Applicant Privacy Statement

This Applicant Privacy Notice sets out what personal data Millboard ("the Company” or “we or us") holds about you and how we collect and use it, when you apply for a role within our business.

It is important that you read the Privacy Notice carefully, together with any other information that we might give you from time to time about how we collect and use your personal data. You should also read our GDPR Data Protection Policy, which explains our obligations in relation to personal data and how we keep it secure, and what we expect from you when you are handling personal data in the course of your work.

Millboard is committed to protecting the privacy and security of the personal data of employees, applicants. We will only use your personal information when the law allows us to do so. Please read this privacy notice carefully as it contains important information on how and why we collect, store, use and share your personal information, your rights in relation to your personal information and on how to contact us in the event you have a complaint.

Who we Are

Millboard is the data controller, which means we are responsible for deciding how we hold and use personal data about you. Millboard includes the following companies:

The Millboard Company Limited, a private limited company registered in England and Wales under company number 06061318. Our registered office is Unit A Castle Court, Bodmin Road, Coventry, CV2 5DB. Millboard is registered with the Information Commissioner’s Office as a data controller, under registration number ZA032710.
Millboard Inc, under registration number 2403224. Registered Agent: The Corporation Trust Company, Corporation Trust Center 1209 Orange Street, Wilmington, New Castle, DE, 19801.
Millboard France SAS, 12 Rue Newton, 33370 Tresses, Bordeaux.

All the above entities are wholly owned by the Elmdene Group Ltd, Unit A Castle Court, Bodmin Road, Coventry, CV2 5DB under company registration number 06890168.

Data Protection Law

Millboard will comply with data protection law, and the information we hold about you will be:

Processed lawfully, fairly and transparently
Only collected to the extent necessary to fulfil the stated specific purposes
Accurate and up to date
Not kept for longer than necessary
Made available upon request
Transferred using secure means, whether electronically or otherwise
Employees and applicants are made fully aware of the reasons for the collection of the data and are given details of the purpose for which the data will be used

Keeping your personal data secure

Your personal information will be protected by the Millboard’s Data Goverance and Compliance processes including the company Information Security Policies and Procedures (Information Security Management System (ISMS).

Your information will be held in a secure environment, and access to it will be restricted to those who have a genuine business need to know it. Those processing your information will do so only in an authorised manner and are subject to a duty of confidentiality.

To prevent unauthorised access or disclosure we have put in place suitable physical, electronic and managerial procedures to safeguard and protect the information we collect online. We use state of the art technology for processing and storing data, and data transfers, including encryption and access control. Your personal data is processed with confidentiality and integrity.

What we collect about you

The Company only holds personal data which is directly relevant to its employees and applicants. That data will be held and processed in accordance with the data protection principles and with this Policy.

The following categories of personal data may be collected, held and processed by the Company:

The information you have provided to us in your curriculum vitae and covering letter
The information you have provided on our application form, including name, title, address, telephone number, personal email address, employment history, qualifications, current salary, driving licence information, UK residence restrictions, requirement of a work permit
Any information you provide to us during an interview
Any other information you provide to us during the application process in any format, including any “presentation or testing documents?” (where applicable)
Results of any tests undertaken as part of the application process

We may also collect, store and use the following “special categories” of more sensitive personal information if you provide it voluntarily:

Information about your race or ethnicity, religious beliefs, sexual orientation and political opinions.
Information about your health, including any medical condition, health and sickness records.
Information about criminal convictions and offences.

How we collect your personal data

From you: You provide us with most of the personal data about you that we hold and use.

Internal sources: in some cases, existing employees can make recommendations about potential applicants. Such employees will add personal data about such potential applicants.

External sources: Some of the personal data about you that we hold and use may come from external sources. For example,

specific recruitment agencies from which we collect general contact information, your CV and qualifications.
Your named referees, from whom we collect dates of employment, reason for leaving, details relating to honesty, reliability, punctuality, ability to work in a team, standard of work, and so on
we may obtain information about you from publicly available sources such as your LinkedIn profile or other social media sources;
Information held on application sources such as job boards that provide us with additional information alongside your what you have provided with your application

How we use Your Personal Data

All applicants’ personal data collected by the Company is collected in order to ensure that the Company can efficiently assess job applicants and conform with its equal opportunities obligations. Personal data shall also be used by the Company in meeting any and all relevant obligations imposed by law.

The table below summarises how we will use the personal information we collect about you, and our purpose and legal basis for processing your personal data:

Personal data	Purpose Keeping Records for our hiring processes	Legal basis for processing
Biographical details (including name, title, contact details) Any information you provide to us in your CV and covering letter; qualifications (including educational, vocational and training); current salary; driving license information; Information you provide during your interview; results of any tests undertaken as part of the application process Performance and career progression; references (dates of previous employment, reasons for leaving, details of honesty, reliability, punctuality, teamworking cooperation, standard of work)	Communicate with you about the recruitment process Assess your skills qualifications, and suitability for the role; determine whether you meet basic requirements for shortlisting and invitation to interview To decide whether to offer you the role If you are offered the role, to carry out background and reference checks to confirm your skills qualifications, job history and suitability for the role – final decision on whether or not to employ	Legitimate Interest
Recruitment information including correspondence, right to work checks and related documents	Where we need it to comply with a legal obligation, for example, to verify you are entitled to work in the country in which you are to be employed.	Legal obligation
	Additional legal grounds for processing special category or other sensitive data
Medical information (disability status)	To consider whether we need to provide appropriate adjustments during the recruitment process – for example during a test or interview, or at any other stage in the process	Legal Obligation / Performance of a contract / Assessment of working capacity
Race, ethnicity, religious beliefs, sexual orientation or health	Where it is needed in the public interest, such as for equal opportunities monitoring and reporting	Legal Obligation / Public interest in monitoring equal opportunities within the workforce

We will only use your personal information for the purposes for which we collected it, unless we consider that we need to use it for another reason and that reason is compatible with the original purpose. If we need to use your personal information for an unrelated purpose, we will notify you and we will explain the legal basis which allows us to do so.

Data Sharing

Millboard may from time to time share an Employee’s personal data with third parties, providing that the legal obligations have been met. For example, where your application involves the use of a recruitment agency, we may pass information regarding the progress of your application, including feedback on your performance in the recruitment process, and the terms on which we are prepared to make a job offer, if applicable, to your recruitment agent.

Where Millboard engages a third party to process your personal data on our behalf, they are provided with written instructions, are under a duty of confidentiality, and are obliged to implement appropriate technical and organisational measures to ensure the security of your personal data. We do not allow our third-party service providers to use your personal data for their own purposes. We only permit them to process your personal data for specified purposes, and in accordance with our instructions.

We limit access to your personal information to only those employees, agents, contractors and other third parties who have a business need-to-know. They are subject to a duty of confidentiality. In no circumstances will your personal data be passed to any department or any individual within the Company or to a third party that does not reasonably require access to that personal data in view of the purpose(s) for which it was collected and is being processed.

Retention & Deletion

Your personal data will only be kept for as long as is necessary and in accordance with our company retention and deletion policy. We only keep your personal information for as long as we need to, so that we can use it for the reasons described above.

To determine the appropriate retention period for personal data, we consider the amount, nature and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal, regulatory, tax, accounting or other requirement.

Where necessary, we shall keep your personal data for as long as required to do so by law; and where required to establish, exercise or defend our legal rights.

If your application is unsuccessful, we will usually retain your personal information for a period of 6 months after we have made the relevant appointment, subject to any additional legal obligations and in accordance with any legitimate interests of the company. We retain your personal information for that period so that we can show, in the event of a legal claim, that we have not discriminated against candidates on prohibited grounds and that we have conducted the recruitment exercise in a fair and transparent way. After this period, we will securely destroy your personal information in accordance with applicable laws and regulations unless you give us permission to retain it for a specified longer period, in case another opportunity arises within the company for which we believe you may be suitable.

Your Rights and Control over Your Personal Data

Under the General Data Protection Regulation and the Data Protection Act 2018, you have a number of rights over your personal data. These include:

Right to know: the right to be informed about what data we collect, the purposes for processing your data, how long we will keep it, and with whom it will be shared. This Privacy Policy has been designed to meet that right.

Right of access: you have the right at any time to ask us (by making a subject access request) what personal information we hold about you, how we are using it, with whom we are sharing it, and where we obtained your personal data. You may also request a copy of the personal information.

Right to correct: the accuracy of your personal data is important to us. You can ask us to rectify/update your personal data, including your address and contact details at any time, and we shall do so promptly at your request. You may also request that we restrict processing if this is justified.

Right to erasure: in some instances, you have the right to request that we delete your personal data. If the request is valid, we shall do so promptly.

Right to object: in some limited instances, you have the right to ‘block’ or suppress processing of your personal data. You also have the right to object to decisions being taken by automated means which product legal or similar effects concerning you.

Right to withdraw consent: Where our processing of your personal data is based on your consent, you have the right to withdraw that consent at any time.

Right to portability: you have the right to receive personal data which you have provided to us, in a structured, commonly used and machine-readable format, and the right to transmit that data to a third party in certain situations.

If you wish to exercise any of your rights, or to request details of personal information which we hold about you or have any questions about this privacy notice or the information we hold about you please contact:

James Etheridge, Head of Compliance: james.etheridge@millboard.co.uk

Privacy Policy Updates

We have the right, at any time, to make changes or additions to the Privacy Policy. The latest version of this privacy policy will always be available on our website. This Privacy Policy is dated 12th December 2023.