Privacy Policy

Last updated: [insert date]

1. Introduction

This Privacy Policy explains how Next Step Placements ("we", "us", or "our") collects, uses, discloses and protects your personal data when you use our employment and recruitment services in England, including our website, communication channels, and any related services (collectively, the "Services").

We are committed to complying with applicable data protection laws, including the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

By using our Services, you acknowledge that you have read and understood this Privacy Policy.

2. Data Controller

Next Step Placements is the data controller responsible for your personal data.

If you have any questions about this Privacy Policy or our data practices, you can contact us at:

Next Step Placements [Insert postal address in England] [Insert email address] [Insert telephone number]

3. Personal Data We Collect

We may collect and process the following categories of personal data, depending on how you interact with us and which Services you use.

3.1 Candidate Data If you are a job seeker or candidate, we may collect:

• Identification details (e.g. name, title, date of birth)
• Contact details (e.g. address, email address, phone number)
• CV / résumé information (e.g. education, work history, skills, qualifications, professional memberships)
• Job preferences (e.g. desired roles, locations, salary expectations, employment type)
• Right to work information (e.g. copies of identity documents, visa or work permit details, nationality) as required by law
• References and background information (e.g. reference checks, professional background, interview notes)
• Employment details relating to placements (e.g. job title, start date, work location, remuneration details where relevant)
• Communications data (e.g. emails, messages, notes of calls and meetings with you)
• Any other information you voluntarily provide to us in connection with your search for employment.

3.2 Client and Supplier Data If you are a client, hiring organisation, or supplier, we may collect:

• Identification and contact details of company representatives
• Professional details (e.g. job title, department)
• Billing and payment information (excluding full card details stored by payment providers where applicable)
• Details of vacancies, assignments, and contracts
• Communications and meeting notes.

3.3 Website and Usage Data When you visit our website or interact with our online platforms, we may collect:

• Technical information (e.g. IP address, browser type and version, device identifiers, operating system)
• Usage data (e.g. pages visited, time and date of visits, referral websites, clicks and interactions)
• Cookie data and similar tracking information (see section 10 – Cookies and Similar Technologies).

3.4 Special Category Data In limited circumstances, and only where necessary and lawful, we may process special category data, such as:

• Health-related information where relevant to your ability to work, workplace adjustments, or statutory requirements
• Information about criminal convictions or offences where required for certain roles, and only in accordance with applicable law.

We will only process special category data when we have a lawful basis and an additional condition under the UK GDPR, and we will apply additional safeguards.

4. How We Collect Your Data

We may collect personal data in the following ways:

• Directly from you, e.g. when you submit your CV or profile, complete a form, register on our website, email or call us, attend interviews, or provide documents
• From publicly available sources, e.g. professional networking sites (such as LinkedIn), job boards, company websites, online directories, and social media (when permitted by their terms and applicable law)
• From third parties, e.g. references from former employers, education institutions, background check providers (where lawful and appropriate), or from clients who share feedback about your performance
• From our clients, when they provide contact details of hiring managers or other employees
• Automatically, when you use our website or online tools, through cookies and similar technologies.

5. Legal Bases for Processing

We process your personal data only when we have a lawful basis under the UK GDPR, including:

• Contract: where processing is necessary to enter into or perform a contract with you (e.g. supplying recruitment services to you as a candidate or client)
• Legal obligation: where we must comply with legal or regulatory requirements (e.g. right to work checks, record-keeping duties)
• Legitimate interests: where processing is necessary for our legitimate interests or those of a third party, and your interests and fundamental rights do not override those interests (e.g. matching candidates with job opportunities, improving our Services, ensuring network and information security)
• Consent: where we rely on your explicit consent for specific processing activities (e.g. some marketing communications, certain types of special category data). You can withdraw consent at any time (see section 11).

6. How We Use Your Personal Data

We may use your personal data for the following purposes:

6.1 For Candidates

• To evaluate your suitability for roles and opportunities
• To register you as a candidate and create your profile in our systems
• To match you with job vacancies and assignments, and to recommend you to clients
• To contact you regarding vacancies, interviews, offers, and placement updates
• To manage placements, including onboarding, compliance checks, and ongoing liaison
• To carry out right to work checks, background checks, and other screening as required by law or client policy
• To respond to your enquiries and provide support.

6.2 For Clients and Suppliers

• To provide and manage recruitment and placement services
• To communicate about vacancies, candidate profiles, and contractual matters
• To manage accounts, invoicing, and payment
• To maintain our business relationship.

6.3 General Purposes

• To operate, maintain, and improve our website and Services
• To analyse service performance and usage for internal reporting and planning
• To comply with applicable laws, regulations, and legal processes
• To protect our rights, property, systems, and the safety of our users and third parties
• To send you service-related communications and, where permitted, marketing communications (see section 9).

7. Sharing Your Personal Data

We may share your personal data with the following categories of recipients, only to the extent necessary and with appropriate safeguards:

• Potential and existing clients (employers and hiring organisations) for the purposes of introducing you as a candidate, arranging interviews, and managing placements
• Third-party service providers who process data on our behalf, such as IT service providers, hosting providers, CRM systems, communication platforms, payroll or accounting services, background check agencies (where lawful), and professional advisors (e.g. legal and accounting)
• Regulatory and governmental authorities, law enforcement agencies, or courts where required by law or to protect our legal rights
• Any third party in connection with a business transaction such as a merger, acquisition, or sale of assets, in which case personal data will be transferred under appropriate safeguards.

We do not sell your personal data.

8. International Transfers

Your personal data is primarily processed in the United Kingdom. However, in some cases, it may be transferred to and processed in countries outside the UK, for example where:

• Our clients, candidates, or service providers are located outside the UK; or
• Our IT or cloud service providers store or process data in other jurisdictions.

Where we transfer personal data outside the UK, we will ensure that appropriate safeguards are in place, such as:

• An adequacy regulation by the UK Government confirming that the destination country provides an adequate level of data protection; or
• Standard Contractual Clauses or equivalent contractual protections approved under UK data protection law.

You may contact us for more information about international transfers and the safeguards used.

9. Marketing Communications

We may use your contact details to send you information about:

• Job opportunities or assignments that may interest you (for candidates)
• Candidates and recruitment services that may be relevant to your organisation (for clients)
• News, updates, or events related to employment and recruitment.

We will only send you electronic marketing communications where permitted by law and, where required, with your consent. You can opt out of marketing at any time by:

• Clicking the "unsubscribe" link in our emails; or
• Contacting us using the details in section 2.

Opting out of marketing communications does not affect service-related communications necessary for our relationship with you.

10. Cookies and Similar Technologies

We may use cookies and similar technologies on our website to:

• Enable core site functionality
• Remember your preferences and improve user experience
• Analyse traffic and usage patterns
• Support security and performance.

You can usually configure your browser to refuse all or some cookies, or to alert you when websites set or access cookies. If you disable or refuse cookies, some parts of our website may not function properly.

Where required by law, we will request your consent before using non-essential cookies.

11. Your Data Protection Rights

Under the UK GDPR, you have certain rights regarding your personal data, subject to conditions and limitations:

• Right of access: to obtain confirmation of whether we process your data and to receive a copy of your personal data
• Right to rectification: to have inaccurate or incomplete data corrected
• Right to erasure: to request deletion of your personal data where there is no longer a valid reason for us to retain it
• Right to restriction: to request that we restrict the processing of your data in certain circumstances
• Right to data portability: to receive your personal data in a structured, commonly used, machine-readable format and to transmit it to another controller, where technically feasible and lawful
• Right to object: to object to certain processing, including processing based on legitimate interests and direct marketing
• Rights related to automated decision-making: to not be subject to decisions based solely on automated processing (including profiling) that produce legal or similarly significant effects, unless certain conditions are met.

To exercise your rights, please contact us using the details in section 2. We may need to verify your identity before responding to your request.

You also have the right to lodge a complaint with the UK supervisory authority:

Information Commissioner's Office (ICO) www.ico.org.uk

We encourage you to contact us first so we can try to resolve any concerns.

12. Data Retention

We retain personal data only for as long as necessary for the purposes described in this Privacy Policy and to comply with legal, regulatory, and contractual requirements.

In general:

• Candidate data is retained while we have an active relationship with you and for a reasonable period thereafter, to consider you for future opportunities and to meet legal and business requirements
• Client and supplier data is retained for the duration of our relationship and for a reasonable period afterwards, particularly for tax, accounting, and contractual purposes.

We will periodically review the personal data we hold and securely delete or anonymise it when it is no longer needed.

13. Security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, alteration, or disclosure. These measures may include access controls, encryption, secure storage, and staff training.

However, no system can be completely secure. Transmission of information via the internet is not entirely risk-free, and you provide data at your own risk. We encourage you to use secure methods when sharing sensitive information.

14. Children’s Data

Our Services are not intended for children, and we do not knowingly collect personal data from individuals under the age of 16 for recruitment purposes. If you believe that a child has provided us with personal data, please contact us so that we can delete it where appropriate.

15. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or services. The updated version will be posted on our website with a new "Last updated" date.

We encourage you to review this Privacy Policy periodically to stay informed about how we handle your personal data.

16. Contact

If you have any questions, concerns, or requests regarding this Privacy Policy or our handling of your personal data, please contact us at the details provided in section 2.