Candidate Data Notice

1. Who we are and when this notice applies

Recruitta Limited is a recruitment business and data controller for the personal information described in this notice. We are registered in Scotland under company number SC667162. Our registered office is 294 Duke Street, Glasgow, Scotland, G31 1RZ. Our Information Commissioner’s Office registration number is ZB159936.

This notice applies to applicants, prospective candidates, work-seekers, agency and temporary workers, contractors, freelancers, and people whom we identify through job boards, professional networks or referrals. It should be read with our main Privacy Policy.

Recruitment enquiries: recruitment@recruitta.com. Privacy questions and rights requests: privacy@recruitta.com.

2. Information we may collect

Depending on your relationship with us and the role, we may collect:

• identity and contact details, photographs, identity documents and signature;
• your CV, employment history, education, qualifications, licences, professional memberships and references;
• work preferences, availability, location, salary or rate expectations, and willingness to travel or relocate;
• applications, interview notes, assessments, communications, offers and feedback;
• right-to-work, nationality and immigration information needed to establish eligibility to work;
• information from background, qualification, reference and safeguarding checks;
• health, disability or adjustment information where relevant, and optional equality-monitoring information;
• PVG application, membership and disclosure information for eligible regulated roles;
• assignment, timesheet, attendance, performance, incident, complaint and health-and-safety records;
• bank, National Insurance, tax, pension, expenses and payroll information where we engage or pay you; and
• technical and usage information submitted through our website and online forms.

3. Where information comes from

We may receive information:

• directly from you, including through forms, applications, interviews and communications;
• from job boards, LinkedIn and other professional networks, and publicly available professional sources;
• from people who refer you, referees, former employers, education providers and professional bodies;
• from clients, prospective employers and workplace contacts;
• from Disclosure Scotland and providers of identity, right-to-work or other lawful checks; and
• from public authorities, regulators or law-enforcement bodies where permitted.

If we obtain your information from another source, we will provide this notice within the period required by data protection law — normally within one month, at our first communication with you, or before the first disclosure to another recipient, whichever applies.

4. Why we use information and our lawful bases

We use candidate information only where we have a lawful basis. The basis depends on the activity:

Where we rely on legitimate interests, we consider the purpose, necessity and impact on you. You may object as described in section 11.

5. Sensitive information, criminal-offence data and PVG checks

Health, disability, equality and safeguarding information may be special-category data. PVG disclosures may contain criminal-offence information. We process this information only when necessary, with both an Article 6 lawful basis and an applicable condition under Article 9, Article 10 and Schedule 1 to the Data Protection Act 2018.

Depending on the circumstances, the additional condition may relate to employment and social-protection law, equality of opportunity, safeguarding, preventing unlawful acts, legal claims, or explicit consent where consent is genuinely appropriate. We maintain an Appropriate Policy Document where the law requires one.

6. Who we share information with

Where necessary and lawful, recipients may include:

• clients, prospective employers and organisations offering assignments or regulated roles;
• Disclosure Scotland and authorised recipients of PVG information;
• referees, former employers, education providers and professional bodies;
• identity, right-to-work, qualification and screening providers;
• payroll or umbrella providers, HM Revenue & Customs, pension providers and banks;
• providers of recruitment, communications, forms, document storage, cloud hosting and IT security services;
• professional advisers, auditors and insurers;
• regulators, public authorities, law-enforcement bodies and courts where required or permitted; and
• a buyer, investor or successor where our business or assets are reorganised or transferred.

Some clients and service providers act as separate controllers and will give you their own privacy information. Others process information only on our documented instructions. We require appropriate confidentiality and security safeguards.

7. International transfers

A service provider or client may process information outside the United Kingdom. Where the destination is not covered by UK adequacy regulations, we use an approved safeguard such as the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, and apply supplementary measures where needed. Contact privacy@recruitta.com for information about the safeguard relevant to your data.

8. How long we keep information

We keep information only as long as needed for the purpose collected, legal and regulatory duties, and the establishment or defence of claims. Our usual starting points are:

• candidate profiles and CVs: two years after the last meaningful contact or recruitment activity;
• records of an unsuccessful application: normally six months after the process ends, unless the information remains part of an active candidate profile or is needed for a claim;
• placement, assignment and worker records: normally six years after the relationship or assignment ends;
• right-to-work records: for the legally required period where the statutory employer obligation applies;
• PVG information: only for the period permitted by Disclosure Scotland’s Code of Practice and our documented safeguarding need; limited audit information may be retained where lawful;
• payroll, tax and pension records: for the statutory period, and longer where required for claims or regulatory purposes; and
• marketing opt-outs: a minimal suppression record for as long as needed to respect the opt-out.

These periods may be shortened or extended where the circumstances, a legal hold, a regulator or a client requirement lawfully justify it. Information is securely deleted or anonymised when no longer required.

9. When information is required

You may choose whether to provide most information, but we cannot progress a role or assignment without the information needed to identify and contact you, assess suitability, verify eligibility, complete required safeguarding checks or administer a contract and payment. We will tell you when information is mandatory and the likely consequence of not providing it.

10. Recruitment technology and automated decisions

We may use search, filtering and matching tools to help recruiters identify potentially suitable roles or candidates. These tools support human judgement. We do not currently make decisions about you based solely on automated processing where the decision produces legal or similarly significant effects. If that changes, we will provide the information and safeguards required by law before using the process.

11. Your data protection rights

Depending on the circumstances, you may have the right to:

• ask for access to your personal information and a copy of it;
• ask us to correct inaccurate or incomplete information;
• ask us to erase information or restrict its use;
• receive information you provided in a portable format where the right applies;
• withdraw consent at any time where a particular activity relies on consent; and
• object to direct marketing, and object to processing based on legitimate interests.

Your right to object. You can object at any time to direct marketing. You can also object to processing based on our legitimate interests; we will stop unless we demonstrate compelling legitimate grounds or need the information for legal claims.

Send requests to privacy@recruitta.com. We may need to verify your identity. Rights are not absolute, and we will explain any lawful limitation. There is normally no fee, although the law permits a reasonable fee or refusal in limited cases.

12. Questions and complaints

Contact privacy@recruitta.com if you have a question, wish to exercise a right or want to make a data protection complaint. We will acknowledge a data protection complaint within 30 days, investigate and respond without undue delay, and keep you informed where appropriate.

You may also complain to the Information Commissioner’s Office (ICO), the UK supervisory authority. We would welcome the opportunity to address your concern first, but you do not have to contact us before approaching the ICO. Current contact details are available at ico.org.uk.

13. Changes to this notice

We may update this notice when our recruitment practices, technology or legal obligations change. The current version will be published on our website with its last-updated date. We will draw material changes to your attention where appropriate.