To comply with the requirements of the General Data Protection Regulation (GDPR), this document covers the specific requirements and business practices around privacy and data processing for Mindmill (HR) Software Ltd. If you have any questions in relation to the terms, please contact us at info@Mindmill.co.uk

This Privacy Notice aims to give you information on how we collect and process your personal data in a variety of circumstances including when using our website www.Mindmill.co.uk or any associated Mindmill domain, including our mobile applications, and any data you may provide through these websites or applications when you use any interactive features such as our Contact forms, Recruitment Systems, Assessments or otherwise. It is important that you read this privacy policy so that you are fully aware of how and why we are using your data. Our website is not intended for children younger than 15 years old and we do not knowingly collect data relating to children. This version was last updated on the 11th of June 2025

Standard Statement Aim:
This policy aims to protect the individual as well as provide reassurance regarding the confidential treatment of information relating to Mindmill (HR) Software Ltd employees /clients / client’s employees and candidates.

Data protection compliance should be seen as an integral part of employment practises to develop a culture in which respect for security and confidentiality of personal/ client data is recognised.

Introduction
As an HR Technology company, Mindmill takes our responsibility in processing personal data, particularly in our role as a Data Processor for our clients, very seriously. Even though user data via our Assessment Platform is almost immediately anonymised and retained only in accordance with the data policies of our clients, we take utmost care to ensure compliance to Data Protection legislation.

Basic Principles
The General Data Protection Regulation (GDPR) standardizes data protection law across all 28 EU countries and imposes strict new rules on controlling and processing personally identifiable information (PII). GDPR came into force on 25 May 2018. The UK GDPR which mirrors the EU version of the GDPR, has been converted into UK law on 1 January 2021.

“Data protection by design and by default”, means that business processes that handle personal data must be designed and built with consideration of the principles and provide safeguards to protect data (for example, using pseudonymization or full anonymization where appropriate), and use the highest-possible privacy settings by default, so that the data is not available publicly without explicit, informed consent, and cannot be used to identify a subject without additional information stored separately. No personal data may be processed unless it is done under a lawful basis specified by the regulation or unless the data controller or processor has received an unambiguous and individualized affirmation of consent from the data subject. The data subject has the right to revoke this consent at any time.

The Act works in two ways:
Giving individuals (data subjects) certain rights with regard to information held about them requiring those who decide how and why individual personal data are processed (data controller) to be open about their use of this data and to comply with the data protection principles in their information handling practises.

The Company is registered with the Information Commissioner’s Office under the Act as processors of personal information and will adhere strongly to the principles of the Act and the obligations to act correctly and transparently in how the information held on all employees and clients is processed.

This policy should be considered as complimentary to Company policies and rules regarding computer/ internet, and confidentiality.

Data Protection Principles
Central to the Act are eight data protection principles which all data controllers must follow to ensure that personal data is:

These principles protect the individual and also make sound business sense (for example, if we send out mailing based upon incorrect or out of date records. Not only may we be in breach of the act and could annoy clients/ candidates, but we could ultimately waste our own time and money).

The Right of Subject Access

Under the GDPR, Mindmill respects the right of data subjects to access and control their personal data and has provisions in place for:

Mindmill (HR) Software Ltd will endeavour to provide:

Please note that Mindmill may not always be able to allow you to access your information, particularly where disclosure would provide information about another individual.

Goals for This Notice
This document should ensure the governance framework and implicitly ensure that the Information Security Program implements adequate:

Management Commitment to Information Security
The Board of Directors, the CEO, and the other approvers (Head of Operations / Client Service Executive) realize how important Information Security is to Mindmill, and have the responsibility for:

What information may be collected?
Personal Information is stored separately on two core systems at Mindmill, which are accessible via our website and mobile applications. The Assessment System and the Recruitment system. A list of Key Information that may be stored on each system is as listed below. Not all fields are applicable in every deployment, and the list lists data fields irrespective of the length of time that data is stored on our systems.

Assessment System

Recruitment System

Where we process special categories of personal data, such as data relating to health (e.g., Disability Status) or racial or ethnic origin, this is done with your explicit consent or as otherwise permitted by law, such as for employment, social security, or social protection law obligations.

Mindmill Mobile Applications

This section specifically addresses the privacy practices related to Mindmill’s mobile applications, available on platforms such as the Google Play Store and Apple App Store (collectively, “the App”). This Privacy Notice applies to all personal data collected and processed through the App, in addition to the general practices outlined in the rest of this document.

Reference to Mindmill (HR) Software Ltd. as the Entity:

The App is provided by Mindmill (HR) Software Ltd., the entity named in the App’s listing on the Google Play Store and Apple App Store. All data processing activities conducted through the App are carried out by Mindmill (HR) Software Ltd. in its capacity as a Data Processor for its commissioning clients, as further detailed in this Privacy Policy.

How the App Collects and Uses Data:

The Mindmill App functions as a mobile interface to our core Assessment System and Recruitment System. Therefore, the types of information collected through the App, and how it is used, mirror the data collection and usage practices described in the “What information may be collected?” and “How is personal information used/shared?” sections of this Privacy Policy. Specifically:

As stated in the “How is personal information used/shared?” section, no personal or personally identifiable information is used/shared within Mindmill’s internal processes from the App. Personal and identifiable data collected via the App is only used or shared to and by the commissioning client, and the information protection falls under the scope and responsibility of the commissioning client, their Privacy Policies, and Data Protection processes. Mindmill may use anonymized data collected via the App to create/update Psychometric norms, but no identifiable data is kept or used for this purpose.

Your Rights within the App:

Your rights as a Data Subject, as outlined in the “Data Subject’s Rights” section of this Privacy Policy, apply equally to personal data processed through the Mindmill App. This includes your right to access, correct, delete, withdraw consent, and object to processing, and to lodge a complaint with the Information Commissioner’s Office. You can exercise these rights by contacting us at info@Mindmill.co.uk.

Data Security and Storage (for App Data):

All data collected through the Mindmill App is subject to the robust security measures and storage practices detailed in the “How do we secure personal data?” and “Where do we store and process personal data?” sections of this Privacy Policy. This includes enterprise threat modelling, application security (OWASP SAMM framework), data classification, system/business application/infrastructure prioritization, and business continuity and business recovery planning. All App data is stored and processed on cloud-based servers in London (UK) with www.webhosting.co.uk and Microsoft’s Azure Cloud services in their UK South region.

Automated Decision-Making and Profiling (via App):

Any automated decision-making or profiling conducted through the App, such as the screening/filtering of suitable candidates based on predetermined job-related criteria, adheres to the principles and disclosures outlined in the “Use Of Automated Decision-Making and Profiling” section of this Privacy Policy. Any final decision regarding shortlisting remains with the commissioning client’s staff.

Data Controller
Users can get in touch if they have questions or concerns about your privacy practices, their personal information, or if they wish to file a complaint. The Mindmill data controller can be reached via info@Mindmill.co.uk

How is personal information used/shared?

No personal or personally identifiable information is used/shared within Mindmill’s internal processes. Personal and identifiable data is only used or shared to and by the commissioning client and that information protection falls under the scope and responsibility of the commissioning client, their Privacy Policies and Data Protection process.

Mindmill may use anonymized data to create/update Psychometric norms, but no identifiable data is kept or used for this purpose.

By using Mindmill and providing your End User Data, you are storing your data on our platform. You may at any time grant access to your End User Data to other users registered on the platform should you wish to be notified of a suitable job opening. You may at any time revoke access to your End User Data.

Also note that in addition to recruitment, our commissioning clients use the MindmillPlatform, which is an assessment platform. for performance management, engagement surveys, staff development etc.

Marketing
If you are a customer of ours, we may contact you from time to time by call or email to provide some information about our products or services. You can ask us or third parties to stop sending you marketing messages at any time by contacting us, as appropriate Where you opt out of receiving these marketing messages, this will not apply to personal data provided to us because of a service experience or other transactions.

Mindmill does not provide users’ personal data to third parties for marketing purposes. However, should this need arise we will get your express opt-in consent before we share your personal data with any company outside of our own for marketing unrelated to our company.

What legal basis do we have for processing your personal data?
Mindmill provides a means of capturing and analysing data. The data we collect from you may include personal data as defined by the Data Protection Act 1998 as amended. By providing any data to us through your use of Mindmill (any such data, End User Data), you acknowledge and consent to the End User data being transferred or stored within or outside the EEA. Please note that some places outside the EEA may offer lower levels of data protection than the UK. By submitting End User Data, you agree to this transfer, storing or processing.

Where do we store and process personal data?
All Mindmill services are cloud-based and servers and databased are hosted in London (UK) with www.webhosting.co.uk. Their specific terms of service can be found and reviewed at https://www.webhosting.uk.com/terms-of-service/

Mindmill also makes use of Microsoft’s Azure Cloud services with data storage facilities in their UK South region with Service Agreement and terms available at https://azure.microsoft.com/en-us/support/legal/

How do we secure personal data?

Enterprise Threat Modelling: Enterprise threat modelling means the exercise of identifying who could be a threat to your organization, what their motives might be and how they would go about accomplishing these motives. It is important to note that threat modelling isn’t something you only do for applications, but something you do for the entire enterprise, hence “enterprise threat modelling”

This threat modelling should include all of the three aspects of the CIA triad and include also for example system failure and manual error. It should model expected or unexpected attackers against the company, their likely TTP (tools, tactics, and procedures), their motivation and intent and what they might be likely to do if they breach the company. Using the threat modelling proactively can be used for budgeting investments and for prioritizing tasks in the day-to-day work by IT and Security personnel.

Based upon risk assessments and risk/consequence estimations preventive, discovering and corrective security controls should be implemented to iteratively until residual risks are within acceptable thresholds i.e., within the risk appetite. The areas to be included in risk assessment are:

Data Classification
Different classification levels for assets/systems should be defined, for example:

System/Business Application/Infrastructure Prioritization
All systems/business applications/infrastructure should be assigned a business criticality between 1 and 3 where 1 means business critical and 3 means a not very critical system /application /infrastructure element. Example of a criticality rating of 3 could be a test system.

Only the business part of the company can prioritize these appropriately, so it’s a project that Information Security can lead but also needs the approvers and relevant business stakeholders. A list of all relevant systems/business applications/infrastructure with a given priority is required and should be updated annually.

We have procedures in place to deal with any suspected data security breach. We will notify you and any applicable regulator of a suspected data security breach where we are legally required to do so.

Business Continuity & Business Recovery Planning
To re-establish a business-as-usual condition following a disaster or a major incident, the company must maintain a Business Continuity Plan and a Business Recovery Plan. The plans must ensure that the company can re-establish systems and data within a predefined time frame. The plans must contain detailed emergency plans for all infrastructure within scope. To accomplish this a scope must be established and approved by the approvers.

The BCP and BRP must be tested at least once per year by for example moving the active systems to the disaster recovery site or by conducting a similar simulation.

The maximum accepted downtime for priority 1 systems is: 2 hours
The maximum accepted downtime for priority 2 systems is: 4 hours
The maximum accepted downtime for priority 3 systems is: 8 to 24 hours
The CEO and/or approvers are responsible for defining acceptable downtime. IT and Information Security are responsible for creating plans that can implement the requirements and testing them.

Continuous improvement
All policies, risk assessments, and controls should be periodically re-evaluated/audited at least annually and whenever appropriate to ensure a continuous improvement of Information Security.

Outsourcing and Vendor Management
The overall goal of defining the rules of outsourcing and vendor management is to:

Retain control of information resources in an outsourcing situation
Manage the handover securely to a partner that has been through the necessary audits/controls/due diligence
Attain the information/tools required to be able to monitor and report on expected significant benefits including any expected financial benefits related to the outsourcing services.

The purpose of this notice is also to satisfy legal and regulatory requirements and to manage the risks involved with outsourcing of significant activities.

Outsourcing should be used:

Only in a situation where this does not in any way impact customers/clients negatively
Strategically to obtain pre-defined significant benefits, the realization of which must be transparently verified and reported on periodically
Only if the process of entering and handing over responsibility to an outsourcing partner is controlled and managed.

How long do we keep your personal data for?
Mindmill complies to and operates as an extension to the Data Retention Policies of its clients and project initiators. As all data entering the Mindmill system belongs to Mindmill, Mindmill operates as an outsourced provider or 3rd party to the commissioning client. Mindmill thus processes data, provides packaged data to the customer and destroy or anonymize the data in accordance the applicable data retention policy.

Use Of Automated Decision-Making and Profiling
In certain instances, Mindmill makes use of Automated Decision making to streamline workflow and the processing of information. Mindmill’s technology is used to help select appropriate candidates for our commissioning clients based on criteria expressly identified by such client, or typical in relation to the role for which you have applied, the screening/filtering of suitable candidates is therefore automatic to a point, based on predetermined job-related criteria. However, any decision as to who the commissioning client will engage to be shortlisted to fill the job opening will be made by a staff member of such client.

By submitting your End User Data:
You grant a worldwide, royalty-free, non-exclusive licence to use the End User Data to us and any third parties with which we may work from time to time in the provision of our services; you also explicitly consent to your End User Data being analysed and forming the basis of a report to be passed to the third party (such as our commissioning client) at whose request you are undergoing the Assessment (such content, Report); and
you represent and warrant that you have the lawful right to provide such End User Data and the necessary rights, power and authority to grant the licence at clause above and you further represent and warrant that the use by us of the End User Data will not infringe the rights (including intellectual property rights) of any third party.

By using Mindmill and providing your End User Data, you are storing your data on our platform. You may at any time grant access to your End User Data to other users registered on the platform should you wish to be notified of a suitable job opening. You may at any time revoke access to your End User Data.

Data Subject’s Rights

Under the General Data Protection Regulation and the UK GDPR, you have a number of important rights free of charge. In summary, those include rights to:

For further information on each of those rights, including the circumstances in which they apply, see the Guidance from the UK Information Commissioner’s Office (ICO) on individuals rights under the UK GDPR.

If you would like to exercise any of those rights, please:

Definitions and Abbreviations
Significant outsourcing activity: Outsourcing of an activity that has a significant size either in financial terms or in impact on the company’s operations and/or clients.

Information Resources (IR): any and all computer printouts, online display devices, magnetic storage media, and all computer-related activities involving any device capable of receiving email, browsing Web sites, or otherwise capable of receiving, storing, managing, or transmitting electronic data including, but not limited to, mainframes, servers, personal computers, notebook computers, hand-held computers, personal digital assistant (PDA), pagers, distributed processing systems, network attached and computer controlled medical and laboratory equipment (i.e. embedded technology), telecommunication resources, network environments, telephones, fax machines, and printers. Additionally, it is the procedures, equipment, facilities, software, and data that are designed, built, operated, and maintained to create, collect, record, process, store, retrieve, display, and transmit information.

Incident: Any event that does or could have caused an unintentional effect on the company’s IR with regards to the CIA triad Confidentiality, Integrity and Availability. Also covers security incidents.

SLA: Service Level Agreement. An agreement with a third party.

OLA: Operational Level Agreement. A company-internal SLA.

BCP: Business Continuity Planning.

DR: Disaster Recovery