Data Retention Policy

MCS Personnel Ltd, trading as MCS Group, is a company registered in Northern Ireland at 10th Floor, The Ewart, 3 Bedford Square, BT2 7EP. Company Number NI069406.

MCS Group takes our responsibility for data protection and security under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018 seriously.

In alignment with our Privacy Policy, MCS Group is committed to adhering to the principles outlined in applicable data protection legislation to safeguard personal data. We are based in the United Kingdom and operate under the regulatory purview of the Information Commissioner's Office, with registration number ZA315767.

MCS Group may use third-party service providers that process or access personal data outside the United Kingdom and European Economic Area. Where personal data is transferred internationally, MCS Group will ensure that appropriate safeguards and transfer mechanisms are in place in accordance with UK data protection legislation. These may include adequacy regulations, the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, and appropriate Transfer Risk Assessments/Data Protection Tests where required.

Our retention policy assures that all personal data is held only for the duration necessary to fulfil the purposes for which it was collected. MCS Group refrains from retaining identifiable personal data beyond what is required for legitimate business functions, regulatory compliance, legal obligations, and reporting requirements.

All personal and business data held by MCS Group is treated as confidential information. We are committed to maintaining the confidentiality and security of all data and implementing appropriate technical and organisational measures to prevent unauthorised access, use, disclosure, alteration or destruction.

This commitment extends to all employees, contractors and third parties who may have access to data and is reinforced through regular training and adherence to our data protection policies and procedures.

In accordance with our retention policies and procedures, we will remove any personal data from our systems after a reasonable time frame—specifically, five years of inactivity—unless a shorter or longer retention period applies due to legal or regulatory requirements, legitimate business requirements or the establishment, exercise or defence of legal claims.

For the purpose of this policy, 'activity' is defined as any of the following: submitting a CV via our job advertisements, engaging in verbal or written communication with us, or interacting with any of our branded marketing materials.

Where MCS Group acts as an employment agency or employment business in Northern Ireland, records required under the Conduct of Employment Agencies and Employment Businesses Regulations (Northern Ireland) 2005 will be retained for the applicable statutory period. Relevant work-seeker records, including application details, agreed terms or contracts for services, qualifications, experience, references, suitability checks and assignment details, will be retained for at least one year after MCS Group last provides services to the work-seeker.

Where MCS Group is responsible for carrying out a prescribed Right to Work check, evidence of that check will be retained for the duration of the worker's employment or engagement and for two years afterwards.

Where another legal or regulatory requirement requires information to be retained for a longer period, the longer retention period will apply.

Should you, as a recruitment candidate, explicitly request the deletion of your personal data from our systems, we will comply where required under applicable data protection legislation. The right to erasure is not absolute, and MCS Group may retain certain information where there is a lawful reason to do so, including legal, regulatory, accounting, HMRC or potential litigation requirements.

MCS Group is dedicated to maintaining transparency. Data subjects will be notified about the length of time their data will be stored and the criteria used to determine this period, either through a Privacy Notice available on our website or a Fair Processing Notice, as applicable.

We continue to take robust measures to ensure the deletion of all personal data that is no longer needed, in accordance with UK GDPR guidelines.

Data Ownership

MCS Group acts as the Data Controller for personal data where it determines the purposes and means of processing.

Individuals retain their rights in relation to their personal data under applicable data protection legislation.

Data collected from candidates and clients may include, but is not limited to, CVs, contact information and communication records. Data provided by third parties, such as job boards, is subject to the terms of the agreement with that third party.

Employees are responsible for the data they create and process in the course of their employment. MCS Group remains the Data Controller where it determines the purposes and means of that processing.

This Data Retention Policy will be reviewed and updated at least annually, or more frequently as needed to reflect changes in legislation, best practice or business requirements. The review will be conducted by the Data Protection Officer and approved by senior management.

Data Handling (Captured, Used, Stored, and Retained)

Captured: Data is captured through various channels, including online applications, CV submissions, phone calls, emails, and in-person meetings.

Used: Data is used for recruitment purposes, including matching candidates with job openings, communicating with clients and candidates, and managing the recruitment process.  Data may also be used for reporting and analytics.

Stored: Data is stored securely on our servers and in cloud storage, with appropriate access controls and encryption measures in place.

Retained: Data is retained only for as long as necessary for the purposes for which it was collected, as outlined in this policy. Retention periods are determined based on data classification, legal requirements and business needs. Where a specific legal or regulatory retention period applies, that period will take precedence. After the applicable retention period expires, data will be securely deleted or anonymised.

MCS Group implements robust security measures to protect data against unauthorized access, use, disclosure, alteration, or destruction. These measures include:

• Physical Security: Secure office premises with restricted access.
• Technical Safeguards: Firewalls, intrusion detection systems, encryption, and access controls
• Administrative Measures: Data protection policies, employee training, data breach procedures, and regular audits.

We conduct regular data retention reviews, at minimum quarterly, to proactively ensure stored data aligns with and does not exceed our business requirements.

In the event of a data breach, MCS Group will follow its data breach procedure, which includes notifying the ICO if necessary and affected individuals as required by GDPR.

Our Data Protection Officer is Fran Coyle, f.coyle@mcsgroup.jobs

MCS Group reserve the right to amend this Policy at any time.