Privacy policy

1. About this privacy policy

Adeptus Talent Limited (“Adeptus”, “we”, “us” or “our”) is a recruitment business operating in the United Kingdom. We act as a data controller when we decide why and how personal data is processed in connection with our recruitment and business activities.

This policy explains what personal data we collect, where it comes from, why and how we use it, who we may share it with, how long we keep it, and the rights individuals may have under applicable data protection law.

This policy applies to candidates and prospective candidates, placed candidates, clients and their contacts, suppliers, referees, emergency contacts, prospective employees and current employees, where relevant.

2. Our contact details

• Organisation: Adeptus Talent Limited
• Registered address: Channel Court, Hill Road, Clevedon, England, BS21 7NE
• Company number: 15953813
• Email: info@adeptustalent.co.uk

3. The personal data we may collect

Depending on your relationship with us and the services involved, we may collect the following categories of personal data:

• Identity and contact details, such as name, address, email address, telephone number, date of birth and photograph.
• Recruitment and career information, such as CVs, employment history, qualifications, skills, experience, professional references, interview notes, job preferences, availability and professional profile links (for example, LinkedIn).
• Identity and right-to-work information, such as passport, visa or other documents and information needed to verify identity and eligibility to work in the United Kingdom, where Adeptus is required or authorised to carry out the relevant check. The party legally responsible for the check and the records to be retained will depend on the placement and engagement arrangements.
• Financial and business information, only where relevant to a particular service or business relationship. Adeptus does not routinely collect candidates’ bank details or National Insurance numbers for its mainly permanent recruitment placements.
• Referee information, such as referees’ names, professional relationship to the candidate and contact details. We normally obtain referee details from candidates and pass those details to the relevant client or prospective employer so that the client can carry out its own reference checks. Adeptus does not normally carry out the reference checks itself. We use and share referee details only for the relevant recruitment purpose and retain them only for as long as necessary.
• Communications and preferences, including information you provide by telephone, email, website, onboarding forms or other correspondence, and records of our interactions with you.
• Special category data, Adeptus Talent Limited does not routinely request or intentionally collect special category personal data as part of its normal recruitment activities. However, candidates may occasionally provide information of this nature within their CVs or other communications. Where this happens, we will only process such information where necessary, lawful and supported by an appropriate condition under applicable data protection legislation. Any information that is not required for our recruitment services will not be retained unnecessarily.
• Criminal offence data, Adeptus Talent Limited does not routinely collect or process criminal offence data or information relating to criminal convictions as part of its normal recruitment activities. Where a client independently carries out criminal record checks as part of its own recruitment or screening process, the client is responsible for ensuring that such checks are conducted lawfully and in accordance with applicable data protection legislation.

4. Where personal data comes from

We may obtain personal data:

• Directly from you, including through your CV, application, telephone calls, emails, website contact forms and CV-upload facility, interviews and onboarding forms. CVs and other website form submissions are stored on the website hosting infrastructure provided by Krystal. Herron has administrative access for website management and technical support. Email notifications are delivered through Amazon Web Services Simple Email Service (Amazon SES) to configured recipients and their email providers; where enabled, CVs may be included as email attachments.
• From publicly available sources and professional platforms, such as LinkedIn, corporate websites and publicly available business records.
• From job boards and recruitment platforms, including CV-Library and other platforms on which you have chosen to make information available.
• From current or former employers, referees and other people you have asked to provide information about you.
• From clients, suppliers, background-screening providers, qualification-checking providers, credit-reference providers or other third parties, where relevant and lawful.

Where we obtain personal data from a source other than the individual, we will provide the required privacy information within the period required by law, unless a relevant legal exception applies.

5. Why we use personal data

We use personal data for purposes that may include:

• Providing recruitment services and managing our relationship with candidates, clients, suppliers and business contacts.
• Assessing candidate suitability for roles and matching candidates with relevant vacancies.
• Contacting candidates about roles, opportunities, interviews, placements and recruitment-related services.
• Sharing relevant candidate information with a client in connection with a potential role, interview, placement or assignment.
• Verifying identity, qualifications, employment history, references and right to work, and completing appropriate pre-engagement checks.
• Managing onboarding, assignments, employment or engagement administration, and payment processes where applicable.
• Responding to enquiries, providing requested information and managing complaints or data-protection requests.
• Maintaining business records, protecting our systems, preventing fraud, establishing or defending legal claims, and complying with legal or regulatory obligations.
• Improving and managing our recruitment services and business operations.

6. Our lawful bases for processing

We must have a lawful basis for each purpose for which we process personal data. Depending on the circumstances, the lawful basis may be:

• Contract or steps before entering into a contract: where processing is necessary to take steps at your request before entering into a contract, or to perform a contract with you.
• Legal obligation: where processing is necessary for us to comply with a legal obligation.
• Legitimate interests: where processing is necessary for our legitimate interests or those of a third party, provided those interests are not overridden by your rights and interests. Our interests may include operating a recruitment business, matching candidates to vacancies, communicating about relevant opportunities, maintaining business records and protecting our services.
• Consent: where we have asked for your consent for a specific purpose. Where we rely on consent, you can withdraw it at any time. Withdrawal does not affect processing carried out before withdrawal.

In general, we expect to rely on the following bases, depending on the circumstances: (a) steps at your request before entering into a contract, where you ask us to help you find a role; (b) our legitimate interests in sourcing candidates, assessing suitability, matching candidates with roles, making relevant recruitment introductions, maintaining business records and operating a recruitment business; (c) contract where processing is necessary to perform a contract with a client, supplier or other business contact; and (d) legal obligation where processing is necessary to meet a legal requirement. We will identify the appropriate basis for the particular activity and will not assume that one basis applies to everything. Where we rely on legitimate interests, we will consider and document the relevant interests, necessity and balancing test. We may also rely on consent for a separate, optional purpose where consent is the appropriate basis; you may withdraw that consent at any time. A candidate’s permission for us to send their identifiable CV or details to a particular client is a separate recruitment confidentiality and submission permission. It does not, by itself, mean that our general processing of the candidate’s personal data is based on GDPR consent.

7. Special category and criminal offence data

Special category data is particularly sensitive personal data, such as information about health, racial or ethnic origin, religious or philosophical beliefs, political opinions, trade union membership, genetic data, biometric data used for identification, or sex life or sexual orientation.

We will only process special category data where it is necessary, an applicable Article 9 condition under the UK GDPR is met, and any additional requirements under the Data Protection Act 2018 are satisfied. We will identify and document the relevant condition and safeguards.

Criminal offence data is subject to separate legal restrictions. We will only process it where an applicable legal basis and condition are met.

8. Who we share personal data with

We may share relevant personal data, where necessary and lawful, with:

• Clients and prospective hiring organisations, for candidate introduction, recruitment, interviews, placement, onboarding and relevant screening.
• Clients and prospective employers, including referee contact details supplied by a candidate where the client needs those details to carry out its own reference checks.
• Service providers supporting our business, including Firefish (our recruitment CRM); Microsoft 365/Outlook and OneDrive; Herron, which manages our website hosting, maintenance and technical support; Krystal, which provides UK-based website hosting; Amazon Web Services Simple Email Service (Amazon SES), which delivers website form and CV-upload notifications to configured email recipients and their email providers; Google reCAPTCHA v3, which processes visitor information to protect forms against spam and automated abuse; Google Analytics 4, deployed through Google Tag Manager and configured to activate only after analytics-cookie consent; CookieYes, which manages website cookie preferences; and our professional advisers.
• Website and online-service providers, including Herron (website management, hosting administration, maintenance and technical support), Krystal (UK website hosting), Amazon Web Services Simple Email Service (delivery of website submission notifications), Google (reCAPTCHA v3 for form security and Google Analytics 4 through Google Tag Manager, subject to analytics-cookie consent), and CookieYes (cookie preference management). These providers may process personal data on our behalf or in accordance with their own terms, depending on the service and their role.
• Regulators, law-enforcement bodies, courts or other parties where disclosure is required by law or necessary to establish, exercise or defend legal claims.

We require service providers processing personal data on our behalf to protect it and use it only in accordance with our instructions and applicable law. We may introduce candidates to prospective UK clients, including by making speculative introductions where we believe a candidate may be suitable for a potential opportunity. We will obtain the candidate’s prior permission before disclosing their identifiable CV or other identifying candidate information to a client. Where practicable, we will tell the candidate the client’s identity and the relevant role or opportunity before making each identifiable submission. Permission for one submission should not be treated as permission for unrelated submissions to other clients. We will record the permission and the relevant client/role in Firefish. Where we make an initial anonymous approach, we will remove information that could reasonably identify the candidate and will obtain permission before sending an identifiable CV. Where a candidate gives us a referee’s personal details, we use those details to support the relevant recruitment process and may pass them to the relevant client so that the client can conduct its own reference checks. We will make this privacy policy or the relevant privacy information available to the referee and, where required, actively provide it within the time required by law. Where we obtain a referee’s details from someone other than the referee, this will normally be within one month of obtaining the details, or earlier if we first contact the referee or disclose their details to the client. The client is responsible for explaining its own processing when it receives and uses referee information. We normally receive referee contact details from the candidate and pass those details to the relevant client; the client then contacts the referee and carries out its own reference checks. We do not normally contact referees ourselves. We will make the relevant privacy information available to referees and, where required, provide it within the time required by law. Where we obtain referee details from a candidate, the information will normally be provided within one month, or earlier if we first contact the referee or disclose the details to the client. The client is separately responsible for explaining its own processing when it receives and uses referee information.

9. International transfers

Adeptus’s recruitment activity is focused on the United Kingdom and is mainly for permanent roles. Adeptus currently uses Firefish as its sole recruitment CRM. Our website is hosted by Krystal on a UK server. Herron manages the website’s hosting, maintenance and technical support and has administrative access. Website form and CV-upload submissions are stored on the website hosting infrastructure and notifications are delivered using Amazon Web Services Simple Email Service. Google reCAPTCHA v3, Google Analytics 4 (through Google Tag Manager) and CookieYes are also used on the website for the purposes described in this policy.

Where personal data is transferred outside the United Kingdom, we will ensure that the transfer is permitted under applicable data protection law and that an appropriate safeguard is in place, such as UK adequacy regulations, the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, or another permitted transfer mechanism. You can contact us at info@adeptustalent.co.uk for further information about relevant safeguards.

10. How long we keep personal data

Adeptus Talent Limited will only retain personal information for as long as reasonably necessary for the purposes for which it was collected, including to meet legal and regulatory obligations.

As a recruitment business, we will apply the following retention approach:

• Candidate records: We will retain relevant recruitment records for at least 12 months after their creation and, where required, for at least 12 months after the date we last provided work-finding services to the candidate.
• Unsuccessful candidates: We will retain relevant records for the legally required period and review whether any further retention is necessary.
• Active candidates: We will retain candidate information while we are actively providing recruitment services and periodically review inactive records.
• Placed candidates: We will retain relevant recruitment records in accordance with our legal and regulatory obligations.
• Client and supplier information: We will retain information for as long as necessary to manage our business relationships and meet our legal obligations.
• Referee information: We will retain referee contact details only for as long as necessary to complete the relevant recruitment and reference process.
• Identification documents: Any passport, visa or right-to-work information held by us will only be retained where necessary and for the applicable lawful retention period.

We will periodically review the personal information held within our Firefish recruitment CRM and other business systems. Information that is no longer required will be securely deleted or anonymised, subject to any legal requirement to retain it.

Where information is held in email accounts, archived records or system backups, we will take reasonable steps to ensure it is deleted in accordance with our retention and data deletion procedures.

11. How we protect personal data

We use appropriate technical and organisational measures designed to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access. The measures may include access controls, secure systems, staff confidentiality obligations, supplier controls, backups and security monitoring, as appropriate to the risks.

No method of transmitting or storing information is completely secure. We review our safeguards and take reasonable steps to address identified risks.

12. Your data protection rights

Depending on the circumstances and subject to applicable legal exceptions, you may have the right to:

• Be informed about how your personal data is used.
• Request access to your personal data and receive a copy of it.
• Ask us to correct inaccurate or incomplete personal data.
• Ask us to erase personal data in certain circumstances.
• Ask us to restrict the processing of personal data in certain circumstances.
• Object to processing based on legitimate interests and to direct marketing.
• Receive certain personal data in a structured, commonly used and machine-readable format, and ask us to transmit it to another controller where the right to data portability applies.
• Withdraw consent at any time where we rely on consent. This will not affect the lawfulness of processing before withdrawal.

These rights are not absolute and may not apply in every situation. We may need to verify your identity before responding. We will respond within the time limit required by law, generally one month, subject to any lawful extension or applicable exception.

To exercise a right, contact us at info@adeptustalent.co.uk and explain what you would like us to do. You do not normally have to pay a fee to exercise your rights.

13. Direct marketing and recruitment communications

We may contact existing candidates and business contacts about roles, opportunities and recruitment services that may be relevant to their professional interests, where permitted by applicable data protection and electronic marketing rules. The rules can depend on the communication channel and the circumstances, and we will not assume that a UK GDPR lawful basis alone is sufficient to permit an email, text or other electronic marketing message. You can object to direct marketing or ask us to stop marketing communications at any time by using any unsubscribe facility provided or by contacting info@adeptustalent.co.uk. Even if you opt out of marketing, we may still send service-related or administrative communications where necessary.

14. Automated decision-making and profiling

We may use AI-assisted features available within our recruitment CRM, Firefish, to support aspects of recruitment administration and candidate-related work. Our staff review relevant information and remain responsible for recruitment decisions, including suitability, shortlisting and selection. We do not make decisions about you based solely on automated processing, including profiling, that produce legal or similarly significant effects.

15. Cookies and website technologies

Our website and associated online services may use cookies and similar technologies to ensure that they operate effectively and provide a good user experience.

Cookies are small text files stored on your device when you visit a website. They may be used to support website functionality, remember preferences and improve the operation of our online services.

Our website uses cookies and similar technologies. CookieYes manages visitors’ cookie preferences. Information about the cookies in use is provided on our Cookies page: https://adeptustalent.co.uk/cookies. The cookie inventory on that page may be updated as the website and its services change.

Google Analytics 4 is installed through Google Tag Manager and is configured to activate only after a visitor consents to analytics cookies. We do not currently use Meta Pixel or LinkedIn Insight Tag. Necessary cookies, including cookies used to remember cookie choices and support website security, may operate before consent where permitted. Google reCAPTCHA v3 is used to protect website forms against spam and automated abuse and processes visitor information for that purpose. Please refer to our Cookies page for the current cookie list and purposes.

You can change or withdraw your cookie choices using the cookie controls provided through CookieYes on our website. You may also manage cookies through your browser settings, although blocking necessary cookies may affect website functionality. We will ensure that non-essential cookies and similar technologies are not activated before the required consent has been obtained.

16. Complaints

If you have a concern about how we use your personal data, please contact us first at info@adeptustalent.co.uk so that we can try to resolve it.

You also have the right to complain to the Information Commissioner’s Office (ICO), the UK’s data protection regulator:

Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

Website: https://ico.org.uk/

17. Changes to this policy

We may update this policy from time to time to reflect changes in our business, systems, services or legal requirements. We will make the updated version available and, where required, bring material changes to the attention of affected individuals.