What this notice will cover at launch.
Master Artists will publish the identity and contact details of the data controller, the purposes for using personal data, the relevant lawful basis, and a clear route for privacy questions.
1. Information we may receive
Client enquiries may include names, business contact information, organisation details, service requirements, and message content. Candidate applications may include contact information, employment history, skills, language information, a CV, and interview notes. Please do not send special-category, financial, identity-document, or health information unless Master Artists has asked for it through a secure approved channel.
2. Why information is used
Information should be used only to respond to an enquiry, evaluate an application, arrange a conversation, operate an agreed service, meet legal obligations, or send communications where a valid permission or other lawful basis exists. A production configuration must identify the appropriate legal basis for each purpose.
3. Candidate data and AI-assisted tools
Candidate information must be assessed by people. If Master Artists introduces AI-assisted CV organisation or language-practice tools, the service must document the purpose, human review, consent or other lawful basis, bias testing, security controls, and a way to request assistance or challenge an outcome. Automated tools must not make final employment decisions.
4. Sharing, suppliers, and international transfers
Personal data should be shared only with authorised personnel and approved processors that need it to provide the relevant service, such as a secure applicant-tracking system, hosting provider, email platform, or client where an application concerns that client. Any international transfer must be assessed and protected with the mechanism required by the applicable law.
5. Security and retention
Before collection begins, Master Artists should configure role-based access, encryption in transit and at rest where appropriate, incident procedures, vendor due diligence, and a documented retention and deletion schedule. The retention period for applications, enquiries, and newsletter records must be confirmed in the published notice.
6. Your choices and rights
Depending on applicable law, a person may request access, correction, deletion, restriction, objection, portability, withdrawal of consent, or information about a complaint route. The production notice must name the contact point, response process, and relevant regulator or supervisory authority.