have under applicable data protection laws, including the EU General Data Protection Regulation (2016/679, “GDPR”) and the UK GDPR (that is, the retained UK version of the EU GDPR, as amended) as well as local laws and regulations supplementing the EU and UK GDPR. The last section of this Notice amends and/or clarifies the information in the Notice to reflect country-specific deviations from the Notice applicable to the individual Sibanye-Stillwater group company alone. Unless this Notice states otherwise, the information herein applies to all Sibanye-Stillwater group companies within EU/EEA/UK.
When this Notice refers to “employee(s)” it means all persons who have some kind of employment relationship with us, be it employees, volunteers, interns, contractors or any other persons with similar roles at Sibanye-Stillwater. In turn, “applicant(s)” means all persons who have applied for a job and are currently in the recruitment process at Sibanye-Stillwater or have indicated their interest in future open positions.
2 CONTROLLER AND CONTACT DETAILS
In most cases, the controller of your personal data will be the Sibanye-Stillwater group company that is your employer or the Sibanye-Stillwater group company you send your application to. Sibanye-Stillwater group companies also process your personal data together as “joint controllers”. This means that (i) the parent company of Sibanye Stillwater (South Africa) and individual Sibanye-Stillwater group company or (ii) all Sibanye-Stillwater group companies together decide why and how your personal data is processed and they are jointly responsible to you under applicable data protection laws. Section 3 of this Notice will specify the purposes when we act together as joint controllers.
For the purpose of this Notice, Sibanye-Stillwater consists of the following group companies:
- Sibanye Europe Oy
- Keliber Oy
- Keliber Technology Oy
- Sibanye UK Limited
- Sibanye Stillwater Sandouville Refinery and
- Sibanye France SAS
Should you have any questions regarding the processing of your personal data or if you wish to use your rights under applicable data protection laws, please contact our Compliance Officer at privacyeu@sibanyestillwater.com. Alternatively, you can contact your local HR. Your local contact point and contact details are described in Section 10 below.
3 PURPOSES AND LEGAL BASIS OF THE PROCESSING OF PERSONAL DATA
This Section will explain what personal data we collect, for what purpose, on what legal basis and for how long we store your personal data. First part is applicable to the processing of employee personal data while the second part applies to applicants.
PART I – EMPLOYEES
3.1 General administration of employment relationship
Sibanye-Stillwater processes your personal data for the purpose of administrating your employment at Sibanye-Stillwater, e.g., to allocate and manage work duties and evaluate your performance, manage disciplinary actions, contact you, store basic information about you, manage work tools and access to IT-systems, manage business travels, participation in trainings and any other day-to-day activities within the scope of your employment. Further, Sibanye-Stillwater may present certain employees and business activities, including photos, in our internal and external communications on voluntary basis.
Personal data related to identity (passport and personal identity number) may be processed as permitted by local legislation.
| Categories of personal data | Legal basis |
| – Name and contact details – Personal identity number – Nationality, passport, visa, and work permit (if applicable) – Employment data – Emergency contacts (next of kin) – Salary and remuneration data – Attendance and absence data – Skills data – Performance data – Disciplinary data (e.g. warnings) – IT data (e.g. IT devices and user rights) – Photo(s) | Contract. The processing is necessary to fulfil the employment agreement with you. (GDPR Art. 6(1)(b)) Consent. The processing of emergency contacts and photos of you is based on your consent. (GDPR Art.6(1)(a)) |
| Exemption for special categories of data | |
| N/A | |
| Retention period | |
| Your personal data relating to the general administration of employment relationship shall be retained as permitted by local legislation, usually between 5 – 10 years following the end of the employment relationship (please see country-specific retention periods in Section 10). However, personal data relating to emergency contacts and user rights are deleted from our systems after your employment has ended, and for a reasonable time thereafter (approximately two months). | |
3.2 Payment of salary and benefits and expense reimbursement
Sibanye-Stillwater processes your personal data for the purpose of administrating the payment of your salary and benefits, including pension administration. This includes calculating and paying salary, benefits and incentives, managing sick pay and other leave of absence. We will also process your personal data for purposes relating to administration of annual leave payments, pensions and insurance premiums and business expenses.
The parent company of Sibanye Stillwater and Sibanye Europe act as joint controllers when they process personal data for the purpose of calculating and managing senior management’s compensation and incentives.
| Categories of personal data | Legal basis |
| – Name and contact details – Personal identity number – Employment data – Salary and remuneration data – Attendance and absence data – Health data (e.g. sick leave certificate) – Trade union membership data (e.g. membership fee deducted from salary) | Contract. The processing is necessary to fulfil the employment agreement with you. (GDPR Art. 6(1)(b)) Legal obligation. The processing is necessary to comply with legal obligations to which Sibanye- Stillwater is subject regarding inter alia a statutory sick pay or a statutory parental leave or other leave of absence, and rehabilitation. (GDPR Art. 6(1)(c)) |
| Exemption for special categories of data | |
| Health data and trade union membership data are processed to carry out obligations and exercise rights in the field of employment law. (GDPR Art. 9(2)(b)) | |
| Retention period | |
| Your personal data may be retained for up to a period of 10 years after your employment has ended. The retention period is based on statutory obligations (e.g., with respect to book-keeping) to which we are subject to under local laws. Special categories of data are retained for as long as necessary to fulfil the legal obligations that we are subject to. Personal data necessary to determine your pension benefits may however be retained until your retirement and for up to a period of 10 years thereafter for the purpose of providing you with pension benefits pursuant to the employment agreement with you. | |
3.3 Workforce and succession planning
Sibanye-Stillwater group companies act as joint controllers when they process your personal data for the purpose of general workforce planning and budgeting, including assessing mobility and relocation needs across the group. Further, we process personal data as joint controllers to identify and develop potential successors for identified roles within Sibanye- Stillwater for talent management and succession planning.
| Categories of personal data | Legal basis |
| – Name and contact details – Employment data – Performance data – Skills data – Location data | Legitimate interest. The processing is necessary to fulfil our legitimate interest to ensure business continuity and employee engagement. (GDPR Art. 6(1)(f)) |
| Exemption for special categories of data | |
| N/A | |
| Retention period | |
| Your personal data is retained until the employment relationship with you has ended, and for a reasonable time thereafter (approximately two months) for the purpose of securely offboarding you and deleting your data from our programs and systems. | |
3.4 Groupwide compliance programs
Sibanye-Stillwater group companies act as joint controllers when they provide a whistleblowing channel that enable the reporting of suspicions of misconduct, disloyalty, and/or policy breaches. Further, we act as joint controllers in connection to our other compliance programs, including anti-bribery and corruption (e.g. gift register and declaration of interest register) for the purpose of business control and prevention of fraud. Compliance programs are implemented in accordance with local legislation.
| Categories of personal data | Legal basis |
| – Name and contact details – Whistleblowing data – Conflict of interest data (e.g. shareholding, investment or other financial interests) – Close family data (e.g. spouse) – Gift register data | Legitimate interest. The processing is necessary to fulfil our legitimate interest to prevent misconduct and unlawful actions to be taken by employees within the scope of the employment at Sibanye-Stillwater and to make sure our policies are followed. (GDPR Art. 6(1)(f)) Legal obligation. The processing of whistleblowing reports within the scope of EU whistleblowing legislation is necessary to fulfil our legal obligations. (GDPR Art. 6(1)(c)) |
| Exemption for special categories of data | |
| In case any data about suspected or actual criminal activities will be handled in connection with an investigation, it will be processed only to the extent necessary to establish, exercise and defend legal claims. (GDPR Art. 9(2)(f)) | |
| Retention period | |
| Personal data is retained during the period necessary to fulfil the specified purpose and/or establish, exercise and defend the legal claim, within local statutory limitations. | |
3.5 Employee surveys and analytics
Individual Sibanye-Stillwater group companies or Sibanye-Stillwater group companies as joint controllers may at times conduct employee surveys related to inter alia workplace satisfaction or employee well-being. Participation in these surveys is always voluntary and reports are produced on an aggregated level, i.e., no information in such documents can be related to you as an individual.
| Categories of personal data | Legal basis |
| – Name and contact details – Employment data – Health data | Consent. The processing is based on your consent. (GDPR Art. 6(1)(a)) |
| Exemption for special categories of data | |
| Health data or other special categories of personal data are processed as permitted by local law. (GDPR Art. 9(2)(b)) | |
| Retention period | |
| Personal data is only processed to facilitate the surveys, including to send the surveys and separate different regions and employee groups. Reports and statistics on an aggregated level (i.e., non-personal data) will be retained until further notice. | |
3.6 Establish, exercise, and defend legal claims
For establishing, exercising, and defending legal claims (for example in connection with a dispute or legal process) we may process your personal data.
| Categories of personal data | Legal basis |
| – Name and contact details – Personal identity number – All data that is necessary to fulfil the specified purpose | Legitimate interest. The processing is necessary to fulfil our legitimate interest to establish, exercise or defend the legal claim, for example in connection with a dispute or legal process. (GDPR Art. 6(1)(f)) |
| Exemption for special categories of data | |
| Special categories of personal data are only processed to fulfil our legitimate interest of establishing, exercising, or defending legal claims. (GDPR Art. 9(2)(f)) | |
| Retention period | |
| Personal data is retained during the period necessary to establish, exercise and defend the legal claim, within local statutory limitations. | |
3.7 Fulfil legal obligations
Besides legal obligations within the field of employment, Sibanye-Stillwater will process your personal data for the purposes of fulfilling legal obligations within the area of e.g., book- keeping, taxation, employment law and requirements under applicable data protection laws. Obligations relating to employment law may inter alia concern anti-discrimination, occupational accidents, work environment, employee well-being, rehabilitation, right to work and trade union negotiations.
| Categories of personal data | Legal basis |
| – Name and contact details – Personal identity number – All data that is necessary to fulfil the specified purpose | Legal obligation. The processing is necessary to fulfil our legal obligations. (GDPR Art. 6(1)(c)) |
| Exemption for special categories of data | |
| Special categories of personal data are processed as permitted by local law. (GDPR Art. 9(2)(b)) | |
| Retention period | |
| Personal data is retained for as long as necessary to fulfil the legal obligations that we are subject to under local legislation. | |
3.8 Camera surveillance
Sibanye-Stillwater operates camera surveillance on its sites and premises to prevent unauthorized access to our workplace facilities and sites, to supervise proper operation of production processes, for detection and prevention of crime, to ensure protection of property and health and safety at sites. Further, Sibanye-Stillwater may use the video footage in disciplinary or other HR investigations in case of suspected policy breach or breach of law.
| Categories of personal data | Legal basis |
| – Camera footage – Access control data | Legitimate interest. The processing is necessary to fulfil our legitimate interest to supervise the proper operation of production processes and ensure protection of property, health and safety at our sites and premises and detection and prevention of crime. (GDPR Art. 6(1)(f)) |
| Exemption for special categories of data | |
| In case any data about suspected or actual criminal activities will be handled in connection with an investigation, it will be processed only to the extent necessary to establish, exercise and defend legal claims. (GDPR Art. 9(2)(f)) | |
| Retention period | |
| Camera footage is retained only for the duration necessary to fulfil the purposes above, usually no more than a month. It may be retained for longer in the event of an incident or legal proceedings or for similar reasons. | |
3.9 Manage and protect IT systems, services and devices
To manage and protect our services and related IT systems, e.g., upon logging, troubleshooting, backup, change and problem management in systems and in connection with potential IT incidents, we process, to the extent necessary, your personal data.
| Categories of personal data | Legal basis |
| – Name and contact details – User data – Log data – Traffic data | Legitimate interest. The processing is necessary to fulfil our legitimate interest of managing and protecting our IT systems and ensuring appropriate information security. (GDPR Art. 6(1)(f)) |
| Exemption for special categories of data | |
| N/A | |
| Retention period | |
| Work email account and IT access rights are retained until the employment relationship with you has ended, and for a reasonable time thereafter (approximately two months) for the purpose of securely offboarding you and deleting your data from our programs and systems. Log data and traffic data may be retained for a maximum of 2 years from the “date of creation” (logging event) as permitted by local laws. | |
PART II – APPLICANTS
3.10 General administration of your recruitment process
Sibanye-Stillwater processes your personal data to administrate the recruitment process. This includes processing of your personal data to assess and determine your skills, qualifications, and interests.
| Categories of personal data | Legal basis |
| – Name and contact details – Application and CV (e.g. education, work experience) – Information from personality tests, psychometric tests and suitability tests – References – Additional information that you have provided (e.g. LinkedIn profile) | Legitimate interest. The processing is necessary to fulfil our legitimate interest in administrating the recruitment process and determining applicants’ suitability. (GDPR Art. 6(1)(f)) Contract. For the chosen applicant(s), the final stages of any recruitment process, processing is necessary to take the steps prior to entering into the employment agreement with the applicant. (GDPR Art. 6(1)(b)) |
| Exemption for special categories of data | |
| N/A | |
| Retention period | |
| Your personal data is retained during the recruitment process. When the recruitment process is done, we will store your personal data for 24 months. | |
3.11 Conducting background checks
Sibanye-Stillwater conducts background checks, such as verify diplomas and references. Further, depending on the applied position, we may conduct personality tests, psychometric tests and/or suitability tests.
| Categories of personal data | Legal basis |
| – Name and contact details – Application and CV data – Information from personality tests, psychometric tests and suitability tests – References | Legitimate interest. The processing is necessary to fulfil our legitimate interest in determining applicants’ suitability. (GDPR Art. 6(1)(f)) |
| Exemption for special categories of data | |
| N/A | |
| Retention period | |
| Your personal data is retained during the recruitment process. When the recruitment is done, we will store your personal data for 24 months. | |
3.12 Record keeping and communication of future career opportunities
If you give your consent, Sibanye-Stillwater will store your personal data to enable us to provide you with information in the future with other career opportunities that fit your profile. You may at any time request that we remove your personal data and unsubscribe to any information regarding career opportunities at Sibanye-Stillwater.
| Categories of personal data | Legal basis |
| – Name and contact information – Application and CV data – Information from personality tests, psychometric tests and suitability tests – References | Consent. The processing is based on your consent that is given in connection with providing us with your information. (GDPR Art.6(1)(a)) |
| Exemption for special categories of data | |
| N/A | |
| Retention period | |
| Your personal data is retained during the recruitment process. When the recruitment process is done, we will store your personal data for 24 months. | |
4 REGULAR SOURCES OF DATA
We collect your personal data from:
Yourself, which you submit to us in connection with your employment allowing us to fulfil our legal and contractual obligations. e.g., pay salaries and benefits.
Emergency contacts, in the event of an accident or other emergency situations.
Public authorities, for the purposes of managing your salary and employment benefits, directing, and distributing work and fulfilling legal obligations.
Banks, insurance companies, as well as pensions and insurance administrators/advisers, for the purpose of managing your salary and employment benefits and to establish, exercise and defend legal claims.
Occupational health care providers, only in connection with your employment, and to the extent permitted by law, so that we may fulfil our legal obligations.
If you are an applicant, we may also collect personal data from:
Your references, which you have submitted to us.
LinkedIn, if you have provided us with your profile information.
Recruitment agencies or other suppliers, which provide us with tests and assessments regarding your personality and suitability.
You can always choose not to provide us with voluntary information, such as LinkedIn profile. However, some personal data is necessary for us to initiate or carry out the employment relationship with you. Not providing such personal data may prevent us from fulfilling our obligations as an employer.
5 DATA DISCLOSURES
(i) Sibanye-Stillwater group companies
Sibanye-Stillwater group companies may disclose and share personal data to other companies belonging to the group when (i) we act as joint controllers e.g. for the purposes described in Sections 3.2, 3.3, 3.4 and 3.5 as well as (ii) Sibanye-Stillwater Limited (parent company) processes personal data on behalf of Sibanye-Stillwater group companies when it provides centralised IT systems and services.
Data disclosures are based on our legitimate interest to centralise common administrative tasks and to manage and maintain group-wide programs, such as a whistleblowing channel and to create efficiency gains benefitting all group companies involved.
(ii) Third parties
Sibanye-Stillwater uses external parties such as service providers that we have engaged. These parties provide services within the areas of, inter alia, IT (such as data storage, support, and management services), payroll and finance (e.g., book-keeping systems). These external parties will act as data processors of Sibanye-Stillwater and may only process your personal data in accordance with our instructions, appropriate confidentiality and not for their own purposes.
In addition, we may also disclose your personal data to third parties in the following circumstances:
- when required to do so by law, e.g. to occupational health care providers or authorities;
- in response to a legitimate request for assistance by the police or other law enforcement agency;
- to seek legal advice from our external advisors (e.g. lawyers or auditors) or in connection with litigation with a third party;
- in connection with the sale, purchase or merger of a business; and/or
- to provide a third party (such as a potential supplier or customer) with a means of contacting you in the normal course of business, for example, by providing your contact details, such as your business phone number and email address.
6 TRANSFERS OUTSIDE OF THE EU/EEA
We may use third-party service providers who process personal data outside the UK and EU/EEA. Where we do, for transfers to service providers in territories which are not considered adequate by the European Commission or (where UK GDPR applies) the UK Information Commissioner, we ensure that our service providers have agreed to the necessary Standard Contractual Clauses to ensure appropriate and lawful protection of personal data.
Any personal data shared or disclosed to Sibanye-Stillwater Limited in South Africa or other group companies in USA or Australia entail transfers to countries outside of the UK and EU/EEA. Therefore, Sibanye-Stillwater group companies have entered into an intra-group data processing agreement, which also adopts the necessary Standard Contractual Clauses to ensure a lawful and adequate level of data protection.
7 PRINCIPLES OF HOW THE PERSONAL DATA IS SECURED
Personal data will be processed lawfully, fairly and in a transparent manner, collected for specified, explicit and legitimate purposes, and will not be further processed in a manner that is incompatible with said purposes mentioned in this Notice. We will only process adequate and relevant personal data, limited to what is necessary in relation to the purposes for which it is processed. We will ensure that the personal data we hold, and use, is accurate and, where necessary, kept up to date and kept in a form which identifies you for no longer than is necessary for the purposes for which the personal data are processed.
We use appropriate technical and organisational measures designed to protect the personal data that are collected and processed. The measures used provide an adequate level of security for the processing of the personal data of the data subjects.
Only certain individuals who, due to their duties as employees, are authorised to access the personal data are entitled to process the personal data. The data is protected by firewalls, access control (personal usernames and passwords) and other adequate technical means.
8 YOUR RIGHTS
Under applicable data protection laws, you have certain rights in relation to the processing of your personal data. Please note that all of these rights are not absolute and some of these rights may be overridden by our legitimate rights and/or exceptions applied under applicable data protection laws. These rights include:
| Access | You may request confirmation whether personal data about you is processed by us and, if that is the case, access your personal data and additional information regarding the operation, such as the purposes of the processing. You are also entitled to receive a copy of the personal data undergoing processing. |
| Object to certain processing | You have the right to object to the processing of your personal data based on a legitimate interest or public interest for reasons which concern your particular situation. In such a situation, we will stop using your personal data, unless we can show that the interest overrides your privacy interest or that the use of your personal data is necessary to manage or defend legal claims. |
| Rectification | You have the right to obtain from us the rectification of inaccurate personal data concerning you. Please keep us informed if your personal details change during your working relationship with us or during the recruitment process. |
| Erasure | You may have your personal data erased under certain circumstances, such as when your personal data is no longer needed for the purposes for which it was collected. Certain personal data cannot be deleted e.g., when we are under a legal obligation to process the data. |
| Restriction of processing | You may ask us to restrict the processing of your personal data (for example, to only comprise storage of your personal data) under certain circumstances, such as when the processing is unlawful, but you do not want your personal data erased. |
| Withdrawal of consent | You have the right to at any time withdraw your consent to the processing of personal data to the extent the processing is based on your consent. This would not affect the lawfulness of the processing based on consent prior to the withdrawal. |
| Data Portability | You have the right to receive the personal data concerning you which you have provided to us in a structured, commonly used, and machine-readable format and ask for the information to be transferred to another data controller (where possible). This right is only applicable to personal data we have collected based on your consent or contract with you. |
Whilst we would of course prefer that you direct any complaints, issues, or queries you have to us first, and give us a reasonable opportunity to handle your complaint, issue, or query, you are entitled to lodge a complaint with a supervisory authority regarding the processing of your personal data, if you are dissatisfied with how your personal data is processed. For more information, please check the contact details provided in Section 10 and visit the relevant authority’s website.
9 CHANGES TO THIS NOTICE
This Notice is subject to change. You will be adequately notified of any changes to this Notice unless such changes are non-material or insignificant.
10 LOCAL CONSIDERATIONS
10.1 Introduction
The purpose of this Section 10 is to amend and/or clarify the information provided in the Notice, to the extent set forth below, in order to reflect national deviations coming from local regulation that have an effect in the processing activities and the collection of your personal data. As indicated below, Sections 10.2 to 10.4 apply only in their respective countries.
10.2 Finland
10.2.1 Data controller and contact details
Local contact point:
| Company name and business ID | Address |
| Keliber Oy (0752546-7) | Toholammintie 496, 69600 Kaustinen |
| Keliber Technology Oy (2914395-3) | Toholammintie 496, 69600 Kaustinen |
| Sibanye Europe Oy (3283284-8) | Siltasaarenkatu 6-10, 00530 Helsinki |
10.2.2 Finland-specific deviations
| Section reference | Deviation |
| 3.1 – General administration of employment relationship | Personal data pertaining to the general administration of employment relationship shall be retained up to 10 years following the end of the employment relationship for the purpose of providing certificates of employment and statutory limitations. |
| 3.10 – General administration of recruitment process | LinkedIn profile is only processed if provided by the applicant. When personal data is collected from other sources than from the applicant, the processing is based on your consent. The retention period for the personal data is 12 months. |
| 3.11 – Background checks | Background checks are limited to verification of references. References are only verified if the applicant has named references. Background checks and psychometric, personality and suitability assessments are based on your consent. The retention period for the personal data is 12 months. |
| 3.12 – Record keeping and communication of future career opportunities | The retention period for the personal data is 12 months. |
| 8 – Your rights | The competent data protection authority in Finland is the Data Protection Ombudsman (www.tietosuoja.fi). |
10.3 France
10.3.1 Data controller and contact details
Local contact point:
| Company name and business ID | Address |
| Sibanye France SAS (921 917 639 RCS Le Havre) | Zone Industrielle portuaire du Havre Port 5059, 76430 Sandouville, France |
| Sibanye Stillwater Sandouville Refinery (817 398 993 RCS Paris) | Zone Industrielle portuaire du Havre Port 5059, 76430 Sandouville, France |
| Sibanye Europe Oy (3283284-8) | Siltasaarenkatu 6-10, 00530 Helsinki |
10.3.2 France-specific deviations
| Section reference | Deviation |
| 3.1 – General administration of employment relationship | Data pertaining to the general administration of employment relationship shall be retained up to five years following the end of the employment relationship. |
| 3.5 – Employee surveys and analytics | The processing for the purpose of conducting employee surveys is based on our legitimate interest to ensure e.g. employee well-being and satisfaction. (GDPR Art. 6(1)(f)) |
| 3.9 – Manage and protect IT systems, services and devices | Retention of IT data (e.g. traffic data and log data) is limited to 6 or 12 months from the logging event. |
| 8 – Your rights | In addition to the rights described in Section 8 above, you have the right to define directives relating to the conservation, deletion and communication of your personal data post-mortem. You have the right to organize the fate of your personal data post-mortem by adopting general or specific directives. Sibanye- Stillwater undertakes to respect these directives. The competent data protection authority in France is Commission Nationale de l’Informatique et des Libertés (www.cnil.fr/fr). |
10.4 UK
10.4.1 Data controller and contact details
Local contact point:
| Company name and business ID | Address |
| Sibanye UK Limited (00103002) | 22 King Street, 22, James’s, London SW1Y 6QY, UK |
10.4.2 UK-specific deviations
| Section reference | Deviation |
| 2 – Controller | Sibanye UK Limited is a corporate extension of the parent company Sibanye-Stillwater Limited (South Africa). Therefore, aforementioned group companies process UK personal data together as joint controllers. |
| 3.1 – General administration of employment relationship 3.2 – Payment of salary and benefits and expense reimbursement | Data pertaining to the general administration of employment relationship and payment of salary shall be retained up to six years following the end of the employment relationship in accordance with statutory limitations. |
| 8 – Your rights | The competent data protection authority in the UK is the Information Commissioner’s Office (www.ico.org.uk). |
