Privacy Notice

Personal Data

In this privacy notice “Personal Data” means data which relates to a living individual who can be identified from that data.

Identification can be by the information alone or in conjunction with any other information in the data controller’s possession or likely to come into such possession.

In the United Kingdom, the processing of personal data is governed by the Data Protection Act 2018 which incorporated the EU’s General Data Protection Regulation 2016/679 into domestic law (see note re Brexit below).

Who we are

Ad Hoc Minds Limited (“Ad Hoc Minds”) is the data controller in respect of information we gather about you. This means we Ad Hoc Minds decides how that Personal Data is processed and for what purposes.

Ad Hoc Minds Limited is registered at 152 Kemp House, City Road, London EC1V 2NX.

Ad Hoc Minds complies with our obligations in respect of personal information by:

• taking steps to ensure personal data is up to date
• storing it securely, and destroying it when necessary
• taking steps to ensure we do not collect or keep more personal data than necessary
• taking technical and practical steps to protect personal data, so that it is kept secure and is not lost or inadvertently/unlawfully disclosed or accessed.
• Taking steps to ensure that you are aware of what we do with personal data
• Giving you the opportunity to change how, what or whether we hold personal data about you (subject to the terms of this privacy notice).

How we collect Personal Data

How personal information is collected, held and processed (including transferred) depends upon the type of information we hold – that is, who provided it, and why it is needed.

• Personal Information about individuals applying for roles, information about actual or potential roles or Ad Hoc Minds itself (see “Candidate Information” below)
• Personal Information about individuals who have carried out services for Ad Hoc Minds (see “Contractor Information” below)
• Personal Information about individuals who work for actual or potential clients or suppliers (see “Client Information” below)
• Personal Information about individuals who apply to attend an event or who attend an event suggested by Ad Hoc Minds (see “Event Information” below)

Brexit

• Whilst the UK has left the EU, the UK law aims to be equivalent to the EU Regulations, and accordingly throughout this privacy notice, the UK and EU law will be referred to collectively as the “GDPR”. For convenience only, where a specific point of law is being mentioned, the Articles from the EU regulations will be used.

 

• Due to the equivalent nature and purpose of the respective data protection regimes, transfers of personal data between the UK and EU are not treated by Ad Hoc Minds as being transfers outside of the EU.

 

Candidate Information

We may hold the following information about Candidates:

• personal identification (passport, driving licence, work permit, residence permit)
• contact details (address, telephone numbers and email)
• work history (which may include references)
• details of qualifications and experience
• medical records*
• criminal record*

*Medical and Criminal record information means a medical/health check and a background check in respect of criminal records. These will only be obtained where it is relevant in respect of a particular role – for example, for work on a safety critical role, or where a role requires specific security/background checks (such as work at an airport). You will always be informed in advance if a client has requested these checks. You may decline the checks, but it may mean that you are no longer able to carry out the role. Any medical or criminal record information will be held securely by Ad Hoc Minds, and will only be passed to the client which has requested the information.

This is how we receive Candidate Information:

• it may be provided by the Candidate or visitor to our website
• the Candidate’s referees’ (in respect of work history or qualifications)
• public bodies (such as regulatory bodies, health professionals or the police)
• third party websites, where a Candidate has posted their CV/resume or other details of their qualifications/experiences for consideration for roles.

Candidate Information is held for the following purposes:

• to consider a candidate for current or future roles
• to provide the candidate with details of our services
• to respond to the candidate/visitor’s queries
• to comply with regulatory requirements

Transfers of Candidate Information

Ad Hoc Minds uses most information for its internal purposes only – that is, to check suitability of a Candidate for actual and potential roles with Clients, or provide Candidates (or visitors to the website) with details/information they have requested.

If a candidate is considered suitable for a potential role Ad Hoc Minds may transfer their personal information to the potential client.

This will ONLY be done, if a Candidate has agreed to be put forward for the role (in accordance with the “consent” basis for processing (described below))

Ad Hoc Minds may also transfer Candidate information to the following entities for the following specific purposes, which are also lawful under Article 6 of the GDPR):

• to a payroll company, in order to facilitate payment to the Candidate if they become a Contractor (see Contractor Information below) (in accordance with the “contract” basis for processing (described below));
• to the police, court or regulatory bodies (in accordance with the “legal obligation” basis for processing data (described below));
• to a third party Customer Relationship Management software provider which facilitate the communication and/or provision of services by Ad Hoc Minds to Clients and communication with Candidates (as part of our “legitimate business interest”, see below). Such providers would only be used where they have agreed to:
  1. treat all data securely;
  2. process data in accordance with the GDPR (or the EU’s approved standard model contracts or other approved basis, if the provider is outside of the UK and the EU);
  3. use the data only in relation to Ad Hoc Minds, and not sell or transfer personal information to any third parties.

Contractor Information

Ad Hoc Minds may hold the following information about Contractors:

• Their relevant Candidate Information, being
  • personal identification (passport, driving licence, work permit)
  • contact details (address, telephone numbers and email)
  • work history (including references)
  • details of qualifications and experience
  • medical records*
  • criminal record*

*Medical and Criminal record information means a medical/health check and a background check in respect of criminal records. These will only be obtained where it is relevant in respect of a particular role – for example, for work on a safety critical role, or where a role requires specific security/background checks (such as work at an airport). You will always be informed in advance if a client has requested these checks. You may decline the checks, but it may mean that you are no longer able to carry out the role. Any medical or criminal record information will be held securely by Ad Hoc Minds, and will only be passed to the client which has requested the information.

• Details of work on assignments, including:
  • Pay
  • Hours worked
  • Performance record
  • Disciplinary record
  • Absenteeism

This is how we obtain Contractor Information:

• from you as part of Candidate Information (see Candidate Information, above)
• from a Client or other line manager reports
• from a Client’s HR departments
• from the Contractor’s payroll, umbrella, or service company
• from public bodies (such as regulatory bodies, health professionals or the police)

Contractor Information is held for the following purposes:

• to consider the Contractor’s suitability in their current role
• to consider the Contractor for alternative current or future roles
• to provide the Contractor with details of our services
• to comply with regulatory requirements

 

Transfers of Contractor Information

Ad Hoc Minds uses most information for its internal purposes only – that is, to check suitability of a Contractor in their current role, and for any alternative actual and potential roles with Clients.

If a Contractor wishes to be considered for alternative roles, they will become a Candidate in respect of that role – in such cases the processing is dealt with in the Candidate Information section.

Ad Hoc Minds may also transfer Contractor Information to the following entities for the following specific purposes, which are also lawful under Article 6 of the GDPR):

• to the Candidate’s payroll, umbrella or service company, in order to facilitate payment to the Contractor or to deal with any contractual issues with the Contractor (see the “contract” basis for processing data)
• to the police, court or regulatory bodies (in accordance with the “legal obligation” basis for processing data see below)
• to third parties if Ad Hoc Minds has been nominated by the Contractor as a referee (as listing Ad Hoc Minds as a referee inherently is a matter determined by the Contractor themselves, as such this would be under the lawful basis of “consent” under the GDPR or where Ad Hoc Minds is required to provide a reference by law/regulation, this will be on the basis of “legal obligations).
• to third parties if Ad Hoc Minds loses the Client account on which the Contractor is working, but the Contractor may be subject to a transfer to the new supplier under the Transfer of Undertakings (Protection of Employment) Regulations (as such this is processing on the lawful basis of complying with “legal obligations”)
• to a third party Customer Relationship Management software provider which facilitate the communication and/or provision of services by Ad Hoc Minds to Clients and communication with Contractors (as part of our “legitimate business interest”, see below). Such providers would only be used where they have agreed to:
  1. treat all data securely;
  2. process data in accordance with the GDPR (or the EU’s approved standard model contracts or other approved basis, if the provider is outside of the UK and EU);
  3. use the data only in relation to Ad Hoc Minds, and not sell or transfer personal information to any third parties.

Client Information

Ad Hoc Minds may hold the following Client Information

• name
• contact details (address, telephone numbers and email)

How we obtain Client Information

• it may be provided by the Client themselves
• it may be provided by a Candidate or Contractor
• third party websites, where a Client’s contact details have been posted

We hold Client Information for the following purposes:

• to consider whether a client may wish to receive services or information from Ad Hoc Minds;
• to manage the provision of services by Ad Hoc Minds to the Client
• where the Client is a supplier, to manage the provision of Services to Ad Hoc Minds
• to comply with regulatory requirements

Transfers of Client Information

Ad Hoc Minds uses Client Information for its legitimate internal business purposes only – that is, to manage the provision of services or information pursuant to an actual or potential contract with the client.

Ad Hoc Minds will only transfer Client Information for the following specific purposes, which are also lawful under Article 6 of the GDPR):

• to a Candidate or Contractor as is necessary for fulfilling the contractual obligations between Ad Hoc Minds, the Client and/or the Contractor/Candidate (see the “contract” basis below); or
• to the police, court or regulatory bodies (in accordance with the “legal obligation” basis for processing data below).
• to a third party Customer Relationship Management software provider which facilitate the communication and/or provision of services by Ad Hoc Minds to Clients (as part of our “legitimate business interest”, see below). Such providers would only be used where they have agreed to:
  1. treat all data securely;
  2. process data in accordance with the GDPR (or the EU’s approved standard model contracts or other approved basis, if the provider is outside of the UK and EU);
  3. use the data only in relation to Ad Hoc Minds, and not sell or transfer personal information to any third parties.

Event Information

Ad Hoc Minds may hold the following information individuals who apply to attend or who actually attend events created or managed by Ad Hoc Minds but utilising the event management platform Eventbrite Services.

• Event Information may include :
  • attendee’s personal identification (name and location)
  • attendee’s contact details (email address, telephone number)
  • details of qualifications and experience
  • record of attendance on an event
  • opinions as to preferred area of work

 

How we obtain Event Information

• Provided by the attendee themselves;
• Feedback/analytics from Eventbrite Services following attendance.

This information is held for the following purposes:

• to keep a record of attendance at different events;
• to consider suitability for roles based on attendance at events.

Transfers of Event Information

Ad Hoc Minds transfers Event Information to the following two groups/entities:

• to the individual who provides the event (which may be an individual employed or alternatively engaged by Ad Hoc Minds), so that they may use the information in order to allow attendance and manage the event (in accordance with the “legitimate business purpose” basis for processing data under the GDPR);
• to Eventbrite services which facilitate the registration, communication and/or provision of the event to Attendees on behalf of Ad Hoc Minds. Eventbrite is located in the United States of America, but nonetheless, Ad Hoc Minds has ensured that Eventbrite will:
  1. treat all data securely;
  2. process data in accordance with the EU’s approved standard model contracts.

A copy of Eventbrite’s privacy policy (including a presigned version of the standard model contracts, can be found here: https://www.eventbrite.com/support/articles/en_US/Troubleshooting/eventbrite-privacy-policy?lg=en_US

 

Lawful Basis for Processing Personal Data

GDPR Article 6 sets out the only basis on which processing of Personal Data is lawful.

Ad Hoc Minds relies on the following:

• Consent

Ad Hoc Minds will always ask for explicit consent prior to putting forward a Candidate for a role.

Ad Hoc Minds will always ask for consent prior to adding a Candidate’s (who may become a Contractor) profile to its database.

You may withhold or withdraw your consent at any time, in accordance with the procedure set out in this privacy notice.

PLEASE NOTE: if you withhold or withdraw your consent, Candidate/Contractor Information will not be used or transferred for the purpose of searching for appropriate roles (that specific type of processing). However, the Personal Data held as part of Candidate or Contractor Information may still be stored and processed by Ad Hoc Minds, if and to the extent necessary to fulfil its other obligations (for example, in relation to legal claims or in relation to financial record keeping) – such further processing will be on one of the following basis.

• Contract

Where Ad Hoc Minds is processing Personal Data in order to fulfil obligations under a contract with you, then this will be the lawful basis for such processing.

Ad Hoc Minds has contracts with candidates, and Contractors (which may include the Contractor’s representatives/employers/companies). Ad Hoc Minds will process Candidate and Contractor Information in order to fulfil our obligations under those contracts. That would include, for example, transferring Personal Data to a payroll company in order to ensure a Contractor is paid for the work they have done.

Ad Hoc Minds has contracts with its clients. In order to fulfil our obligations to clients, we will need to pass certain Client Information to Candidates or Contractors (for example, the contact details of Human Resource staff for Candidate interviews, Shift/Line Managers to Contractors when the commence work, or Client Representatives for queries from Ad Hoc Minds’s client relationship team) or to payroll (for example, contact details from the client’s finance department).

• Legal Obligation

Ad Hoc Minds will process Personal Data in order to comply with the law. This includes obligations to maintain accurate and historic financial records and /or respond to and manage legal claims or threats (in each case subject to relevant statutory limitation periods).

Ad Hoc Minds will also transfer Contractor Information in order to comply with TUPE obligations (Transfer of Undertakings, Protection of Employment), in the event that Ad Hoc Minds loses a relevant contract. Contractor Information will be transferred to the incoming service provider.

• Legitimate Interests

Ad Hoc Minds maintains a database of Event, Candidate, Contractor and Client Information. It does not transfer or sell this information to any third parties, save in the instances set out above. However, it does hold this information, and may use it for searching for business opportunities.

PLEASE NOTE – As explained in relation to consent – no Event, Candidate or Contractor Information will be transferred to third parties in relation to roles / job opportunities without the Candidate or Contractor’s consent.

All database information will be held securely, and not kept for longer than is necessary.

How Long we keep Your Personal Data

Ad Hoc Minds stores Personal Data for periods which are necessary and reasonable depending upon the nature of the data, and the reason for which it is being stored.

The following table sets out the current retention periods being used by Ad Hoc Minds for Personal Data held for various purposes. Please note, these periods are subject to review and the table may be amended from time to time:

REASON	Period Data Kept
If you have provided services to, or on behalf of Ad Hoc Minds	7 years from conclusion
If you have been a Client	7 years from the last date on which services were provided
If you applied for an Assignment but were unsuccessful	5 years from the date of the most recent application
If your CV is on Ad Hoc Minds’s data base but you have not been put forward for consideration for a role	5 years from registering your CV if there has been no contact. Alternatively, 2 years from the most recent contact.
If you have registered to attend an event organised by Ad Hoc Minds (please note: if you registered for consideration for a role with Ad Hoc Minds pursuant or in addition to an Event, the retention period will be the later of this period or the period set out in the relevant category above)	5 years from the date of registration

 

In addition to the above retention periods, Ad Hoc Minds may retain archive copies of personal information beyond those dates, but only in relation to handling legal claims or legal obligations. It will not be sold or transferred or otherwise used for alternative purposes

Procedural and Technical Safety Measures

In order to ensure all Personal Data is held securely, Ad Hoc Minds takes the following procedural and technical safety measures:

• access to Ad Hoc Minds’ IT systems and files are controlled by secure log-in procedures, and passwords are regularly changed
• all staff/contractors are trained in Data Protection laws and regulations, and have obligations to keep data secure in their contracts
• our corporate website www.adhocminds.com is secured with SSL encryption

Contacting us about Personal Data we hold

If you want to contact us in respect of this notice, or the data we may hold about you, we can be reached at the following email address: ddcaneva@adhocminds.com

In addition to general questions you may have about either this notice or our processing of personal data, you may wish to ask about the following:

• receiving copies of certain personal data (“Relevant Information”) we hold about you
  • This is known as a “data subject access request”. If you would like to make a data subject access request:
    • you must write to Ad Hoc Minds at the address set out at the top of this notice;
    • in order to ensure that we only provide copies of information to you, please enclose a certified colour copy of either your passport or driving license;
    • Ad Hoc Minds will carry out a reasonable search for Relevant Information held, so when making the request, it would be helpful for you to be as specific as possible in respect of the information you are seeking: for example, in terms of periods covered, and types of data held. This makes it more likely that Ad Hoc Minds can locate the information which is most relevant for you. If you do not provide any detail as to the information you are seeking, Ad Hoc Minds may contact you to ask for further details about your request;
    • the search will be carried out within a month of receiving the confirmation set out in the above bullet points, unless the search you have requested is particularly complex, or the amount of information is unusually large (we will inform you of such within the month);
    • “Relevant Information” is information on Ad Hoc Minds’ electronic or structured manual files which is about you. This means that it will be information which records something tangible about you, rather than just listing your name. For example, a file recording your conduct during an Assignment with a Client is likely to be Relevant Information, whereas your email address being in a recipient list of a mailshot for job opportunities is unlikely to be Relevant Information;
    • there are various exemptions which mean that your personal information may not be disclosed as Relevant Information. These can be found on the Information Commissioner’s Website https://ico.org.uk, but some common exemptions are when the information contains a third party’s personal information (and such third party does not consent to disclose such), where searching for and disclosing information requires a disproportionate effort, or where a document has legal professional privilege.
  • updating or amending personal data we hold about you:
    • if you believe the Personal Data we hold is inaccurate or out of date, we would be grateful if you could let us know. This will also help ensure that Ad Hoc Minds is not processing incorrect data about you. To update or amend your Personal Data:
      • please contact us via email to ddcaneva@adhocminds.com;
      • Ad Hoc Minds may ask to verify your identity;
      • within one month of receiving such verification, Ad Hoc Minds will review the amended or updated information provided by you, including where relevant, asking for confirmation/verification from relevant third parties;
      • if there is a delay in verification or otherwise amending the Personal Data, Ad Hoc Minds will contact you within the one month period, explaining the grounds for any such delay;
      • once the updated or amended information has been verified, Ad Hoc Minds shall amend its systems accordingly. The expired/inaccurate Personal Information shall be removed from the active systems, but a copy may be retained for archive and maintenance of records only;
      • please note, during any period of verification your Personal Data will continue to be processed in the unamended form until verification has been complete;
      • at the end of any verification, we shall contact you to inform you how your Personal Data has been updated/amended.

 

• You have the right to request for your Personal Data to be blocked, pending the above requests. This would mean that we will not contact you about any services or otherwise process your data (save to the extent necessary to meet its legal or regulatory obligations, or deal with actual or potential litigation), until the above steps have been completed.

 

• Removing your consent for Ad Hoc Minds to process certain data about you:

 

• You are free at any time to amend or withdraw your consent to all or part of the relevant processing (being, processing we carry out on the “contract” basis). If you wish to do so, the following process applies:
  • you must contact ddcaneva@adhocminds.com informing us that you have changed your preference in respect of our processing in one of the areas where the basis of processing is “consent” or “contract”;
  • we will respond within 10 working days, to verify your identity and request;
  • once your identity and request has been acknowledged and confirmed, we will amend our system processes in relation to your Personal Data accordingly. Please note, if you withhold or withdraw your consent to processing carried out due to our contractual relationship, your Event, Candidate or Contractor Information will not be used or transferred for the purpose of providing or offering services. However, the Personal Data may continue to be stored and processed by us, if and to the extent necessary to fulfil our other obligations as set out elsewhere in this notice (for example, in relation to legal claims or in relation to financial record keeping) – such further processing will be on one of the lawful basis set out above.

 

• Requesting that Ad Hoc Minds transfers your Personal Data to another entity.
  • Where you have provided us with Personal Data, you can request that we transfer that Personal Data to a third party (for example, another consultancy) (the “Transferring Data”). In order to do this, the following process applies:
    • you must write to us at the postal address at the top of this privacy notice providing details of the third party to whom you wish to transfer the “Transferring Data”;
    • the Transferring Data should include Personal Data which:
      • is processed via an automated means; and
      • you provided to Ad Hoc Minds; and
      • has been processed under the lawful basis of either:
        • “consent”; or
        • “contract”;
      • We will contact you within 10 working days to confirm the fact and details of your request;
      • once we have received the above confirmation, we will make a copy of the Transferring Data on a commercially generally available format (for example Microsoft Word, Microsoft Excel) and will send a copy to the contact details you have provided;
      • after carrying out the above bullet points, we will send you an email confirming what Personal Data was transferred to the third party. 

• When making the above request, you may also request for your Personal Data to be blocked, pending the above steps. This would mean that we will not process your Personal Data, save to the extent necessary to meet its legal or regulatory obligations, or deal with actual or potential litigation, until the above steps have been completed.