Data Protection Policy

1. Policy Statement

MEL recognises that recruitment and staffing require the responsible handling of personal information belonging to candidates, workers, employees, clients, suppliers and website visitors.

MEL is committed to processing personal information lawfully, fairly, securely and transparently.

This policy operates alongside MEL's Privacy Policy and other relevant information-security procedures.

2. Legal Framework

MEL will handle personal information in accordance with applicable UK data protection law, including the UK GDPR, the Data Protection Act 2018, the Data (Use and Access) Act 2025 and applicable privacy and electronic communications requirements, as amended from time to time.

3. Data Protection Principles

MEL will seek to ensure that personal information is:

• processed lawfully, fairly and transparently;
• collected for specified and legitimate purposes;
• adequate, relevant and limited to what is necessary;
• accurate and kept appropriately up to date;
• not retained longer than necessary;
• protected through appropriate security measures; and
• handled in accordance with applicable accountability requirements.

4. Recruitment Data

MEL may process information necessary for recruitment and staffing, including:

• name and contact information;
• CV and employment history;
• qualifications and training;
• references;
• right to work information;
• professional registration information where relevant;
• DBS or other criminal-record information where legally appropriate;
• availability and assignment information;
• pay and timesheet information;
• health and safety information where necessary; and
• other information required for a particular role or legal obligation.

5. Lawful Basis

MEL will identify an appropriate lawful basis for processing personal data. Depending on the activity, this may include contractual necessity, steps taken before entering into a contract, legal obligation, legitimate interests, consent or another lawful basis available under applicable law.

Different processing activities may rely on different lawful bases.

6. Special Category and Criminal Offence Data

Special category information and criminal offence information will only be processed where there is an appropriate legal condition and where the processing is necessary and proportionate.

Examples may include health information relevant to workplace requirements, equality monitoring information, safeguarding information or criminal-record information required for a role.

7. Recruitment Checks

MEL may verify identity, right to work, qualifications, references, professional registration, DBS eligibility and other role-specific requirements where appropriate.

Checks will be proportionate to the role and applicable legal requirements.

8. Data Security

MEL will use appropriate technical and organisational measures to protect personal information against unauthorised access, accidental loss, destruction, alteration or disclosure.

Access to personal information should be restricted to people who require it for legitimate business purposes.

9. Data Sharing

MEL may share relevant information with clients, candidates, workers, payroll providers, compliance providers, professional bodies, regulators, legal advisers, technology providers or other parties where there is a lawful and legitimate reason.

MEL will seek to limit information shared to what is reasonably necessary.

10. International Transfers

Where personal information is transferred outside the United Kingdom, MEL will seek to ensure that the transfer is permitted under applicable data protection law and that appropriate safeguards are in place where required.

11. Retention

MEL will retain personal information only for as long as reasonably necessary for the purpose for which it was collected, taking account of legal, regulatory, contractual, operational and dispute-resolution requirements.

Different records may therefore have different retention periods.

12. Data Breaches

Any suspected loss, unauthorised disclosure, cyber incident or other personal-data breach must be reported promptly to the appropriate MEL manager.

MEL will assess incidents and take appropriate containment, investigation, notification and remedial action.

13. Individual Rights

Individuals may have rights under applicable data protection law, including rights concerning access, correction, restriction, objection, erasure and portability, subject to applicable legal exemptions and conditions.

Requests should be directed to MEL using the contact details below.

14. Data Protection Complaints

MEL will provide an appropriate route for individuals to raise concerns about how their personal information is handled.

Complaints will be acknowledged and handled in accordance with applicable requirements and MEL's internal process.

15. Training

Relevant personnel will receive appropriate information or training regarding data protection, confidentiality, secure handling of recruitment records and incident reporting.

16. Contact

MEL
6-9 The Square
Stockley Park
Uxbridge
UB11 1FW

Email: info@mymel.co.uk
Telephone: 020 8064 0994

17. Review

This policy will be reviewed at least annually and whenever relevant legislation, guidance, technology or MEL's processing activities materially change.