Draft for review. This page was prepared in good faith and has not yet been reviewed by a qualified legal adviser. RECRUITERCLICK LTD will update it following that review.
The law that applies
As a business established in the United Kingdom that handles personal information about candidates, clients and website visitors, RECRUITERCLICK LTD must comply with:
- the United Kingdom General Data Protection Regulation (the GDPR as it applies in United Kingdom law);
- the Data Protection Act 2018;
- the Data (Use and Access) Act 2025, which updated parts of both of the above;
- the Privacy and Electronic Communications Regulations 2003 (PECR), which cover cookies and electronic marketing.
Where we handle information about people located in the European Economic Area in connection with our services, the EU General Data Protection Regulation may also apply.
This page summarises how we meet those obligations. Our Privacy Notice and Candidate Privacy Notice give the full details of what we collect and why.
Who is responsible
RECRUITERCLICK LTD (company number 12012771) is the controller of the personal information we collect through this website and our services. Privacy questions and requests can be sent to info@recruiterclick.com, or by post to Armadillo Mumb#92963, 8 Parkway Avenue, Sheffield, United Kingdom, S9 4WA.
We have not appointed a statutory Data Protection Officer, as the law does not require one for an organisation of our type and size. Privacy questions and requests are handled by our team through the contact details above.
Our data protection principles
We follow the data protection principles set out in Article 5 of the GDPR. Personal information is:
| Principle | What it means in practice |
|---|---|
| Lawfulness, fairness and transparency | We tell people what we collect and why, in plain language, before or at the point we collect it. |
| Purpose limitation | We use CVs and candidate details for recruitment purposes, and enquiries for responding to them, not for unrelated purposes. |
| Data minimisation | Our forms ask only for what is needed. We do not request dates of birth, national insurance numbers, passport details or health information at registration. |
| Accuracy | Candidates can ask us to correct or update their details at any time. |
| Storage limitation | Records are deleted automatically when their retention period ends. See our Data Retention Policy. |
| Integrity and confidentiality | CVs are stored privately, access is restricted to authorised staff, and access is logged. |
| Accountability | We keep records of consent, privacy notice versions and staff access, so that we can demonstrate compliance. |
Lawful bases we rely on
| Activity | Lawful basis (Article 6 GDPR) |
|---|---|
| Reviewing CVs and matching candidates to opportunities | Steps taken at the candidate's request before entering into an arrangement, and legitimate interests |
| Introducing a candidate to an employer for a specific role | Legitimate interests, only after telling the candidate about the role |
| Providing recruitment and IT services to clients | Performance of a contract |
| Responding to enquiries | Legitimate interests |
| Emails about future opportunities | Consent, given through a separate optional tick box and withdrawable at any time |
| Keeping records required by law, and handling claims | Legal obligation and legitimate interests |
We do not ask for special category information (such as health, ethnicity or religion) or criminal offence information through this website. If a specific role later requires checks of this kind, we will explain the legal basis and condition before collecting anything.
Recruitment-specific safeguards
- We never send a candidate's CV to an employer without first telling the candidate about the opportunity.
- We share only the information relevant to the role.
- Employers who receive candidate details become controllers of that information and must handle it lawfully; this is set out in our Employer Terms.
- Recruitment decisions are made by people, not solely by automated systems.
- We never charge candidates a fee for finding them work.
Your rights
Under the GDPR you have the following rights, subject to certain conditions and exceptions:
| Right | What you can ask us to do |
|---|---|
| Right to be informed | Tell you how your information is used (this page and our privacy notices). |
| Right of access | Give you a copy of the personal information we hold about you. |
| Right to rectification | Correct information that is inaccurate or incomplete. |
| Right to erasure | Delete your information where there is no good reason for us to keep it. |
| Right to restrict processing | Limit how we use your information, for example while a correction is checked. |
| Right to data portability | Provide information you gave us in a structured, machine-readable format, where processing is based on consent or contract and carried out by automated means. |
| Right to object | Stop using your information where we rely on legitimate interests, and stop direct marketing at any time. |
| Rights relating to automated decisions | Not be subject to significant decisions made solely by automated means. We do not make such decisions. |
| Right to withdraw consent | Withdraw consent at any time, without affecting processing that took place before. |
Making a subject access request
- Email info@recruiterclick.com with "Subject access request" in the subject line, or write to us at the address above. You do not need to use a particular form of words.
- Tell us your name, the email address you used with us, and anything that will help us find your information.
- We may ask for proof of identity before releasing information, to protect you against someone else obtaining it.
- We will respond within one month of receiving your request (or of confirming your identity). For complex or numerous requests we may extend this by up to two further months, and we will tell you within the first month if we need to.
- There is normally no charge. We may charge a reasonable fee, or decline, only where a request is manifestly unfounded or excessive, as the law allows.
We carry out reasonable and proportionate searches to find the information you ask for. The same process applies to the other rights listed above.
Service providers and employers
We use carefully selected service providers, such as website hosting and email, to run our business. They act as processors on our behalf, under written contracts that require them to keep information secure and use it only on our instructions. We do not sell personal information.
International transfers
We aim to keep personal information within the United Kingdom. If information is transferred outside the United Kingdom, we make sure it is protected by United Kingdom adequacy regulations or by appropriate safeguards, such as the International Data Transfer Agreement or the United Kingdom addendum to the European Commission's standard contractual clauses.
Security and data breaches
We use appropriate technical and organisational measures, including encrypted connections, restricted and logged staff access, private storage for CVs, checks on uploaded files and protection against automated abuse. If a personal data breach occurs, we will:
- contain it and assess the risk to the people affected;
- report it to the Information Commissioner's Office within 72 hours of becoming aware of it, where the law requires;
- tell the people affected without undue delay where the breach is likely to result in a high risk to their rights and freedoms;
- record the breach and the action taken, whether or not it has to be reported.
Automated decision-making
We do not make decisions about candidates or clients based solely on automated processing, including profiling, that produce legal or similarly significant effects.
Children
Our services are intended for adults and businesses. We do not knowingly collect information from children under 16 through this website.
Complaints
If you are unhappy with how we have handled your personal information, please contact us first. Under the Data (Use and Access) Act 2025, we will acknowledge a data protection complaint within 30 days, investigate it without undue delay and tell you the outcome. See our Complaints Procedure.
You also have the right to complain to the Information Commissioner's Office (ICO), the supervisory authority for data protection in the United Kingdom. You can call its helpline on 0303 123 1113 or use its website.