Emerald Starfish GDPR Statement

At Emerald Starfish we are taking GDPR and the way we handle your personal data very seriously. This policy explains what we do with your personal information, why we want to use it, how we protect it, and what rights you have to control our use of your personal data.

The most important fact is that it’s your personal data. We have complete respect for your rights and would like to reassure you that we will only use it where necessary to deliver our services to you.

Information about Emerald Starfish

The registered address for Emerald Starfish is Harborough Innovation Centre, WellingtonWay, Market Harborough, Leicestershire, LE16 7WB. Our Company Registration Number is 07966212.

If you wish to contact us about any of the points in this policy, or require any information about how we protect your privacy, please email us at privacy@emerald-starfish.com. We use this email address for all data protection and matters of data access.

The Purpose & Lawful Basis for Processing your Personal Data

We use information for different purposes and each of these have a different lawful basis. As such we are required by law to explain this to you.

1. Candidates

If you have applied for a role via Emerald Starfish we hold your personal details in order to process your application, and as such we believe we have a lawful basis for holding this information.

When you apply for a role via one of the job boards we use, your personal data enters our bespoke Applicant Tracking System (ATS), which keeps the data from all of our recruitment projects separate. We promise:

To share your data only with the specific client to whom you have applied.

If you are unsuccessful at the applicant stage we will keep your details only for the duration of the recruitment project (typically 2 months). Your details will not leave the ATS and once you have received a rejection letter, you can be assured that all the details we hold on you will be deleted.

If you are an active candidate (someone who we want to progress within the recruitment process), your details will be shared only with the client company to whom you have applied. This information will include your contact details, application form, CV and any telephone interview notes that have been generated. Our aim is to share as little as necessary, and only details relevant to the position for which you have applied. We have monthly procedures in place to ensure that any trails of personal data are deleted, and we have a comprehensive process for the removal of all data at the end of each recruitment project that we run.

One of the services that we offer to our clients is the identification of future potential from existing candidates (you may not be suitable for the position for which you have applied, but the client may have a future role for which you might be suitable). If we do identify you as having 'future potential' for our client, we will contact you for permission to retain your details, in which we will clearly state the length of time for which we would like to hold your details for this client only. You will need to give this permission to us in written format. After the stated length of time has passed, we will automatically delete all your details or contact you again for further permission if applicable.

If you are the successful candidate in one of our recruitment projects, you will be treated in the same way as our active candidates.

2. Clients

If you are an existing Emerald Starfish client, we hold your name and contact details because we have a contractual obligation to deliver services to you. We need your contact details to deliver our services (such as to send you candidate and interview details, send you invoices and so on). We will hold your information for six years from the date of our last recruitment project with you, for legal records.

When Emerald Starfish acts on your behalf as your internal recruitment team, you can be assured that we have robust procedures in place in order to comply with GDPR in terms of dealing with both your company's data, and that of the candidates we process for you, in accordance with our 'Terms & Conditions' (Clause 2.7).

We store all our client information on a secure Customer Relationship Management System (CRM), including all relevant contact details (names, addresses, email addresses, mobile phone numbers and landlines), and records of conversations and actions relating to potential and active recruitment projects. This information is treated with the utmost confidentiality, as detailed in our 'Terms & Conditions' (Clause 2.6) and will not be shared with candidates without prior permission. This data will be stored on the CRM for as long as it remains relevant to our relationship with the client, unless we receive written notice that the client no longer wishes that we retain it.

Any communication between Emerald Starfish and our clients, which is stored within our email system, will be deleted on a regular ongoing basis in line with our internal administration policies.

Whilst dealing with candidates on your behalf, we will treat the retention of their personal information as detailed in the above section, in order to comply fully with GDPR regulations.

All our clients are offered access to the ATS in order to view applicant information, and where clients have access to personal data about candidates, we assume that they too have robust systems in place to comply with GDPR.

If you are a previous Emerald Starfish customer, in the six year period following the end of our last recruitment project, we may continue to contact you with information about our services because we think you will find it useful. We believe we have a legitimate interest in this direct marketing activity (and this is also permitted under the Privacy and Electronic Communications Regulations or ‘PECR’) but you are always able to unsubscribe by clicking the link at the bottom of the emails we send, or by emailing us at privacy@emerald-starfish.com.

If you’re not an existing customer we may have your contact details on our marketing list so we can contact you about our services. You may withdraw consent at any time - usually this is easiest by choosing the ‘unsubscribe’ option at the bottom of information we send to you. You can also email us at privacy@emerald-starfish.com any time. Please note that if you do this, we will delete your records on our marketing list. If you remain on our marketing list, we will hold your information for two years from the time we last checked that you wanted to receive communication from us.

3. Employees

If you are an employee of (or temporary or contract worker at) Emerald Starfish, we hold your personal details for remuneration, taxation, pension and benefits purposes. We have a legitimate interest in being able to use your information in this way, and we also believe it’s in your interests to show that you’re up to date with data protection training. We will hold your personal information for six years from the expiry of your employment with Emerald Starfish, for legal records.

4. Suppliers

If you are a supplier or other business associated with Emerald Starfish, we will hold your contact details because we have a legitimate interest in doing business with your company. We will aim to hold this information for three years since we were last in contact with you. It’s possible we picked this information up from public directories (such as LinkedIn and internet searches) or that you passed your details to us with a business card.

Who Receives your Personal Data?

If you are a candidate and have applied for a role via a job board, your personal data will be received by the job board company, and then by The Easyweb Group, who feed the information into our applicant tracking system (ATS). These companies act as data processors for us. Where applicable, your personal data will be passed onto our clients if you are selected as a suitable candidate for one of their vacancies. Occasionally, your details may be relevant for a vacancy for which you have not applied, and if this is the case, we will always seek your permission before sharing your personal data with another client for your mutual benefit.

If you are a client, we hold your contact details on our accounting system (Xero) and on CRM support systems such as HubSpot and MailChimp. These companies are data processors for us. Client business cards are stored and organised alphabetically, and are regularly sifted for relevance.

If you are an employee of Emerald Starfish, your personal data will be passed to HMRC for tax purposes, and to our payroll and pension providers for your personal benefit and remuneration.

Your Personal Data Rights

The personal data we hold about you is your data, so you have certain rights over them. This section summarises your rights. You can exercise any or all these rights when you choose, and the easiest way is by dropping us an email at privacy@emerald-starfish.com.

Where we are processing your data based on your consent (e.g. for a job application) you can withdraw that consent and we must immediately stop processing your data. Please note that up to that point, we’re acting lawfully with your consent, and withdrawal of consent cannot be backdated.

You have the right to request a copy of all personal data we hold relating to you and we must provide this within 30 days. You also have the right to require us to correct any records that are wrong.

You have the right to require us to erase personal data and we must comply with this right. We retain the right to keep data that is needed to establish, exercise or defend a legal claim.

Where we process your data based on a ‘legitimate interest’ (underlined in the section on purpose and lawful basis, above) you still have the right to object to our processing of that data. From that point, we must stop processing your data until we have determined whether your rights override our interests.

Finally, you have the right to have your personal data transferred to another organisation, and we’re obliged to provide it to you in a clear and reasonable format.

Your Rights to Lodge a Complaint with Regulator

At all times, you have the right to report a concern or lodge a complaint with the Information Commissioner’s Office. Please refer to the ICO at https://ico.org.uk/concerns/ or by calling them on 0303 123 1113.

Of course, we hope that we can resolve your issue quickly and fairly – you can contact us at privacy@emerald-starfish.com.

Our Contractual Requirements to Use your Personal Data

If you are a candidate, we have a legitimate interest in using your personal data for the purposes of processing your job application and sharing it with potential employers.

If you’re an Emerald Starfish client, it’s a requirement that we collect personal information from you so that we can enter into a contract with your company.

If you’re an employee (or temporary or contract worker) at Emerald Starfish, we have a legitimate interest in using your personal data for payroll, taxation, pension and benefits purposes. We use our legitimate interests as the lawful basis for processing your data (which is why we don’t ask for your consent to process it).

Automated Processing of your Personal Data

The only automated processing we do of personal data is to take information provided to the job boards by candidates who apply for advertised roles, and move it into our applicant tracking system (ATS).

We also use Mailchimp and HubSpot to undertake some automated communications activities. You are able to manage the information you receive from us through these channels at any time.

Other Purposes for Processing Personal Data

We don’t process your personal data for any other purpose than we’ve described here. We won’t sell your personal data to other companies.

As we develop the Emerald Starfish range of products, we might add a new data process to our platform that uses your personal information. Should we decide that we want to develop a new processing purpose, we will contact you to let you know what we intend to do, the lawful basis we will use, and your rights over our intended new processing. We will also publish information about it here.

Changes to this Privacy Notice

This privacy notice was last updated on 4th April 2018 and historic versions can be obtained by contacting us. We may change this privacy notice from time to time by amending this page.

How to Contact Us

If you have any questions, concerns or just want some more information about our privacy management, drop us a line at privacy@emerald-starfish.com.

If you want to know the data that we are keeping on you either as a client or a candidate please contact us directly, and if you have any queries at all about Emerald Starfish's handling of your data, please contact us directly.