Privacy Policy


A policy to inform Scarlet’s Data Subjects of their rights in relation to the personal data we collect.

Scarlet

The Scarlet Company Group includes Scarlet Global Holdings Ltd, Scarlet NB UK and Scarlet NB B.V. This Privacy Policy will explain how our organisation uses the personal data we collect from you when you:

  • visit our website;
  • approach Scarlet as a potential customer;
  • use Scarlet’s services as an existing customer; and
  • engage with Scarlet as a potential recruit.

In all cases, you are a “Data Subject”.

Topics

In this Privacy Policy, we cover the following:

  1. What data do we collect from you?

  2. How do we collect your data?

  3. How will we use your data?

  4. What is our legal justification for collecting your data?

  5. How do we store your data?

  6. What are your data protection rights?

  7. How do we make changes to this Privacy Policy?

  8. How do you get in touch with us?

  9. How do you contact the appropriate authorities?

What data do we collect?

Our website visitors

Scarlet collects the email addresses of those who sign up to our “Waiting List”. Scarlet collects no other personal information from visitors to our website. Scarlet does not use cookies.

Our prospective customers

Scarlet may collect the following personal information in our early interactions with you, a prospective customer:

  • your full name and contact details (including email address and phone number);
  • your employer, role and job title; and
  • your signature.

Our existing customers

In order to provide our services (i.e. conformity assessment activities), Scarlet may also collect the following personal information about you, as an employee or representative of a customer:

  • your full name and contact details (including email address and phone number);
  • your employer, role and job title;
  • your education and training qualifications (including dates);
  • your job history and work experience (including dates);
  • and your signature.

It is possible that our customers will also provide aggregated health information about their patients or the users of their medical devices. For example, information on the clinical characteristics of a population involved in a clinical investigation. Customers may proactively inform us of incidents that concern specific individuals in the open entry fields of Scarlet’s software.

We do not request any health information. We strongly advise our customers against inputting any specific health information about themselves or their customers in Scarlet’s software.

Our prospective recruits

Scarlet may collect the following data from you in the recruitment or onboarding processes:

  • full name, home address, email address, phone number, date of birth; training qualifications, job history, information from referees;
  • details of criminal convictions;
  • information about your identity and right to work, including passport, national insurance number, tax code and bank account details;
  • other personal information that may be required to assess whether you are a good match for the role;
  • and your signature.

How do we collect your data?

Our website visitors

You directly provide Scarlet with your email address when you complete the field on our website.

Our prospective customers

We obtain this information directly from you, or representatives at your company. Occasionally, in the case of full name and contact details, we might obtain this information from mutual connections (such as investors), who think that we might work well together.

You might communicate the data to us over email, Slack or phone calls. You may also input it into our customer contract or other legal agreement.

Our existing customers

After you have been onboarded as a Scarlet customer, you (or representatives at your company), will continue to provide us with personal data - likely over email, Slack or phone calls.

You and your colleagues might also communicate the data to us by inputting it into Scarlet’s software.

Our prospective recruits

You directly provide most of this information to Scarlet — including over email, Slack or phone calls.

We also collect the data from third parties such as recruitment agencies, background checking companies or former employers, using the same mediums.

We may obtain the data from your public profiles available online including, for example, recruitment platforms.

How will we use your data?

Our website users

Scarlet collects your data so that we can communicate with you in relation to the services we provide or may provide.

Our prospective customers

As with our website visitors, we collect your data to:

  • give you information about the services we provide;
  • and determine whether you are eligible to receive Scarlet’s services.

Our existing customers

Scarlet collects your data so that we can:

  • communicate with you in relation to the services we provide or may provide;
  • conduct conformity assessment activities in relation to your business or your product(s);
  • and ensure that both you and Scarlet comply with the relevant regulations on an ongoing basis.

Our prospective recruits

Scarlet uses the data we collect in the recruitment and onboarding process to:

  • identify you as a possible new recruit for Scarlet;
  • make an assessment about your eligibility and suitability for the role;
  • communicate with you about the role;
  • agree a contract with you.

What is our legal justification for collecting your data?

Our website visitors

Consent: By visiting the website and entering your email address, you have given consent to the processing of your personal data for the purpose of receiving additional information about Scarlet and its services.

Our prospective customers

Consent: In most cases, you directly provide the information to Scarlet, with knowledge about what the information will be used for.

Contract: In seeking the services, you request that we take certain steps prior to entering a customer contract. We collect the data in that context.

Legitimate interest: We require the information to assess whether you are eligible for our services and, if so, to sign a contract with you.

Our existing customers

Consent: In some cases, we receive the data from you directly, following an opportunity for you to decline our request.

Contract: We collect some of the data to perform the job required of us under the contract.

Official authority: As an approved, notified or certification body, Scarlet is required to make assessments about the qualifications of some of our customer’s employees. Scarlet may collect your data to comply with our own regulatory requirements.

Legitimate interest: We may collect your data for another legitimate interest, such as to communicate with a colleague about the service we provide.

Our prospective recruits

Consent: When you apply for a job at Scarlet, you willingly give your data to Scarlet.

Contract: In responding to the job application, request that Scarlet take certain steps to enter into an employment agreement. Scarlet collects your data in that context.

Legitimate interest: Scarlet requires the information to assess whether you are eligible for the job and, if so, to sign an employment agreement with you.

How do we store your data?

Scarlet stores very little of your personal data itself, but instead engages well-known and verifiable third party processors to do so on Scarlet’s behalf.

In so doing, Scarlet can ensure that your personal data is:

  • encrypted at rest;
  • protected by two factor authentication; backed up regularly; and
  • only held by data storage providers who are compliant with state of the art information security standards and practice.

The following entities may be involved in the storage and processing of your personal data:

  • Google;
  • Slack;
  • Attio;
  • Github;
  • VS Code;
  • Xero;
  • Zapier;
  • Mailchimp;
  • Employers of record; and
  • Other external advisors (such as lawyers and accountants).

We keep your personal information only as long as we need it. In most cases, we deem this to be 7 years from the day that you stop interacting with Scarlet (which may also be the day that you stop using our services).

In the case of potential recruits, Scarlet will only store your personal information for 1 year from the day the job application closes or the contract is signed by the successful applicant.

We will then dispose of your information by deleting it from our systems, or by ensuring that it is sufficiently aggregated or anonymised.

How do we share your data?

To the extent that it is relevant and necessary, Scarlet may share the data it collects with Scarlet’s people (that is, its employees, directors, agents and contractors). Scarlet’s people are based in the UK, EU, US and Brazil.

We may also share your data with third parties for the purpose of intra-group financing and administration, which may include our investors (and prospective acquirers), personal assistant support team, external legal and financial advisors and our Employers of Record.

Your data may be shared with government authorities, regulators and law enforcement officials if needed for the legal protection of our legitimate interests in compliance with applicable laws.

What are your data protection rights?

Scarlet would like to make sure you are fully aware of all of your data protection rights. Every Data Subject is entitled to the following:

  • The right to access: You have the right to request copies of your personal data from Scarlet. We may charge you a small fee for this service.
  • The right to rectification: You have the right to request that Scarlet correct any information you believe is inaccurate. You also have the right to request that Scarlet completes information that you believe is incomplete.
  • The right to erasure: You have the right to request that Scarlet erases your personal data, under certain conditions.
  • The right to restrict processing: You have the right to request that Scarlet restrict the processing of your personal data, under certain conditions.
  • The right to object to processing: You have the right to object to Scarlet’s processing of your personal data, under certain conditions.
  • The right to data portability: You have the right to request that Scarlet transfers the data that we have collected to another organization, or directly to you, under certain conditions.

If you make a request, we have one month to respond to you. If you would like to exercise any of these rights, please contact us at our email: ops@scarletcomply.com.

How do we make changes to this Privacy Policy?

Scarlet keeps its Privacy Policy under regular review and places any updates on this page. This Privacy Policy was last updated in April 2023.

How do you get in touch with us?

If you have any questions about this Privacy Policy, the data we hold on you, or you would like to exercise one of your data protection rights, please do not hesitate to contact us at ops@scarletcomply.com.

How do you contact the appropriate authorities?

Should you wish to report a complaint or if you feel that Scarlet has not addressed your concern in a satisfactory manner, you may contact: