We take privacy seriously here at Marshmallow. This privacy notice explains how we process and handle your personal data. We’ve tried to make the information as clear as possible, but let us know if anything doesn’t make sense. In this document, 'we', 'our' and 'us' refer to Marshmallow the company.
The information we use throughout the hiring process will enable us to determine your suitablity for the role.
We may carry out automated decision-making to filter applications using the notice periods of candidates for positions in the event that we need to fill a position expeditiously. This is the most appropriate way to achieve our business requirements given the large number of applications we receive.
We therefore rely on Art. 22(1)(a) of UK GDPR since this filtering is necessary for entering into, or performance of a contract between you and us.
We don’t use special category data to do this and delete any special category data accidentally created.
If you would like to exercise your right to obtain human intervention from us regarding your application to:
● express your point of view;
● contest the outcome; or
● provide additional documentation,
in relation to the automated decision, please contact talentacquisition@marshmallow.co.
Marshmallow uses third party platforms and services to carry out important tasks that we have to do as your employer. We always act as the controller when your data is being processed, and we enter into a data processor arrangement with these third parties. The third parties we use include:
● Our recruitment platform Ashby
● Sourcing platforms, e.g. LinkedIn
● Background checks service provider (see more about this below)
We use Zinc to run background checks. Zinc uses your personal details and compares it to financial and criminal databases. If Zinc finds any information that reflects badly on your character (also known as adverse information), they let us know. They also complete the right to work checks for us. To understand how Zinc processes your personal data see their privacy notice at https://zincwork.com/privacy
Some of our external third parties are based outside the UK and the EU. This means that your personal data will sometimes involve a transfer of data outside the UK.
Whenever we transfer your personal data out of the UK, we ensure a similar degree of protection is afforded to it by ensuring at least one of the following safeguards is implemented:
● We will only transfer your personal data to countries that have been deemed to provide an adequate level of protection for personal data by the UK Secretary of State or European Commission.
● Where we use certain service providers, we may use specific contracts approved for use in the UK and the EU which give personal data the equivalent protection that it has in the UK.
Please contact us if you want further information on the specific mechanism used by us when transferring your personal data out of the UK and EU.
Your data will be stored on our recruitment platform for 1 year after we have communicated to you our decision about whether to appoint you to a role. We retain your personal data for that period so that we can show, in the event of a legal claim, that we have not discriminated against candidates on prohibited grounds and that we have conducted the recruitment exercise in a fair and transparent way. After this period, we will securely destroy your personal data in accordance with our data retention policy.
We will only contact you about similar roles if you have provided your consent for us to do so. You have the right to withdraw your consent for processing for that purpose at any time. To withdraw your consent, please contact talentacquisition@marshmallow.co.
If your application is successful then your data will be processed in accordance with our employee privacy notice.
Under certain circumstances, by law you have the right to:
● Request access to your personal data (commonly known as a "data subject access request"). This enables you to receive a copy of the personal data we hold about you and to check that we are lawfully processing it.
● Request correction of the personal data that we hold about you. This enables you to have any incomplete or inaccurate information we hold about you corrected.
● Request erasure of your personal data. This enables you to ask us to delete or remove personal data where there is no good reason for us continuing to process it. You also have the right to ask us to delete or remove your personal data where you have exercised your right to object to processing (see below).
● Object to processing of your personal data where we are relying on a legitimate interest (or those of a third party) and there is something about your particular situation which makes you want to object to processing on this ground.
● Request the restriction of processing of your personal data. This enables you to ask us to suspend the processing of personal data about you, for example if you want us to establish its accuracy or the reason for processing it.
● Request the transfer of your personal data to another party.
We know data protection can be confusing. If you have any questions or concerns about how we use your personal data, reach out to our Data Protection Officer by emailing dpo@marshmallow.co.
We would always suggest referring your complaint to us in the first case so we can try to handle your complaint. However, you have the right to make a complaint to the ICO relating to our data protection practices. To do that, you can use their complaint web form here.
