Privacy policy

This policy sets out how we gather, use, store, share and safeguard personal data whenever you:

• browse our website at www.jobpro.example;
• send us a CV or an application;
• apply for a role;
• tell us you are interested in recruitment opportunities;
• get in touch with us;
• send us a vacancy or a recruitment enquiry;
• work with us as a client or potential client;
• speak or write to us by phone, email or any other channel; or
• deal with Job Pro in any other way.

Unless we say otherwise, Job Pro Ltd acts as the data controller, under the data protection laws that apply, for the personal data processed for the purposes set out in this policy.

Questions about how we handle your personal data can be sent to us using the contact details at the end of this policy.

The types of personal data we collect and process vary according to how you deal with us.

When you apply for a role, send us your CV or get in touch about permanent or contract work, we may collect:

• your full name;
• contact details, such as your email address, phone number and home address;
• your CV and work history;
• your education and qualifications;
• professional qualifications and memberships you hold;
• your skills, experience and abilities;
• details of your current and past jobs;
• the kind of work you are looking for;
• your expected salary or pay;
• where and how you would like to work;
• when you are available and your notice period;
• information about your right to work;
• nationality or immigration details, where needed to confirm your right to work;
• references and details of your referees;
• interview notes and correspondence about recruitment;
• details given in application forms;
• details found in your CV or supporting documents;
• details about how suitable you are for particular roles;
• details of your communications with us;
• records of our recruitment activity and dealings with you; and
• anything else you choose to share with us.

Where it is lawful and relevant to recruitment, we may also process information from third parties, for example former employers, referees, professional bodies, recruitment platforms or professional sources open to the public.

For clients and potential clients, we may collect:

• your name;
• your job title;
• the name of your company;
• your work contact details;
• your business address;
• correspondence with you;
• details of vacancies;
• your hiring needs;
• details about your organisation;
• contract and commercial details;
• billing and payment details;
• records of calls, messages and meetings; and
• anything else reasonably needed to deliver recruitment services.

Using our Website may result in us collecting details such as:

• your IP address;
• the browser you use;
• details of your device;
• your operating system;
• a rough location worked out from technical data;
• the pages you view;
• the site that referred you;
• when you visited, by date and time;
• how you interact with the Website; and
• data from cookies and similar technologies.

What is actually collected depends on the technologies and services the Website uses at the time.

You may give us personal information when you:

• upload your CV;
• fill in an application form;
• apply for a role;
• send us a vacancy;
• get in touch with us;
• ask us for information;
• sign up to receive communications;
• speak or write to someone in our recruitment team;
• take part in an interview or recruitment process; or
• correspond with us in any other way.

Please make sure the information you give us is correct and keep it reasonably current.

If you give us information about someone else, such as a referee, please make sure you are entitled to share it with us.

While delivering recruitment services, we may receive personal information about a person from someone other than that person.

Such sources can include:

• clients;
• candidates;
• referees;
• former or potential employers;
• professional networking sites;
• recruitment platforms and job boards;
• professional information available to the public;
• professional bodies;
• schools, colleges and universities;
• providers of background checks;
• providers of right-to-work checks; and
• any other lawful third-party source.

Personal data we receive from another source will be processed in line with the data protection laws that apply.

If the law requires it, we will give the person concerned the relevant privacy information within the period set by statute.

We may use personal data for the purposes below.

• finding suitable candidates for roles;
• measuring candidates against what a role requires;
• handling applications;
• keeping in touch with candidates;
• setting up interviews;
• introducing candidates to clients;
• telling candidates about roles that may suit them;
• keeping recruitment records;
• looking after our relationships with candidates;
• running suitable recruitment checks;
• collecting references;
• confirming qualifications and experience;
• confirming right-to-work details where relevant; and
• helping candidates through each recruitment process.

• replying to recruitment enquiries;
• understanding what each client needs from a hire;
• finding and introducing candidates;
• running recruitment assignments;
• keeping in touch with clients;
• managing our contracts with clients;
• running client accounts;
• handling invoices and payments; and
• delivering and improving our recruitment services.

• running and maintaining our Website;
• replying to enquiries;
• handling forms and applications;
• keeping the Website secure;
• stopping fraud and misuse;
• tracking how the Website performs;
• making our Website and services better;
• keeping business records; and
• running our internal systems and operations.

Where needed, we may process personal data to:

• meet our legal and regulatory duties;
• answer lawful requests made by public authorities;
• bring, pursue or defend legal claims;
• stop fraud or unlawful activity;
• keep proper business records;
• protect our rights and property; and
• meet the requirements of recruitment law.

We process personal data only when data protection law gives us a lawful basis for doing so.

The basis we rely on depends on the situation, and may be one or more of those set out below.

We may process personal data when we need to in order to carry out a contract with you, or to take steps you have asked for before a contract is made.

This could apply, for example, where:

• you hire us to provide recruitment services;
• we are managing a recruitment relationship under contract;
• we need certain information to set up a recruitment service we have agreed to provide; or
• you are being considered for a contract or engagement and the processing is needed for the contract arrangements involved.

We may process personal data when it is needed for our legitimate interests or a third party’s, as long as your interests, rights or freedoms do not override them.

These interests can include:

• running our recruitment business;
• finding and contacting candidates who may be suitable;
• keeping up professional recruitment relationships;
• introducing candidates to clients;
• looking after client relationships;
• keeping recruitment records accurate;
• making our services better;
• keeping our Website and IT systems secure;
• stopping fraud and misuse;
• running our business operations; and
• contacting existing professional contacts where the law allows.

When relying on legitimate interests, we weigh up whether the processing is necessary and proportionate, and balance our interests against the rights and freedoms of the person affected. ICO guidance recommends that organisations relying on this basis complete and record a suitable three-part assessment.

We may process personal data when we need to in order to meet a legal obligation that applies to us.

Such obligations can come from employment, recruitment, tax, accounting, anti-fraud, immigration, right-to-work, regulatory or other relevant law.

If the law requires it, we may ask for your consent.

You can withdraw any consent you have given us at any time.

Processing that took place before you withdrew consent stays lawful.

Personal data is an unavoidable part of recruitment.

When you send us a CV or apply for a role, we may use what you give us to:

• judge whether you suit the role in question;
• find other roles that may suit you;
• get in touch about recruitment opportunities;
• introduce you to potential employers or clients;
• keep you updated on recruitment processes;
• keep your candidate record up to date;
• deliver recruitment services; and
• meet the legal obligations that apply.

We aim to share candidate information only when there is a genuine recruitment reason and sharing it is lawful.

Where applicable, once an organisation receives your information, it becomes responsible for how it processes your personal data.

When suitable, we may pass relevant candidate details to a Client for recruitment purposes.

The details we share may include:

• your CV;
• your work history;
• your qualifications;
• your professional experience;
• your skills;
• your availability;
• your pay expectations;
• your location;
• right-to-work details where suitable; and
• anything else reasonably needed for the recruitment process.

We aim to share only what is relevant and suitable for the specific opportunity.

Sensitive personal information will not usually be passed to a Client unless we have both a lawful basis and a suitable reason for doing so.

The UK GDPR treats some information as “special category data” and gives it extra legal protection.

It covers information that reveals:

• racial or ethnic origin;
• political views;
• religious or philosophical beliefs;
• membership of a trade union;
• genetic data;
• biometric data used to identify a person;
• health data;
• sex life; or
• sexual orientation.

As a rule, we do not ask Candidates to give us special category data through our Website.

Even so, this kind of information sometimes appears in a CV or application, or becomes relevant during a recruitment process.

We process special category data only when an Article 9 condition is met, along with any further requirements of the DPA 2018 that apply.

Please leave out of your CV or application any special category information that is not needed.

If a role makes it relevant, we may process information about criminal convictions or offences.

We will only do so where the law allows it and the relevant legal requirements are met.

If a role calls for a criminal record check or other background check, we will, where required, explain the checks involved and how the data is processed.

For certain roles, we may process the information needed to confirm that a Candidate has the right to work in the United Kingdom.

This can include details taken from:

• passports;
• visas;
• immigration documents;
• Home Office paperwork;
• right-to-work share codes; and
• other relevant verification details.

We carry out this processing in line with immigration, employment and data protection law.

Depending on the situation, personal data may be shared with:

• current or potential Clients;
• employers;
• candidates;
• referees;
• recruitment platforms and job boards;
• CV databases;
• providers of recruitment software;
• providers of applicant tracking systems;
• IT and cloud service providers;
• website hosts;
• email and communications providers;
• professional advisers;
• accountants and auditors;
• lawyers;
• insurers;
• providers of background checks;
• providers of right-to-work checks;
• regulators;
• government bodies;
• law enforcement agencies; and
• other service providers where reasonably needed to run our business.

Personal data is only shared when we have a lawful basis for sharing it.

When third-party processors handle personal data for us, we aim to make sure suitable contractual and security safeguards are in place, as the law requires.

Some of the providers we use may process personal data outside the United Kingdom.

Any transfer of personal data outside the UK will be made in line with the data protection laws that apply.

Depending on the situation, this may mean:

• sending data to a country recognised as offering adequate protection;
• putting suitable safeguards in place, such as the UK International Data Transfer Agreement or the International Data Transfer Addendum;
• using another transfer mechanism the law allows; or
• getting consent where the law considers this appropriate.

You can ask for more details about particular international transfers using the contact details at the end of this policy.

We keep personal data only for as long as is reasonably needed for the purposes we collected it for, including meeting legal, regulatory, accounting and reporting requirements.

How long we keep information can vary by type. For example:

Candidate information may be kept while our recruitment relationship lasts and for a reasonable time after it ends, so that we can:

• keep considering you for roles that may suit you;
• keep proper recruitment records;
• show that we have met our legal and regulatory obligations; and
• handle any disputes or claims that may arise.

Information we no longer need is securely deleted or, where suitable, anonymised.

We may keep client information while our commercial relationship lasts, and afterwards for as long as is reasonably needed for legal, accounting, regulatory and legitimate business purposes.

Details sent through the Website’s contact forms may be kept for as long as is reasonably needed to handle the enquiry and keep proper records.

Some information may have to be kept for longer, where the law requires it or where this is reasonably needed to bring, pursue or defend legal claims.

We review the personal data we hold from time to time and aim to delete or anonymise anything we no longer need.

Depending on the legal conditions and exemptions that apply, you may hold the following rights over your personal data:

You can ask for a copy of the personal data we hold about you.

You can ask us to fix personal data that is wrong or incomplete.

In some situations, you can ask us to delete your personal data.

In some situations, you can ask us to limit how we process your personal data.

In some situations, you may be entitled to receive the personal data you gave us in a structured, commonly used, machine-readable format, and to ask for it to be sent to another organisation.

You may be entitled to object to some types of processing, including processing that relies on legitimate interests.

You may hold rights over some decisions taken solely by automated means, including profiling, where those decisions have legal or similarly significant effects.

We do not currently plan to make recruitment decisions purely by automated means without suitable human involvement.

Where we rely on your consent, you can withdraw it whenever you choose.

Any processing carried out before you withdraw remains lawful.

We may send clients, potential clients and, where suitable, candidates information about our recruitment services, vacancies or other relevant business matters.

In doing so, we follow data protection and electronic marketing law, including the Privacy and Electronic Communications Regulations 2003 (“PECR”).

If consent is needed, we will get it before sending the electronic marketing in question.

If the law lets us rely on a different lawful basis, or on an existing customer relationship, for direct marketing, we will make sure the relevant legal requirements are met.

You can stop receiving marketing from us at any time by:

• using the unsubscribe option in the message you received; or
• emailing us at hello@jobpro.example.

Opting out of marketing does not stop us sending messages needed for an existing contractual, recruitment or other legitimate relationship.

Cookies and similar technologies may be used on our Website.

They may help us to:

• run the Website;
• remember your preferences;
• keep the Website secure;
• see how the Website is used;
• measure how it performs;
• make it work better; and
• support our recruitment and marketing activity.

The specific cookies and third-party technologies on the Website may change over time.

Before placing non-essential cookies or similar technologies on your device, we will give you suitable information and, where the law requires, ask for your consent.

More details will be given in our Cookie Policy and through any cookie settings tool on the Website.

We use reasonable technical and organisational measures intended to protect personal data from:

• access without permission;
• accidental loss;
• destruction;
• alteration;
• disclosure; and
• any other unlawful or unauthorised processing.

These measures may include access controls, authentication, secure systems, limited access and other steps suited to the nature of the personal data we process and the risks involved.

Even so, no method of sending data over the internet or storing it electronically can be guaranteed as fully secure.

Please get in touch straight away if you think there has been a security incident affecting your personal data.

If we learn of a personal data breach, we will assess what happened and take suitable action in line with data protection law.

Where the law requires, we will tell the Information Commissioner’s Office and/or the people affected within the periods set by statute.

Our Website may link to websites, platforms or services run by third parties.

Their privacy practices, content and security are not our responsibility.

Before giving personal information to any third-party website, please read its privacy policy.

Our recruitment services are mainly aimed at adults of working age.

We do not knowingly set out to collect children’s personal data through the Website, unless it is necessary and lawful for a particular purpose.

If you think a child has given us personal information without a suitable legal basis, please let us know so we can look into it and act as needed.

Technology may help us with recruitment administration, searching for candidates or matching candidates to what a role requires.

Using technology to support recruitment work does not necessarily amount to solely automated decision-making under the UK GDPR.

Unless the relevant legal requirements are met, we will not knowingly make decisions about a person solely by automated means where those decisions have legal or similarly significant effects.

Where relevant, we will explain the logic involved, the likely consequences of the processing and the rights people have.

To run our recruitment business, we may use technology from third parties, such as applicant tracking systems, recruitment databases, job boards, CV databases, cloud services, communication tools and other systems.

The particular providers we use may change over time.

When a third-party provider processes personal data for us, we will take suitable steps to make sure that:

• where acting as a processor, it handles personal data only as we instruct;
• suitable confidentiality duties apply;
• suitable security measures are in place;
• suitable contractual protections are in place; and
• any international transfer is made lawfully.

When we pass candidate information to a Client for recruitment, the Client may become an independent data controller for any processing of that information it carries out afterwards.

In that case, the Client may process the information under its own privacy notice and data protection duties.

If another organisation is independently responsible for processing your personal data, please also read that organisation’s privacy information.

If you are worried about how we handle your personal data, please speak to us first, using the contact details at the end of this policy.

We will look into your concern and aim to put it right.

You are also entitled to complain to the Information Commissioner’s Office (“ICO”), the UK’s independent data protection regulator. You can find the ICO’s contact details at ico.org.uk.

To use any of your data protection rights, email us at hello@jobpro.example.

Please give us enough information to identify you and understand what you are asking for.

Before we release or change any personal data, we may need to ask for more information to confirm who you are.

This security step helps stop personal data reaching anyone not entitled to it.

Valid requests will be answered within the period set by statute.

This Privacy Policy may be updated from time to time to reflect changes to:

• the law;
• regulatory guidance;
• our business;
• our Website;
• the technology providers we use; or
• the way we process personal data.

We will publish the current version on our Website, showing its “Last updated” date.

Where the law requires, we will tell people about significant changes before starting any new processing.