1 Purpose
We collect information about you to process employee vetting requests from your potential employer. We can only do this with your permission which is recorded when you sign and return our authorisation declaration.
Our aim is to respect your privacy and comply with the Data Protection Act 1998 and the General Data Protection Regulation (GDPR) in force May 2018. We will only use the information that we collect about you lawfully.
2 Scope
This policy is in addition to GSA Global’s Data Privacy & Protection Policy (GSA014 – Data Protection Policy) and applies to data collected by MHG Corporate Risks Limited, a subsidiary of GSA Global Ltd, as part of personnel vetting process. Where relevant, this policy supersedes the GSA Global Policy reference above.
3 Your Data Controller is your potential employer/employer
MHG Corporate Risks Limited (MHG) generally act as a Data Processor on behalf of your employer (the Data Controller) or potential employer, (shown simply as Employer). MHG takes instructions from them and relies on your legitimate interest to lawfully process your data. There may be some dual functionality where we are acting in certain processing activities as a joint Data Controller.
4 How do we collect information from you?
Your data is securely collected from your Employer the Data Controller, or in some instances directly via secure form or through our web portal.
4.1 What type of information is collected from you?
The personal information we collect might include:
- your name or previous names
- gender
- marital status
- date and place of birth
- nationality / citizenship
- addresses for last 5 years
- educational information
- current and past employment information
- current and past directorships
- national service details
- professional qualification and memberships?
- passport details
- work permit or overseas details
- phone number
- email address
- financial information e.g. salary
- criminal / CCJs / insolvency records
- social media handles / usernames
- security industry authority (SIA)
5 How is your information used?
Your data is collected for specified, explicit and legitimate purposes of security vetting for your employment purposes and not further processed in a manner that is incompatible with those purposes. MHG has no further use for your personal data and does not share with any 3rd parties other than for our vetting processes below.
MHG processing of your data is adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed.
We may use your information for the following processing:
- UK Credit Check including Insolvency Check
- Right to Work Check
- UK Criminal Record Check
- Overseas Criminal Record Check
- Overseas Credit Check
- Academic Verification – UK and Abroad
- Employment Verification – UK and Abroad
- Professional Qualification check
- Directorship check – UK and Abroad
- Passport Verification
- Global Security Risk Database Check
- Internet Trawl and Media Search
- Financial Review
6 How long do we retain your information?
MHG deletes your data at the expiry of or no more than 4 months and normally within one month from the date of the completion of the necessary vetting research.
7 Who has access to your information?
Your Data will be used solely for the processing purposes above and will be checked against any relevant service provider records held by any Civil or Government Authority, Police Records (Special Category Data), Credit Database records. This maybe within or outside of the EU territory dependent on your individual circumstances.
8 Protecting Your Personal Data
Your data is processed in a manner that ensures appropriate security, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical and operational measures.
We have an internal Data Protection Policy in place to oversee the effective and secure processing of your personal data.
9 Your Rights
You are in complete control. You can object or withdraw your permission to the use of your personal data at any time. Though in most cases we will not then be able to provide your vetting information to your current or prospective employer where the information processing is an integral part of the service, we offer them. We or your employer will tell you if this is likely to be the case.
Subject to some legal exceptions, you have the right to:
- request a copy of the personal information we hold about you;
- to have any inaccuracies corrected;
- to have your personal data erased;
- to place a restriction on our processing of your data;
- to object to processing; and
- to request your data to be ported (data portability).
You also have the right to complain to the ICO. To learn more about these rights please see the ICO website.
9.1 Subject Access Requests
Data subjects have the legal right to request details of information held about them by the Company. Subject access requests can be made verbally or in writing, including via social media.
Any subject access requests received by any Staff should be referred to the Administration Head or Director of Shared Services, GSA. The Company will respond to any subject access requests promptly, and in any event, within one month.
10 Exceptions
Any exception to the policy must be approved by the ISMS Review Committee and registered on the Exceptions Register according to the ISMS exceptions section located in the ISMS Management Procedure documentation.