At Matrix SCM Limited, we’re committed to ensuring that your personal information is protected. Your privacy is important to us and right at the heart of our business.

Please read the following carefully to understand our views and practices regarding your personal data and how we will treat it.

Contact us

Matrix’s Data Protection Officer (DPO) can be contacted by email at privacy@teammatrix.com.

Matrix SCM Limited is registered at 2nd Floor Partis House, Davy Avenue, Knowlhill, Milton Keynes MK5 8HJ No. 02227962. Our ICO registration number is Z1146191. 

How we process your personal data as a data controller

When using the term “personal data” in this Privacy Notice, we mean information that relates to you and from which you could be identified, either directly or indirectly in combination with other information which we may have in our possession. 

Where we act as a data controller, we may collect, store, and use the following kinds of personal information:

Purpose	Personal data	Lawful basis
Pre-contractual discussions and onboarding	Contact details including name, email address, contact number and job title.	Contractual obligation
To register you as a user on our client portal	Contact details including name, email address, contact number and job title.	Contractual obligation
Send statements and invoices to you, and collect payments from you via the website	Contact details including name, email address, contact number and job title. Transactional details	Contractual obligation
To manage our relationship with you which may include:Notifying you about changes to our terms or privacy notice Asking you to leave a review or take a survey	Contact details including name, email address, and contact number.	Contractual obligation Legal obligation Necessary for our legitimate interests (to ascertain how clients use our products/services and related feedback to make improvements)
To administer our business and our website, including improving and securing our website	Contact detailsIP address, geographical location, browser type and version, operating system, referral source, length of visit, page views, website navigation	Necessary for our legitimate interests (for running our business, provision of administration and IT services, network security)
To send you marketing emails and general correspondence	Contact details	Necessary for our legitimate interests (to keep our clients up to date with our services)
To ensure security on our client portal	IP address and user ID	Necessary for our legitimate interests (for the provision of IT services, network security)
To track and analyse website traffic and user behaviour by measuring metrics such as page views, session duration, and user demographics.	IP address, geographical location, browser type and version, operating system, referral source, length of visit, page views, website navigation.	Consent
To maintain a register of corporate gifts and hospitality and to comply with our other legal and regulatory obligations, e.g. undertaking conflict checks.	Contact details	Legal obligation

How we process your personal data as a data processor

Where we are acting as a data processor on behalf of the client (the data controller), we may collect, store, and use the following kinds of personal information:

Information provided to us for the purpose of placing workers in temporary employment may include, but is not limited to:

• your identity and contact data including your title, name, date of birth, gender, current address (and address history), email address and contact number. 
• place of birth
• National Insurance number
• copies of ID documentation such as passport and/or driving license
• nationality (at birth and current)
• copy of your CV including current and previous employment information, education and/or professional qualifications and references
• criminal offence and conviction data
• details of hours and days worked during your employment. 
• employment details including start/end date of employment and pay rates.
• technical data such as your internet protocol (IP) address, your login data, browser type and version, time zone setting and location, browser plug-in types and versions, operating system and platform, and other technology on the devices you use to access this website.
• usage data such as information about how you use our website and services.
• special categories of data relating to equality and inclusion including ethnic and racial origin, sexual orientation, religious beliefs and disability and reasonable adjustments. You can opt to not disclose this information, if preferred. 

Sometimes, we also collect sensitive personal data about you, known as ‘special category data’. This includes:

• health data and details of reasonable adjustment, where relevant to the client and/or role. 
• social values information such as racial/ethnic origin, religion, sexual orientation, etc. for reporting purposes. For example, the client may require Matrix to provide a report portraying the ethnicity and gender of their workers. However, such data will be provided to the client anonymously.
• details of criminal offence/convictions data, where applicable.  

Whilst some of the above information is required by default, such as contact details, other personal data gathered is strictly related to the level of documentation required by our clients for compliance purposes, such as copies of right to work documentation and signed NDAs. No unnecessary information is obtained from data subjects that is not specifically required for the purpose of the placing workers in temporary employment.

We may use artificial intelligence (AI) to validate and automate elements of the operation to provide a better experience for clients, suppliers and/or temporary workers and/or to speed up our processes in a diligent manner. We do not use AI for decision making regarding screening outcomes – this is undertaken by humans. If would like further information regarding our use of AI, please contact privacy@teammatrix.com. 

Our lawful basis for processing

It is not our responsibility to determine the lawful basis for processing your personal data where we are acting on the client’s instructions. As a data controller, the client will determine the lawful basis, purpose and reason for data processing. However, all processing of personal data by Matrix is carried out with authorisation of each data subject. This authorisation does not alter the lawful basis for processing determined by our client.

How we collect and use your personal data

Where you are the client or supplier (recruitment agency):

Most of the personal information we process is provided to us directly by you for one of the following reasons:

• where you correspond with us by post, phone, email, over the website or otherwise.
• where you fill in forms in our website, including subscribing to newsletters and alerts, registering for marketing campaigns or event invites, or requesting a white paper or further information.
• throughout pre-contractual discussions and to register you as a client or supplier. 
• to manage our relationship with you which may include approving timesheets and to notify you of new vacancies. 
• to send you statements and invoices to you and collect payments. 
• to send you marketing emails and general correspondence.
• to administer our business and our website, including improving and securing our website.
• to ensure security on our systems which may include tracking the date and time when you login to CR.net and/or Prism.

Where you are the temporary worker:

We often receive your personal information indirectly from the supplier or client during the process of submitting you for an open vacancy.The Supplier will be responsible for uploading your personal data and supporting documentation, such as copies of IDs, to CR.net and/or Prism. It is important to note that Matrix is a neutral vendor and therefore is not involved in the selection of candidates for employment. 

We also use your information to review and approve submitted timesheets in relation to your placement and for monitoring and reporting purposes. 

You may provide us with your information where you make direct contact with us, by filling in the forms on our website, or by corresponding with us by telephone, post, email, Live Chat, or otherwise. Please note that where you make a telephone call to Matrix, calls may be recorded.

We may also receive your personal information from third parties such as:

• the Disclosure and Barring Service, where required for a criminal record check.

Cookies 

Where we obtain your consent, we use Google Analytics and Microsoft Analytics to collect cookie data to track and analyse website traffic and user behaviour by measuring metrics such as page views, session duration, and user demographics. We need this data to understand how you use our website so we can improve its design and functionality. We also need the data to get the most out of our marketing campaigns. You can find further information in our Cookie Policy.

Except as provided in this privacy statement, we will not provide your information to third parties.

Who we share your personal data with

We may disclose information about you to any of our employees insofar as reasonably necessary to fulfil our obligations for the purposes as set out in this privacy notice. In particular, we may share your personal information in the following circumstances:

• with the client, in line with our contractual obligations and to report any findings, such as reports and pre-employment screening checks
• with our subsidiary, Matrix Security Watchdog, where you are undergoing a criminal record check, digital identity check and other related pre-employment screening checks.
• with referees, where required to confirm your activity history
• with the supplier (recruitment agency) for approval of any timesheets
• with the National Fraud Initiative (NFI), where applicable, for fraud prevention purposes. 

In some circumstances, your data will also be shared with DocuSign or Precisely for the purpose of obtaining signature from yourself.

In addition, we may disclose your personal information:

• to the extent that we are required to do so by law
• in connection with any legal proceedings or prospective legal proceedings
• in order to establish, exercise or defend our legal rights (including providing information to others for the purposes of fraud prevention and reducing credit risk); and
• to the purchaser (or prospective purchaser) of any business or asset which we are (or are contemplating) selling.

International transfers

Matrix processes personal data in its operations centre based in the UK. All personal data is stored in a cloud-based solution managed by AWS and based in the UK. 

Matrix does not systematically transfer personal data outside the UK/EEA. However, where such circumstances arise, Matrix has undertaken appropriate assessments to determine whether the international data transfer provides an adequate level of protection to candidates. We will only transfer personal data outside the UK where we are satisfied that the third country is able to provide such protection.

Matrix is committed to using appropriate transfer tools permitted under the UK GDPR in all contracts where data may be transferred outside of the EEA and UK or as otherwise required.

How long we store your personal data

Matrix has a Data Retention Policy which mandates how long records, including personal data, must be retained. 

We will only retain your personal data for as long as reasonably necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, regulatory, tax, accounting or reporting requirements. We may retain your personal data for a longer period in the event of a complaint or if we reasonably believe there is a prospect of litigation in respect to our relationship with you.

Your rights

Under data protection law, you have rights including:

Your right of access – You have the right to ask us for copies of your personal data.

Your right to rectification – You have the right to ask us to rectify personal data you think is inaccurate. You also have the right to ask us to complete information you think is incomplete.

Your right to erasure – You have the right to ask us to erase your personal data in certain circumstances.

Your right to restriction of processing – You have the right to ask us to restrict the processing of your personal data in certain circumstances.

Your right to object to processing – You have the right to object to the processing of your personal data in certain circumstances.

Your right to data portability – You have the right to ask that we transfer the personal data you gave us to another organisation, or to you, in certain circumstances.

Your right to withdraw consent – When we use consent as our lawful basis you have the right to withdraw your consent.

You don’t usually need to pay a fee to exercise your rights. If you make a request, we have one calendar month to respond to you.

If you want to exercise any of the above rights, please contact the DPO at privacy@teammatrix.com. Please note that exemptions set out in the Data Protection Act 2018 may apply meaning that we do not have to grant your request in full. However, we will always meet your request as far as we are able to.

What we may require from you

We may need to request specific information from you to help us confirm your identity and ensure your right to exercise any of your rights. This is another appropriate security measure to ensure that personal information is not disclosed to any person who has no right to receive it.

Your right to complain

If you have any concerns or complaints regarding the processing of your personal data, or our compliance with the UK GDPR and Data Protection 2018, you should contact the DPO at privacy@teammatrix.com.

You also have the right to lodge a complaint with the Supervisory Authority

Their contact details in the UK are: 

• Website: www.ico.org.uk
• Telephone: 0303 123 1113
• Postal address: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF

Changes to this Privacy Notice

We reserve the right to update this Privacy Notice at any time, and we will provide you with a new Privacy Notice when we make any substantial updates. We may also notify you in other ways from time to time about the processing of your personal information. 

If you have any questions about this Privacy Notice, please contact the DPO at privacy@teammatrix.com.