← Back to home

Privacy Policy

Vecta Search Ltd · Issued: August 2024

1. About this Privacy Policy

This privacy policy explains how Vecta Search Ltd collects, uses, and protects your personal information when you interact with us as a candidate, a client, or a visitor to our website.

We take your privacy seriously and are committed to handling your personal information in line with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

2. Who we are

Vecta Search Ltd (also referred to as "we", "us", and "our") is a recruitment agency providing recruitment and search services across the UK.

We are the data controller responsible for the personal information we hold about you.

We are not required to appoint a Data Protection Officer under UK GDPR, but Max Hodgson is the named contact for all data protection matters at Vecta Search Ltd.

If you have any questions about this policy or how we handle your information, please contact:

Max Hodgson
Email: max@vectasearchgroup.com

3. Information we collect

The information we collect depends on whether you are a candidate, a client, or a visitor to our website.

3.1 Candidate information

If you are a candidate, the personal information we may hold includes:

• Name, contact details, and address
• Date of birth
• CV and employment history
• Education and qualifications
• Right to work documentation (for example passport, visa, or share code)
• Salary history and expectations
• References
• Notes from interviews and conversations
• Job preferences such as location, role type, and sector
• LinkedIn profile and other professional online profiles
• National Insurance number (only where needed for placement or payroll)
• Bank details (only where needed for payment on contract or temporary placements)

3.2 Client information

If you are a client, or a contact at a client business, the information we may hold includes:

• Name, job title, and contact details
• Company name and registered address
• Notes from meetings, calls, and email correspondence
• Records of vacancies, candidate submissions, and placements
• Billing and invoicing details
• Marketing preferences

3.3 Website visitor information

When you visit vectasearchgroup.com we may collect:

• IP address
• Device and browser type
• Pages visited and how you navigate the site
• Information you submit through contact forms or applications
• Cookie data (see section 12)

3.4 Special category data

Special category data is sensitive information that needs extra protection. We only process this type of information where it is strictly necessary, and we always have an additional lawful basis for doing so. Examples include:

• Health information, for example a disability or accessibility requirement that is relevant to a role
• Information needed for equality monitoring such as ethnicity or gender
• Criminal records data, only where it is required for the role and with your consent

We do not collect special category data unless it is necessary, and we will always tell you why we are asking for it. The specific conditions we rely on for processing this type of data are set out in section 5.5.

4. How we collect your information

We collect personal information in a number of ways:

• Directly from you, for example when you send us your CV, apply for a role, contact us through our website, or speak to us by phone or email
• From job boards and professional networks such as LinkedIn, Indeed, CV-Library, Reed, and similar platforms where you have made your details available for recruiters to view
• From referrals within our network, where someone has recommended you for a role
• From third party data providers that supply business contact information
• From clients, for example when they share information about hiring contacts
• Through our website, including cookies and analytics tools

Where we collect your information indirectly, we will let you know within a reasonable period (and within one month at the latest) how we are using it.

5. How we use your information

We use your personal information to provide recruitment services, run our business, and meet our legal obligations. For each use, we rely on a lawful basis under UK GDPR. The main bases we rely on are:

5.1 Legitimate interests

We use your information where it is in our legitimate business interests to do so, and where those interests are not overridden by your rights. Examples include:

• Identifying candidates suitable for our clients' roles
• Contacting candidates about relevant opportunities
• Maintaining records of our recruitment activities
• Sharing candidate details with clients with your knowledge
• Building and maintaining our network of candidates and clients
• Understanding how our website is used and improving it

We have carried out a Legitimate Interests Assessment for these activities to make sure our interests are balanced against your rights. You can request a summary of the assessment by contacting us using the details in section 14.

5.2 Contract

We use your information where it is necessary to take steps at your request before entering into a contract, or to perform a contract with you. Examples include:

• Submitting your CV to a client after you have agreed to it
• Arranging interviews
• Managing the offer and onboarding process
• Providing services to clients under our terms of business

5.3 Legal obligation

We process some information to meet our legal and regulatory duties. Examples include:

• Verifying right to work
• Keeping records for tax and accounting purposes
• Complying with employment and recruitment legislation

5.4 Consent

Where we rely on consent (for example for certain marketing communications, processing special category data, or contacting you about specific roles in some cases), you can withdraw your consent at any time by emailing max@vectasearchgroup.com.

5.5 Special category and criminal records data

Where we process special category data (for example health information, ethnicity, or other sensitive data), we always have an Article 6 lawful basis (usually legitimate interests, contract, or consent) and an additional condition under Article 9 of UK GDPR. The specific conditions we rely on are:

• Employment, social security, and social protection law: Article 9(2)(b) and Schedule 1 Part 1 of the Data Protection Act 2018, for example to verify right to work, manage health and safety, or support reasonable adjustments
• Equality of opportunity or treatment: Article 9(2)(g) and Schedule 1 Part 2 paragraph 8 of the Data Protection Act 2018, where we process diversity data for monitoring purposes
• Explicit consent: Article 9(2)(a), where you have given clear, specific consent
• Legal claims: Article 9(2)(f), where information is needed to establish, exercise, or defend a legal claim

Where we process information about criminal convictions or offences (for example for vetted roles or DBS checks), we do so under Article 10 of UK GDPR with a condition under Schedule 1 of the Data Protection Act 2018, and only where the role requires it.

6. Sharing your information

We do not sell your personal information. We share it only where necessary, and with appropriate safeguards in place. We may share it with:

• Clients, where we believe you may be suitable for a role and you have agreed to your details being shared. We will always tell you which client we are submitting you to before we do so.
• Service providers that help us run our business, including our CRM provider Bullhorn, IT, hosting, and email providers, accountants, auditors, and legal advisors, marketing and communications platforms, and background check or right to work verification providers where relevant.
• Regulators and authorities where required by law, for example HMRC or the ICO
• Professional advisors such as solicitors or insurers, where needed
• Buyers or successors if our business is sold or restructured

All third parties we work with are required to handle your information in line with data protection law and only for the purposes we agree.

7. International transfers

We are based in the UK and primarily store and process information in the UK. Some of our service providers may store data in other countries, for example in the EU or the US. Where this happens we make sure appropriate safeguards are in place, such as:

• Transfers to countries the UK has deemed to provide an adequate level of protection
• Standard Contractual Clauses or the UK International Data Transfer Agreement
• Other safeguards required under UK GDPR

If you would like more information about international transfers and the safeguards we use, please get in touch.

8. How long we keep your information

We only keep your personal information for as long as we need it. The exact retention period depends on the type of data and the relationship we have with you. As a general guide:

• Candidate records: up to 6 years from our last meaningful contact with you. After this period we will either delete your record or contact you to ask if you want to stay on file.
• Placed candidates: up to 6 years from the end of the placement, to manage the placement, meet contractual obligations to clients, and protect against potential legal claims.
• Client and contact records: for the duration of our business relationship and for up to 6 years after our last meaningful contact, to manage ongoing matters and protect against potential legal claims.
• Financial and tax records: at least 6 years from the end of the relevant financial year, in line with HMRC requirements.
• Right to work documents: for the duration of employment or placement and for 2 years afterwards, in line with Home Office guidance.
• Website analytics and cookies: as set out in section 12.

If you would like us to remove your information sooner, get in touch using the details in section 14.

9. How we keep your information secure

We take the security of your personal information seriously and use appropriate technical and organisational measures to protect it. These include:

• Storing data in secure, password protected systems
• Using encrypted connections where appropriate
• Restricting access to personal data to those who need it
• Training our staff on data protection
• Regularly reviewing our security practices

No system is completely secure, but we do our best to reduce the risk and respond quickly if anything goes wrong.

In the unlikely event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will report it to the ICO within 72 hours of becoming aware of it, and we will notify you directly without undue delay where the breach is likely to result in a high risk to you.

10. Your rights

Under UK GDPR you have a number of rights in relation to your personal information:

• Right to be informed: to know how we use your data, which is what this policy is for
• Right of access: to request a copy of the personal information we hold about you
• Right to rectification: to ask us to correct any information that is inaccurate or incomplete
• Right to erasure: to ask us to delete your information in certain circumstances
• Right to restrict processing: to ask us to limit how we use your data in certain circumstances
• Right to data portability: to receive your data in a structured, machine readable format
• Right to object: to object to us processing your data for certain purposes, including direct marketing
• Rights relating to automated decision making: we do not currently use automated decision making or profiling that has legal or similarly significant effects on you

To exercise any of these rights, contact us at max@vectasearchgroup.com. We will respond within one month. There is no fee in most cases, but we may charge a reasonable fee or refuse a request that is clearly unfounded or excessive.

We may need to verify your identity before we can act on your request.

11. Marketing

We may send you information about roles, market updates, or our services. The basis we rely on depends on who you are:

• Individuals (including candidates): we rely on your consent under UK GDPR and the Privacy and Electronic Communications Regulations (PECR). We will only send you marketing where you have opted in, or where the soft opt-in rules apply.
• Business contacts at client companies: we rely on legitimate interests, in line with PECR rules for B2B marketing. You can opt out at any time.

You can opt out of marketing at any time by:

• Clicking the unsubscribe link in any marketing email
• Emailing max@vectasearchgroup.com
• Replying to a message and asking to be removed

Opting out of marketing does not stop us contacting you about specific roles you have applied for or other operational matters.

12. Cookies

Our website uses cookies and similar technologies to help the site work, understand how it is used, and improve your experience.

Cookies are small text files placed on your device when you visit a website. We use:

• Strictly necessary cookies: needed for the website to function
• Analytics cookies: to help us understand how visitors use our site
• Functional cookies: to remember your preferences

You can control cookies through your browser settings. If you turn off all cookies, parts of our website may not work properly.

13. Changes to this policy

We may update this privacy policy from time to time. The latest version will always be available on our website. Where the changes are significant, we will let you know by email or another suitable method.

This policy was issued in August 2024.

14. Contact us and complaints

If you have any questions about this policy, want to exercise your rights, or want to raise a concern, please contact:

If you are not happy with how we have handled your personal information, you have the right to complain to the Information Commissioner's Office (ICO):

We would always appreciate the chance to address your concerns directly before you contact the ICO, so please get in touch with us first if you can.