The Company is a recruitment business which provides work-finding services to its clients and work-seekers. The Company must process personal data (including sensitive personal data) so that it can provide these services – in doing so, the Company acts as a data controller. A data controller is responsible for deciding how to hold and use personal data. Personal data is information or data from which you can be identified and is about you.

You may give your personal details to the Company directly, such as on an application or registration form or via our website, or we may collect them from another source such as a jobs board. The Company must have a legal basis for processing your personal data. For the purposes of providing you with work-finding services and/or information relating to roles relevant to you we will only use your personal data in accordance with the terms of the following statement.

1. Collection and use of personal data

a. Purpose of processing and legal basis

The Company will collect your personal data (which may include sensitive personal data) and will store and process your personal data for the purposes of providing you with work-finding services. The legal bases we rely upon to offer these services to you are:

• Legitimate interest
• Contractual obligation

b. Personal data

Your personal data includes personal contact details (such as name, title, address, telephone number, and email address), biographical data (such as your date of birth, gender, marital status and dependants), financial data (such as bank account details, payroll records, National Insurance number, tax status information), and compensation data (such as salary, benefits, bonuses, pension information).

In addition to processing personal data, the Company will also process sensitive personal data. Sensitive personal data is data of a more sensitive nature and includes information about your race, ethnicity, religious beliefs, sexual orientation, political opinions, trade union membership, information about your health, biometric data and information about criminal convictions and offences. The Company envisages that it will most commonly process data in relation to your nationality for establishing your legal right to work in the UK. However, depending on the information that you provide, the Company may also process other categories of sensitive personal data. The Company’s legal basis for processing this data will be because it is necessary to do so for the purpose of carrying out obligations in the field of employment.

If you do not wish the Company to process your sensitive personal data do not provide it.

c. Legitimate interest

Where the Company has relied on a legitimate interest to process your personal data our legitimate interests are as follows:

• To provide recruitment services
• To contact you about relevant positions of interest
• To submit your CV to clients
• To carry out our obligations for any contractual agreements with clients
• To fulfil any payroll obligations
• To send to third parties to obtain criminal reference checking services
• To undertake any required skill testing
• To keep you informed of relevant industry events
• To third parties whether that be regulatory or law enforcement where the Company is required to disclose such information in relation to any legal proceedings

d. Recipient/s of data

The Company will process your personal data and/or sensitive personal data with the following recipients:

• Named clients where you have given your consent for your CV to be sent
• If you are temping with us, we will pass your personal details to our Accountants, Grosvenor Partners LLP

The Company may transfer your personal data outside of the EU. If we do, you can expect a similar degree of protection in respect of your personal data, to the protection that you receive in the UK.

e. Statutory/contractual requirement

Your personal data is required by law and/or a contractual requirement (e.g. our client may require this personal data), and/or a requirement necessary to enter into a contract. You are obliged to provide the personal data and if you do not the consequences of failure to provide the data are:

• Failure to provide recruitment services.

2. Data retention

The Company will retain your personal data only for as long as is necessary to fulfil the purposes for which we collected it including for the purposes of satisfying any legal, accounting (temporary payroll records including holiday pay, sick pay and pension auto-enrolment records), or reporting requirements. Different laws require us to keep different data for different periods of time.

The Conduct of Employment Agencies and Employment Businesses Regulations 2003, require us to keep work-seeker records for at least one year from (a) the date of their creation or (b) after the date on which we last provide you with work-finding services. The Company will delete your personal data after five years if we have not had any ‘meaningful contact’ with you or if we do not hold any records on you that are in our legitimate interests to keep.

“Meaningful contact” is defined as any form of contact between us in relation to the Company assisting/providing recruitment services to you.

3. Your rights

Please be aware that you have the following data protection rights:

• The right to be informed about the personal data the Company processes on you;
• The right of access to the personal data the Company processes on you;
• The right to rectification of your personal data;
• The right to erasure of your personal data in certain circumstances;
• The right to restrict processing of your personal data;
• The right to data portability in certain circumstances;
• The right to object to the processing of your personal data that was based on a public or legitimate interest;
• The right not to be subjected to automated decision making and profiling; and
• The right to withdraw consent at any time.

Where you have registered with the Company and acknowledged their legitimate interest to process your personal data, you have the right to withdraw that consent at any time by contacting Kirsty Miall, Director at Attic Recruitment Limited, kirsty@atticrecruitment.co.uk, 020 7436 9909. Once the Company has received notification that you have withdrawn your consent, it will no longer process your data for the purpose or purposes you originally agreed to, unless the Company has another legitimate basis for doing so.

4. Complaints or queries

If you wish to complain about this privacy notice or any of the procedures set out in it please contact: Kirsty Miall, Director at Attic Recruitment Limited, kirsty@atticrecruitment.co.uk, 020 7436 9909.

You also have the right to raise concerns with Information Commissioner’s Office on 0303 123 1113 or at https://ico.org.uk/concerns/, or any other relevant supervisory authority should your personal data be processed outside of the UK, if you believe that your data protection rights have not been adhered to.