This statement explains how MOOODY COW LIMITED meets its obligations under the UK GDPR and the Data Protection Act 2018. It is written for clients carrying out supplier due diligence, and for candidates and workers who want to understand how their data is protected. Our privacy policy explains what data we hold and why. This page explains how we govern it.
On this page
We take the protection of personal data seriously. As a staffing and technology business we handle a significant volume of personal data about candidates, workers and client contacts, some of it sensitive. We treat that responsibility as a core part of how we operate, not as a paperwork exercise.
We act as a data controller for the personal data we collect and use for our own purposes. This includes candidate records, client contact records, supplier records and website enquiries. Our privacy policy sets out how we handle that data.
We act as a data processor where we handle personal data on behalf of a client, under their instructions, as part of a consultancy or technology engagement. In those cases the client is the controller, we act only on their documented instructions, and our obligations are set out in a written agreement that meets the requirements of Article 28 of the UK GDPR.
Where our role is unclear at the start of an engagement, we agree it in writing before any personal data is shared.
Everything we do with personal data is measured against the seven principles in the UK GDPR:
| Principle | What we do |
|---|---|
| Lawfulness, fairness and transparency | We identify a lawful basis before we process, and we tell people clearly what we are doing through our privacy policy and our direct communications |
| Purpose limitation | We use data for the purpose we collected it, and we do not repurpose it without checking that the new use is compatible or obtaining consent |
| Data minimisation | We collect only what we need for the role, engagement or enquiry in question |
| Accuracy | We keep records current, correct errors promptly, and encourage candidates and clients to tell us when details change |
| Storage limitation | We apply defined retention periods and delete or anonymise data at the end of them |
| Integrity and confidentiality | We apply technical and organisational security measures proportionate to the risk |
| Accountability | We document our decisions and can demonstrate our compliance on request |
We do not rely on consent as a general basis for recruitment activity, because consent must be freely given and can be withdrawn at any time, which is rarely appropriate in a staffing context. Instead we rely on the basis that genuinely fits each activity.
We keep a record of the basis relied on for each processing activity, and we review it when the activity changes.
You have the rights set out in Chapter III of the UK GDPR: access, rectification, erasure, restriction, portability, objection, and the right not to be subject to solely automated decision making. Section 13 of our privacy policy explains each one.
Email hello@mooodycow.co.uk with the words "data request" in the subject line, or write to us at Regency House, 48 Birmingham Road, Bromsgrove, Worcestershire, B61 0DD. You do not need to use a particular form of words, and you will not be charged.
If we cannot act on your request, we will tell you why, and explain your right to complain to the ICO and to seek a judicial remedy.
We maintain a record of processing activities as required by Article 30. It records the purposes of each processing activity, the categories of data subject and personal data involved, the recipients of the data, any international transfers, the retention periods that apply, and a description of the security measures in place. We review it at least annually and whenever a significant change occurs.
We consider data protection at the point we design a process or select a system, rather than afterwards. In practice this means limiting the data a new system collects, restricting who can see it, and setting retention rules before it goes live.
We carry out a Data Protection Impact Assessment before any processing likely to result in a high risk to individuals. This includes large scale processing of special category data, systematic monitoring, and the use of new technologies. Where an assessment identifies a high residual risk that we cannot mitigate, we consult the ICO before proceeding.
All staff receive data protection training when they join, and refresher training thereafter. Everyone who handles personal data is bound by confidentiality obligations in their contract. Access to personal data is granted on a least privilege basis, and is reviewed when someone changes role or leaves.
We only appoint suppliers who can provide sufficient guarantees that they will meet the requirements of the UK GDPR. Before appointing a processor we assess their security posture, their location, and their own use of sub processors.
Every processor we appoint is engaged under a written contract that requires them to act only on our instructions, keep the data confidential, apply appropriate security measures, assist us with data subject requests and breach notification, and delete or return the data at the end of the engagement.
Our current processors are listed in section 9 of our privacy policy. Clients carrying out due diligence can request our full sub processor list and our standard data processing terms by contacting us.
We operate internationally, and personal data may be transferred to or accessed from outside the United Kingdom. Before any such transfer we identify a valid transfer mechanism, which will be UK adequacy regulations, the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, or another safeguard permitted under Article 46.
Where we rely on contractual safeguards rather than adequacy, we carry out a transfer risk assessment considering the law and practice of the destination country, and apply supplementary measures where needed. Details of the transfers we make are in section 10 of our privacy policy.
Our measures are proportionate to the risk and include:
We maintain an incident response procedure covering detection, containment, assessment and notification.
We apply a retention schedule setting out how long each category of data is held and what happens at the end of that period. The periods we apply are set out in section 11 of our privacy policy. Data is deleted securely or anonymised so that it can no longer identify an individual. Backups are cycled so that deleted data does not persist indefinitely.
Where we process personal data on behalf of a client, we commit to:
As a staffing business we have obligations that sit alongside data protection law, and we treat them together.
Our supervisory authority is the Information Commissioner's Office. If you have a concern about how we handle personal data, please raise it with us first at hello@mooodycow.co.uk so that we have the opportunity to resolve it. You can complain to the ICO at any time, and doing so does not affect any other legal remedy available to you.
Information Commissioner's Office
Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF
Helpline 0303 123 1113
ico.org.uk
For data protection enquiries, due diligence questionnaires, copies of our processing terms, or to exercise your rights, email us at hello@mooodycow.co.uk, or write to MOOODY COW LIMITED, Regency House, 48 Birmingham Road, Bromsgrove, Worcestershire, B61 0DD.