Marshmallow Recruitment Privacy Notice

We take privacy seriously here at Marshmallow. This privacy notice explains how we process and handle your personal data. We’ve tried to make the information as clear as possible, but let us know if anything doesn’t make sense. In this document, 'we', 'our' and 'us' refer to Marshmallow the company.

The information we use throughout the hiring process will enable us to determine your suitablity for the role.

Processes that need your data
What personal data we use
Legal Basis
Proactive search using LinkedIn and other
social/search platforms (Otta, Cord, etc) to review information you have made available
publicly.
● Full name
● Contact details
● Address
● Skills/qualifications/employment history/education
● Employment information
● A record of your progress through any hiring process we conduct
Our legitimate interests to review your application.
Receiving direct applications through our
ATS (Ashby), LinkedIn etc.
● Full name
● Contact details
● Address
● Visa status
● Skills/qualifications/employment history/education
● Employment information
● A record of your progress through any hiring process we conduct
● Health information should you disclose it for the purpose of reasonable adjustments
Our legitimate interests to open the recruitment process and review your
application.
Receiving agency or internal referrals.
● Full name
● Contact details
● Address
● Visa status
● Skills/qualifications/employment history/education
● Employment information
● A record of your progress through any hiring process we conduct
Our legitimate interests to open the recruitment process and review your application.
Running reference and background checks,
including criminal and financial checks.
● Full name
● Address
● Date of birth
● ID documents
● Financial history
● Criminal convictions
We are legally required by the FCA to carry out criminal record and financial record checks as part of the application process for certain roles. Don’t worry, it’s not as scary as it sounds.
Assessing suitability for the role. Using information provided in the application and
throughout the interview/hiring process.
This will be based on information listed above and as provided throughout the recruitment process.
Our legitimate interests to review your application.
Reaching out to you about similar roles.
● Contact details
Consent as we will only contact you if you have permitted us to do so.
Considering whether we need to provide appropriate adjustments during the recruitment process.
● Disability status
As legally required under the Equality Act
2010.
Filtering applications for candidates with appropriate notice periods.
● Notice Period
Our legitimate interests to review your application in line with our business requirements.

Automated Decision-Making

We may carry out automated decision-making to filter applications using the notice periods of candidates for positions in the event that we need to fill a position expeditiously. This is the most appropriate way to achieve our business requirements given the large number of applications we receive.

We therefore rely on Art. 22(1)(a) of UK GDPR since this filtering is necessary for entering into, or performance of a contract between you and us.

We don’t use special category data to do this and delete any special category data accidentally created.

If you would like to exercise your right to obtain human intervention from us regarding your application to:
● express your point of view;
● contest the outcome; or
● provide additional documentation,
in relation to the automated decision, please contact talentacquisition@marshmallow.co.

Who do we share your data with?

Marshmallow uses third party platforms and services to carry out important tasks that we have to do as your employer. We always act as the controller when your data is being processed, and we enter into a data processor arrangement with these third parties. The third parties we use include:

● Our recruitment platform Ashby
● Sourcing platforms, e.g. LinkedIn
● Background checks service provider (see more about this below)

We use Zinc to run background checks. Zinc uses your personal details and compares it to financial and criminal databases. If Zinc finds any information that reflects badly on your character (also known as adverse information), they let us know. They also complete the right to work checks for us. To understand how Zinc processes your personal data see their privacy notice at https://zincwork.com/privacy

Cross-Border Data Transfers

Some of our external third parties are based outside the UK and the EU. This means that your personal data will sometimes involve a transfer of data outside the UK.

Whenever we transfer your personal data out of the UK, we ensure a similar degree of protection is afforded to it by ensuring at least one of the following safeguards is implemented:

● We will only transfer your personal data to countries that have been deemed to provide an adequate level of protection for personal data by the UK Secretary of State or European Commission.
● Where we use certain service providers, we may use specific contracts approved for use in the UK and the EU which give personal data the equivalent protection that it has in the UK.

Please contact us if you want further information on the specific mechanism used by us when transferring your personal data out of the UK and EU.

How long do we keep your data for?

Your data will be stored on our recruitment platform for 1 year after we have communicated to you our decision about whether to appoint you to a role. We retain your personal data for that period so that we can show, in the event of a legal claim, that we have not discriminated against candidates on prohibited grounds and that we have conducted the recruitment exercise in a fair and transparent way. After this period, we will securely destroy your personal data in accordance with our data retention policy.

We will only contact you about similar roles if you have provided your consent for us to do so. You have the right to withdraw your consent for processing for that purpose at any time. To withdraw your consent, please contact talentacquisition@marshmallow.co.

If your application is successful then your data will be processed in accordance with our employee privacy notice.

What are your data rights?

Under certain circumstances, by law you have the right to:
Request access to your personal data (commonly known as a "data subject access request"). This enables you to receive a copy of the personal data we hold about you and to check that we are lawfully processing it.
Request correction of the personal data that we hold about you. This enables you to have any incomplete or inaccurate information we hold about you corrected.
Request erasure of your personal data. This enables you to ask us to delete or remove personal data where there is no good reason for us continuing to process it. You also have the right to ask us to delete or remove your personal data where you have exercised your right to object to processing (see below).
Object to processing of your personal data where we are relying on a legitimate interest (or those of a third party) and there is something about your particular situation which makes you want to object to processing on this ground.
Request the restriction of processing of your personal data. This enables you to ask us to suspend the processing of personal data about you, for example if you want us to establish its accuracy or the reason for processing it.
Request the transfer of your personal data to another party.

Chatting to us about data

We know data protection can be confusing. If you have any questions or concerns about how we use your personal data, reach out to our Data Protection Officer by emailing dpo@marshmallow.co.

Contacting the Information Commissioner’s Office (ICO)

We would always suggest referring your complaint to us in the first case so we can try to handle your complaint. However, you have the right to make a complaint to the ICO relating to our data protection practices. To do that, you can use their complaint web form here.