Data Protection and GDPR Policy

As a company, in order to provide temporary and permanent recruitment and work-finding services, we must process personal data (including sensitive personal data). In doing so, the company acts as a data controller. We are registered with the ICO.

You may give your personal details to the company directly, such as on an application or registration form or via our website. Or we may collect data from another source, such as a job board onto which you have uploaded your CV. The company must have a legal basis for processing your personal data. For the purposes of providing you with work-finding services and/or information relating to roles relevant to you, we will only use your personal data in accordance with this privacy statement. At all times we will strive to comply with current data protection laws.

What information might we collect?

Typically, most of your personal data will come to us in the form of your CV, which will include but is not limited to your name, contact details (such as phone numbers, e-mail addresses and home address) plus details of your current salary and package. Occasionally we may be provided with sensitive personal information such as ethnicity, date of birth or even information regarding criminal convictions. We have processes in place to limit our use and disclosure of such sensitive data, other than where permitted by law.

We will normally receive your CV electronically via email or via an application to a job advertised on our website or a third-party job board. As our relationship with you progresses, we will likely obtain further personal information about you, which could come directly from you or may be obtained from third parties, such as organisations to whom we have provided your CV to and who have engaged with you as part of a job application (e.g., our clients or other recruitment agencies along the chain).

How we use your personal information

The following is a list of ways in which we might process your personal information:

• To provide our recruitment services to you
• To communicate and maintain our business relationship with you, where you are a client, candidate or user of our website
• To enable you to submit your CV for general applications, to apply for specific jobs or to subscribe to our newsletters or job alerts
• To match your details and requirement with job vacancies. This will help us in finding a position that is most suitable for you and to send your personal information to clients in order to apply for jobs
• To notify you about future job opportunities (based on your requirements) other than the specific role for which you have contacted us
• To answer your enquiries effectively
• To advise you of news, industry updates, events, promotions and competitions, reports and other information. Before we do so, you will be given an option to opt-out of such communications and an option to unsubscribe will also be provided with each communication
• To fulfil contractual obligations with our clients
• To provide regulatory or law enforcement agencies with personal information, if ever requested to do so
• To facilitate transport to a place of work at your request

What legal basis do we have for processing your personal information?

We must have a legal basis to process your personal data. In line with GDPR the legal bases we rely upon to offer our work-finding services to you are:

Legitimate interests

In order for us to carry out work on your behalf in an effective manner, it is reasonable for us to need to store certain elements of your personal data. As a employment agency and business which submits candidates to permanent and contract assignments, the exchange of candidate and client data is essential.

Having a database of candidates and clients with certain elements of personal data is needed to support individual career aspirations and to fulfil our clients' resourcing requirements. We also feel it is reasonable for us to hold data on prospective candidates and clients in order for us to grow our business.

If you are looking for new employment or have uploaded your CV or similar information to a job board or professional networking site, we'd reasonably assume that you are happy for us to collect this data and to contact you to support you in that objective. Prior to us sending any of your data to our clients or any other trusted party, we will first seek your consent. Potential employers may want to confirm your qualifications or references at some point in the process, so again we feel it is necessary for us to hold your data to fulfil these obligations and to help you secure the job you want. Providing you with tailored job alerts also requires us to process your data to ensure the content is appropriate to your needs. And we may also need to use your data for internal administrative activities, like payroll and invoicing.

Unless you ask us to remove your data, we may retain it for up to 20 years. This reflects the long-term relationships we have with candidates and clients throughout their careers.

Who might we share your data with?

In order to fulfil our obligations and provide a service to you, we will share your personal information with other trusted parties. The following is a list of some possible recipients whom the company may process your personal data with:

• Clients (whom we may introduce or supply you to)
• Former employers whom we may seek references from (with your prior permission)
• Payroll service providers who manage payroll on our behalf or other payment intermediaries whom we may introduce you to (such as umbrella companies)
• Other recruitment agencies in the supply chain (where you have given your consent to be submitted for a role)

Overseas transfers

The company may transfer your data to countries outside the European Economic Area ('EEA') for the purpose of providing you with work-finding services. We will take steps to ensure adequate protections are in place to ensure the security of your information. The EEA comprises the EU member states plus Norway, Iceland and Liechtenstein.

Data Retention

Any personal data held is stored on our secure recruitment database which is password protected and accessible only by our professional and qualified consultants for the purposes of finding you work finding services or supporting our clients to identify suitable applicants for the vacancies which we are supporting them with. We also have a confidential waste facility in place to safely discard any printed CVs we are working with.

The Company will retain your personal data only for as long as is necessary for the purpose we collect it. Different laws may also require us to keep different data for different periods of time. For example, the Conduct of Employment Agencies and Employment Businesses Regulations 2003, require us to keep work-seeker records for at least one year from (a) the date of their creation or (b) after the date on which we last provide you with work-finding services.

If we pay you, we must also keep your payroll records, holiday pay, sick pay and pensions auto-enrolment records for as long as is legally required by HMRC and associated national minimum wage, social security and tax legislation. This is currently 3 to 6 years.

We typically support candidates throughout their careers and so may often hold their data for lengthy periods. We do, however, proactively communicate with everyone whom we hold data for every three years to remind them of our privacy policy, remind them of their data rights and ensure they are still happy for us to continue to hold their data.

Our process for confirming you have permitted us to store your data

• At the outset of our relationship we will request your permission to store your data on our system
• Once consent is obtained you may then receive occasional communication from us in the form of mailers or job alerts, but each time you will have the option to unsubscribe from similar future communications
• Once per year we review our privacy policy to all whom we store data for, giving you the opportunity to change their consent or update their details
• If we receive a request from you to remove all your data, our procedure is to 'retain & restrict' which means that everything apart from your name and an internal identification number is removed completely. We retain the name so that we can indicate to our team that you do not wish data to be stored or to be contacted. If we were to remove the name too, then there is a good chance one of our team will contact you through another means and will not know of your preference not to be contacted

Your rights

Please be aware that you have the following data protection rights. You have the right:

• to be informed about the personal data the company processes on you
• of access to the personal data the company processes on you
• to rectification of your personal data
• to erasure of your personal data in certain circumstances
• to restrict processing of your personal data
• to data portability in certain circumstances
• to object to the processing of your personal data that was based on a public or legitimate interest
• not to be subjected to automated decision making and profiling without your knowledge
• to withdraw consent at any time

Where you have consented to the company processing your personal data, you have the right to withdraw that consent at any time by contacting us via any member of staff. Please note that if you withdraw your consent to further processing, that will not affect any processing done prior to the withdrawal of that consent, or which is done according to another legal basis.

There may be circumstances where the company will still need to process your data for legal or official reasons. Where this is the case, we will tell you and we will restrict the data to only what is necessary for those specific reasons.

If you believe that any of your data that the company processes is incorrect or incomplete, please contact us and we will take reasonable steps to check its accuracy and correct it where necessary. You can also contact us using the above details if you want us to restrict the type or amount of data that we process for you, access your personal data or exercise any of the other rights listed above.

Cookies

We may obtain data about you from cookies. These are small text files that are placed on your computer by websites that you visit. They are widely used in order to make websites work, or work more efficiently, as well as to provide information to the owners of the site. Cookies also enable us to deliver more personalised content.

The table below explains the cookies we use and why.

Most web browsers allow some control of most cookies through the browser settings. Please note that in a few cases some of our website features may not function if you remove cookies from your browser.

Log files

We use IP addresses to analyse trends, administer the site, track users' movements, and to gather broad demographic information for aggregate use. IP addresses are not linked to personally identifiable information.

Links to external websites

The Company's website may contain links to other external websites. Please be aware that the Company is not responsible for the privacy practices of such other sites. When you leave our site, we encourage you to read the privacy statements of each and every website that collects personally identifiable information. This privacy statement applies solely to information collected by our Company website.

Sale of business

If the Company's business is sold or integrated with another business your details may be disclosed to our advisers and any prospective purchasers and their advisers and will be passed on to the new owners of the business.

Data security

The Company takes every precaution to protect our users' information. Only employees or our suppliers who need the information to perform a specific job (for example, consultants, our accounts clerk or a marketing assistant) are granted access to your information via our password protected recruitment database.

The Company uses all reasonable efforts to safeguard your personal information. However, you should be aware that the use of email/the Internet is not entirely secure and for this reason the Company cannot guarantee the security or integrity of any personal information which is transferred from you or to you via email/the Internet.

If you share a device with others, we recommend that you do not select the "remember my details" function when that option is offered.

Changes to this statement

We will update this privacy statement from time to time. We will post any changes on the statement with revision dates. If we make any material changes, we will notify you.

Complaints or queries

If you wish to complain about this privacy notice or any of the procedures set out in it, please write to us at Sorted Personal Management Ltd, 19 Henrietta Gardens, Bath, England, BA2 6NA

You also have the right to raise concerns with Information Commissioner's Office on 0303 123 1113 or at https://ico.org.uk/concerns/, or any other relevant supervisory authority should your personal data be processed outside of the UK, if you believe that your data protection rights have not been adhered to.