Data protection center

DATA PRIVACY POLICY

Effective Date: November 2022

1. Introduction

The protection of your personal data is important to us.

Malt (we, us, our) is committed to collecting only the personal data needed to provide our users (you, your) with the best possible service, to ensuring its confidentiality and security, including when we use service providers, and to making it easy for you to exercise your rights regarding your data.

Our primary commitment is to comply with applicable data protection legislation.

We comply with the obligations of the UK’s General Data Protection Regulation ("GDPR") and any other relevant data protection legislation in force in the UK.

Here we describe what we do with your data.

This policy describes the personal data we collect, how it is used and, if applicable, shared, and your rights concerning this. It applies to all users of our services. We advise that you read it carefully. We have done our utmost to make it clear, easily understandable, and accessible at any time while using our website.

We strive to be as clear as possible.

We want this notice to be easy to read and to provide you with clear information about the processing of your personal data. However, should you require clarification or have any questions for us regarding the policy, you can always contact our DPO team at [email protected].

We reserve the right to make changes to this Privacy Policy at any time. The most current version of this Policy governs our use of your data and will always be kept available at https://www.malt.fr/about/privacy/policy

Please be aware that features to help manage your data and protect its privacy and security are also available in our Data Protection Centre, which is available at the following address: [https://www.malt.uk/about/privacy].

Effective date

The updated Privacy Policy will automatically take effect for all active users as of 08.11.2022.

We reserve the right to make changes to this Privacy Policy at any time, including to account for new processing activities or changing legal requirements. The most current version of this Policy governs our use of your data and will always be kept available at https://www.malt.uk/about/privacy/policy.

Should we make any material changes to this Privacy Policy, we will notify you using the email address you provided via the site.

2. Data controller: Malt Community

Malt Community, a public limited company with a Board of Directors, listed on the Paris Trade and Companies Register under no. 791 354 871, with its registered office located at 18 rue Godot de Mauroy, 75009 Paris.

Malt Community SA acts on behalf of and for its subsidiaries, namely: Malt Community SL, Malt Community GmbH, Malt Community SRL, Malt Community BV, and Malt Community Ltd, as identified in the Malt Terms and Conditions.

3. Contact information for our DPO

You may address any questions regarding the protection of personal data at Malt, or send a request to exercise your rights to access, rectify, oppose, delete, limit, transport, or determine what happens to your data after your death, to our Data Protection Officer:

- by email at: [email protected]

- by post, addressed to: DPO, Malt Community, 18 rue Godot de Mauroy, 75009 Paris

4. Data we process

Summary:

Within the context of your use of our services and your navigation of our website, Malt processes several categories of data, which are detailed below. This data originates from:

  • Information that you provide to us ;

  • Information resulting from your use of our services.

We do not process certain categories of data (sensitive data), such as data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs or trade union membership, genetic data, biometric data, data concerning health, or data concerning people's sex life or sexual orientation.

4.1 Freelancer data

We will inform when requesting data whether the information is mandatory.

Means of collection

Category

Details

Communicated by the Freelancer

Personal information

- Last name
- First name
- Place and Date of birth
- Gender (optional)
- Email address
- Phone number
- Occupational category
- Geolocalisation at the time of the login
- Profile picture
- Nationality
- Address
- If applicable, official national identification number

Information relating to communication with our teams

- Emails
- Dates and duration of phone calls
- Summary of communication, if necessary to follow up your requests or to provider you with support

Professional information

- Professional experience
- Skills
- Portfolio
- Assignment preference(s)

Legal Structure

- Names
- Legal form
- Identity of the company's legal representative
- Legal documents that vary according to the structure of your company and in particular: name; address of the registered office, official national identification number (if applicable); directors (in case of legal entities); provisions governing power of attorney, or the legal structure.

Banking information

Bank account statement

Additional information concerning your profile (optional)

- Integration of your social network accounts (Twitter, Behance, StackOverflow, Github)
- Certifications and training courses
- Languages

Information on completed assignments

- Comments from your clients
- Reviews left by your clients

Generated by your use of the Marketplace

Browsing data

Required cookies and other cookies subject to your consent and IP address

Transaction information

Transaction details (e.g. payment for your assignments)

Recommendations

External recommendations resulting from your requests

Data relating to the use of secure messaging

- User identification (sender and receiver)
- Date and time the message was sent
- Message content, when necessary for fraud prevention and user support.

4.2 Customer employee data

Means of collection

Category

Details

Communicated by the Customer/ Customer's employees using the Marketplace

Personal information

- Last name
- First name
- Date of birth
- Gender
- Email address
- Profile picture

General information about the company

- Sector of activity
- Number of employees
- Company logo

Legal structure

- Billing information
- Accounting contact

Information relating to assignments

- Feedback from freelancers who have completed assignments for your company
- Comments left by these freelancers

Information relating to communication with our teams

- Emails
- Dates and durations of phone calls
- Possible content of exchanges, when necessary in order to combat fraud and provide support to users.

Browing data

Required cookies and other cookies subject to your consent and IP address

Generated by your use of the Marketplace

Transaction information

Transaction details

Data relating to the use of secure messaging

- User identification (sender and receiver)
- Date and time the message was sent
- Message content, when necessary in order to combat fraud and provide support to users.

4.3 Statistical information regarding your use of our services

We may collect and generate statistical information relating to your use of the Marketplace and our services. For example, we collect statistics:

  • Relating to the use of the secure messaging system we offer (percentage of messages answered, response time);

  • Relating to end-of-assignment evaluations (comments left by clients and freelancers, average ratings);

  • Statistics based on user login and navigation data;

  • On the use of the search engine and the Freelancer contact form;

  • On your use of the different modules such as the quotation tool, the contract module, the payment module; the features made available to companies (reporting, team pages, barometer);

  • Relating to commercial data, such as the number of assignments completed, business volumes by freelancer category, or by client category.

5. Cookies

We use authentication cookies, security and site integrity cookies, location cookies, cookies relating to site functionality and services, analytics and search cookies, and cookies to deliver advertising messages. You can accept, decline, or set your cookie choices when you first log into the Marketplace, and you can amend your choices at any time by visiting the cookies section in our data protection centre, available here: www.malt.uk/about/privacy/cookies. You will also find a more detailed description of the cookies we use.

6. Lawful basis of processing

Summary:

Malt processes most of your personal data as part of the service agreement you entered into when you registered on the site, by accepting our terms and conditions. However, we may process certain data relating to you on the basis of your consent, on account of legal obligations, or in line with our legitimate interest in the processing of this data.

Malt and its partners or subcontractors shall process your personal data, in particular, when you log into the Marketplace, when you register on the Marketplace, during your activity in the Marketplace, such as, during your communication with freelancers, with potential or existing clients during the assignment, during your use of the services available on the site (including the assignment payment service and the factoring service), as well as within the scope of communications you may have with our teams in the context of support regarding the use our services or the offering of assignments.

When you register with Malt, Malt will process your personal data to the extent that this is necessary in order to complete your profile, verify your business, process your business proposals, and manage your assignments and payments, as well as to support and assist freelancers and clients in the use of the Marketplace. Malt may also forward your profile to a client if it matches their search parameters.

The data we collect allows us to provide, manage, protect, and improve our Marketplace  and services, to develop new services, and to protect both our users and ourselves against potential fraudulent use of our Marketplace.

Lawful basis details :

In particular, we process your personal data :

  • for the performance of a contract including taking steps to enter into a contract with you at your request, for example the terms and conditions of our website use (https://www.malt.uk/legal), or our services contract with you. If you fail to provide such information then we may be unable to enter into a contract with you, or to perform our contractual obligations.

  • for ensuring compliance with our legal obligations, for example with theour money laundering and anti-terrism obligations when managing payments made via the Marketplace with our payment provider Mangopay.

  • for our legitimate interests (or those of a third party), provided your interests and fundamental rights do not override those interests, such as the efficient running of our business, for example to facilitate contact between freelancers and clients, process payments, for data security, to develop our services, to combat fraud, to train our sales team and to promote our services.

  • with your consent, where required or otherwise permitted by law. In any case where we process your personal data based on your consent, then you can revoke that consent at any time although please note that such a revocation would not affect the lawfulness of any processing that has already occurred.

7. Recipients or category of recipients and transfers to countries outside the EEA

Summary:

Malt is the recipient of personal data collected via our website.

However, some of the services and features we make available to you are provided by, or integrated for the use of, selected third parties.Where this is the case then we may share information with other users or with our business partners. We may also share this information for the purposes of running our business, for legal purposes or in the event of litigation.

Details :

We will only share your personal data with third party companies, organisations, or individuals in the following circumstances:

7.1 Sharing with clients

We may share freelancers’ personal data with our clients when freelancers send them a business proposal or when an assignment is launched, such as the freelancer’s company details or legal documents relating to the services requested.

7.2 Sharing with trusted partners and service providers

We may share personal data with our partners or with certain trusted third party service providers. Where this is the case, they will process your data on our behalf, as instructed by us or as contractually agreed, in accordance with this policy and in compliance with any other appropriate security and confidentiality measures.

7.3 Sharing with other third parties

Malt may share information about website users, freelancers and our clients’ employees with other third parties such as our investors, accountants, lawyers, auditors and other external professional advisors, including in conjunction with any fundraising or auditing of the use of funds raised. In the context of a disposal of all or part of our business we may also transfer your personal data to potential purchasers and their advisors, subject to appropriate confidentiality obligations.

7.4 With authorised third parties

We may share your personal data with government bodies, dispute resolution organisations and law enforcement agencies including regulatory authorities, the police and the courts.

We may retain or disclose your information if we believe that it is reasonably necessary to satisfy any legal or regulatory obligation, legal process, or administrative request, to protect the safety of any person, to address any fraudulent, security-related, or technical issues, or to protect the rights or property of our users.

7.5 Among the entities of the Malt Group

Malt may share your personal data with other companies in our group, such as for planning purposes or for provision of client services. Any transfers executed in this context will be subject to our intragroup data sharing agreement.

Important: Malt does not resell your data/information and documents you entrust to us to third parties, and we do not disclose personal and private information other than in the instances described in this Data Protection Policy.

7.6 Data localisation

All our servers on which your data is stored are located in Europe. In some cases our service providers or other third parties we share your personal data with may be located in a country outside the UK or European Economic Area (EEA) in which we may transfer your data to that country. In such cases, we check beforehand that they are respecting their obligations in terms of the protection of our users' data and we put in place appropriate safeguards as required under the UK GDPR, such as the ICO’s International Data Transfer Agreement or the International Data Transfer Addendum to the EU standard contractual clauses, to ensure that your personal data benefits from a level of protection equivalent to that offered by the GDPR.

8. Retention period or criteria for determining retention periods

We only retain personal data for as long as is reasonably necessary to achieve the purposes for which it is being processed including taking into account (i) the purposes identified above, (ii) any retention period(s) required by law; or (iii) the statute of limitations during which legal proceedings may be brought for the purpose of establishing, exercising or defending potential legal claims.

9. Data security

We implement appropriate technical and organisational measures to ensure the continued security, confidentiality, integrity, availability, and resilience of our information system and your data, and to protect the personal and other data we process against destruction, loss, alteration, and unauthorised disclosure of / access to data that is transmitted, stored, or otherwise processed.

We undertake to use all available means to ensure the security and confidentiality of this data, in particular:

  • We encrypt most of our services using SSL technology;

  • We verify your email address when you create your account;

  • We conduct internal audits regarding data collection, storage and processing, including physical security measures, to prevent unauthorised access to our systems;

  • Access to personal data is strictly limited to Malt employees and contractors who require access in order to process it on our behalf. These individuals are subject to strict confidentiality obligations and may be subject to disciplinary action, up to and including dismissal, in the event of a breach.

10. Rights

You have certain rights under the UK GDPR:

- to obtain access to your personal data - you may request information on how your personal data is handled by us and request a copy of such personal data.

- to request us to correct or update your personal data if it is inaccurate or out of date. In order for you to exercise this right as easily as possible, we invite you to apply these changes or additions directly within your profile. If you feel that other data relating to you requires changing or completion, and you are unable to make this change yourself, we invite you to submit your request directly in the 'Your rights' section in our data protection centre, or by writing to us at [email protected].

- to object to the processing of your personal data where we rely on legitimate interests as our justification, unless we demonstrate compelling legitimate grounds which override your right to object or the processing is necessary for the establishment, exercise or defence of legal claims.

- to erase your personal data held by us where the personal data is no longer necessary in relation to the purposes for which it was collected, in certain circumstances where you have objected to the processing of such personal data, or where the personal data has been unlawfully processed.

For security reasons, and to avoid undesired account deletion, we invite you to perform this step independently when logged into your account.

With respect to your profile data, you should keep in mind that search engines and other third parties may still retain copies of your public profile information for some time after you have agreed to be listed, even after you have deleted the information from the Malt site or disabled your account. However, Malt is not responsible for any such processing of your data by third parties. If you wish, you can exercise your right to dereferencing directly with these search engines. For example, to submit such a request to Google, you can use the tool provided by the search engine here.

- to restrict processing by us (i.e. the processing will be limited to storage only) where you oppose deletion of your personal data and prefer restriction of processing instead, or where you object to the processing by us on the where we rely on legitimate interests as our justification.

to transmit personal data you submitted to us back to you or to another organisation in certain circumstances.

If you have any questions concerning the protection of personal data by Mangopay, or if you wish to exercise your rights, please contact [email protected].

10.1 Right to file a complaint with a supervisory authority

Malt Community's main office is located at 18 rue Godot de Mauroy, 75009 Paris. As such, the supervisory authority competent to deal with any request concerning us, including, if applicable, any user complaints, is the Commission Nationale de l'Informatique et des Libertés (CNIL). However, you may direct your request to any data protection authority, in particular within your country of residence, in the country where you work, or in the country of which you are a citizen, and the latter will forward your request to the CNIL.

If you wish to submit a request to the CNIL, you will find the contact information below:

CNIL (NATIONAL COMMISSION FOR INFORMATION TECHNOLOGY AND LIBERTIES)

3 Place de Fontenoy - TSA 80715 - 75334 PARIS CEDEX 07

Tel. : 01 53 73 22 22

(Monday to Thursday from 9 a.m. to 6:30 p.m. / Friday from 9 a.m. to 6 p.m.)

Fax : 01 53 73 22 00

Please note! The CNIL is not open to the public and does not provide information on site.

If you wish to file a complaint with the CNIL, you can fill out the online complaint form available at https://www.cnil.fr/fr/plaintes

If you have a question concerning your rights and freedoms with regard to data, you can consult the CNIL website: www.cnil.fr.

To contact any other data protection authority in the European Union, you can refer to the European Commission directory. It lists all the contact details of the data protection authorities in EU Member States and is available here:

https://ec.europa.eu/justice/article-29/structure/data-protection-authorities/index_en.htm

LEARN MORE

You can find other useful resources relating to the protection of your data in our Data Protection Centre:

- Our commitments and the actions we take to best protect your data;

- A tool to manage your preferences regarding notifications and communications;

- Information about how we use cookies and other tracking devices;

- Information on how to exercise your rights;

- A tab dedicated to exercising your right to portability.

If you have any questions about the protection of your personal data processed by Malt or if you wish to exercise your rights to access, rectify, erase, oppose, limit or transport your data, or to determine what happens to your data after your death, you can contact our DPO:

- By email: [email protected]

- By post: DPO, Malt Community, 18. rue Godot de Mauroy, 75009 Paris, France

Versions