1. Who we are
Social Scanner Ltd is registered in England and Wales under company number 14621108. Our registered office is 17 Burrows Road, Kingswinford, West Midlands, United Kingdom, DY6 8LS. Questions and rights requests may be sent to info@socialscanner.co.uk.
This Policy explains how we handle personal information about school users, candidates and other screened individuals, website visitors, contacts and support users.
2. Our data-protection role
The school or organisation requesting a screening ordinarily decides why the individual is screened and how the report is used. It is normally the controller for that recruitment processing, and Social Scanner acts as its processor when carrying out the instructed screening and hosting the report.
We are a controller for purposes we determine ourselves, including managing accounts and enquiries, providing security and audit records, billing, preventing misuse, meeting legal obligations and administering our business. If the facts of a particular service mean the parties jointly determine purposes and essential means, we will document the arrangement and make its main points available to affected people.
Candidates may contact either the requesting organisation or us. Where the organisation is the controller, we may pass the request to it and assist with its response.
3. Information we collect
School users: name, work contact details, job title, organisation, account and role information, authentication records, support messages, screening activity, credit orders, invoice and purchase-order information, and audit records.
Candidates and screened individuals: name, date of birth where supplied, contact details, address, countries of origin and residence, current and previous employer, role applied for, social-media handles or URLs, consent/acknowledgement record, and information found within the agreed public-source search.
Public-source results may incidentally reveal opinions, photographs, relationships, location, employment, education and information suggesting racial or ethnic origin, political opinions, religious or philosophical beliefs, trade-union membership, health, sex life, sexual orientation, criminal allegations or offences. We seek to record only material relevant to the documented screening scope.
Website visitors and contacts: information submitted through forms or correspondence, and technical data such as device/browser information, IP address, dates and times, requested pages, security events and essential session information.
4. Where information comes from
Information may come from the individual, the requesting school or organisation, authorised users, public social-media profiles, search engines, public news and web pages, and records generated by use of the Services.
Where information was not obtained directly from the individual, the requesting organisation is responsible for providing its recruitment privacy information at the appropriate time. We also make this Policy available at the candidate submission point.
5. Purposes and lawful bases
We process personal information only where we have a lawful basis:
- Provide screenings and the platform: to perform our contract with the Customer and, for candidate processing, on the Customer's lawful documented instructions.
- Safer-recruitment due diligence: the requesting organisation may rely on legitimate interests, public task, employment obligations or another basis it identifies. Social Scanner does not assume that a candidate's consent is the sole UK GDPR basis merely because an acknowledgement is captured.
- Accounts, billing and support: contract performance and our legitimate interests in administering and improving a secure B2B service.
- Security, audit, fraud prevention and legal claims: our legitimate interests and compliance with legal obligations.
- Enquiries and business communications: responding to requests, taking steps towards a contract and our legitimate interests in communicating with organisations. Electronic marketing will follow PECR where it applies.
Where processing includes special-category or criminal-offence data, the relevant controller must also identify an applicable UK GDPR Article 9 or DPA 2018 Schedule 1 condition and maintain any required Appropriate Policy Document. Depending on the facts, conditions may relate to employment and safeguarding obligations, substantial public interest, legal claims or information manifestly made public by the individual. Public availability alone does not make all further use lawful.
6. How screening works
A screening uses candidate identifiers and supplied profiles to search agreed publicly accessible sources. Researchers assess possible matches, relevance and context and record evidence under safeguarding-related categories. A second review or quality-assurance step may be used before release.
Social Scanner does not make the recruitment decision. A rating, category or flag is not a finding of fact or an instruction to reject someone. Reports are intended for meaningful review by an authorised person at the requesting organisation, which should verify material information and give the candidate an opportunity to respond where appropriate.
We do not use solely automated processing to make a legal or similarly significant recruitment decision about a candidate. If our approach changes materially, we will update this Policy and implement any required explanation, challenge and human-review safeguards.
8. International transfers
We aim to keep core service data in the United Kingdom where our configured providers support this. Some suppliers or support operations may process information from, or store limited information in, other countries. Before a restricted transfer, we use an adequacy regulation, the UK International Data Transfer Agreement or UK Addendum to EU Standard Contractual Clauses, or another lawful safeguard, together with supplementary measures where appropriate.
You may ask us for further information about the safeguard relevant to your information.
9. How long we keep information
Published screening reports and their associated findings are ordinarily permanently deleted from the platform 60 days after publication. Customers are warned of the expiry date and are responsible for any downloaded copy retained within their own lawful recruitment records.
- unused or expired invitation records and incomplete submissions are kept only as long as needed to administer the request, investigate misuse and meet the Customer's documented retention instructions;
- account and organisation records are retained while the account is active and for a reasonable period afterwards to manage closure, disputes and legal obligations;
- invoice, purchase and tax records are normally retained for six years after the relevant financial period;
- support, consent, security and audit records are retained for periods proportionate to their purpose and any legal-claim limitation period; and
- enquiries are retained only as long as needed to respond and manage any resulting relationship.
We may retain a record longer where law, litigation, a regulator or a preservation request requires it, or delete it sooner where the purpose has ended.
10. Security
We use organisational and technical controls intended to protect information against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access. These include role-based access, authentication, encryption in transit and at rest where supported, access logging, limited staff access, backups and retention controls.
No online service can guarantee absolute security. Customers must also protect their accounts and downloaded reports and tell us promptly about suspected compromise. We assess personal-data breaches and notify the relevant controller, individuals and Information Commissioner's Office where the law requires.
12. Your rights
Depending on the circumstances, UK data-protection law gives you the right to be informed; request access and a copy; correct inaccurate information; request erasure or restriction; object to processing based on legitimate interests; receive certain information in a portable format; and obtain safeguards relating to solely automated decisions.
These rights are not absolute. For example, information may need to be retained for legal claims, safeguarding or another lawful obligation. We may ask for information to verify identity and locate the relevant record. We normally respond within one month, subject to lawful extensions for complex or multiple requests.
To exercise a right, email info@socialscanner.co.uk and identify the requesting organisation and screening where possible. You can also contact the school or organisation that requested the screening.
13. Questions and complaints
Please contact us first so we can investigate: Social Scanner Ltd, 17 Burrows Road, Kingswinford, West Midlands, United Kingdom, DY6 8LS, or info@socialscanner.co.uk.
You may complain to the Information Commissioner's Office at ico.org.uk/make-a-complaint, by telephone on 0303 123 1113, or by writing to the ICO at Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF. You may also have the right to seek a judicial remedy.
14. Children, external links and changes
The Services screen job applicants and are not intended for children. Public-source material about an adult may incidentally include a child; users and researchers must minimise and avoid recording such information unless strictly necessary and lawful. Please tell us promptly if you believe a child's information has been included inappropriately.
Our website may link to third-party sites. Their operators control their own processing, and their privacy information applies. We may update this Policy when law, guidance, suppliers or the Services change. We will post the revised date and give additional notice where a change materially affects how we use information.
Use of the Services is also governed by our Terms and Conditions and Acceptable Use Policy.