Mint Analysis Ltd. (M.INT)
Company No. 10813027 | ICO Registration No. ZA264362
This summary explains how we handle your personal data during Integrity Due Diligence or related vetting checks. It is designed to be clear and understandable while meeting the requirements of the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, the Privacy and Electronic Communications Regulations 2003 (PECR), and applicable UK data protection developments, including the Data (Use and Access) framework (DUAA), and where relevant, the EU GDPR.
M.INT takes a proportionate, transparent, and secure approach to personal data. This summary explains:
Data Controller: The organisation instructing M.INT. This may be a prospective employer, recruitment agency, production company, or other client. The Data Controller determines the purposes and lawful basis for processing your personal data.
Data Processor: M.INT acts strictly on the instructions of the Data Controller and does not make hiring, casting, or scouting decisions.
We collect only information that is relevant and proportionate to the vetting process.
We may obtain personal data:
The categories of personal data we may process include:
Special category data (racial or ethnic origin, religion, health data, sexual orientation, political opinions, trade union membership, etc.) is not actively collected. Where such data is encountered incidentally in publicly available sources, it is handled only where necessary under Article 9(2)(e) UK GDPR (data manifestly made public) and in accordance with applicable safeguards. Any data that is not relevant to the purpose of the assessment is disregarded without further processing.
Your personal data is used solely for the purposes of:
We do not use personal data for marketing or any unrelated purpose.
Lawful basis for processing:
Processing is carried out on behalf of the Data Controller, who determines the lawful basis for the assessment. In most cases, this will be legitimate interests (Article 6(1)(f) UK GDPR), in connection with proportionate due diligence relating to employment, engagement, or reputational risk decisions.
Where special category data is processed, this is handled in accordance with Article 9(2)(e) UK GDPR and applicable safeguards.
Automated decision-making:
M.INT does not carry out automated decision-making or profiling.
Your personal data may be shared only with:
Our research may involve accessing publicly available international sources.
Research is primarily conducted within the United Kingdom. Where personal data is transferred outside the UK, this will only occur where appropriate safeguards are in place, such as adequacy regulations, Standard Contractual Clauses (SCCs), or approved international data transfer frameworks.
Unless otherwise instructed by the Data Controller, M.INT will retain personal data for no longer than three (3) years following completion of the relevant vetting or due diligence engagement. This retention period reflects the legitimate interests pursued in connection with the provision of due diligence services, including maintaining an appropriate audit trail, supporting informed decision-making in respect of senior or high-profile appointments, and enabling proportionate re-screening or review where required by the Data Controller.
Retention periods are determined in accordance with the UK GDPR storage limitation principle and are subject to periodic review to ensure they remain necessary, proportionate, and limited to the purposes for which the data was collected.
Where relevant to the nature of the engagement, M.INT applies differentiated retention periods, with shorter retention for underlying or supporting data and longer retention for final due diligence reports and associated audit records, in line with the principle of data minimisation, applied throughout the retention period.
Upon expiry of the applicable retention period, personal data is securely deleted or irreversibly anonymised, unless continued retention is required or permitted by applicable law.
You have the right to:
How to exercise your rights:
Please contact the Data Controller who instructed the vetting process. M.INT will assist where possible and in coordination with the Data Controller.
You also have the right to lodge a complaint with the UK Information Commissioner’s Office (ICO) if you believe your personal data has been processed unlawfully: https://ico.org.uk/make-a-complaint/
If you are dissatisfied with the way M.INT has handled your personal data, you may raise a formal complaint using our online complaint form or by emailing data.security@mintanalysis.co.uk.
How we handle complaints:
If your complaint remains unresolved, you have the right to escalate to the UK Information Commissioner's Office (ICO):
ico.org.uk/make-a-complaint | 0303 123 1113
We implement appropriate technical and organisational measures to protect your personal data, including:
In the event of a personal data breach:
For any queries relating to this summary or your personal data:
Email: data.security@mintanalysis.co.uk
M.INT is not required to appoint a Data Protection Officer under applicable law. Data protection queries should be directed to the email above.