Data Protection Statement

We have separate Data Protection Statements for Candidates and Clients. We want to explain in this Data Protection Statement how we process personal data of other contacts that we have in the business.

For ease of use, we have split our Data Protection Statements into sections so you can easily find the information that you need:

• Our Other Contact - Data Protection Statement (this statement) is relevant to all data subjects whose personal data we process who are not considered Candidates or Clients. This includes but is not limited to suppliers, agencies, partners, referees, emergency contacts, website users and members of the public.
• Our Candidate - Data Protection Statement provides specific information about active/potential job seekers, and candidates supplied on assignment, whose personal data we process as part of our business
• Our Client - Data Protection Statement provides specific information about our processing activities relevant to business clients, whose personal data we process as part of our business activities
• Our Group Information Statement provides information about the companies in the Group including relevant contact details. This information is relevant to all data subjects
• The Data Protection Rights Statement is relevant to all data subjects and provides information about your rights and what you should do if you want to raise a concern

For further information about our group of companies please see.

References to “we”, “us” and “Company” shall apply to the company in the group that is processing your personal data.

This Data Protection Statement applies to Other Contacts

This Data Protection Statement describes how we process personal data of “Other Contacts”. For the purposes of this Data Protection Statement an “Other Contact” includes anyone who is not a Candidate or a Client.

Other Contacts will include suppliers, subcontractors, agencies, partners, referees, trade, professional and membership organisations, details of next of kin/emergency contacts, website users, visitors to our sites and members of the public.

We source Other Contacts personal data as part of our services. We will only ever source personal data that is necessary and in a way that would be generally expected.

We will only ever source personal data relating to Other Contacts in a way that would be generally expected. We receive personal data about Other Contacts from a variety of sources, as follows:

• directly from the Other Contacts or created by us as part of the relationship
• through access to and use of our website
• from Candidates in the case of next of kin/emergency contact details and referees
• from our CCTV cameras in certain sites

This section describes the lawful basis we may use to process personal data in accordance with the requirements of the GDPR.

We process all personal data lawfully and in accordance with the requirements of the Data Protection Laws. The GDPR sets out the legal grounds available for processing personal data.
When we process personal data any one of the following legal grounds will generally apply.

CONTRACT

We will process personal data where necessary to perform our obligations relating to or in accordance with any contract that we may have with you or to take steps at your request prior to entering into that contract.

CONSENT

For certain processing activities we may rely on your consent. For example, certain marketing activity will only be undertaken if we have your consent.

Where we are unable to collect consent for a particular processing activity, we will only process the personal data if we have another lawful basis for doing so.

You can withdraw consent provided by you at any time by contacting us at privacy@morganmckinley.com

LEGITIMATE INTEREST

At times we will need to process your personal data to pursue our legitimate interests, for example for administrative purposes, to collect debts owing to us, to provide information to you, to operate, evaluate, maintain, develop and improve our websites and services or to maintain their security and protect intellectual property rights.

We will not process your personal data on a legitimate interest basis where the impact of the processing on your interests or fundamental rights and freedoms outweigh our legitimate interests.
You may object to any processing we undertake on this basis. If you do not want us to process your personal data on the basis of our legitimate interests, contact us at privacy@morganmckinley.com and we will review our processing activities.

LEGAL OBLIGATION

If we have a legal obligation to process personal data we will process personal data on this legal ground.

DEFENCE OF LEGAL CLAIMS

In limited circumstances and in accordance with the law we may use personal data in the defence of legal claims or enforcing legal rights, such as IP rights.

We only collect the personal data that we require in order to deliver and improve the services we provide.

The table below sets out the general categories of personal data that we collect in relation to Other Contacts:

We want to ensure that the personal data is used for the purposes that you would expect

The table below sets out the purpose for which we collect your personal data, our lawful basis for doing so, and the personal data that we collect.

We endeavour to only retain personal data for only as long as it is needed for the relevant purposes

In some circumstances it is not possible for us to specify in advance the period for which we will retain your personal data. In such cases we will determine the appropriate retention period based on balancing your rights against our legitimate interests. We may also retain certain personal data beyond the periods specified herein in some circumstances such as where required for the purposes of legal claims.

Our retention policy for Other Contacts personal data is as follows:

We may need to share your personal data in order to deliver our services. We will always ensure that any disclosure of personal data is undertaken in compliance with Data Protection Law and ensure that appropriate technical and organisational measures are undertaken to protect and secure any personal data that is transferred.

Other Contacts Personal Data is shared in certain circumstances as follows:

• between the companies identified in this Data Protection Statement and in particular in our Group Information Statement for the purposes of administration, marketing and provision of our services
• to business partners and third party service providers for the purposes of servicing our company and administration of our business, including email, chat, ticketing, Customer Relationship Management, Applicant Tracking System, payment processors, data aggregators, hosting service providers, external consultants, accountants, auditors, IT consultants and lawyers
• if a company in the group or substantially all of its assets are acquired by a third party, in which case personal data held by us will be one of the transferred assets
• if we are under a duty to disclose or share personal data in order to comply with any legal obligation (including tax, audit or other authorities), or in order to enforce or apply any contracts that we have
• to official authorities to protect our rights, property, or safety, or those of other persons (including you)
• to payment service partners for the processing of payments to and from our business,
• to protect our rights, property, or safety, or that of our customers or others. This may include exchanging information with other companies and organisations for the purposes of fraud protection
• to analytics and search engine providers that assist us in the improvement and optimisation of our Website. This consists of information relating to the web pages visited on the Website and tracking codes from service providers like LinkedIn and Google
• to insurance brokers and providers where required for administering claims
• to our email distribution partner and service providers in the case of marketing and newsletters
• for the purposes of communications between Clients and Candidates
• to Clients in the case of certain information relevant to Candidates such as referees, next of kin/emergency contacts

In some circumstances we may need to transfer personal data outside of the country where it was originally collected. We will always undertake such transfers in accordance with data protection laws.

We may transfer Personal Data outside of your home country; however, we will always ensure that this is done in compliance with the relevant laws of your country.

We will normally use and share personal data outside of your country for the following reasons:

• to carry out corporate oversight of our global business organization
• to provide shared services in certain functions such as HR, Finance, and IT
• to deploy certain tools and resources across the global organisation
• to facilitate interactions between our employees across our global locations
• to work with our group companies to identify Candidates/Clients

We will ensure that any transfer of Personal Data outside of any jurisdiction is undertaken using legally compliant transfer mechanisms and in accordance with relevant laws.

We monitor for and do everything that we can to protect personal data and prevent security breaches.

We will take all steps reasonably necessary to ensure that all personal data is treated securely in accordance with this Data Protection Statement and the Data Protection Laws. In particular, we have put in place appropriate technical and organisational procedures to safeguard and secure the personal data we process.

We monitor for and do everything we can to prevent security breaches of the personal data that we process. Once we have received your personal data, we will use strict procedures and security features for the purpose of preventing unauthorised access and ensuring that only those who need to have access to your personal data can access it.

We also use secure connections to protect personal data during its transmission. Where you have been given (or where you have chosen) a password which enables you to access services, you are responsible for keeping this password confidential. Please do not share your password with anyone.

If you think that there has been any loss or unauthorised access to personal data of any individual, please let us know immediately.

It is important to be careful when visiting third party websites and when providing personal data to third parties. We have no control over third party websites that you may access.

Websites that you access via a link on our website or otherwise, are outside our control and are not covered by this Data Protection Statement. If you access other websites using the links provided, the operators of these websites may collect personal data from you, which will be used by them in accordance with their own statements, which may differ from ours. Please check the statements on those websites before you submit any personal data to them.

Please see our separate Cookie Notice available at https://www.morganmckinley.com.cn/en/cookies-policy for further information.

We will update the date on this Data Protection Statement when we make changes to it.

We will post any changes to this Data Protection Statement on the Website and when doing so will change the effective date at the top of this Data Protection Statement.

In some cases, we may provide you with additional notice of changes to this Data Protection Statement, such as via email. We will always provide you with any notice in advance of the changes taking effect where we consider the changes to be material.

Please contact us if you have any questions or concerns about how your personal data is being used by us.

Please see our Data Protection Rights Statement for further information about your rights

If we are unable to resolve your concerns, you have the right to contact the supervisory authority in the country where you live or work, or where you consider that the data protection rules have been breached.

Please see section 2 of our Data Protection Rights Statement “Queries and Supervisory Authority Contact Details” for further information about relevant Data Protection Authority contact details.