Privacy Policy

1.1 Information you give us directly

1.2 Information collected automatically

When you visit the Site, our hosting provider and embedded third-party services may automatically receive limited technical information, including IP address, browser type, device type, referring page and pages viewed.

Our scheduling tool (Cal.com) is embedded on the Site and sets its own cookies when you interact with it; its use of that information is governed by Cal.com's own privacy policy.

We do not operate advertising trackers on the Site and we do not use the Site to build advertising profiles.

1.3 Information we obtain from other sources

This section is most relevant to Candidates. In the ordinary course of recruitment we obtain professional information about individuals from:

• Publicly available professional networking platforms and profiles (for example LinkedIn)
• Publicly available professional directories, firm websites, licensing registries and industry publications
• Referrals from mutual professional contacts
• Employers, in relation to roles they ask us to fill
• Job boards where you have posted your CV or profile
• Referees, where you have provided their details

The information we obtain in this way is limited to professional information — name, employer, job title, professional history, qualifications and business contact details. We do not seek out or knowingly collect information about your private life from these sources.

Where we obtain your data from a source other than you, we will tell you the source at or before our first substantive contact with you.

1.4 Information we do not collect

We do not request or knowingly collect Social Security numbers, National Insurance numbers, government identification numbers, financial account details, precise geolocation, biometric data, information about race, ethnicity, religion, sexual orientation or political affiliation.

Please do not send us this information. If you send it to us unsolicited, we will delete it.

1.5 Special category and sensitive data

Recruitment can involve information that qualifies as special category data under UK GDPR, including health or disability information (for example, to arrange interview adjustments), and criminal conviction data (for roles requiring DBS checks or security clearance).

We only process special category data where you have provided it voluntarily and given explicit consent, or where processing is necessary under employment law (for example, right-to-work or health and safety requirements), or where permitted under Schedule 1 of the Data Protection Act 2018. We do not require you to provide special category data. Where you choose to share it, we will explain how we intend to use it and on what basis.

For criminal offence data, we process this only where permitted by UK law and where necessary for assessing suitability for a specific role.

We use personal information to:

• Identify and evaluate individuals who may be suitable for roles we are engaged to fill
• Contact Candidates about potential opportunities and discuss their career objectives
• Present Candidates to Clients, with the Candidate's knowledge (see Section 4)
• Provide recruitment services to Clients, including intake, search, shortlisting and offer support
• Schedule, hold and follow up on calls and meetings
• Maintain our records of Client and Candidate relationships
• Respond to enquiries received through the Site
• Verify eligibility to work where legally required
• Send marketing communications where you have opted in (see Section 5)
• Operate, secure and improve the Site
• Comply with legal obligations and enforce our agreements

We do not use personal information for automated decision-making that produces legal or similarly significant effects without human involvement. A person reviews every Candidate we put forward. If we introduce automated decision-making or profiling in the future, we will update this policy and notify affected individuals.

Under UK GDPR, we rely on the following lawful bases:

Where we rely on legitimate interests, we have conducted a balancing assessment to ensure our interests do not override your rights and freedoms. You can request details of these assessments by contacting us.

You may withdraw consent at any time where consent is our lawful basis. Withdrawal does not affect the lawfulness of processing before withdrawal.

This is the most important data-sharing decision in recruitment, so we want to be specific.

Before we share your details with a specific employer:

• We will tell you which employer we are submitting you to and for which role before we share your full CV or identifying details
• You can tell us not to submit you to a particular employer and we will respect that
• We may initially share an anonymised or redacted summary of your profile (without your name, contact details or employer names) with a Client to gauge interest before sharing full details
• Full details (name, CV, contact information) are shared only after we have confirmed with you that you are happy to be put forward

We do not circulate Candidate profiles speculatively to firms that have not asked for them.

After your details are shared:

• The prospective employer becomes an independent data controller for the information we share with them
• We ask employers not to retain Candidate information beyond the recruitment process for the specific role, but we cannot guarantee their compliance
• Your CV may contain personal contact details — if you prefer, we can submit a version with direct contact details removed so all communication goes through us

Because we recruit across the UK, US and Canada, your details may be shared with employers in those countries. See Section 7 for the safeguards we apply.

We will only send you marketing communications (job alerts, newsletters, market updates) where you have given explicit consent, or where you are an existing Client and the marketing relates to similar services and you have not opted out (soft opt-in under PECR).

Every marketing communication includes an unsubscribe option. You can also opt out at any time by contacting us.

We disclose personal information only as follows:

• To Clients — Candidate profiles and CVs, as described in Section 4.
• To Candidates — Client role information (company name, role details, salary range), where relevant to a potential opportunity.
• To service providers — third parties who process personal information on our behalf and under contract, in the following categories: cloud hosting and infrastructure, applicant tracking and CRM systems, email and communication platforms, calendar and scheduling tools, website analytics, payment and invoicing. These providers are permitted to use personal information only to provide services to us. A full list of our current processors is available on request.
• To professional advisers — solicitors, accountants or auditors where necessary.
• For legal reasons — where required by law, subpoena or other legal process, or where we believe disclosure is necessary to protect our rights, your safety or the safety of others.
• In a business transaction — if we are involved in a merger, acquisition, financing or sale of assets, personal information may be transferred as part of that transaction, subject to this policy.

We do not sell personal information. We do not share personal information for cross-context behavioural advertising. We have not done so in the preceding twelve months.

Because we recruit across the UK, US and Canada, your personal data may be transferred to and processed in those countries.

Where we transfer personal data outside the UK, we use a legally recognised transfer mechanism appropriate to the recipient and circumstances. This may include:

• UK adequacy regulations, where the UK government has determined that the destination country provides an adequate level of data protection
• The UK International Data Transfer Agreement (IDTA) or UK Addendum to the EU Standard Contractual Clauses, together with any required transfer risk assessment and supplementary measures
• The UK Extension to the EU-US Data Privacy Framework, where the US recipient is a qualifying participant

We do not rely on any single mechanism as a blanket justification. We assess each transfer individually. You can request details of the specific safeguards applied to any transfer by contacting us.

At the end of the applicable period, data is securely deleted or irreversibly anonymised. Where data is held across multiple systems, deletion is applied across all systems within a reasonable period.

You can ask us to delete your data at any time — see Section 9.

You have the right to:

• Access the personal data we hold about you
• Correct inaccurate or incomplete data
• Delete your data in certain circumstances ("right to be forgotten")
• Restrict processing in certain circumstances
• Object to processing based on legitimate interests, or to direct marketing
• Data portability — receive your data in a structured, machine-readable format
• Withdraw consent at any time where processing is based on consent

To exercise any of these rights, contact us at privacy@procruit.co.uk. We will respond within one calendar month. In complex cases we may extend by a further two months, but we will tell you within the first month if an extension is needed and why.

If you are unhappy with how we have handled your data, you have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk or by calling 0303 123 1113.

If you are in Canada, we handle your personal information in accordance with the Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial privacy laws.

• Accountability: Our Data Protection Contact (see the top of this policy) is accountable for our compliance with PIPEDA. Complaints should be directed to them in the first instance.
• Consent: We obtain your meaningful consent before collecting, using or disclosing your personal information. We will explain what we are collecting, why, and who will receive it. We obtain your consent before sharing your profile or CV with a prospective employer.
• Withdrawal: You may withdraw consent at any time by contacting us. If you withdraw consent, we will stop representing you for new roles. We will explain the consequences of withdrawal at the time.
• Your rights: request access to the personal information we hold about you; challenge the accuracy of your information and request correction; know who your information has been disclosed to; challenge our compliance with PIPEDA.

We will respond to requests within 30 days.

Storage and transfer: Your information may be stored or processed outside Canada, including in the UK and the United States, where it may be subject to lawful access requests by local authorities. We apply the transfer safeguards described in Section 7.

Complaints: If you are not satisfied with our response, you may file a complaint with the Office of the Privacy Commissioner of Canada at priv.gc.ca.

If you are in Quebec, the following additional provisions apply under Quebec's Act respecting the protection of personal information in the private sector (Law 25):

• We will conduct a privacy impact assessment before implementing any new processing activity involving your personal information
• We will notify you and the Commission d'accès à l'information du Québec in the event of a confidentiality incident that presents a risk of serious injury
• You have the right to data portability — to receive your personal information in a structured, commonly used format

Complaints may be directed to the Commission d'accès à l'information du Québec at cai.gouv.qc.ca.

If you are a California resident, the California Consumer Privacy Act, as amended by the California Privacy Rights Act, gives you the following rights. The California employment-related information exemption expired on 31 December 2022 — Candidate and applicant information is fully covered.

Categories of personal information we collect:

We do not sell personal information. We do not share personal information for cross-context behavioural advertising. We have not done so in the preceding twelve months.

We do not collect sensitive personal information as defined by the CCPA.

Your California rights:

• Right to know: request the categories and specific pieces of personal information we have collected, the sources, our purposes, and the categories of third parties we disclose it to
• Right to delete: request deletion of your personal information, subject to statutory exceptions
• Right to correct: request correction of inaccurate personal information
• Right to opt out of sale or sharing: we do not sell or share personal information as those terms are defined by the CCPA. If this changes, we will update this policy and provide the required mechanism
• Right to non-discrimination: we will not deny you services, charge a different price, or provide a different level of service because you exercised any of these rights

Notice at collection: the categories of personal information we collect, the purposes for which we use them, and our retention periods are described in Sections 1, 2 and 8. We collect this information for the recruitment purposes described in Section 2 and for no other purpose.

Global Privacy Control: where your browser transmits a Global Privacy Control signal, we treat it as a valid request to opt out of sale and sharing for that browser.

If you are a resident of a state with a comprehensive consumer privacy law — including Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, Delaware, Iowa, Nebraska, New Hampshire, New Jersey, Minnesota, Maryland, Tennessee, Indiana, Kentucky or Rhode Island — you may have rights to access, correct, delete and obtain a portable copy of your personal information, and to opt out of targeted advertising, sale and certain profiling.

Right to appeal: if we decline your request, you may appeal by replying to our response or contacting us at privacy@procruit.co.uk. We will respond within the period required by your state's law, and if we deny the appeal we will provide a mechanism for contacting your state Attorney General.

Send your request to privacy@procruit.co.uk with the subject line "Privacy Request."

Tell us what you would like us to do and include enough information for us to locate your records — typically the name and email address we contacted you on. We will verify your identity by confirming the information you provide against our records; we may ask for additional information if we cannot reasonably verify you, and we will not use that information for any other purpose.

Response times: UK GDPR — within one calendar month (extendable by two months in complex cases). PIPEDA — within 30 days. CCPA/CPRA — within 45 calendar days (extendable by a further 45 days where reasonably necessary).

Authorised agents: an authorised agent may submit a request on your behalf with written proof of authorisation. We may contact you directly to confirm.

If you ask us to delete your information, we will remove it from our records and instruct our service providers to do the same. We cannot delete information held by third-party platforms we do not control, such as your own public LinkedIn profile.

We maintain administrative and technical safeguards designed to protect personal information, including access controls, encrypted transmission, role-based permissions, salted password hashing (we never store passwords in plain text), and vendor due diligence.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If we become aware of a personal data breach that is likely to result in a risk to your rights, we will notify the ICO and, where required, you, in accordance with UK GDPR.

The Site and our services are directed to working professionals. We do not knowingly collect personal information from anyone under 18. If you believe a minor has provided us with personal information, contact us and we will delete it.

Our website uses cookies and similar technologies. Full details are set out in our Cookie Policy, available from the Site footer.

We may update this policy from time to time. When we do, we will revise the "Last updated" date above. Material changes will be brought to the attention of Clients and active Candidates by email. The latest version will always be available at procruit.co.uk/privacy-policy.

Email: privacy@procruit.co.uk