Referee Privacy Notice

This Privacy Notice includes information about your personal data and we encourage you to read it carefully.

Zinc Work Limited (“Zinc”, “we”, “us”, “our”) is a company registered and incorporated in England and Wales (company number is 10961635) with registered address at Eastcastle House, 27-28 Eastcastle Street, England, United Kingdom, W1W 8DH.

We take your privacy seriously and are committed to protecting and respecting your personal data and this privacy policy details how Zinc shall process your personal data.

For the purpose of data protection legislation in the UK, when you provide a reference for a candidate through Zinc, we are the data processor. Typically speaking the candidate's current or future employer will be the data controller.

1. What personal data do we collect and process, and how do we use it?

Zinc may collect a range of information about you in the course of obtaining a personal or employment reference for a candidate from you. When you use the Zinc Service, you may provide us with the following personal data, and we may collect and process such personal data in accordance with this Privacy Policy and for the following purposes:

Zinc may collect this information via our platform or other forms of communication. Zinc will also collect limited personal data about you from candidates, for example, your name, and contact details.

2. How does Zinc protect your personal data?

We adopt appropriate data collection, storage and processing practices and security measures to protect against unauthorised access, alteration, disclosure or destruction of any personal data we collect or you provide. We store your personal data securely via Amazon Web Services having chosen data centres in the United Kingdom.

3. Who has access to data?

When you use the Zinc Service, we may need to disclose your personal data to the following categories of third parties:

• data controllers who have requested background checks on candidates, typically these will be the candidate’s current employer.
• sub-processors as set out below in order to enable the functioning of your referee user account.

We may also need to disclose your personal data in the following limited circumstances:

• to comply with a legal requirement, such as a law, regulation, subpoena, warrant, court order, legal proceedings or in response to a law enforcement agency or regulatory request;
• if the disclosure of your personal data is or may be necessary to prevent physical harm or financial loss, to report suspected illegal activity or to enforce the terms of any agreement we may have with you; and
• other third parties with your consent or direction to do so.

4. Transfers of your personal data

We will not transfer your personal data outside of the UK or EEA unless explicitly requested by you.

5. Cookies

Cookies are small text files that are placed on your device by websites that you visit. They are widely used in order to make websites work, or work more efficiently, as well as to provide information to the owners of the site. The table below explains the cookies we use and why.

Most web browsers allow you to specify cookie preferences via browser settings. You may need to refresh webpages for your settings to take effect.

To opt out of being tracked by Google Analytics across all websites, please visit: http://tools.google.com/dlpage/gaoptout

6. Third party services

The Zinc Service may contain links to third party websites and apps. If you follow a link to a third party website or app, please note that this Privacy Policy does not apply to that website or app. We are not responsible or liable for the privacy policies or practices of any third party websites or apps, and we suggest you read their policies before you submit any personal data to those websites.

7. Data Retention

In keeping with Zinc's commitment to GDPR we store your personal data only for as long as it is necessary to provide our services to you unless we have a legal or regulatory obligation to keep your data.

Zinc collects the types of data set out in Clause 1 above. We delete most of the data we collect after 180 days but we do retain your name and email address in order to keep your referee account active.

You may ask us to delete your personal data, or make any other request in line with Clause 8 below, and we shall ensure that your personal data is entirely removed from our system. If you want to delete your account you may also ask us to do so and we shall ensure that your account is entirely removed from our system. As mentioned above, we may be required to retain certain data to comply with a legal or regulatory obligation.

In all other circumstances, once personal data has been shared via our API, Zinc no longer retains such personal data. For all other categories of data that form the result of the specific check, such as criminal record data, employment history data, qualification data, etc., we encrypt this data and store it securely via MongoDB. As mentioned above, you can request a permanent and entire deletion of this data.

8. Accessing your personal data and your rights

As a result of us collecting and processing your personal data, you have the following legal rights:

• to access personal data held about you;
• to be informed about the collection of your personal data;
• to request us to make any changes to your personal data if it is inaccurate or incomplete;
• to request your personal data is erased where we do not have a compelling reason to continue to process such data in certain circumstances;
• to receive your personal data provided to us as a data controller in a structured, commonly used and machine-readable format where our processing of the data is carried out by automated means, and it is based on: (i) your consent; (ii) our necessity for performance of a contract to which you are a party to; or (iii) steps taken at your request prior to entering into a contract with us;
• to object to, or restrict, our processing of your personal data in certain circumstances;
• if we ever use your personal data for direct marketing, you can ask us to stop and we will comply with your request;
• if we use your personal data on the basis of having a legitimate interest (as set out in the table above), you can object to our use of it for those purposes, giving an explanation of your particular situation, and we will consider your objection;
• to object to, and not be subject to a decision which is based solely on, automated processing (including profiling), which produces legal effects or could significantly affect you; and
• to lodge a complaint with the Information Commissioner’s Office (ICO), the UK supervisory authority for data protection issues (www.ico.org.uk). We would, however, appreciate the chance to deal with your concerns before you approach the ICO so please contact us in the first instance.

To exercise any of your rights set out above, including to withdraw your consent where we have stated we are processing your personal data based on your consent, please contact us by email at legal@zincwork.com.

9. Sub-processors

Zinc may use the following sub-processors in order to enable the operation of your referee user account:

10. AI and Automated decision-making

Zinc may use AI to assist in processing personal data. This does not involve any automated decision-making.

11. Contacting us and changes to your personal data

If you have any questions, comments and requests relating to this Privacy Policy or your personal data, please contact our DPO, Hamraj Gulamali available at legal@zincwork.com.

12. Changes to our privacy policy

Any changes we may make to this Privacy Policy in the future will be displayed within the Zinc Service, and, where appropriate, you may be notified to you by email. Please check back regularly to keep informed of updates or changes to this Privacy Policy.