Legal
Recruitment Privacy Notice
In short: we collect the personal data needed to run a recruitment service — candidate profiles and CVs, employer and vacancy details, and the applications, submissions, interviews and placements that connect them. We use it only for recruitment purposes we've told you about. Personal data is never sold. It is used only for stated recruitment purposes and disclosed only to authorised service providers or relevant employers, with the candidate informed and in control.
1. Who we are
This service is operated by Laurus Recruitment (referred to as "we", "us", "Laurus Recruitment"), part of Laurus Group.
[TO CONFIRM: exact legal controller entity name (e.g. "Laurus Group Limited, trading as Laurus Group Recruitment"), company number, registered office address and ICO registration reference — see COMPLIANCE_DECISIONS_REQUIRED.md item 1. This page must not go to Production with this flag still open.]
2. Who this notice covers
- Candidates — anyone who creates a candidate account, profile, or applies for a role.
- Employers — organisations and the individual staff who use the Employer Portal.
- Staff users — Laurus consultants and administrators using the internal operating system.
- Site visitors — anyone browsing the public website without an account.
3. Candidates
What we collect
Account details (name, email, phone); profile information you add (headline, summary, location, right-to-work status, skills, experience, salary and work preferences, availability); your CV and any supporting documents you upload; records of vacancies you apply to and the status of each application; interview scheduling and feedback we choose to share with you; internal recruiter notes are not shown to you directly but may fall within a subject access request (see Your rights).
Where it comes from
Directly from you, when you register, complete your profile, or upload a document. We do not buy candidate data from third parties for this service.
Why we use it (lawful basis)
Reading and using your Privacy Notice does not itself give us a lawful basis — it is information, not consent. For matching you to vacancies and running the recruitment process, our proposed lawful basis is legitimate interests (UK GDPR Article 6(1)(f)) — operating a recruitment business and helping you find suitable work — balanced against your rights, as set out in docs/compliance/LEGITIMATE_INTERESTS_ASSESSMENT.md. Using the Candidate Portal itself (hosting your account, storing what you type) is contractual necessity under our Candidate Terms of Use. Any optional marketing communication is sent only with your separate, freely-given consent, which you can withdraw at any time without affecting your candidate account.
Sharing with employers
We do not give any employer open access to our candidate database. Your profile and CV are shared with a specific employer for a specific vacancy only when: (a) you actively apply for that vacancy and confirm you want to be put forward, or (b) a consultant proposes submitting you and you approve that submission (unless you have already given a clear, recorded, appropriately-scoped prior authorisation covering it). See Candidate-to-employer sharing below and your Data & Privacy area in the Candidate Portal, which shows exactly who your information has been shared with.
Special category and sensitive information
We do not ask for date of birth, health, ethnicity, religion, sexual orientation, trade union membership, biometric or criminal-record information as part of general registration. If a specific role genuinely requires right-to-work, DBS/vetting or reasonable-adjustment information, that is collected and handled separately, on its own lawful basis, with access restricted to those who need it — see RECRUITMENT_DPIA.md. Please do not include sensitive information in free-text fields (such as your CV summary) unless it is genuinely necessary for a specific application.
4. Employers
We collect organisation and vacancy details, and the account details of the individual staff who use the Employer Portal on your organisation's behalf. This is used to run the recruitment relationship: matching candidates, managing applications and interviews, and confirming placements. Our proposed lawful basis is contractual necessity (delivering the recruitment service you've engaged us for) and legitimate interests (running an effective recruitment business). Candidate information made available to you is provided only for the stated recruitment purpose for that specific vacancy — see the Employer Portal Terms of Use for what you may and may not do with it.
5. Staff users
Laurus consultants and administrators have their own account records, activity logs and audit trail, used to operate the platform securely, demonstrate accountability, and investigate misuse if it occurs. Internal recruiter notes about candidates are themselves personal data and are handled under the same rights framework as any other record we hold — see the guidance shown to staff alongside the notes field.
6. Site visitors
Browsing our public pages does not create an account or a profile. See the Cookie & Browser Storage Policy for what, if anything, is stored on your device. If you contact us (for example by email), we use the details you provide to respond to you.
7. Candidate-to-employer data sharing, in detail
Every disclosure of a candidate's profile or CV to an employer is tied to a specific, recorded application or submission for a specific vacancy, with the candidate's own authorisation captured at that point (including the version of this notice and the Candidate Terms then in force). CV downloads use short-lived, individually authorised links rather than permanent public files, and access is logged by who, when, which candidate and which organisation — never the document's contents. If a candidate withdraws their authorisation, this stops future portal access where technically possible, but cannot make an employer "unsee" or automatically delete a copy they lawfully already downloaded — the employer's own contractual deletion duties (see the Employer Portal Terms of Use) apply to that copy.
8. Who else sees your data
We use a small number of service providers (processors) to run this platform — for hosting, database, authentication, file storage, transactional email and (for staff/employer sign-in) Google's sign-in service. The full list, their roles, and their data-location details are in docs/compliance/PROCESSOR_AND_SUBPROCESSOR_REGISTER.md. We do not sell personal data, and we do not share it for other organisations' marketing.
9. International transfers
Where a service provider processes data outside the UK, we rely on an appropriate safeguard (such as the UK's own adequacy regulations or a UK International Data Transfer Agreement/Addendum) — see docs/compliance/INTERNATIONAL_TRANSFERS_REVIEW.md for the current, verified position for each provider. We do not claim a transfer safeguard is in place unless it has actually been checked.
10. How long we keep it
We keep recruitment records for as long as needed to run the recruitment relationship, plus a period afterwards required or justified by law — including the minimum record-keeping period set out for employment agencies under the Conduct of Employment Agencies and Employment Businesses Regulations 2003 (currently at least 12 months from creation, and at least 12 months after we last provided a work-finding service to you). Some periods are still business decisions pending confirmation — see docs/compliance/RETENTION_SCHEDULE.md, marked TO CONFIRM where that applies. We do not run automatic bulk deletion; retention decisions go through a reviewed, auditable process.
11. How we protect it
Access to personal data is restricted by role (candidate, employer, consultant, admin) and, for employers, to their own organisation only. CVs and supporting documents are stored privately and only ever released through short-lived, individually authorised links. See docs/compliance/SECURITY_AND_ACCESS_CONTROL_STANDARD.md for the full technical and organisational measures in place, and their honest current limitations.
12. Your rights
Subject to the conditions and exemptions that apply under UK data protection law, you can ask us to: give you a copy of your data (access), correct it (rectification), delete it (erasure — see the note below), limit how we use it (restriction), object to our use of it, or receive it in a portable format. You can also withdraw marketing consent at any time. See docs/compliance/DATA_SUBJECT_RIGHTS_PROCEDURE.md for how we handle these requests, including our target response time and how we verify identity.
A note on deletion: we cannot always delete data immediately on request — for example, where we are legally required to keep a record for a period, or where a record is needed to establish, exercise or defend a legal claim. Where that applies, we will explain why, restrict further use of the record, and delete or anonymise it once the legal reason for keeping it has passed.
Candidates can raise most of these requests directly from the Data & Privacy area of the Candidate Portal, which starts a reviewed request rather than an instant, irreversible action.
13. Contact and complaints
Privacy queries and rights requests: [TO CONFIRM: a monitored privacy contact address — a role address such as [email protected] is recommended, but must not be published as real until it is confirmed to exist and be monitored. General enquiries can currently be sent to [email protected].]
You also have the right to complain to the UK's data protection regulator, the Information Commissioner's Office (ICO), at ico.org.uk/make-a-complaint, though we would welcome the chance to put things right first.
14. Changes to this notice
We will update the version number and effective date above whenever this notice changes materially, and keep a record of which version each user accepted.