Henry Blue Ltd is a recruitment business which provides work-finding services to its clients and work-seekers. Henry Blue Ltd must process personal data (including sensitive personal data) so that it can provide these services – in doing so, the Company acts as a Data Controller.

You may give your personal details to the Company directly, such as on an application or registration form or via our website, or we may collect them from another source, such as a job board. The Company must have a legal basis for processing your personal data. For the purposes of providing you with work-finding services and/or information relating to roles relevant to you. We will only use your personal data in accordance with the terms of the following policy.

This Privacy Policy explains what we do with your personal data, whether we are in the process of helping you find a job, continuing our relationship with you once we have found you a role, providing you with a service, receiving a service from you, using your data to ask for your assistance in relation to work finding services, or you are visiting our website.

It describes how we collect, use and process your personal data, and how, in doing so, we comply with our legal obligations to you. Your privacy is important to us, and we are committed to protecting and safeguarding your data privacy rights.

This Privacy Policy applies to the personal data of our Candidates, and other people whom we may contact in order to find out more about our Candidates or whom they indicate is an emergency contact.

We reserve the right to update this Privacy Policy at any time, and we will provide you with a new Privacy Policy when we make any substantial updates. We may also notify you in other ways from time to time about the processing of your personal information.

If you are dissatisfied with any aspect of our Privacy Policy, you may have legal rights and, where relevant, we have described these as well.

Our Role

We are a “data controller”. This means that we are responsible for deciding how we hold and use personal information about you. Data protection legislation requires us to give you the information contained in this Privacy Policy.

Data Protection Principles

We will comply with data protection law. This says that the personal information we hold about you must be:

• Used lawfully, fairly and in a transparent way.
• Collected only for valid purposes that we have explained to you clearly and not used in any way that is incompatible with those purposes.
• Relevant to the purposes we have told you about and limited to those purposes only.
• Accurate and kept up to date.
• Kept only for such time as is necessary for the purposes we have told you about.
• Kept securely.

The Kind of Information we hold about you

Where you contact us directly, the information we collect from you will include anything you provide to us by corresponding with us by phone, email or otherwise.  

During the recruitment process, the information we collect may come from our third party service providers and publicly available websites to which you are registered or subscribed.

The information you give us or we collect may include your name, address, phone number, information listed on your CV including employment history and education.

As part of our registration, you will be required to provide additional information to satisfy our own legal requirements as well as those of our clients. Such information would include sensitive personal information such as criminal allegations or convictions, references, passport numbers and any other required Right to Work confirmations.

1. Collection and use of personal data

Purpose of processing and legal basis

The Company will collect your personal data (which may include sensitive personal data) and will process your personal data for the purposes of providing you with work-finding services. The legal basis we rely upon to offer these services are:

• Consent
• Legitimate interest
• Legal obligation
• Contractual obligation

Consent

• In certain circumstances, we are required to obtain your consent for the processing of your personal data in relation to certain activities. Depending on exactly what we are doing with your information, this consent will be opt-in consent or soft opt-in consent.
• Article 4(11) of the GDPR states that (opt-in) consent is “any freely given, specific, informed and unambiguous indication of the data subjects’ wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her.” This means that:
• you must give us your consent freely, without us putting you under any type of pressure;
• you must know what you are consenting to – so we will make sure we give you enough information;
• you should have control over which processing activities you consent to and which you don’t, and
• you must take positive and affirmative action in giving us your consent

We have already mentioned that, in some cases, we will be able to rely on soft opt-in consent. We may market products or services to you which are related to the recruitment services we provide as long as you do not actively opt-out from these communications.

As we have mentioned, you have the right to withdraw your consent to these activities at any time.

Legitimate interest

Where the Company has relied on a legitimate interest to process your personal data our legitimate interests are as follows:

Candidate Data

• We believe it is reasonable to expect that if you are looking for employment or have posted your professional CV information on a job board or professional networking site, you are happy for us to collect and use your personal data to offer or provide our recruitment services to you, share that information with prospective employers and assess your skills against our bank of vacancies. Once it looks like you may get the job, your prospective employer may also want to double check any information you’ve given us to confirm your references, qualifications and criminal record, to the extent that this is appropriate and in accordance with local laws. We need to do these things so that we can function as a profit-making business, and to help you and other Candidates get the jobs you deserve.
• We want to provide you with tailored job recommendations and relevant articles to help you on your job hunt. We therefore think it’s reasonable for us to process your data to make sure that we send you the most appropriate content.
• We must make sure our business runs smoothly, so that we can carry on providing services to Candidates like you. We therefore also need to use your data for our internal administrative activities, like payroll and invoicing where relevant.
• We have our own obligations under the law, which is a legitimate interest of ours to insist on meeting. If we believe in good faith that it is necessary, we may therefore share your data relating to crime detection, tax collection or actual or anticipated litigation.

How do we safeguard your personal data?

We are committed to taking all reasonable and appropriate steps to protect the personal information that we hold from misuse, loss, or unauthorised access. We do this by having a range of appropriate technical and organisational measures in place. These include measures to deal with any suspected data breach.

Recipients of data/Legal Obligation

The Company may share or process your personal data and/or sensitive personal data, in various ways and for various reasons, with the following recipients:

• Clients – Educational Establishments
• Gov Update Service (DBS Checks)
• Payroll – Umbrella Companies
• TP Online

Statutory/contractual requirement

Your personal data is required by law and/or a contractual requirement (e.g. our client may require this personal data), and/or a requirement necessary to enter into a contract.

Several elements of the personal data we collect from you are required to enable us to fulfil our contractual duties to you or to others. For example, some Candidates’ National Insurance numbers and right to work in the UK are required by statute or other laws. Other items may simply be needed to ensure that our relationship can run smoothly.

Depending on the type of personal data in question and the grounds on which we may be processing it, should you decline to provide us with such data, we may not be able to fulfil our contractual requirements or, in extreme cases, may not be able to continue with our relationship.

1. Overseas Transfer

The Company may transfer the information you provide to us to countries outside the European Economic Area (‘EEA’) for the purposes of providing you with work-finding services. We will take steps to ensure adequate protections are in place to ensure the security of your information. The EEA comprises the EU member states plus Norway, Iceland and Liechtenstein. 

1. Data retention

The Company will retain your personal data only for as long as is necessary. Different laws require us to keep different data for different periods of time.

The Conduct of Employment Agencies and Employment Businesses Regulations 2003, require us to keep work-seeker records for at least one year from (a) the date of their creation or (b) after the date on which we last provide you with work-finding services.

We must also keep your payroll records, holiday pay, sick pay and pensions auto-enrolment records for as long as is legally required by HMRC and associated national minimum wage, social security and tax legislation.

Where the Company has obtained your consent to process your personal and sensitive personal data we will do so in line with our retention policy. Upon expiry of that period the Company will seek further consent from you. Where consent is not granted the Company will cease to process your personal data and sensitive personal data.

In some circumstances, we may anonymise your personal information so that it can no longer be associated with you, in which case we may use such information without further notice to you. Once you are no longer seeking work we will retain and securely destroy your personal information in accordance with applicable laws and regulations.

1. Your Rights

Please be aware that you have the following data protection rights:

• The right to be informed about the personal data the Company processes on you;
• The right of access to the personal data the Company processes on you;
• The right to rectification of your personal data;
• The right to erasure of your personal data in certain circumstances;
• The right to restrict processing of your personal data;
• The right to data portability in certain circumstances;
• The right to object to the processing of your personal data that was based on a public or legitimate interest;
• The right to not be subjected to automated decision making and profiling; and
• The right to withdraw consent at any time.

Your rights in relation to personal information:

• Request access to your personal information (commonly known as a “data subject access request”). This enables you to receive a copy of the personal information we hold about you and to check that we are lawfully processing it.
• Request correction of the personal information that we hold about you. This enables you to have any incomplete or inaccurate information we hold about you corrected.
• Request that your personal information is erased. This allows you to ask us to delete or remove personal information where there is no good reason for us continuing to process it. You also have the right to ask us to stop processing personal information where we are relying on a legitimate interest and there is something about your situation that makes you want to object to processing on this ground.
• Request the restriction of processing of your personal information. This enables you to ask us to suspend the processing of personal information about you, for example if you want us to establish its accuracy or the reason for processing it.
• Request the transfer of your personal information to another party.

If you want to review, verify, correct or request erasure of your personal information, object to the processing of your personal data, or request that we transfer a copy of your personal information to another party, please contact Alex Stead – Data Controller at alex.stead@henry-blue.co.uk 

No fee usually required

You will not have to pay a fee to access your personal information (or to exercise any of the other rights). However, we may charge a reasonable fee if your request for access is unfounded or excessive. Alternatively, we may refuse to comply with the request in such circumstances.

What we may need from you

We may need to request specific information from you to help us confirm your identity and ensure your right to access the information (or to exercise any of your other rights). This is another appropriate security measure to ensure that personal information is not disclosed to any person who has no right to receive it.

Right to withdraw consent

In the limited circumstances where you may have provided your consent to the collection, processing and transfer of your personal information for a specific purpose, you have the right to withdraw your consent for that specific processing at any time. To withdraw your consent, please contact Alex Stead – Data Controller at alex.stead@henry-blue.co.uk . Once we have received notification that you have withdrawn your consent, we will no longer process your information for the purpose or purposes you originally agreed to, unless we have another legitimate basis for doing so in law.

We will seek to deal with your request without undue delay, and in any event within 30 days (subject to any extensions to which we are lawfully entitled). Please note we may keep your communications to help us resolve any issues which you raise.

1. Automated decision-making (Profiling)

Automated decision-making takes place when an electronic system uses personal information to make a decision without human intervention. We can use automated decision-making in the following circumstances:

• Where we have notified you of the decision and given you 21 days to request a reconsideration.
• Where it is necessary to perform the contract with you and appropriate measures are in place to safeguard your rights.
• In limited circumstances, with your explicit written consent and where appropriate measures are in place to safeguard your rights.

If we make an automated decision based on any particularly sensitive personal information, we must have either your explicit written consent or it must be justified in the public interest, and we must also put in place appropriate measures to safeguard your rights.

You will not be subject to decisions that will have a significant impact on you based solely on automated decision-making, unless we have a lawful basis for doing so and we have notified you.

We do not envisage that any decisions will be taken about you using automated means, however we will notify you in writing if this position changes.

1. Cookies

A cookie is a string of information that a website stores on a visitor’s computer, and that the visitor’s browser provides to the website each time the visitor returns. Henry Blue Ltd uses cookies to help us identify and track visitors, their usage of our website, and their website access preferences. Henry Blue Ltd visitors who do not wish to have cookies placed on their computers should set their browsers to refuse cookies before using Henry Blue’s website, with the drawback that certain features of the website may not function properly without the aid of cookies. For more information about cookies visit www.aboutcookies.org

1. Third party cookies

We sometimes embed photos, videos or tweets from websites such as news articles and LinkedIn. Pages with this embedded content may present cookies from these websites. Similarly, if you use a share button on our website, a cookie may be set by the service you have chosen to share content through. We do not control the dissemination of these cookies. You should check the relevant third party website for more information about these.

1. Links to other websites

Our website may contain links to other websites of interest. However, once you have used these links to leave our site, you should note that we do not have any control over the other website. Therefore, we cannot be responsible for the protection and privacy of any information you provide whilst visiting such sites and such sites are not governed by this privacy statement. You should exercise caution and look at the privacy statement applicable to the website in question.

1. Complaints or queries

If you wish to complain about this Privacy Policy or any of the procedures set out in it, please contact:

Alex Stead – Data Controller – alex.stead@henry-blue.co.uk

You also have the right to raise concerns with Information Commissioner’s Office on 0303 123 1113 or at https://ico.org.uk/concerns/, or any other relevant supervisory authority should your personal data be processed outside of the UK, if you believe that your data protection rights have not been adhered to.