INTRODUCTION

The General Data Protection Regulations (GDPR) came into force on 25 May 2018. It imposes greater obligations on organisations whilst giving more rights to individuals in relation to how their personal data is processed. GDPR will oblige organisations to take a ‘privacy by design and by default’ approach to data protection. This means that data protection must be integral to all data processing activities.

GDPR applies to all organisations which collect the personal data of individuals living within the EU.  This bill replaces the Data Protection Act 1998 and will import the GDPR standards into UK law whilst also dealing with any exemptions/derogations permitted by the GDPR.

ShieldMe Solutions are committed to protecting and respecting your privacy.

This policy (together with our terms of and any other documents referred to on it) sets out the basis on which any personal data we collect from you, or that you provide to us, will be processed by us. Please read the following carefully to understand our views and practices regarding your personal data and how we will treat it. This website is governed by the laws of England and Wales and the English and Welsh Courts shall have exclusive jurisdiction over it.

ShieldMe are registered with the Information Commissioners Office (ICO).  This ensures we adhere to our data protection obligations under the DPA and appropriate action is taken where there is a breach or a breach is suspected has taken place.  The aim of the policy, in line with the DPA obligations, is to ensure all information, including sensitive information is lawfully processed, subject data is held with their knowledge, consent and for a particular purpose.  Subjects are also entitled to request their information by making a “Subject Access Requests”.

Data Protections Policy and Privacy Statement also applies to our candidates registering.

Definitions and Key Terms

‘consent’ means any freely given, specific, informed and unambiguous indication of an individual’s wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of persona data relating to him or her;

‘Data controller’ means an individual or organisation which, alone or jointly with others, determines the purposes and means of the processing of personal data;

‘Data processor’ means an individual or organisation which processes personal data on behalf of the data controller; 

“Data subject” is the living individual to whom the personal data relates. Organisations are not data subjects.

“Personal data” means data that can identify a data subject as a living individual. There is general personal data such as a data subject’s name, address, National Insurance number and online identifiers/location data. Sensitive personal data which includes information on physical and mental health, sexual orientation, race or ethnic origin, religious beliefs, trade union membership and criminal records.  Information relating to identifiable individuals, such as job applicants, current and former employees, agency, contract and other staff, clients, suppliers and marketing contacts.

Personal data we gather may include: individuals’ contact details, educational background, details of certificates and diplomas, education and skills, marital status, nationality, job title, DBS Status, Eligibility to Work status and CV.

Financial and pay details will remain between the candidate and ShieldMe Solutions or the client/vendor and ShieldMe Solutions.  Payment history may be part of the audit requirements between ShieldMe Solutions and the Vendor and/or umbrella company.

Personal data will be uploaded to vendor sites and or for compliance/audit requests

Sensitive personal data must be protected to a higher level:  Personal data about an individual’s racial or ethnic origin, political opinions, religious or similar beliefs, trade union membership (or non-membership), physical or mental health or condition, criminal offences, or related proceedings—any use of sensitive personal data should be strictly controlled in accordance with this policy.

Business Purposes:

The purposes for which personal data may be used by us: Personnel, administrative, financial, regulatory, payroll and business development purposes.

Business purposes include the following:

• Compliance with our legal, regulatory and corporate governance obligations and good practice
• This includes audits from relevant vendors and framework organisations
• Gathering information as part of investigations by regulatory bodies or in connection with legal proceedings or requests
• Ensuring business policies are adhered to (such as policies covering email and internet use)
• Operational reasons, such as recording transactions, training and quality control, ensuring the confidentiality of commercially sensitive information, security vetting, credit scoring and checking
• Investigating complaints
• Checking references, Qualifications, DBS and Eligibility to Work details, ensuring safe working practices.
• monitoring and managing staff access to systems and facilities and staff absences, administration and assessments
• Monitoring staff conduct, disciplinary matters
• Marketing our business

Lawful basis: There are six lawful bases for processing a data subject’s personal data:

a)     The lawfulness of processing conditions for personal data are:

1. Consent of the individual for one or more specific purposes.
2. Processing is necessary for the performance of a contract with the individual or in order to take steps at the request of the individual to enter into a contract.
3. Processing is necessary for compliance with a legal obligation to which the controller is subject to.
4. Processing is necessary to protect the vital interests of the individual or another person.
5. Processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the data controller.
6. Processing is necessary for the purposes of legitimate interests pursued by the controller or a third party, except where such interests are overridden by the interests or fundamental rights or freedoms of the individual which require protection of personal data, in particular where the individual is a child.

The following are the lawful bases for processing a data subject’s sensitive personal data:

b)    The lawfulness of processing conditions for sensitive personal data are:

1. Explicit consent of the individual for one or more specified purposes, unless reliance on consent is prohibited by EU or Member State law.
2. Processing is necessary for carrying out obligations under employment, social security or social protection law, or a collective agreement, provided for appropriate safeguards for the fundamental rights and interests of the individual.
3. Processing is necessary to protect the vital interests of the individual or another individual where the individual is physically or legally incapable of giving consent.
4. Processing carried out by a not-for-profit body with a political, philosophical, religious or trade union aim provided the processing relates only to members or former members (or those who have regular contact with it in connection with those purposes) and provided there is no disclosure to a third party without consent.
5. Processing relates to personal data which manifestly made public by the individual.
6. Processing is necessary for the establishment, exercise or defence of legal claims or whenever courts are acting in their judicial capacity
7. Processing is necessary for reasons of substantial public interest on the basis of EU or Member State law which is proportionate to the aim pursued and which contains suitable and specific measures to safeguard the fundamental rights and interests of the individual.
8. Processing is necessary for the purposes of preventative or occupational medicine, for assessing the working capacity of the employee, medical diagnosis, the provision of health or social care or treatment or management of health or social care systems and services on the basis of EU or Member State law or a contract with a health professional
9. Processing is necessary for reasons of public interest in the area of public health, such as protecting against serious cross-border threats to health or ensuring high standards of healthcare and of medicinal products or medical devices.
10. Processing is necessary for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes, which shall be proportionate to the aim pursued, respect the essence of the right to data protection and provide for suitable and specific measures to safeguard the fundamental rights and interests of the data subject.

Consent, legitimate interests, performance of a contract and legal obligations are likely to be the most relevant for recruitment companies (though note that legitimate interests and performance of a contract are not lawful bases for processing sensitive personal data).

In this policy the following terms have the following meanings:

“Third Parties/3^rd Party” means Clients, Managed Vendors, Umbrella companies, DBS Services, Occupational Health Providers, Training Providers

“Cookies” means small pieces of data on a user’s device.

‘personal data breach’ means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data;

‘processing’ means any operation or set of operations performed on personal data, such as collection, recording, organisation, structuring, storage (including archiving), adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.

‘profiling’ means any form of automated processing of personal data consisting of the use of personal data to evaluate certain personal aspects relating to an individual, in particular to analyse or predict aspects concerning that natural person’s performance at work, economic situation, health, personal preferences, interests, reliability, behaviour, location or movements;

‘pseudonymisation’ means the processing of personal data in such a manner that the personal data can no longer be attributed to an individual without the use of additional information, provided that such additional information is kept separately and is subject to technical and organisational measures to ensure that the personal data are not attributed to an identified or identifiable individual;

‘supervisory authority’ means an independent public authority which is responsible for monitoring the application of data protection. In the UK the supervisory authority is the Information Commissioner’s Office (ICO).

“User” means the user using the service. The User corresponds with the data subject, who is the subject of personal data.

“Usage Data” means data collected automatically either generated by the use of the service or from the Service Infrastructure itself (e.g. duration of page visit)