Merco Privacy Policy
Privacy Policy
1. Introduction
Merco Medical Staffing Ltd is committed to conducting its business in accordance with all applicable Data Protection law and regulations. Any information collected through our offices, our website or during the registration process will be used only for the purposes of the services we provide to you. We never share or sell your personal details to any third party. This policy explains how we will collect, control and process your personal information in accordance with GDPR.
2. This policy applies to:
Website users
· Candidates
· Clients
· Staff
· Suppliers
3.Who is controlling your data?
· The Data Controller is Merco Medical Staffing Ltd, company number 4501121
· Our registered address is: Bank House, 81 St Judes Road, Englefield Green, Surrey, TW200DF
· Our office address is: St Georges House, 305 Pepys Road, Raynes Park, London, SW20 8NJ
· Our Data Protection Officer (DPO) is an employee
· You can contact our DPO at gdpr@merco.co.uk
· You can call our DPO on 020 8947 3077
· Merco is registered with the ICO, certificate number Z2229480
· Any reference to our Group means our subsidiaries or ultimate holding company as defined by the UK Companies Act 2006
4. What is personal data?
Personal data is any data that can identify you as an individual. There is general personal data such as name, address, NI number and online identifiers or location data. There is also sensitive personal data which includes information on physical and mental health, sexual orientation, race or ethnic origin, religious beliefs and criminal records. In line with GDPR, sensitive personal data must be protected to a higher level.
4.1. Who we are, our services and how we obtain your data
Merco Medical Staffing Ltd is a staffing agency and recruitment business as defined in the Employment Agencies Act 1973. We collect personal data from the following types of people to allow us to undertake our core business and related activities:
· Prospective and placed candidates for temporary or permanent roles
· Prospective and active client contacts
· Referee contacts provided by candidates
· Supplier contacts to support our services
· Employees, consultants, temporary workers and contractors
5.The data we collect and how we use it?
This section applies to individuals that wish to use our recruitment services, are already using our recruitment services or those seeking a role with us as an employee.
The personal data we collect or receive includes the following, as applicable:
· Name
· Address
· Email address & other contact details
· Date of birth
· Work history, including information relating to placements through Merco
· Education history, qualifications & skills
· Passport, visa and right to work or identity information
· Bank details
· National insurance and payroll information
· Next of kin details
· Contact details of referees
· Information contained in references and pre-employment checks from third parties
· Professional body registration details
· Health & Medical information
· Outcome of criminal record checks
We may obtain your personal data from sources including but not limited to:
You, through your CV or application or registration form
· Our website
· A client
· Other candidates
· Online jobsites/job boards
· Marketing databases
· Public domain
· Social media
· Conversations on the telephone, video conferencing or through SMS (all of whichmay be recorded)
· Notes following a conversation or meeting
For candidates, where we have obtained your personal data from a third party such as an online job board, it is our policy to advise you of the source when we first communicate with you.
6. How we will use or process your personal data
The ways in which we will process your personal data may include:
· Collecting and storing your personal data, in manual or electronic file formats
· Notifying you of potential temporary or permanent job opportunities
· Assessing and reviewing your suitability for temporary or permanent job opportunities
· Introducing and or supplying you to actual and or potential clients
· Engaging you for a role with us or with our clients, including related administration e.g. timesheets and payroll
· Collating market or sector specific information and providing the same to our clients
· Sending information to third parties with whom we have or intend to enter into arrangements with which are related to our recruitment services
· Providing information to regulatory authorities or statutory bodies, and our legal or other professional advisers
· Retaining a record of our dealings
· Establishing quality, training and compliance with our obligations and best practice
· For the purposes of backing up information on our computer systems
7. Why we process your personal data and our legal justification
Our legal basis for processing personal data is our legitimate business interests, although we will also rely on Contract, Legal and Consent for certain specific uses of personal data.
We will rely on Contract as the legal basis if we are negotiating or have entered into a placement agreement with you or your organisation or any other contract to provide services to you or receive services from you or your organisation.
Where we are legally obliged to hold information, we will apply the Legal basis for doing so. In some cases, where legally required, we will obtain express consent from you.
8. Entering into and performing a contract with you
In order to provide our recruitment services, we may enter into a contract with you and or a third party. In order to enter into a contract, we will need certain information, for example your name and address. A contract will also contain obligations on both your part and our part and we shall process your data as is necessary for the purpose of those in order to process payroll on your behalf.
9. Compliance with legal obligations
(Regulatory and statutory obligations)
We must comply with several statutory provisions when providing our recruitment services which necessitate the processing of personal data. These provisions include:
· Verifying your identity
· Assessing your suitability for a role
· Establishing your right to work
· Establishing your fitness to work
· Paying you and providing information to the HMRC
· Maintaining records for specific periods in line with legal requirements
Where we engage an individual to work for us (whether directly or supplied to a client), there are other statutory obligations that we must comply with including but not limited to payroll, taxation, social security and HMRC reporting requirements. We are also required to comply with statutory and regulatory obligations relating to general business, for example fraud or crime prevention.
10. Our legitimate interests
(in carrying on the commercial activity of the provision of recruitment services)
In providing our recruitment services we will carry out processing of personal data which is necessary for the purpose of our legitimate interests. These include:
· Retaining records of our dealings and transactions and the use of such records for the purposes of:
o Establishing compliance with contractual obligations with clients or suppliers
o Addressing any query or dispute that may arise including establishing, exercising or defending any legal claims
o Protecting our reputation
o Maintaining a backup of our system for the purpose of being able to restore the system to a particular point in the event of a system failure or security breach
o Evaluating quality and compliance, including compliance with this Privacy Policy
o Determining staff training and system requirements
· Using your personal data to:
o Assess your suitability and to contact you regarding potential temporary or permanent job opportunities
o Collate market intelligence or trends including providing analysis to potential or actual clients
o Source potential opportunities or roles as part of our recruitment services
o Personalise your experience and our offering, whether via our website or otherwise
This means that for our commercial viability and to pursue these legitimate interests we may continue to process your personal data for as long as we consider reasonably necessary for these purposes.
11.Consent to our processing of your data
We may process your personal data on the basis that you have consented to us doing so for a specific purpose, for example, if you apply for a specific role you may have consented to our processing of the data that has been provided for the purpose of progressing your application and considering your suitability for that role. In other cases, you may have provided your written or verbal consent to the use of your data for a specific reason such as receiving marketing updates on some of our additional services.
You may withdraw your consent to our processing of your personal information for a particular purpose at any stage. However, please note that we may continue to retain, or otherwise use your personal information thereafter where we have a legitimate interest or a legal or contractual obligation to do so. Our processing in that respect will be limited to what is necessary in furtherance of those interests or obligations. Withdrawal of consent will not have any effect on the lawfulness of any processing based on consent before its withdrawal.
12.When your data is obtained through third party
Part of our business activity involves researching information relating to individuals for the purposes of filling temporary or permanent jobs. This could include obtaining personal data from online sources including social media sites, job boards and sources where the information is publicly available. Other sources include sites or resources where we are subscribers. From time to time we may also receive personal information about you from hiring organisations, colleagues and former employers, or from persons for whom you have provided services or been otherwise engaged.
Where information from third party sources is of no use to us, or where you have notified us that you do not want us to provide you with services, we shall erase it. However, we may maintain a limited record in order to avoid the duplication of the process. Where we consider that information may be of use to us in pursuance of the provision of our recruitment services any processing will be in accordance with this Privacy Policy. You do have the right to object to processing - please see later section, Enhanced Rights of Individuals.
13.Sensitive personal data
Sensitive personal data is information which is intensely personal to you and maybe irrelevant to our consideration of your suitability for a job role. Examples of sensitive personal data include information which reveals your political, religious or philosophical beliefs, sexual orientation, race or ethnic origin, or certain information relating to your health.
Regardless of the basis for your dealings with us, we request that you do not provide us with any sensitive personal data unless absolutely necessary for work requirements. However, to the extent that you do provide us with any sensitive personal data, such as data which you choose to share with us in conversation, will only be used for the purposes of our relationship with you or for the provision of our recruitment services. This will be for one or more of the following reasons:
· You have expressed consent to the processing
· For the purpose of our assessment of your suitability for a temporary or permanent job
· Where processing is necessary for the purpose of obligations or rights underemployment, social security or social protection law
· To maintain records of our dealings to address any later dispute, including but not limited to the establishment, exercise or defence of any legal claims
14.Who we share personal data with
We shall not share your personal information unless we are entitled to do so. The categories of persons with whom we may share your personal data includes:
· Individuals, hirers and other third parties, necessary for the provision of our recruitment services
· Any regulatory authority or statutory body following a request for information or any legal obligation which applies to us
· Parties who process data on our behalf, including but limited to:
o IT support
o CRM system providers
o Payroll systems providers
o Legal and professional advisers
o Insurers
15.Automated decisions
We may use software to review the personal data of individuals recorded on our database or of those who have applied for specific roles. The software may determine suitability for a specific role via targeted questions relating to the role, and or may identify and select individual personal information according to the stored characteristics. For example, the software may enable us to quickly identify individuals from our database who have specific skills, e.g., a GP, and exclude individuals whose characteristics do not match the requirements.
Where we use software to assist us with our assessment of your suitability for a particular job and you consider that any such assessment has been made wrongly or incorrectly, you may ask for an explanation.
This section applies where you are an individual working for a third party, such as a client or supplier, with whom we have dealings.
We may collect your personal data in the course of our dealings, and this could include:
· Your full name
· Your job titles
· Your email, web address, telephone and address contact information
· Your statements and or opinions, e.g., a reference
· Information relating to our relationship with you or the party for whom you work including records of any meetings or discussions
· Your marketing preferences
· Records of our communication with you via email, telephone, SMS and letter We may obtain your personal data from sources including but not limited to:
o You
o Staff or other representatives of the organisation you represent
o Candidates
o Marketing databases
o Social media
o Job boards
o The public domain
o Conversations and subsequent notes with you and or others including face to face, telephone, video, SMS and email
16.How we will use your personal data?
We will process your personal data in the context of our dealings with you and or your organisation only, for the purposes of our recruitment services. Processing could include:
· Collecting and storing your personal data in manual or electronic file formats
· Using the data to communicate with you
· Sending information to third parties with whom we have or intend to enter into arrangements which are related to our recruitment services
· Actions necessary to further any obligation on us pursuant to a contract between ourselves and the third party you work for
· Collating market or sector specific information and providing the same to our clients
· Providing information to regulatory authorities or statutory bodies and our legal or other professional advisers including insurers
· Retaining records of our dealings with you and the organisation whom you represent
· Establishing quality, training and compliance with our obligations and best practice
17. Why we process your personal data?
1) Compliance with legal obligations (regulatory and statutory obligations)
We are required to comply with several statutory provisions when providing our recruitment services which necessitate the processing of personal data. We also have a requirement to comply with statutory and regulatory obligations relating to business generally, for example taxation and fraud and crime prevention.
2) Our legitimate interests (in carrying on the commercial activity of our recruitment services)
In providing our recruitment services we will carry out some processing of personal data which is necessary for the purpose of our legitimate interests. This processing could include:
· Using your personal data to:
o Contact you regarding our services
o Assess suitability of candidates and roles, for example, referencing or other feedback
o Collate market information or trends including providing analysis to potential or actual clients
o As otherwise necessary provide our services and or to meet our obligations towards either the party whom you represent, or other clients or suppliers
o To personalise your experience and our offering, whether via email, telephone, our website or otherwise
· Retaining records of our dealings and transactions and where applicable, using such records for the purposes of, including but not limited to:
o Establishing compliance with contractual obligations with our clients or suppliers
o Addressing any query or dispute that may arise including establishing, exercising or defending any legal claims
o Protecting our reputation
o Maintaining a backup of our system, for the sole purpose of being able to restore the system to a point in the event of a system failure or security breach
o Evaluating quality and compliance including compliance with this Privacy Notice
o Determining staff training and system requirements
This means that for our commercial viability and to pursue these legitimate interests we may continue to process your personal data for as long as we consider reasonably necessary for these purposes.
18. Consent
We may process your personal data on the basis that you have consented to us doing so for a specific purpose. For example, if you have provided your contact details in order that we may use these to provide you with details of our recruitment services you may have consented to our processing of the data for that purpose. In other cases, you may have provided your written or verbal consent to the use of your data for a specific reason, for example for requesting a reference from you.
You may withdraw your consent to our processing of your personal data for a particular purpose at any stage. Please refer to our Enhanced Rights of Individuals policy. However, please note that we may continue to retain or otherwise use your personal information thereafter where we have a legal basis of legitimate interest or a legal or contractual obligation to do so. Our processing in that respect will be limited solely to what is necessary in furtherance of those interests or obligations. Withdrawal of consent will not have any effect on the lawfulness of any processing based on consent before its withdrawal.
19. What if we obtain your personal data from a third party
Our core business functions concern researching information for the purposes of finding and filling temporary and permanent jobs. This may include obtaining personal data from sources including job boards, advertisements, social media, the public domain and from sources to which we are subscribers. From time to time, we may also receive personal data about you from hiring organisations, colleagues, and former employers, or from persons for whom you have provided services or been otherwise engaged.
Where information from third party sources is of no use to us we shall discard it, however we may maintain a limited record in order to avoid the duplication of process. Where we consider that information may be of use to us for the provision of our recruitment services any processing will be in accordance with this Privacy Policy. You do have the right to object to processing. Please refer to our Enhanced Rights of Individuals policy.
20. Sensitive personal data
Sensitive personal data is information which is intensely personal to you and maybe irrelevant to our consideration of your suitability for a job role. Examples of sensitive personal data include information which reveals your political, religious, or philosophical beliefs, sexual orientation, race or ethnic origin, or certain information relating to your health.
Regardless of the basis for your dealings with us, we request that you do not provide us with any sensitive personal data unless absolutely necessary for work requirements. However, to the extent that you do provide us with any sensitive personal data, such as data which you choose to share with us in conversation, will only be used for the purposes of our relationship with you or for the provision of our recruitment services. This will be for one or more of the following reasons:
· You have expressed consent to the processing
· For the purpose of our assessment of your suitability for a temporary or permanent job
· Where processing is necessary for the purpose of obligations or rights under employment, social security, or social protection law
· To maintain records of our dealings to address any later dispute, including but not limited to the establishment, exercise, or defence of any legal claims
21. Who we share personal data with
We shall not share your personal information unless we are entitled to do so. The categories of persons with whom we may share your personal data includes:
· Individuals, hirers and other third parties, necessary for the provision of our recruitment services
· Any regulatory authority or statutory body following a request for information or any legal obligation which applies to us
· Parties who process data on our behalf, including but limited to:
• IT support
• CRM system providers
• Payroll systems providers
· Legal and professional advisers
· Insurers
This section applies to all personal data.
22. Transfer of data outside of the EEA
During provision of our recruitment services, we do not transfer any data outside of the EEA. Should this change in the future then this policy will be updated accordingly, and the individuals affected notified.
23. If you do not wish to provide us with necessary data
There may situation where you do not wish to provide us with the data that we require to fulfil our statutory or contractual obligations. If this is the case ten you must notify us. However, please be aware that in such an instance we may be unable to provide you with our recruitment services, and in some cases, it could represent a breach of contract.
24. Group companies and transfer
This Privacy Notice applies to all Merco Group companies and any reference to our Group means our subsidiaries or ultimate holding company as defined by the UK Companies Act 2006. Your data may be accessible and shared with other organisations within our Group, for any of the purposes set out in this Privacy Notice, including where we have shared administration and staff.
In the event of a sale, merger, liquidation, receivership or the transfer of all or part of our assets to a third party, we may need to transfer your information to a third party. Any transfer will be subject to the agreement of the third party to this Privacy Notice and any processing being only in accordance with this Privacy Notice.
25. Data Security and Confidentiality
It is our policy to ensure, in so far as is reasonably practicable, that our systems and records are secure and not accessible to unauthorised third parties in line with best practice. For more information about our data security measures please refer to our IT Security Policy.
26. Cookies
Our website, www.merco.co.uk, uses cookies to track an individual user’s progress through the website and ensure that certain features of the website work for the user. The cookies are a randomly generated ID and are not able to identify any specific individual. No cookie data is retained when a user has left the site nor analysed by Merco, although Google Analytics captures limited anonymised data such as pages visited by users, their geographic region and the total number of visitors to the website. Cookies may be retained on the users’ browser - these can be deleted from their browser using their browser settings.
27. Retaining your data
Your data will be retained in accordance with the legal obligations we are required to meet. In most circumstances your data will not be retained for more than 7 years from the last point at which we provided any services or otherwise engaged with you, and it is our policy to only store your personal data for as long as is reasonably necessary for us to comply with our legal or contractual
obligations. We may, however, retain data for longer than 7 years where we have a legal basis to do so, or we form the view that there is otherwise a continued basis to do so, for example where your personal information identifies specialist skill sets which may remain in demand, or we are subject to a legal obligation which applies for a longer period. If at any stage, you feel that we should not retain your data then please inform us of this. Please also refer to our Enhanced Rights of Individuals Policy.
28. Changes to this Privacy
This Privacy Policy is reviewed regularly and may be updated from time to time to reflect changes in our business or legal or commercial practice. Where an update is relevant to our processing of your data, we shall notify you of the same.
29. Your rights
29.1. Enhanced Rights of Individuals
It is important that you are aware of your rights within the context of personal data. These rights are often referred to as the enhanced rights of individuals and they include:
· Subject Access Request -you have the right to request a copy of the data we hold about you
· Right to Object to Processing - where that processing is based upon legitimate interest and there are no compelling grounds for the continued processing of that data
· Right to Restriction of Processing - in certain circumstances
· Right to Erasure - where the continued use of that data cannot be justified. Agencies are required to keep certain records such as ID or right to work checks and payroll records for certain periods of time. These obligations will override any request to erase data or any objection to processing for so long as they must keep the data
· Right to Rectification - incorrect or incomplete data must be corrected by us within 1 month of notification
· Right of Data Portability - only being applicable where our processing of your data is based either on your consent or in performance of a contract
· Withdrawing your Consent - to our processing of your personal data for a particular purpose at any stage. However, please note that we may continue to retain, or otherwise use your personal information thereafter where we have a legitimate interest or a legal or contractual obligation to do so. Our processing in that respect will be limited to what is necessary in furtherance of those interests or obligations only
· Making a compliant to the Information Commissioners Office - https://ico.org.uk
· Request we stop any direct marketing to you
If you have any questions concerning your enhanced rights or should you wish to exercise any of these rights, please contact gdpr@merco.co.uk. Please note that should you exercise your right to request that we erase your data or cease any processing activity we may retain a record of this request and the action taken to both evidence our compliance, and to take steps to minimise the prospect of any data being processed in the future should it be received again from a third-party source.
29.2. Reporting a Concern
If you have a concern about the way we are collecting or using your personal data you can contact us at gdpr@merco.co.uk or you can contact the Information Commissioners Office at www.ico.org.uk/concerns/ or by calling them on 0303 123 1113.
30. Contact Us
To discuss how we collect, control and process your personal information then please contact our Data Protection Officer, Afifa Sardar at gdpr@merco.co.uk or on 0208 947 3077. You can write to us at:
Data Protection Officer
Merco Medical Staffing Ltd
St Georges House 3-5 Pepys Road Raynes Park London
SW20 8NJ
Updates
This Privacy Policy may be updated by us from time to time in accordance with GDPR and general data security best practice updates. Please review this policy periodically to ensure you have the most up to date information.