Candidate Privacy Policy

1. Introduction

M3 (referred to as “M3”, “we”, “us” or “our” in this privacy policy) takes your privacy very seriously and we are committed to protecting your personal data. This includes information you provide to us and information that we obtain about you from other sources. The statement below describes what data we will obtain, how the data is used and how the data is protected. This Privacy policy relates to all candidates who apply either directly or indirectly to work for M3 (EU) Ltd, M3 USA or any other M3 owned Business.

2. Who We Are

As your prospective employer, M3 and the M3 group business needs to keep and process personal data (including sensitive personal data) about you to allow the recruitment process and assess suitability for employment prior to a contract of employment. In doing so, M3 acts as a data controller. The information we hold and process will be used for management and administrative purposes only. We will keep and use it to run the business and manage our relationship with you effectively, lawfully and appropriately during the recruitment process. A separate Privacy Policy will be available upon commencement of employment to cover whilst you work for us, at the time when your employment ends and after you have left. This includes information to enable us to comply with legal requirements, pursue the legitimate interests of M3 and protect our legal position in event of legal proceedings.

Any questions about your data or our privacy policy can be addressed in writing to our Data Protection Officer: dpo@eu.m3.com.

3. Collection and use of personal data

Purpose of processing and legal basis

We collect personal information about our candidates through the application and recruitment process, either directly from individuals or sometimes from an employment agency or job board. We may sometimes collect additional information from third parties including former employers, credit reference agencies and/or other background suitability check agencies. Where background checks and referencing are conducted by a third party, the third party will provide you with access to their own privacy policy which applies in addition to this one.

M3 must have a legal basis for processing your personal data. For the purposes of providing you with employment (including all stages from application to contract of employment), we will only use your personal data in accordance with the terms of the following statement.

M3 will collect your personal data and will process this for the following purposes:

  • Manage the recruitment process and assess your suitability for employment;
  • Make decisions about who to offer initial employment to, and subsequent internal appointments and promotions;
  • Comply with statutory and/or regulatory requirements and obligations, e.g. checking your right to work and any associated visas;
  • Comply with the duty to make reasonable adjustments for disabled job applicants and successful candidates along with other disability discrimination obligations;
  • Ensure effective HR and personnel management;
  • Dealing with legal claims made against us;
  • Preventing fraud; and
  • Monitoring equal opportunities.

In some cases, we may be required to use your data for the purpose of investigating, reporting and detecting crime and also to comply with laws that apply to us.

The legal bases we rely on include

  • Fulfilling a contractual obligation that we have with you;
  • Where we have a legitimate interest;
  • Complying with a legal obligation that we have; and/or
  • Your consent.
Contractual obligations

As your prospective employer we assume certain contractual obligations to you. This includes ensuring you gain the benefit of any statutory or contractual rights.

If we are unable to obtain or hold the information necessary to meet our legal or contractual obligations, we may be prevented from providing a contract of employment.

Legitimate interest

M3 has a legitimate interest in identifying suitable individuals for work opportunities provided it is reasonable and does not go against what you would reasonably expect from us. We are also interested in trends in recruitment and the development of reports that help us to devise recruitment strategies for hiring the best staff.

Legal obligations

M3 has many legal obligations to various individuals, clients and public bodies to ensure we are complying with laws in relation to for example:

  • Carrying out checks in relation to your right to work;
  • Checks to ensure your suitability to work for us; and
  • Making reasonable adjustments for disabilities or individuals who are in a rehabilitation process.
Consent

Where we process special categories of information relating to your health, racial or ethnic origin, political opinions, religious and philosophical beliefs, trade union membership, biometric data or sexual orientation, we will always obtain your explicit consent to obtain these details unless this is required by law or the information is required to protect your health in an emergency.

Special categories of data may be used:

  • for the purposes of equal opportunities monitoring; and
  • to determine reasonable adjustments.

Where we are processing data based on your consent, you have the right to withdraw that consent at any time.

4. Information we hold

The types of information we hold includes your application form and/or Curriculum Vitae and references, background and security checks, correspondence with or about you, for example invites to interview, information needed for equal opportunities monitoring; and records relating to your career history.

It is important that the personal information we hold about you is accurate and current. Please keep us informed if your personal information changes during the period which we hold your data.

You may provide M3 with details of other individuals (including, without limitation, referees and next of kin/persons to be contacted in an emergency). By doing so you are confirming that you have that person’s consent to provide us with their details, to process the information for the intended purpose and to contact them for the intended purpose if necessary and/or appropriate.

5. CCTV

Some of our offices use Closed-Circuit television (CCTV) for security purposes. Recordings are kept for a maximum of one month and only IT and security staff have access to the system and the system is only viewed when required, not systematically.

The purpose for processing this information is for security and safety reasons. The legal basis we rely on to process your personal data is article 6(1)(f) of the GDPR, which allows us to process personal data when its necessary for the purposes of our legitimate interests.

6. Sharing of personal data

Your data will be shared with colleagues within the Company where it is necessary for them to undertake their duties. This includes, for example, the HR department and recruitment / hiring managers to administer the recruitment process.

Where we use third-party service providers, they are required to take appropriate security measures to protect your personal information in line with our policies. We do not allow our third-party service providers to use your personal data for their own purposes. We only permit them to process your personal data for specified purposes and in accordance with our instructions and we will not sell access to your data to other businesses for marketing or any other purpose.

We may share your data with the following people or companies:

Recruitment portal

M3 uses SmartRecruiters (https://www.smartrecruiters.com/) as our applicant tracking system and recruitment portal.

References and pre-employee assessments

With your consent, we may share data with your former employers to obtain references. M3 use Crosschq, Inc. for processing reference requests for new hires and Criteria Corp. for pre-employment assessments.

Suitability checks

M3 use HireRight to carry out suitability checks where applicable for employees in UK, EU and US. For employees in India, M3 uses Dcode Research Services Pvt Ltd.

Group Companies

M3 may share your data with other members of our group of companies for the purposes of monitoring and managing the services provided by the company. When sharing data across companies, where applicable we anonymise all personal data or protect the data by password protecting and / or using the secure file share application and ensure safeguards required by Data Protection Laws are in place and adhered to.

Members of our group include:

  • M3 Inc (Japan)
  • M3 Medical Holdings Ltd (UK)
  • QQFS (Sweden)
  • M-Panels Research Services Pvt Ltd T/A M360 Research (India)
  • IQUS Ltd T/A RotaMaster (UK)
  • OneHealth Communications and Data4Health (UK)
  • pharma-insight (Germany)
  • Ekas (Australia)
  • M3-MI (USA)
  • All Global (UK, Europe)
  • Vidal Group Holdings Ltd including subsidiaries in France, Germany and Spain
  • M3 USA
  • M3 (EU) Ltd which includes trading styles:
  • Doctors.net.uk (UK)
  • medeConnect (UK)
  • M3 Global Research (UK)

7. Protection of your data

We are committed to taking all reasonable and appropriate steps to protect the personal information that we hold from misuse, loss or unauthorised access.

Access to your data is restricted to ensure it can only be accessed by authorised users. We have minimised the need for data to be accessed unless this is strictly necessary to meet our obligations or to respond to any reasonable and lawful request and information is regularly backed up to reduce the risk of loss or corruption.

To provide a recruitment service, this may involve your data be transferred to a country outside of where you reside. M3 ensures that there are technical and organisational measures implemented to protect your personal data and where required by law we use EU and UK Standard Contractual Clauses to safeguard the personal data to a country outside of the UK or EEA.

8. Data Retention

M3 will retain your personal data only for as long as is necessary for the purpose we collect it. Different laws may also require us to keep different data for different periods of time.

At point of application, you will be asked if you consent for M3 to retain your personal data on record for any suitable opportunities that may arise in future. If you provide this consent, we will retain your personal data for 2 years from the date of your application.

If you do not provide consent for M3 to retain your data for an extended period, we will retain your interview notes and CV including contact details for 6 months post interview to comply with our legal obligations.

You may request for your details to be deleted at any time by contacting the Data Protection Officer - dpo@eu.m3.com.

9. Your rights

Please be aware, you have the following Data Protection rights:

  • The right to be informed about the personal data the Company processes on you;
  • The right of access to the personal data the Company processes on you;
  • The right to rectification of your personal data;
  • The right to erasure of your personal data in certain circumstances;
  • The right to restrict processing of your personal data;
  • The right to data portability in respect of any data that has been provided to us directly by you;
  • The right to object to the processing of your personal data that was based on a public or legitimate interest; and
  • The right to regulate any automated decision-making and profiling of personal data. You have a right not to be subject to automated decision making in way that adversely affects your legal rights.

Where you have consented to M3 processing your personal data you have the right to withdraw that consent at any time by contacting us.

There may be circumstances where M3 will still need to process your data for legal or official reasons. We will inform you if this is the case and we will restrict the data to only what is necessary for meeting those specific reasons.

You can also contact us if you want us to restrict the type or amount of data, we process for you, access your personal data or exercise any of the other rights listed above.

10. California Residents

Residents of California are also protected under the California Consumer Privacy Act (CCPA) and its addendum California Privacy Rights Act (CPRA). This Privacy Policy outlines the requirements specifically:

  • the categories of personal information collected by the employer during the preceding 12 months;
  • the categories of sources from which the personal information is collected
  • the business or commercial purposes for collecting, selling, or sharing that personal information;
  • the categories of third parties to which personal information is disclosed;
  • the categories of personal information disclosed for a business purpose in the preceding 12 months; and
  • the individual’s CPRA rights and how to exercise those rights
Right to Opt-Out of the Sale of Personal Information ("Right to Opt-Out")

Under CCPA, you have the right to opt-out of the "sale" (as defined by CCPA) by a CCPA- subject business of your personal information to third parties. CCPA defines a "sale" of personal information as occurring when a business exchanges personal information of California residents to a third party for monetary or other valuable consideration.

M3 does not "sell" your personal information, in either the CCPA sense, nor any other sense including for purposes of cross-context behavioural advertising.

We may share your personal information as defined in section 6 of this Privacy Policy solely for the provision of contract with you as an employee or as otherwise required by law.

Except as outlined in this Privacy Policy, all data that we share will be deidentified information (meaning, data that has been carefully encrypted so it no longer identifies you or is linkable to you) or aggregate information (which means data from a group of individuals from which all individual identities have been carefully removed so no particular person may be identified). Neither deidentified information nor aggregate consumer information are considered personal information as defined in CCPA.

11. Changes to the Privacy Policy

This Privacy Policy was last updated on 18 April 2024. If it is necessary for us to alter the terms of this Privacy Policy, we will publish a revised policy on our recruitment portal.

12. Complaints or queries

M3 is committed to meeting the highest standards when collecting and using personal information and expects all staff to share this commitment. For this reason, we take any complaints very seriously. We encourage you to bring it to our attention if you think that our collection or use of your information is unfair, misleading or inappropriate.

This privacy policy was drafted with brevity and clarity in mind. It does not provide exhaustive detail of all aspects of M3’s collection and use of personal information. However, we are happy to provide any additional information or explanation needed. Any requests for this should be sent to the email address below.

If you wish to raise any query or complaint about this privacy policy or any of the procedures set out in it, please contact our Data Protection Officer - dpo@eu.m3.com

You also have the right to raise concerns with your local Supervisory Authority if you believe that your data protection rights have not been adhered to.: