Candidate Privacy Notice

Mint Analysis Ltd. (M.INT)
Company No. 10813027 | ICO Registration No. ZA264362

This Privacy Notice explains how personal data is processed during Integrity Due Diligence and related vetting checks. It is designed to provide clear and understandable information about the processing of personal data in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and applicable UK data protection law, including the Data (Use and Access) Act 2025 (DUAA), and, where relevant, the EU GDPR.

M.INT takes a proportionate, transparent and secure approach to the processing of personal data. This Privacy Notice explains:

• who controls and processes your data;
• what data may be processed and why;
• how your data is used and shared;
• how long your data is retained; and
• your data protection rights, including how to make a complaint.

1. Who Handles Your Data

Data Controller

The organisation instructing M.INT to carry out the due diligence assessment is the Data Controller. This may be a prospective employer, recruitment partner, production company, investor, corporate client or other organisation considering you for an appointment or engagement.

The Data Controller determines the purposes and lawful basis for processing your personal data and instructs M.INT as to the scope of the due diligence assessment.

Data Processor

Mint Analysis Ltd. (“M.INT”) acts as a Data Processor, processing personal data on behalf of and in accordance with the documented instructions of the Data Controller.

M.INT does not make hiring, recruitment, engagement, investment or other appointment decisions.

2. What Data We Process

We process personal data that is relevant and proportionate to the Integrity Due Diligence assessment instructed by the Data Controller.

Information Sources

We may obtain personal data:

• directly from you;
• from the Data Controller or its appointed recruitment partner;
• from relevant third-party sources, including professional references and other persons or organisations where relevant to the assessment; and
• from publicly available sources, including public registers, professional and corporate records, regulatory and sanctions lists, media publications, online and social media platforms, public databases and digital archives.

Categories of Personal Data

Depending on the information available and relevant to the assessment, the personal data we may process includes:

• Identity and address information;
• Professional and educational information, including CV information, employment history, professional experience, qualifications and academic history;
• Corporate and professional records, including directorships, company interests, professional memberships and relevant regulatory or professional records;
• Sanctions and restricted-party information, including information appearing on relevant sanctions, regulatory or other restricted-party lists;
• Publicly available information and digital footprint, including online content, social media activity, news and media coverage, public records, third-party references or mentions, and archived or historical material;
• Data integrity information, including information relating to exposed or compromised credentials, data breaches and leaked information; and
• Other information relevant to the assessment, including information relating to international activities, records or sources, where obtained from the sources described above and necessary and proportionate to the due diligence purpose.

Special Category Data

Special category data, such as data concerning racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, health, sex life or sexual orientation, is not actively sought as part of our standard due diligence research.

Where such information is encountered incidentally in relevant sources, it will only be processed where permitted by applicable data protection law and where relevant and proportionate to the due diligence purpose. Information that is not relevant to that purpose will not be further processed.

Criminal Offence Data

In the course of due diligence, information relating to criminal convictions, offences, allegations, investigations or proceedings may be identified from relevant sources. Where such information is processed, M.INT does so on the instructions of the Data Controller and in accordance with applicable data protection law.

3. How Your Data Is Used

Your personal data is processed solely for the purposes of:

• verifying identity and background information;
• conducting integrity, reputational and security-related assessments; and
• producing structured due diligence reports for the Data Controller.

We do not use personal data for marketing or unrelated purposes.

Lawful Basis for Processing

M.INT processes personal data on behalf of the Data Controller. The Data Controller determines the applicable lawful basis for processing.

Automated Decision-Making and Technology-Assisted Processing

M.INT does not determine a Candidate's employment, engagement, suitability, eligibility or other status. M.INT may use search engines, artificial intelligence and other technology-assisted tools to support human-led research, information retrieval, organisation, translation, transcription or analysis.

4. Who Sees Your Data

Your personal data may be shared only where necessary to provide the due diligence service or where required by law, including with:

• the Data Controller and other recipients authorised by the Data Controller in connection with the relevant engagement;
• authorised sub-processors or service providers involved in the screening process, subject to appropriate data protection obligations; and
• legal advisers, regulators or law enforcement authorities where required or permitted by applicable law.

5. International Data Transfers

Our research may involve accessing publicly available international sources.

Research is primarily conducted within the United Kingdom. Where personal data is transferred outside the UK, this will only occur where an appropriate lawful transfer mechanism and safeguards are in place, such as UK adequacy regulations, the UK International Data Transfer Agreement, the UK Addendum or another legally recognised transfer mechanism.

6. How Long We Keep Your Data

M.INT retains personal data in accordance with the instructions of the Data Controller and the retention period agreed for the relevant engagement.

Unless the Data Controller instructs otherwise, M.INT's standard retention period is three (3) years following completion of the relevant vetting or due diligence engagement.

At the end of the applicable retention period, M.INT will securely delete or irreversibly anonymise personal data, unless continued retention is required or permitted by applicable law.

7. Your Rights

Depending on the circumstances and applicable law, you may have the right to:

• access your personal data;
• request correction of inaccurate or incomplete data;
• request deletion of your personal data;
• request restriction of processing;
• object to processing;
• request data portability; and
• withdraw consent where processing is based on your consent.

Exercising Your Rights

Requests relating to your personal data should ordinarily be directed to the Data Controller that instructed M.INT to carry out the due diligence assessment.

M.INT will provide reasonable assistance to the Data Controller in responding to data protection rights requests in accordance with its obligations as a processor.

You also have the right to lodge a complaint with the UK Information Commissioner’s Office (ICO) if you believe your personal data has been processed unlawfully: ICO complaints

8. Complaints

If you have concerns about M.INT’s handling of your personal data, you may contact M.INT at data.security@mintanalysis.co.uk

M.INT will acknowledge your complaint, investigate it fairly and objectively, and provide a substantive response without undue delay. Where appropriate, M.INT may liaise with or refer the matter to the relevant Data Controller.

If your complaint remains unresolved, you may contact the ICO: ICO complaints | 0303 123 1113

9. Security

M.INT implements appropriate technical and organisational measures to protect personal data, including:

• encryption;
• access controls and role-based permissions; and
• secure IT infrastructure and monitoring.

10. Data Breaches

Where M.INT becomes aware of a personal data breach affecting personal data processed on behalf of a Data Controller, M.INT will notify the Data Controller without undue delay in accordance with its obligations as a processor.

The Data Controller is responsible for determining whether affected individuals or the Information Commissioner’s Office must be notified, in accordance with applicable law.

11. Questions or Support

For questions relating to this Privacy Notice or the processing of your personal data by M.INT, please contact data.security@mintanalysis.co.uk

12. Related Policies

• Cookie Policy – for information about website cookies and tracking technologies.

13. Changes to this Privacy Notice

We may update this Privacy Notice from time to time to reflect changes in our processing activities, legal or regulatory requirements, or how we operate our services.

The latest version will always be available on this page.