People Ltd (the Company)
+44 (0)1435 873921
18th May 2018
Company is a recruitment business which provides work-finding services to its
clients and work-seekers. The Company must process personal data (including
sensitive personal data) so that it can provide these services in doing
so, the Company acts as a data controller.
You may give your personal details to the Company
directly, such as on an application or registration form or via our website, or
we may collect them from another source such as a job boards. The Company must
have a legal basis for processing your personal data. For the purposes of
providing you with work-finding services and/or information relating to roles
relevant to you we will only use your personal data in accordance with the
terms of the following statement.
1.Collection and use of personal
a.Purpose of processing and legal basis
will collect your personal data (which may include sensitive personal data) and
will process your personal data for the purposes of providing you with
work-finding services. This includes for example, contacting you about job
opportunities, assessing your suitability for those opportunities, updating our
databases, putting you forward for job opportunities, arranging payments to you
and developing and managing our services and relationship with you and our
In some cases we may be required to use your data
for the purpose of investigating, reporting and detecting crime and also to
comply with laws that apply to us. We may also use your information during the
course of internal audits to demonstrate our compliance with certain industry
The legal bases we rely upon to offer these
services to you are:
Where we have a legitimate interest
with a legal obligation that we have
To fulfil a contractual obligation
that we have with you
b. Categories of data
The Company has, or will collect, the following personal data on
you, including but not limited to:
Date of birth
Contact details, including telephone number, email address
and postal address
Experience, training and qualifications
salary and required salary
Current Notice period
Additional data we may require should you
secure a permanent or consultancy position:
National Insurance number
Limited Company name, ownership
details, and Incorporation Certificate
VAT registration certificate
Company Insurance certificates
Your job title
Your business contact
information including your business email address
Company policies and procedures
Visitors to our website
you contact us through our website to submit an application, submit your CV,
submit a job description, recommend a candidate or client, or ask a question we
will ask you to agree that you accept the terms of this Privacy Notice.
c. Legitimate interest
This is where the Company has a
legitimate reason to process your data provided it is reasonable and does not
go against what you would reasonably expect from us. Where the Company has
relied on a legitimate interest to process your personal data our legitimate
interests is/are as follows:
The Company is a recruitment business
which provides work-finding services to its clients and work-seekers. The
Company must process personal data (including sensitive personal data) so that
it can provide these services.
d. Recipient/s of data
Company will process your personal data and/or sensitive personal data with the
Background screening partners
Your personal data may be required by law and/or a
contractual requirement (e.g. our client may require this personal data),
and/or a requirement necessary to enter into a contract. If you are obliged to
provide the personal data and if you do not the consequences of failure to
provide the data are:
As a recruitment business, we will be unable to
provide work-finding services to you.
Company may transfer only the information you provide to us to countries
outside the European Economic Area (EEA) for the purposes of
providing you with work-finding services. We will take steps to ensure adequate
protections are in place to ensure the security of your information. The EEA
comprises the EU member states plus Norway, Iceland and Liechtenstein.
The Company will
retain your personal data only for as long as is necessary for the purpose we
collect it. Different laws may also require us to keep different data for
different periods of time.
The Conduct of Employment Agencies and Employment
Businesses Regulations 2003, require us to keep work-seeker records for at
least one year from (a) the date of their creation or (b) after the date on
which we last provide you with work-finding services.
We must also keep your payroll records, holiday
pay, sick pay and pensions auto-enrolment records for as long as is legally
required by HMRC and associated national minimum wage, social security and tax
Where the Company has obtained your consent to
process your personal data and sensitive personal data, we will do so in line
with our retention policy (a copy of which is attached in Annex B below). Upon
expiry of that period the Company will seek further consent from you. Where
consent is not granted the Company will cease to process your personal data and
sensitive personal data.
Please be aware that you
have the following data protection rights:
The right to be informed
about the personal data the Company processes on you;
The right of access
to the personal data the Company processes on you;
The right to
rectification of your personal data;
The right to erasure of your personal
data in certain circumstances;
The right to restrict processing of your
The right to data portability in certain circumstances;
The right to object to the processing of your personal data that was based
on a public or legitimate interest;
The right not to be subjected to
automated decision making and profiling; and
The right to withdraw consent
at any time.
Where you have consented to the Company processing your
personal data and sensitive personal data you have the right to withdraw that
consent at any time by contacting
Alexis Sermbezis on
griffinpeople.com or 01435 873921
There may be circumstances where the Company will
still need to process your data for legal or official reasons. We will inform
you if this is the case. Where this is the case, we will restrict the data to
only what is necessary for the purpose of meeting those specific reasons.
If you believe that any of your data that the
Company processes is incorrect or incomplete, please contact us using the
details above and we will take reasonable steps to check its accuracy and
correct it where necessary.
You can also contact us using the above details if
you want us to restrict the type or amount of data we process for you, access
your personal data or exercise any of the other rights listed above.
5.Source of the personal data
sent to us directly, The Company sourced your personal data/sensitive personal
data by the following means:
Job boards including: Jobserve.com, Jobsite.co.uk,
Social Media and Networking sites
information came from a publicly accessible source.
If you wish to complain about this privacy notice or any of the
procedures set out in it please contact:
Alexis Sermbezis on
griffinpeople.com or 01435 873921.
You also have the right
to raise concerns with Information Commissioners Office on 0303 123 1113
or at https://ico.org.uk/concerns/, or any other relevant supervisory
authority should your personal data be processed outside of the UK, if you
believe that your data protection rights have not been adhered to.
a) The lawfulness of processing conditions for
personal data are:
1.Consent of the individual for one or more
2.Processing is necessary for the performance of a
contract with the individual or in order to take steps at the request of the
individual to enter into a contract.
3.Processing is necessary for
compliance with a legal obligation that the controller is subject to.
4.Processing is necessary to protect the vital interests of the individual
or another person.
5.Processing is necessary for the performance of a task
carried out in the public interest or in the exercise of official authority
vested in the data controller.
6.Processing is necessary for the purposes
of legitimate interests pursued by the controller or a third party, except
where such interests are overridden by the interests or fundamental rights or
freedoms of the individual which require protection of personal data, in
particular where the individual is a child.
b) The lawfulness of
processing conditions for sensitive personal data are:
consent of the individual for one or more specified purposes, unless reliance
on consent is prohibited by EU or Member State law.
necessary for carrying out data controllers obligations under employment,
social security or social protection law, or a collective agreement, providing
for appropriate safeguards for the fundamental rights and interests of the
3.Processing is necessary to protect the vital interests of the
individual or another individual where the individual is physically or legally
incapable of giving consent.
4.In the course of its legitimate activities,
p rocessing is carried out with appropriate safeguards by a foundation,
association or any other not-for-profit body, with a political, philosophical,
religious or trade union aim and on condition that the processing relates only
to members or former members (or those who have regular contact with it in
connection with those purposes) and provided there is no disclosure to a third
party without the consent of the individual.
5.Processing relates to
personal data which are manifestly made public by the individual.
6.Processing is necessary for the establishment, exercise or defence of
legal claims or whenever courts are acting in their judicial capacity.
7.Processing is necessary for reasons of substantial public interest on the
basis of EU or Member State law which shall be proportionate to the aim
pursued, respects the essence of the right to data protection and provide for
suitable and specific measures to safeguard the fundamental rights and
interests of the individual.
8.Processing is necessary for the purposes of
preventative or occupational medicine, for assessing the working capacity of
the employee, medical diagnosis, the provision of health or social care or
treatment or the management of health or social care systems and services on
the basis of EU or Member State law or a contract with a health professional
and subject to the necessary conditions and safeguards.
necessary for reasons of public interest in the area of public health, such as
protecting against serious cross-border threats to health or ensuring high
standards of quality and safety of healthcare and of medicinal products or
medical devices, on the basis of EU or Member State law which provides for
suitable and specific measures to safeguard the rights and freedoms of the
individual, in particular professional secrecy.
10.Processing is necessary
for archiving purposes in the public interest, scientific or historical
research purposes or statistical purposes, which shall be proportionate to the
aim pursued, respect the essence of the right to data protection and provide
for suitable and specific measures to safeguard fundamental rights and
interests of the individual.
Griffin People Ltd (the
+44 (0)1435 873921
Data Retention Policy
20th May 2018
organisations that process personal data are required to comply with data
protection legislation. This includes in particular the Data Protection Act
1998 (or its successor) and the EU General Data Protection Regulation (together
the Data Protection Laws). The Data Protection Laws give
individuals (known as data subjects) certain rights over their
personal data whilst imposing certain obligations on the organisations that
process their data. As a recruitment business the Company collects and
processes both personal data and sensitive personal data. It is required to do
so to comply with other legislation. It is also required to keep this data for
different periods depending on the nature of the data. This policy sets out how
long the Company will keep personal date and sensitive personal data
Data retention period
including 3 years from the last date
CV, ID checks, terms
engagement (also see below),
services as an
details of assignments,
opt-out Agency or
notices and interview
Hirer records including client details,
terms of business (also see
and assignment/vacancy details.
Terms of engagement
years from the last date
workers of providing
and terms of business with clients
services as an Employment
(and all other
Business, in order to deal
with any civil action
in the form of
a contractual claim
(Limitation Act 1980).
to right to work in
the UK References