Privacy Policy

1. Who we are

Recruitta Limited (referred to as “Recruitta”, “we”, “us” or “our”) is a company registered in Scotland under company number SC667162. Our registered office is 294 Duke Street, Glasgow, Scotland, G31 1RZ. We are registered with the Information Commissioner’s Office under registration number ZB159936.

For the personal information described in this policy, Recruitta is normally the data controller. This means that we decide why and how that information is used. In some client-managed arrangements we may act only on a client’s instructions as its data processor; where that applies, the client’s own privacy information will explain its use of your information.

Questions about this policy or our use of personal information can be sent to privacy@recruitta.com or posted to the registered office above, marked “Data Protection”.

2. Who this policy applies to

This policy applies to personal information we handle about:

• job applicants, candidates, work-seekers, temporary workers, contractors and people interested in future opportunities;
• employees and workers to the extent covered by our recruitment and assignment processes (separate internal notices may also apply);
• contacts at clients, prospective clients, suppliers, subcontractors, framework partners and other business partners;
• referees, emergency contacts and other people whose details are provided to us; and
• visitors to our websites, people who submit forms, and anyone who otherwise contacts us.

3. Personal information we collect

Depending on your relationship with us, we may collect and use the following categories of information:

• Identity and contact information: name, title, date of birth, postal and email addresses, telephone numbers, photographs and identification details.
• Career and recruitment information: CV, work history, education, qualifications, professional memberships, skills, role preferences, availability, salary or rate expectations, interview notes and communications.
• Eligibility and screening information: right-to-work evidence, immigration status where relevant, references, licences, background-screening results and information required for regulated or safeguarding-sensitive roles.
• Assignment and performance information: placements, work locations, schedules, timesheets, attendance, training, feedback, complaints, incidents and performance information.
• Pay and administration information: National Insurance number, tax status, bank details, payroll records, pension information, expenses and details needed to pay you or administer an engagement.
• Business contact information: job title, employer, business contact details, purchasing history, contracts, correspondence and information about a client, supplier or partner relationship.
• Website and technical information: IP address, device and browser details, form submissions, security logs, cookie identifiers and information about how our website is used.
• Communications and preferences: emails, call notes, enquiries, complaints, marketing preferences and records of consent or opt-out choices.

4. Special category and criminal offence information

Some roles require us to process information that receives additional legal protection. This may include health or disability information, reasonable-adjustment needs, racial or ethnic origin, religious beliefs, trade-union membership, sexual orientation, biometric information used for identification, and criminal conviction or offence information.

We process this information only where it is relevant, necessary and lawful. In addition to an Article 6 lawful basis, we rely on an applicable condition under Article 9 UK GDPR or Schedule 1 to the Data Protection Act 2018. Depending on the circumstances, this may include obligations and rights in employment and social protection law, equality monitoring, safeguarding, preventing or detecting unlawful acts, establishing or defending legal claims, or your explicit consent where consent is genuinely appropriate. We request standard or enhanced criminal-record checks only where the role is legally eligible for that level of check.

Where the law requires additional safeguards or an Appropriate Policy Document, we apply and maintain them. Optional equal-opportunities information is kept separate from recruitment decisions and used in an aggregated or anonymised form where practicable.

5. How we obtain personal information

We obtain information:

• directly from you, including through applications, registration forms, interviews, emails, telephone calls and our website;
• from job boards, professional networking sites, publicly available professional sources and recruitment platforms;
• from referees, former employers, education providers, professional bodies and people who refer you to us;
• from clients, hiring organisations, suppliers, payroll or umbrella providers and other partners involved in an assignment;
• from identity, right-to-work, criminal-record and other screening providers; and
• from government departments, regulators, law-enforcement bodies and other lawful public sources.

If we obtain your information from another source, we will provide this policy or equivalent privacy information within the period required by law — normally within one month, at our first communication with you, or before we first disclose the information, whichever applies first.

6. Why we use personal information and our lawful bases

UK data protection law requires us to identify both a purpose and a lawful basis for each use. More than one basis may apply to the same information in different circumstances.

7. Our legitimate interests

Where we rely on legitimate interests, we assess the purpose, necessity and impact on the people concerned. Our interests include finding suitable work for candidates, helping clients fill roles, maintaining a relevant professional network, delivering and improving services, managing business relationships, preventing misuse and protecting legal rights. We do not rely on this basis where your rights and interests override ours.

8. When information is required

Some information is required by law or is necessary to enter into or perform a contract. We will tell you when providing information is mandatory. If you do not provide required identity, right-to-work, qualification, payment or safeguarding information, we may be unable to register you, put you forward, place or pay you, or provide the requested service.

9. Who we share personal information with

Where necessary and lawful, we may share information with:

• clients, prospective employers and hiring organisations considering or managing a role or assignment;
• payroll providers, umbrella companies, pension providers, banks and HM Revenue & Customs;
• identity, right-to-work, Disclosure and Barring Service, reference, qualification and other screening providers;
• suppliers that provide applicant tracking, CRM, communications, cloud hosting, website, document, security and support services;
• referees, former employers, education providers and professional bodies;
• insurers, auditors, accountants, lawyers and other professional advisers;
• government departments, regulators, courts, law-enforcement bodies and public authorities where disclosure is required or permitted; and
• a prospective buyer, investor or successor if our business or assets are reorganised, sold or transferred, subject to appropriate confidentiality safeguards.

Recipients receive only the information reasonably necessary for their role. Service providers acting for us must use information only on our documented instructions, keep it secure and comply with applicable data protection law. We do not sell personal information.

10. International transfers

Some technology or service providers may process information outside the United Kingdom. Before making a restricted transfer, we use a lawful transfer mechanism, such as UK adequacy regulations or appropriate contractual safeguards (including the UK International Data Transfer Agreement or UK Addendum where relevant), and carry out any assessment required by law. You can contact us for further information about safeguards relevant to your information.

11. How long we keep information

We keep personal information only for as long as reasonably necessary for the purpose collected, including legal, regulatory, accounting, safeguarding and dispute requirements. We then securely delete or anonymise it. Our standard retention approach is:

• Candidate profile and CV: normally two years from the last meaningful contact or activity, unless you ask us to keep it for longer, we renew the relationship, or a longer period is required for a placement or legal claim.
• Unsuccessful application records: normally six months after the recruitment decision, unless retained within an active candidate profile or needed for a complaint or legal claim.
• Worker, placement and assignment records: normally six years after the relationship or relevant assignment ends, subject to any longer safeguarding, contractual or legal requirement.
• Right-to-work evidence: for the duration of employment or engagement and two years afterwards where the statutory employer retention requirement applies.
• Criminal-record certificate information: no longer than necessary after the recruitment or suitability decision; certificate copies are normally destroyed within six months unless lawfully required for longer. A limited record of the check and outcome may be retained where permitted.
• Payroll and tax records: for at least three years from the end of the tax year to which they relate, and longer where another legal, pension, accounting or claims requirement applies.
• Pension administration records: normally six years, or four years for opt-out records, in line with applicable requirements.
• Client, supplier, partner, contract and invoice records: normally six years after the relationship or transaction ends.
• General enquiries and business communications: normally two years after the last meaningful contact, unless the record becomes part of another relationship or is needed for a complaint or legal claim.
• Marketing preferences: until you opt out or the information is no longer accurate or relevant; we may retain a minimal suppression record so that we honour an opt-out.

Specific legal holds, complaints, safeguarding concerns or contractual requirements may justify a longer period. Backup copies are protected and overwritten or deleted in accordance with our backup cycle.

12. Security

We use proportionate technical and organisational measures designed to protect personal information against loss, misuse, unauthorised access, alteration or disclosure. These include access controls, staff confidentiality and training, supplier due diligence, secure systems, backup and incident-management arrangements. Access is limited to people who need the information for an authorised purpose.

No internet or email transmission is completely secure. If a personal data breach creates a risk to people, we will investigate, take appropriate action and notify the Information Commissioner’s Office and affected people where the law requires.

13. Automated decision-making

We may use search, filtering or matching tools to support recruiters, but we do not currently make decisions that produce legal or similarly significant effects on you solely by automated means. If this changes, we will provide the information and safeguards required by law, including how to obtain human intervention and challenge a decision.

14. Marketing, job alerts and cookies

You can ask us to stop sending marketing or vacancy communications at any time by using an unsubscribe option or contacting us. Service messages that are necessary for an application, assignment, contract, security or legal obligation are not marketing.

Our website uses cookies and similar technologies. Strictly necessary cookies support essential functions. We will ask for consent before using non-essential cookies where required. Details of the cookies in use, their providers and durations, and how to change choices are set out in our Cookie Policy and consent tool.

15. Your data protection rights

Depending on the circumstances, you may have the right to:

• be informed about how your personal information is used;
• request access to your personal information and receive a copy;
• ask us to correct inaccurate or incomplete information;
• ask us to erase information in certain circumstances;
• ask us to restrict how information is used in certain circumstances;
• receive information you provided in a structured, commonly used and machine-readable format, and ask us to transfer it, where the right to data portability applies;
• withdraw consent at any time where consent is our lawful basis, without affecting earlier lawful processing;
• object to direct marketing at any time; and
• object to processing based on legitimate interests or a task in the public interest, including related profiling, on grounds relating to your particular situation.

Your right to object. You always have the right to object to direct marketing. If you object to other processing based on legitimate interests, we will stop unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing is needed for legal claims.

To exercise a right, contact privacy@recruitta.com. We may ask for information needed to confirm your identity and clarify your request. We normally respond within one month. Rights are not absolute, and we will explain if a lawful exemption or limitation applies. We do not charge a fee unless a request is manifestly unfounded or excessive, as permitted by law.

16. Complaints

You can make a data protection complaint by emailing privacy@recruitta.com or writing to the registered office, marked “Data Protection Complaint”. Please explain what happened, the information or processing concerned and, if possible, what you would like us to do. We will acknowledge the complaint within 30 days, investigate it appropriately and communicate the outcome without undue delay.

You also have the right to complain to the UK Information Commissioner’s Office (ICO): www.ico.org.uk/make-a-complaint or 0303 123 1113. You may also contact the data protection authority in the country where you live or work where applicable.

17. Third-party websites

Our website may link to websites, platforms or services operated by others. Their handling of personal information is governed by their own privacy notices. We encourage you to read those notices before providing information.

18. Changes to this policy

We may update this policy when our services, technology or legal obligations change. The latest version will be published on our website with its effective date. If a change materially affects how we use existing information, we will take reasonable steps to bring it to the attention of the people concerned.

19. Contact details

Controller: Recruitta Limited | Company number SC667162 | ICO registration ZB159936

Email: privacy@recruitta.com

Post: Data Protection, Recruitta Limited, 294 Duke Street, Glasgow, Scotland, G31 1RZ