Topics to read about
You can select any topic, or read from the beginning.
Estimated reading time: 6.5 minutes.
- Who we are
- How we received your data
- What data we process
- Why we process your data
- Sensitive data
- Our legal basis for processing your data
- What else we might do with your data
- Sharing your data
- Safeguards when sharing your data
- Who has access to your data
- Where your data is held
- Retaining your data
- Withdrawing your consent
- Access to your personal data, and data portability
- Correcting inaccurate personal data
- Requesting that we delete your data
- Restricting our processing of your personal data
- Objecting to our processing of your personal data
- Automated decision-making
- Making a data protection complaint
Who we are
We are ECM, an independent UK company based in Quy, Cambridge. You can write to us at 3 Stow Court, Quy, Cambridge, CB25 9AS; email us at info@ecmselection.co.uk; or call us on 01223 81 33 99; if we’ve sent you an SMS, you can SMS us back on the same number. Our registered company name is ECM Selection (Holdings) Limited.
How we received your data
We receive the personal data you send us when you register with us via our website or get in touch with us by phone, email or social networking. We may also receive your personal data from other companies and services which you invite (or allow) to send your personal data to companies, such as a job board.
We may also receive your personal data when you are recommended to us by a friend or a colleague of yours, or if you are a client employee, when you or a colleague make contact with us.
We may also obtain your personal data from sites on which you have posted your personal data publically, such as LinkedIn.
We do not purchase personal data from any source, including CV repositories or email lists.
What data we process
We process personal data including your name, contact details and our correspondence.
For clients, we also process personal data including your job title and office address.
For candidates, we also process personal data which may include your CV and qualifications, nationality, right to work in different countries, whether you have a driving licence and car, whether you own property or rent, salary, benefits, notice period, skills, motivations, opinions on jobs or companies, personal interests, interview and CV feedback, job offers, and the requirements for your job search including location, start date, salary and preferences as to types of work and company. We may process additional kinds of personal data at your request or if you give them to us, and provided there is a legitimate reason for our doing so in the context of helping you find a job with one of our clients.
Why we process your data
As a candidate, we process your personal data for the sole purpose of helping find and secure you a suitable job with one of our clients. As a client employee, we process your personal data in the course of our companies’ business relationship, as requested by your company.
Sensitive data
Certain kinds of data are considered “special category” data by law. This includes data on a person’s race, ethnic origin, politics, religion, trade union membership, genetics, biometrics, health and sexual orientation. We would only process this data if you supply it to us and ask us to do so, and only if there is a legitimate legal way that doing so could help us secure you a job with one of our clients. This is unlikely to be the case, so in the normal course of things, we do not have this data, will not ask for it, and do not store or process it.
Our legal basis for processing your data
As a candidate, we process your personal data on the basis of our legitimate interest to do so, in the course of our ongoing efforts on your behalf regarding your job search.
As a client, we process your personal data on the basis of our legitimate interest to do so in the normal course of our companies’ business relationship.
What else we might do with your data
Before we process your personal data for other reasons, we are required to provide you with detailed information on this in advance, and you would have the right to object. We do not anticipate this, but will contact you in advance if so.
Sharing your data
As a candidate, we may share your personal data with specific client companies, and their service providers, if you consent to our approaching the client on your behalf regarding a job with them. You have to “opt-in” to this per company. If you do not wish to give your consent for a company, we will respect your wishes and we would anticipate no consequences other than we will not be able to help you secure a job with them.
As a client employee, we may share your personal data with a candidate at your or your employer’s request, and with other employees of your company in the normal course of our business relationship.
We may share candidates’ and clients’ personal data with companies providing us with services to support our business, such as email providers and auditors, to the extent necessary to provide us with such services.
Under certain circumstances we may also have to disclose candidates’ and clients’ personal data to a government, regulatory body or legal representative in order to comply with UK law or legal proceedings.
We do not otherwise share your personal data.
Safeguards when sharing your data
If we have to transfer your personal data outside the UK or EU, it is our responsibility to ensure that adequate safeguards are in place to protect your data in that other country.
We would only share your data in the ways we have described here, and currently only with UK, EU and US companies. Where necessary, we put legal agreements in place with companies which safeguard your data and your rights.
We will not send your personal data outside the UK or EU without ensuring such safeguards are in place.
Who has access to your data
Only those of our staff who are collectively participating in the process of securing you a job (as a candidate) or servicing your company’ needs (as a client) have access to your personal data.
Where your data is held
All personal data held by us is stored at ECM premises in the UK, or in datacentres in approved countries with safeguards in place. Any backups of your personal data are encrypted and remain in the UK.
Retaining your data
As a candidate or client, we retain your personal data indefinitely, subject to periodic review.
In addition, we retain backups for up to two years.
We periodically review the personal data we hold and decide based on the following criteria whether to keep or erase the data: the duration for which we have held it, the nature of the data and whether it includes sensitive data, the likelihood of its being accurate and relevant, preferences you have expressed, the likelihood of us needing to contact you for as a client or being able to assist you in future as a candidate, its relevance and necessity to our ongoing business, any need to retain it for legal reasons, and whether our legitimate interests in retaining the data are still valid.
Withdrawing your consent
As a candidate, you may withdraw your consent to our disclosing your personal data to any client company, or to anyone outside ECM, at any time, by informing us by phone, email, SMS or in writing. We will comply as soon as possible, except where we obliged to disclose to specific parties by law or due to legal proceedings.
When you withdraw your consent, it will not affect the lawfulness of any past activities we have undertaken based on previous consent.
Access to your personal data, and data portability
As a candidate or client employee, you have the right to ask if we hold personal data about you and request access to it if we do. If we do, the first of these copies is free of charge.
Sometimes personal data we hold about you, such as the record of a meeting or correspondence, may also be the personal data of other people involved. The data we provide to you will not include data which could infringe on the rights of those other people regarding the disclosure of their own personal data.
Where we are processing some (or all) of your personal data by automated means and with your consent, you have the right to receive the relevant data in a structured, commonly used and machine-readable format of our choosing, and the right to transmit that data to other people and companies without checking with us.
Correcting inaccurate personal data
As a candidate or client employee, you have the right to request that we correct personal data about you which is inaccurate.
Please also help us by ensuring we have your current details, including an up to date CV if appropriate.
Requesting that we delete your data
You have the right to request that we delete your personal data if we no longer need it, if you object to our processing your personal data and there is no legitimate reason for us to continue processing it, or if the law requires us to.
If we delete your personal data from our live systems, we also have processes in place to ensure that your data is not accidentally restored from backups in future.
Restricting our processing of your personal data
You have the right to ask us to restrict processing your personal data if you believe it is inaccurate (whilst we verify that); if the law requires us to cease processing your data but you don’t want us to erase it; if we no longer need it and so wish to erase it, but you wish us to keep it for legal reasons; or if you have objected to our processing your personal data and we are checking that there is no legitimate reason for us to continue processing it.
Whilst processing of your personal data is restricted it will only be processed with your opt-in consent or for legal reasons. We will let you know before this restriction is lifted.
Objecting to our processing of your personal data
Where we are processing your personal data based on our legitimate interests, you have the right to object at any time to our processing that personal data.
Automated decision-making
In many situations you have the right not to be subject to any decision made based on your personal data, by purely automated means, which could significantly affect you.
We do not make decisions about you by purely automated means.
Making a data protection complaint
If you have concerns or complaints about the way we are processing your personal data, or the way we handle your requests relating to your rights, you can raise a question or complaint with us directly. We treat these issues seriously and we are happy to assist.
If you are not satisfied with the way we handle your complaint, you are entitled to contact the supervising authority for UK companies, the UK Information Commissioner’s Office, https://ico.org.uk.
