GDPR Candidate Agreement

Privacy Policy 23^rd September 2022

We are RF Recruitment Consultancy (company no. 14220208) of 2^nd Floor, Bollin House, Bollin Link, Wilmslow, SK9 1DP (‘the Company’ or ‘We’ or ‘Us’).

Collecting personal data

Purpose of processing

The Company is a recruitment business. This Privacy Policy explains what we do with your personal data, whether we are working with you to help find you a new role, continuing our relationship with you once we have found you a role, providing you with a service, receiving a service from you, using your data to ask for your assistance in relation to one of our candidates, or you are visiting our website. It describes how we collect, use and process your personal data and comply with our legal obligations.

We take your privacy very seriously and we are committed to protecting and safeguarding your data privacy rights. The policy applies to the personal data of our website users, candidates, clients, suppliers and other people who we may contact to find out more about our candidates.

When we collect your personal data we act as a data controller. At all times we will comply with current data protection laws.

If you have opted-in we may also send you marketing information and news via email/ text. You can opt-out from receiving these at any time by clicking “unsubscribe” when you receive these communications from us.

We may also use your information for audits to demonstrate our compliance with certain industry standards. In some cases we may be required to use your data for the purpose of investigating, reporting and detecting crime and also to comply with laws that apply to us.

Our legal bases for processing personal data

We must have one or more legal bases to process personal data. The legal bases we rely upon to offer our recruitment services to you (whether a work-seeker or a client contact) are:

Your consent
Where we have a legitimate interest which include:

Managing our database and keeping work-seeker records up to date;
Providing recruitment services to work-seekers and our clients;
Contacting you to seek your consent where we need it;
Giving you information about similar products or services that you have used from us recently;

To comply with a legal obligation that we have
To fulfil a contractual obligation that we have with you
- We have certain legal and contractual requirements to collect personal data (e.g. to comply with the Conduct of Employment Agencies and Employment Businesses Regulations 2003, immigration and tax legislation, and in some circumstances safeguarding requirements.) Our clients may also require this personal data, and/or we may need your data to enter into a contract with you. Unfortunately if you do not give us personal data we need to collect we may not be able to continue to provide recruitment services to you.

Who we may share your personal data with

Where you are a work-seeker, we will process your personal data and/or special category or criminal records data with the following recipients:

Clients (whom we may introduce or supply you to)
Former employers whom we may seek references from
Payroll service providers who manage payroll on our behalf or other payment intermediaries whom we may introduce you to
Other recruitment agencies in the supply chain

Where you are a client, we will share the contact details of relevant staff with the work-seeker.

Personal data collected from work-seekers:

Categories of data: We will collect certain personal data from you but we may also collect data form other sources.

Personal data:

Your name and address
Private and corporate e-mail address and phone number
References verifying your qualifications and experience
Documentary evidence of your right to work in the United Kingdom
Curriculum vitae and photograph
Employment details and preferences.
Financial information (such as national insurance number and P45) and compliance documentation

Special category and criminal records data:

Nationality
Health information including whether you have a disability
Criminal record

Sources of the personal data:

Where you are a work-seeker we source your personal data from:

You – your registration form, CV and application to us, when you subscribe to our services, attend our events, participate in discussion boards or other social media functions on our website, enter a competition, promotion or survey, and when you report a problem with our site.
Links to your professional profiles available in the public domain e.g. LinkedIn, Twitter, Facebook for Business or corporate website.
A former employer
Any referees whose details you have given to us

Personal data collected from clients

We collect limited personal data about our clients and their staff. We generally only need to have contact details or the details of individual contacts at a client organisation (such as their names, telephone numbers, job title and email addresses) to enable us to ensure that our relationship runs smoothly. It also helps us to better understand our clients and other users as a group so that we can continue to provide them with an efficient service. We may also hold extra information that someone in the organisation has chosen to tell us. If we need any additional personal data for any reason, we will let the individual concerned know.

We may collect, hold and process the following data about individuals who work at our client organisations:

Personal information collected in the form of a completed form which may be received via our site or one of our recruitment consultants. We will hold this form in our database. Personal information may also be collected from client contacts by email or by telephone. Personal information can be updated at any time by submitting a new form to us or by contacting us by email or telephone.
If you contact us, we may keep a record of that correspondence.
Details of clients visits to our site including, but not limited to, traffic data, location data, weblogs and other communication data, whether this is required for our own billing purposes or otherwise and the resources that you access.

Sending personal data overseas

We will not transfer personal data to countries outside the European Economic Area (‘EEA’) for the purposes of providing you with recruitment services. The EEA comprises the EU member states plus Norway, Iceland and Liechtenstein.

How long we keep your personal data for

We will keep your personal data only for as long as is necessary for the purpose we collect it. We must comply with different laws which require us to keep different data for different periods of time e.g.:

Reason for keeping your personal data	What we must keep	For how long
Candidates/ work-seekers
Conduct of Employment Agencies and Employment Businesses Regulations 2003	Your work-seeker records	At least one year from (a) the date of their creation or (b) after the date on which we last provide you with recruitment services
Immigration legislation	Your right to work documents	2 years from when we last supplied you
Tax and national insurance legislation	Payroll records	3 years from the end of the pay reference period after the period the records relate to
Pensions auto-enrolment information	Auto-enrolment date, opt in and out notices, contributions paid	6 years except for opt out notices which we keep for 4 years
Statutory benefits	Such as statutory sick pay, maternity, paternity adoption pay	Generally 3 years (in line with payroll records)
Working Time Regulations	Including holiday records and 48 hour opt out notices	2 years from when the record was created
Criminal record information	DBS checks (if required)	6 months
Clients
The Conduct Regulations and for the performance of contracts	Contact details of hiring managers, marketing contacts and other staff. Copies of contracts	6 years for the purposes of dealing with any contractual enquiries or claims.

Where you give us consent to process your personal data, we will do so in line with our retention policy set out above. When necessary, we will ask you for further consent to continue processing your data. If you do not give us consent, we may not be able to continue to provide recruitment services to you unless we can rely on another legal basis.

We may archive part or all of your personal data or retain it on our financial systems but delete all or part of it from our recruitment software system. On removal, we may anonymise parts of your data – particularly following a request for suppression or deletion of your data – to ensure we do not re-enter your personal data to our database, unless you have requested us to do so.

Your personal data rights

You have the following data protection rights:

The right to be informed about the personal data we process on you;
The right of access to the personal data we process on you;
The right to rectification of your personal data;
The right to erasure of your personal data in certain circumstances;
The right to restrict processing of your personal data;
The right to data portability in certain circumstances;
The right to object to the processing of your personal data that was based on a public or legitimate interest;
The right not to be subjected to automated decision making and profiling; and
The right to withdraw consent at any time.

Where you have consented to us processing your personal data (including special category data and/ or criminal records data) you have the right to withdraw that consent at any time by contacting Rachel Filby, Director of RF Recruitment Consultancy Ltd. at rachelfilby@rfrecruit.co.uk. Please note that if you withdraw your consent to further processing that does not affect any processing done prior to the withdrawal of that consent, or which is done according to another legal basis.

There may be circumstances where we will still need to process your data for legal or official reasons. Where this is the case, we will tell you and we will restrict the data to only what is necessary for those specific reasons.

If you believe that any of your data that we process is incorrect or incomplete, please contact us using the details above and we will take reasonable steps to check its accuracy and correct it where necessary.

You can also contact us using the above details if you want us to restrict the type or amount of data we process for you, access your personal data or exercise any of the other rights listed above.

Automated decision-making [Optional]

We do not use automated decision-making.

Cookies

We may set and access Cookies on your computer. Cookies may be placed on your computer when you visit certain parts of the Website. We use these to identify and track visitors, their usage of the Website, their access preferences and for advertising.

If you want to learn more about the general use of cookies, please visit Cookiepedia.

Essential Cookies

Strictly Necessary cookies - These are cookies that allow you to use different parts of our site. Without them different features that you have requested cannot be provided. These are usually set in response to an action performed by the user like clicking on a job advert or failing to enter the correct password to their account.
Functional cookies - These help us to make your experience within our site more personal. For instance, knowing if you have been on the site before so that messages for new visitors are not displayed to you.
First party cookies - These are cookies that are set by our website. And only we can read them.
Session cookies - These are stored while you browse our site and then deleted once you leave.
Persistent cookies - These are saved on your computer and won’t be deleted when you close the web page. We use these to provide functionality like keeping you logged in when you come back to the site.

Performance cookies (optional if tracking codes are used)

These help us to track how people are using our site. They help us to know what pages people are using most and how users navigate around the site, we use this information to make informed decision about how we can improve the user experience of our site.

The information we get using these cookies is completely anonymous and we will make no attempt to identify you or influence your experience of our site while you are on it.

Third party cookies (optional if tracking codes are used)

These are set by someone other than us, these can be things like Analytics and other embedded content.

First Party Cookies we use (Essential Cookies)

ASP.NET_SessionId	We use this to identify each session that is open on our site. This cookie holds no personal data. All it stores is an ID number generated by us.	First Party Cookie & Session Cookie
ffcookies-dismiss	This is used to stop the cookie policy banner popping up every time you visit our site. This cookie holds no personal data.	First Party Cookie & Persistent Cookie
ffIEWarning	We use this cookie to notify a user that they are using an outdated version of IE and that they should upgrade. This cookie holds no personal data.	First Party Cookie & Persistent Cookie
ff_secCheck	This cookie is used to keep track of when a user had made a failed login attempt. This cookie holds no personal data.	First Party Cookie & Functional Cookie
ff_AdDist	This cookie is used to identify when a user has opened the current job advert page from a link sent to them by email from us. Eg. Job Alerts or Mailshots.	First Party Cookie
.ASPXAUTH	This is a cookie we use to authenticate a logged in user on our site, effectively this is how we keep you logged into our site and able to navigate the site without needing to login every time.	First Party Cookie & Persistent Cookie
AngularAntiXsrfToken	This cookie is used to ensure the person performing an action is currently browsing our website preventing cross site request forgery attacks. This cookie holds no personal data and only stores a random ID.
AntiXsrfToken	This is an additional cookie that is used to prevent cross site request forgery attacks. This cookie holds no personal data and only stores a random ID.

Third Party Cookies

These are cookies that are set by other websites through embedded content.

Intercom - Intercom is used for customer support and notification. For detailed cookie information see: https://www.intercom.com/help/en/articles/2361922-intercom-messenger-cookies

Functional cookies - AddThis

AddThis sets up sharing options to allow visitors to share pages with other websites such as social media. For detailed cookie information see: https://www.addthis.com/privacy/privacy-policy

Functional cookies - LinkedIn

These are used to allow visitors to post links directly into LinkedIn when visiting the site and are set after interacting with the sharing functionality. For detailed cookie information see: https://www.linkedin.com/legal/l/cookie-table#thirdparty

Functional cookies – Meta

These are used to allow visitors to post links directly into Facebook when visiting the site and are set after interacting with the sharing functionality. For more information on how Meta use cookies see: https://www.facebook.com/policies/cookies

Functional cookies - Twitter

These are used to allow visitors to post links directly into Twitter when visiting the site and are set after interacting with the sharing functionality. For more information on how Twitter use cookies see: https://help.twitter.com/en/rules-and-policies/twitter-cookies

Google Analytics

We use Google Analytics to help us understand how visitors use our website. For detailed cookie information see: https://business.safety.google/adscookies/

Log Files

Our applicant tracking system (ATS) logs several activities for the purpose of debugging faults, aggregating usage, and data retention. Some of these activities may contain personally identifiable information. This is held for a maximum of 30 days to comply with data protection rules. The ATS also logs connection information containing IP Addresses for security purposes.

Links to external websites

The Company’s website may contain links to other external websites. Please be aware that the Company is not responsible for the privacy practices of such other sites. When you leave our site we encourage you to read the privacy statements of each and every website that collects personally identifiable information. This privacy statement applies solely to information collected by the Company’s website.

Sale of business

If the Company’s business is sold or integrated with another business your details may be disclosed to our advisers and any prospective purchasers and their advisers and will be passed on to the new owners of the business.

Data Security

All information stored on our recruitment software is secured through the Microsoft Azure Infrastructure and located at two data centres locations within Europe. Our primary centre is located in Microsoft’s Western European centre, and these facilities are secured by a series of measures, including (but not limited to) biometric access, security alarm systems and round-the-clock security staff. Additional security information on Microsoft’s data centres can be found here.

Only employees who need the information to perform a specific job (for example, consultants, our accounts clerk or a marketing assistant) are granted access to your information.

We use all reasonable efforts to protect your personal information. However, the use of email/ the Internet is not entirely secure and for this reason we cannot guarantee the security or integrity of any personal information which is transferred to or from you by email/ the Internet.

If you share a device with others, we recommend that you do not select the “remember my details” function when that option is offered.

If you have any questions about the security at our website, you can email rachelfilby@rfrecruit.co.uk.

Changes to this privacy statement

We will update this privacy statement from time to time. We will post any changes on the statement with revision dates. If we make any material changes, we will notify you.

Complaints or queries

If you wish to complain about this privacy notice or any of the procedures set out in it please contact: rachelfilby@rfrecruit.co.uk.

You also have the right to raise concerns with Information Commissioner’s Office on 0303 123 1113 or at https://ico.org.uk/concerns/, or any other relevant supervisory authority should your personal data be processed outside of the UK, if you believe that your data protection rights have not been adhered to.