Candidate and Staff Privacy Notice

Version: 26th January 2022

1. The purposes of the document

Stainless Games Limited (together, “we”, “us” or “our”) collect and process personal data relating to you in the course of our recruitment processes and, if we engage you in a role, in the course of your engagement with us. This staff privacy notice (the “Candidate and Staff Privacy Notice”) has been prepared to provide you with an explanation of how and why we process the personal data that we hold about you in relation to our recruitment processes and, if we engage you in a role, your engagement with us.

If you have any questions or comments about this Candidate and Staff Privacy Notice, please contact us at:

Telephone: +44 (0)1983 827227

Email: privacy@stainlessgames.com

For those engaged in a role with us – prior to and throughout the time you are working for us and for a period afterwards, we will collect, use and store personal data about you in order to meet our obligations in connection with your engagement with us. For recruitment candidates – we will retain your personal information in accordance with paragraph 11.

When we collect and use information about you, we will likely do so as the “data controller”. This means that we are responsible for deciding the purposes and means for which the personal data that we hold about you is being processed. We will comply with all applicable data protection laws, including without limitation the General Data Protection Regulation 2016/679 and the General Data Protection Regulation as it forms part of the laws of England and Wales, Scotland and Northern Ireland by virtue of section 3 of the European Union (Withdrawal) Act 2018 and the Data Protection Act 2018.

It is important that you read, understand and comply with any policies, notices or other information regarding personal data.

This Candidate and Staff Privacy Notice applies to all of our candidates for roles and our staff (including employees, workers and contractors), but it does not form part of any offer for a role or engagement, contract of employment, other contract of engagement or any contract for providing services.

2. The types of information we hold about you

We may collect, store, and use the following categories of personal data about you:

Recruitment, personal contact & background data

Recruitment information (including copies of right to work documentation such as copies of passport or work visas, offer letters, acceptance of employment or other engagement, references received and other information included in a CV or cover letter or as part of the application process or in application forms we may use).
Information from interviews (such as interview notes or standard candidate assessment forms) or phone-screenings preceding an employment offer or an offer for another form of engagement.
Personal contact details such as your full name, title, marital status, home address, personal telephone numbers, personal email addresses, photograph, copy of or details of your driving licence and/or passport.
Date of birth.
Gender.
Next of kin and emergency contact information.
National Insurance number / Social Security number or other taxpayer or government identification number.
Bank account details, payroll records, student loan details (if any) and tax status information.
Salary, annual leave, pension and benefits information.

Educational data

Education records (including educational background, copies of diplomas, degree certificates, transcripts, training records or other evidence of academic achievement or work experience, technical skills, language capabilities).

Data relating to your role

Date of hire, start date, dates of promotions, date of resignation or termination, reasons for resignation or termination and administration information such as references.
Data produced during any immigration process.
Location of workplace.
Engagement records (including job or contractor titles, work history, working hours, training records and professional certifications, accreditation or memberships).
On-boarding information (including acknowledgment of, where applicable, staff handbook and policies, procedures and codes of conduct, such as policies addressing conflicts of interest, data protection and information security, anti-corruption and anti-terrorism and other corporate/commercial resource usage and practices).
Compensation history.
Performance information (including internal reviews and performance appraisals, letters of recommendation or warnings).
Disciplinary and grievance information (including monitoring compliance with and enforcing our policies).
Sick pay, record of work absences, annual leave, maternity/paternity leave, and other paid time off, entitlement and requests.
Information about previous applications for roles made to us and any previous employment or other work engagement history.
Information produced over the course of your work engagement (including emails, voicemails, correspondence, paper and electronic documents, and other work product and communications created, stored, transmitted or accessed via our networks, software applications, provided devices such as work mobile, laptop or computer or other communications equipment).

"Special categories" of personal data

Health and medical data (including applications for and information relating to employee health and welfare benefits (where applicable), medical conditions, short or long-term disabilities, physical limitations, visual or hearing impairments and special needs and health and sickness records).

3. How your personal data is collected

We may collect personal data about you in a variety of ways. Mostly, we collect personal data directly from you in circumstances where you actively provide your personal data to us. For example, through application and recruitment processes, application forms, CVs or resumes, identity documents, forms completed by you, correspondence (such as emails) with you or through interviews, meetings or other assessments as well as during the course of your actual work-related activities if you are engaged with us.

We may sometimes collect additional information about you from third parties, including recruiters, former employers or customers, educational institutions or professional accreditation bodies.

If you are engaged in a role with us, you have obligations under your contract to provide us with certain information about you. In particular, you may be required to report absences from work and provide information about disciplinary or other matters under the duty of good faith. You may also have to provide us with information in order to exercise your statutory rights, such as in relation to statutory leave entitlements. Failing to provide this information may mean that you are unable to exercise your statutory rights.

Certain information must also be provided by you in order to enable us to: (i) be able to consider your application / interest in a role with us (for candidates); and/or (ii) to enter into a contract with you for your engagement. If you are engaged in a role with us and do not provide such information, this will hinder our ability to administer the rights and obligations arising as a result of our working relationship (such as an obligation to pay you). We may also be prevented from complying with our legal obligations (such as an obligation to ensure the health and safety of our workers).

If you are a recruitment candidate and do not provide such information which is necessary for us to consider your application or interest in a role, we may not be able to process your application or record your interest successfully (and so would not be able to progress it further).

4. Your duty to inform us of changes to your personal data

It is important that the personal data we hold about you is accurate and current. Please keep us informed if your personal data changes during your working relationship with us or during the recruitment process.

5. How we will use information about you and on what basis

We need to process the information listed in paragraph 2 above in order to:

perform our contract with you;
enable us to comply with our legal obligations; and
to pursue legitimate interests of our own or of third parties to operate our business, provided that the resulting impact on your interests and fundamental rights does not override those interests.

The purposes for which we will process your personal data are set out in the table below. Sometimes the legal bases for processing will overlap and there may be several legal bases that support our processing of your personal data. Please note that some of these purposes are relevant to those engaged in a role with us, and not necessarily to all recruitment candidates more generally.

Purposes

Making a decision about your recruitment or appointment.
Determining the terms on which you work for us.
Checking you are legally entitled to work in the UK and dealing with or facilitating any relevant immigration process at the start, during or at the end of your working relationship with us.
Paying you and, if applicable to your work engagement (e.g. if you are an employee), deducting tax and National Insurance contributions.
Liaising with your pension provider.
Administering the contract that we have entered into with you.
Business management and planning, including accounting and auditing.
Conducting performance reviews, managing performance and determining performance requirements.
Assessing qualifications for a particular role or task, including decisions about promotions.
Gathering evidence for possible grievance or disciplinary hearings.
Making decisions about your continued employment or engagement.
Making arrangements for the termination of our working relationship.
Enabling your education, training and development requirements.
Dealing with legal disputes involving you, or other employees, workers and/or contractors, including, for example, accidents at work.
Ascertaining your fitness to work.
Managing sickness absence.
Complying with our health and safety obligations.
Making arrangements for your work-related travel and accommodation (where applicable).

6. How we use special categories of personal data

‘Special categories’ of personal data such as (without limitation) data concerning health, are granted higher levels of protection by data protection laws. We will only process special categories of personal data if it is appropriate given the nature of the circumstances of your engagement and where we are legally able to do so. Under certain circumstances, we may use such personal data, in accordance with our legal obligations or to exercise specific rights in the field of employment law. We need to have further justification for collecting, storing and using this type of personal data.

We may process special categories of personal data in the following circumstances:

In limited circumstances with your prior explicit consent.
Where we need to carry out our legal obligations or exercise rights in connection with employment or other types of engagement.
Where it is needed in the public interest, such as for equal opportunities monitoring.

Less commonly, we may process this type of information where it is needed in relation to legal claims or where it is needed to protect your interests (or someone else's interests) and you are not capable of giving your consent, or where you have already made the information public.

We may need to process your special categories of personal data in the following ways:

For candidates:
We may process information about your disability status in order to consider whether we need to make appropriate adjustments during the recruitment process, for example whether adjustments need to be made for a recruitment-related test or interview.
For those engaged in a role with us:
We will use information relating to leaves of absence, which may include sickness absence or family-related leaves to comply with employment and other laws.
We will use information about your physical or mental health or disability status to ensure your health and safety in the workplace, to obtain the relevant insurance and to assess your fitness to work, to provide appropriate workplace adjustments, to monitor and manage sickness absence and to administer benefits, and to comply with employment and other laws.
Making arrangements for your work-related travel and accommodation (where applicable). For example, where a visa or similar travel documentation or administration requires that health-related information be declared.

7. Information about criminal convictions

We do not foresee that we will process criminal conviction related information. If we do, we will only do so because there is a legal basis to justify that processing.

8. Data sharing

Third party service providers

We may share personal data with third party service providers insofar as it is reasonably necessary for the purposes set out in this Candidate and Staff Privacy Notice, provided that they do not make independent use of the information. We only permit them to process your personal data for specified purposes and in accordance with our instructions. All our third party service providers are required to take appropriate security measures to protect your personal data in line with our policies.

The following activities may be carried out by our third party service providers: recruitment consultancy, payroll administration, benefits administration and work-related travel arrangements administration.

Group companies

We may share your personal data with other entities in our group as part of our regular reporting activities on company performance, in the context of a business reorganisation or group restructuring exercise, for system maintenance support and hosting of data.

Other third parties

We may share your personal data with other third parties, for example in connection with the provision of staff benefits, in the event of a sale or merger, where using professional advisors (e.g. bankers, accountants, auditors, legal representatives) or where required by law, court order, administrative agency or other government body (e.g. to HMRC), public authority or regulator to meet national security, law enforcement or other legal requirements.

9. International data transfers

We are established in the United Kingdom and we do not envisage transferring your personal data to entities located outside the United Kingdom in the ordinary course of business.

However, in the event that we needed to do so, we would not transfer your personal data except where we had first put in place appropriate measures to ensure the adequate protection of your personal data. Those measures may include, for example, specific contracts containing the UK Government’s standard contractual clauses or another appropriate measure.

In the event an international data transfer of your personal data occurs and you require further information about the protective measures that we apply, please contact privacy@stainlessgames.com .

10. Data security

We will take all reasonable technical and organisational precautions to prevent the loss, misuse or alteration of your personal data.

Please be aware that, while we place a high priority on the security of all information that we hold and process and we endeavour to provide robust, commercially reasonable security at all times, no security system can prevent every possible kind of security breach.

11. Data retention

We will only retain your personal data for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting or reporting requirements. For those engaged in a role with us, once you no longer work for us, your personal data will only be retained in accordance with applicable laws and regulations.

To determine the appropriate retention period for personal data in all instances, we consider the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorised use or accidental disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal requirements.

12. Your rights in connection with personal data

You have the following rights over the way we process personal data relating to you:

Request access. You have the right to ask for a copy of personal data we are processing about you.
Request correction. You have the right to request correction of the personal data we hold about you, such as if it is incomplete or inaccurate.
Request erasure. You have the right to request erasure of your personal data,where there is no legitimate reason for us to continue to process it, or where you have exercised your right to object to the processing (see below).
Object to processing. You have the right to object to the processing of your personal data where we rely upon the legal basis of our (or a third party’s) legitimate interests for that processing.
Request processing restriction. You have the right to ask us to suspend processing of your personal data, such as if you want to establish its accuracy or the reasons for it being processed.
Request machine-readable copy and transfer. You have the right to request a machine-readable copy of your personal data, which you can use with another data controller. Where it is technically feasible, you can also ask us to send this information directly to another data controller if you prefer.
Right to make a complaint. You have the right to make a complaint to a data protection supervisory authority. In the UK, the relevant supervisory authority would be the Information Commissioner’s Office.
Right to withdraw consent. In the limited circumstances for any processing by us of your personal data for which we rely upon the legal basis of your consent, you have the right to withdraw your consent at any time upon notice to us. If you do, we will no longer process the relevant personal data.

If you wish to make a request or exercise your rights, please contact privacy@stainlessgames.com. We aim to comply without undue delay, and within one month at the latest.

Please be aware that we may need to request specific information from you to help us confirm your identity and ensure your right to access the information (or to exercise any of your other rights). This is another appropriate security measure to ensure that personal data is not disclosed to any person who has no right to receive it.

13. Changes to this Candidate and Staff Privacy Notice and applicability

We reserve the right to update this Candidate and Staff Privacy Notice at any time, and we will provide you with a new Candidate and Staff Privacy Notice when we make any substantial updates. We may also notify you in other ways from time to time about the processing of your personal data. If you are unsure about how or if this Candidate and Staff Privacy Notice applies to you, please contact privacy@stainlessgames.com.