Candidate Terms & Privacy Policy

1. The Data We Collect

We collect personal data necessary to provide work-finding services. This may include:

• Identity & Contact Data: Name, address, email, phone number.
• Professional Data: CV, employment history, qualifications, skills, references, and portfolio links.
• Compliance Data: Proof of right to work in the UK (e.g., passport), National Insurance number, and background checks (if applicable and legally required).

2. Our Lawful Basis for Processing

We process your personal data under the following lawful bases:

• Legitimate Interests: To run our recruitment business, match your skills to vacancies, and contact you about relevant opportunities.
• Consent: When we submit your CV to a specific client.
• Legal Obligation: To verify your identity, check your statutory right to work in the UK, and comply with HMRC requirements.

3. Who We Share Your Data With

We will only share your data with trusted third parties, including:

• Prospective Employers (Clients): Only with your prior written permission for specific roles.
• Service Providers: IT support and email hosting services where necessary to operate our business.
• Regulatory Bodies: HMRC or the Home Office, if legally required.

4. Data Retention

• We will retain your personal data for 5 years from the date of our last meaningful contact with you (e.g., an email exchange, interview, or profile update).
• If you are placed in a role by us, we are legally required to keep certain placement records for a longer period (typically up to 6 years to comply with HMRC and Conduct Regulations).
• After the retention period, your data will be securely deleted.

5. Your Legal Rights

Under the UK GDPR, you have the right to:

• Request Access: Ask for a copy of the personal data we hold about you (Subject Access Request).
• Request Correction: Ask us to correct any incomplete or inaccurate data.
• Request Erasure: Ask us to delete your personal data (the "right to be forgotten"), subject to our legal retention requirements.
• Object to Processing: Object to us using your data for legitimate interests or direct marketing.
• Withdraw Consent: Where you have provided consent, you can withdraw it at any time.
• Right to Lodge a Complaint: If you are unhappy with how we have handled your personal data, you have the right to lodge a complaint with the Information Commissioner's Office (ICO), the UK's independent supervisory authority for data protection. You can contact the ICO at:

  Website: ico.org.uk

  Telephone: 0303 123 1113

  Post: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

  We would, however, appreciate the opportunity to address your concerns before you contact the ICO, so please contact us first at hello@decruzsearch.com.

6. Data Breach Notification

• In the event of a personal data breach that is likely to result in a high risk to your rights and freedoms, we will notify you without undue delay and provide information about the nature of the breach, the likely consequences, and the measures we have taken or propose to take to address it.
• We will also notify the ICO of any reportable breaches within 72 hours of becoming aware of them, in accordance with our obligations under the UK GDPR.