Privacy Notice

Please select the correct link below, depending on how Deerfoot IT have collected your data, to find out how
Deerfoot IT store, process and handle your personal data. The email this document was attached to will
highlight if you approached us or we approached you initially:

1. Did you approach Deerfoot IT directly? – includes applying for an advert (either on the Deerfoot
website or third-party job board) or you making contact with us initially.

2. Did Deerfoot IT approach you initially?

1. Privacy Notice - Direct

The following applies to information collected directly from a candidate, this will include all methods whereby
a candidate approaches Deerfoot IT initially, including: applying to a job advertisement (both on the Deerfoot
IT website and / or third-party job board), emailing / calling / messaging Deerfoot IT or contacting us via a
social media network.

Company Name: Deerfoot IT Resources Ltd (‘the Company’)

Company Contact Deerfoot IT Head Office

details: Address: 10-11, Mortimers Park, Ower, Romsey, SO51 6AF
Telephone: 02380 813001
Data Protection Officer: Joshua Saunders – DPO@Deerfoot.co.uk

Topic: Data protection – For Information collected directly from the candidate

Date: 01st May 2018

Version: 1.0

The Company is a recruitment business which provides work-finding services to its clients and work-seekers. The
Company must process personal data (including sensitive personal data) so that it can provide these services –
in doing so, the Company acts as a data controller.

You may give your personal details to the Company directly, such as on an application or registration form or via
our website, or we may collect them from another source such as a job board. The Company must have a legal
basis for processing your personal data. For the purposes of providing you with work-finding services and/or
information relating to roles relevant to you we will only use your personal data in accordance with the terms
of the following statement.

1. Collection and use of personal data

a. Purpose of processing and legal basis

The Company will collect your personal data (which may include sensitive personal data) and will process your
personal data for the purposes of providing you with work-finding services. The legal bases we rely upon to offer
these services to you are:

Legitimate interest as per b. below. We rely on consent to transfer your data (application) to a potential
employer.
b. Legitimate interest

Where The Company has relied on a legitimate interest to process your personal data our legitimate interests
is/are as follows:

• To provide you, as a work seeker, with recruitment services

• To inform you, as a work seeker, of potential employment opportunities

c. Recipient/s of data

The Company will process your personal data and/or sensitive personal data with the following recipients, after
gaining consent from you:

• Existing clients and associated third parties of The Company (who are seeking to engagement and / or
employ the worker) – you will be notified of the end client organisation prior to transferring.

d. Statutory/contractual requirement

Your personal data is required by law and/or a contractual requirement (e.g. our client may require this personal
data), and/or a requirement necessary to enter into a contract. You are obliged to provide the personal data and
if you do not the consequences of failure to provide the data are:

• The Company will be unable to provide work related services to you.

2. Overseas Transfers

Should you be applying for a role outside of the European Economic Area (‘EEA’) The Company may transfer only
the information you provide to us to countries outside the (‘EEA’) for the purposes of providing you with work-
finding services. We will take steps to ensure adequate protections are in place to ensure the security of your
information. The EEA comprises the EU member states plus Norway, Iceland and Liechtenstein.

3. Data retention

The Company will retain your personal data only for as long as is necessary. Different laws require us to keep
different data for different periods of time.

The Conduct of Employment Agencies and Employment Businesses Regulations 2003, require us to keep work-
seeker records for at least one year from (a) the date of their creation or (b) after the date on which we last
provide you with work-finding services.

Where relevant, we must also keep your payroll records, holiday pay, sick pay and pensions auto-enrolment
records for as long as is legally required by HMRC and associated national minimum wage, social security and
tax legislation.

Where the Company has obtained your consent to process your personal and sensitive personal data (please
see section 6 below for the types of data we collect), we will do so in line with our retention policy (please see
section 7 below). Upon expiry of that period the Company will seek further consent from you. Where consent is
not granted the Company will cease to process your personal data and sensitive personal data by deletion.

4. Your rights

Please be aware that you have the following data protection rights:
• The right to be informed about the personal data the Company processes on you;
• The right of access to the personal data the Company processes on you;
• The right to rectification of your personal data;
• The right to erasure of your personal data in certain circumstances;
• The right to restrict processing of your personal data;
• The right to data portability in certain circumstances;
• The right to object to the processing of your personal data that was based on a public or legitimate interest;
• The right not to be subjected to automated decision making and profiling; and
• The right to withdraw consent at any time.

Where you have consented to the Company processing your personal data and / or sensitive personal data, you
have the right to withdraw that consent at any time by contacting The Company’s Data Protection Officer -
Joshua Saunders via email using DPO@deerfoot.co.uk or by phone on 02380 813001.

5. Complaints or queries

If you wish to complain about this privacy notice or any of the procedures set out in it please contact The
Company’s Data Protection Officer - Joshua Saunders via email using DPO@deerfoot.co.uk or by phone on 02380
813001.

You also have the right to raise concerns with Information Commissioner’s Office on 0303 123 1113 or at
https://ico.org.uk/concerns/, or any other relevant supervisory authority should your personal data be
processed outside of the UK, if you believe that your data protection rights have not been adhered to.

6. What information will we collect?

The personal data that you provide to us (including sensitive personal data) will not be shared with any third-
party companies without prior consent from yourself. We will not sell, distribute or lease your personal
information to third parties unless we have your permission or are required by law to do so.

Through the natural course of providing recruitment services, we may collect data about you, both personal
data and sensitive personal data such as the information provided in your CV, including:

• Name, Telephone Number, Email Address

• Candidate Identification / reference number
• Home Addresses
• CV’s / Portfolios
• Job Application / Covering sheets
• Passports / Visas (RTW documents) / Other forms of ID
• Certificates / Qualifications / Education History
• Security Clearance / CRB / DBS / credit check
• Past employer references / Referrals
• Employment contracts (for contractors)
• Salary / Payment details / NI numbers
• Interview Notes / debriefs / client feedback
• Social media pages / comments
• Test results

For the information listed above that is not collected via your CV, it will only be collected by gaining consent
directly from yourself. Not all data listed above will be required as some information will only be necessary
should we successfully secure a position for you and depending on the nature of the employment and end
client requirements, may not be needed. The consultant you engage with will be able to inform you what
information will be required for a job application and / or securing employment.
 7. Retention of records – How long do we store information?
Document Type
Unsuccessful Candidate records: -
Including all information included in section 6 of
the Privacy notice, such as all information
provided in an application form/CV, ID, contact
details, interview and consultant notes.
Successful Candidates who gain employment via
Deerfoot IT services: -
Including all information included in section 6 of
the Privacy notice, such as all information
provided in an application form/CV, ID, contact
details, interview and consultant notes. And all
details of assignments / employment gained and
opt notices.
Terms of Engagement with Contract / Temporary
worker and Terms of Business with clients
References
How long Source of requirement to store
we retain
1 year From the last date of engagement, supply or
Minimum – introduction to any client (Conduct of
Employment Agencies and Employment Businesses
Regulations 2003 (Conduct Regulations))
2 years Should Deerfoot IT not engage with a candidate for a
Maximum two-year period, all data will be automatically deleted.
6 years In order to deal with any civil action in the form of
contractual claim (Limitation Act 1980). This is only 5
years in Scotland, but we maintain 6 years.
6 years From the last date of engagement (end of contract). In
order to deal with any civil action in the form of
contractual claim (Limitation Act 1980). This is only 5
years in Scotland, but we maintain 6 years.
2 years Following the introduction to a client OR 2 years after
engagement has ended, whichever is the later (Under
the DPA records are only to be kept as long as
necessary however the Conduct Regulations require
references to be kept for 1 year)
 2. Privacy Notice – Indirect

The following applies to information collected indirectly, as in all sources that are considered not direct
from the candidate. This may include: One of the third-party job boards we subscribe to, our internal
database, social media websites, referrals or recommendations.

Company Name: Deerfoot IT Resources Ltd (‘the Company’)

Company Contact Deerfoot IT Head Quarters

details: Address: 10-11, Mortimers Park, Ower, Romsey, SO51 6AF
Telephone: 02380 813001
Data Protection Officer: Joshua Saunders – DPO@deerfoot.co.uk

Topic: Data protection – collected from 3rd party - Indirect

Date: 01st May 2018

Version: 1.0

The Company is a recruitment business which provides work-finding services to its clients and work-seekers. The
Company must process personal data (including sensitive personal data) so that it can provide these services –
in doing so, the Company acts as a data controller.

You may give your personal details to the Company directly, such as on an application or registration form or via
our website, or we may collect them from another source such as a job board. The Company must have a legal
basis for processing your personal data. For the purposes of providing you with work-finding services and/or
information relating to roles relevant to you we will only use your personal data in accordance with the terms
of the following statement.

1. Collection and use of personal data

a. Purpose of processing and legal basis

The Company has collected your personal data (which may include sensitive personal data) and will process your
personal data for the purposes of providing you with work-finding services. The legal bases we rely upon to offer
these services to you are:

Legitimate interest as per c. below. We rely on consent to transfer your data (application) to a potential
employer.

b. Categories of data

The Company has collected the following personal data on you:

Personal data:
 • Your name and contact details
• Any and all data available on your CV
• Any and all data made available on any job boards you have subscribed to

Sensitive personal data:

• Any and all data available on your CV
• Any and all data made available on any job boards you have subscribed to

We may collect additional information on you as highlighted in section 7 below should you wish to engage with
us further.

c. Legitimate interest

Where the Company has relied on a legitimate interest to process your personal data our legitimate interests
is/are as follows:

• To provide you, as a work seeker, with recruitment services

• To inform you, as a work seeker, of potential employment opportunities

d. Recipient/s of data

The Company will process your personal data and/or sensitive personal data with the following recipients, after
gaining consent from you:

• Existing clients and associated third parties of The Company (who are seeking to engagement and / or
employ the worker) – you will be notified of the end client organisation prior to transferring.

2. Overseas Transfers

Should the job vacancy be located outside of the European Economic Area (‘EEA’) The Company may transfer
only the information you provide to us to countries outside the (‘EEA’) for the purposes of providing you with
work-finding services. The Company will only transfer your data outside of the EEA once consent from yourself
has been received. We will take steps to ensure adequate protections are in place to ensure the security of your
information. The EEA comprises the EU member states plus Norway, Iceland and Liechtenstein.

3. Data retention

The Company will retain your personal data only for as long as is necessary. Different laws require us to keep
different data for different periods of time.

The Conduct of Employment Agencies and Employment Businesses Regulations 2003, require us to keep work-
seeker records for at least one year from (a) the date of their creation or (b) after the date on which we last
provide you with work-finding services.

Where relevant, we must also keep your payroll records, holiday pay, sick pay and pensions auto-enrolment
records for as long as is legally required by HMRC and associated national minimum wage, social security and
tax legislation.

Where the Company has obtained your consent to process your personal and sensitive personal data (please
see section 7 below for the types of data we collect), we will do so in line with our retention policy (please see
section 8 below). Upon expiry of that period the Company will seek further consent from you. Where consent is
not granted the Company will cease to process your personal data and sensitive personal data by deletion.
4. Your rights

Please be aware that you have the following data protection rights:

• The right to be informed about the personal data the Company processes on you;
• The right of access to the personal data the Company processes on you;
• The right to rectification of your personal data;
• The right to erasure of your personal data in certain circumstances;
• The right to restrict processing of your personal data;
• The right to data portability in certain circumstances;
• The right to object to the processing of your personal data that was based on a public or legitimate interest;
• The right not to be subjected to automated decision making and profiling; and
• The right to withdraw consent at any time.

Where you have consented to the Company processing your personal data and / or sensitive personal data, you
have the right to withdraw that consent at any time by contacting The Company’s Data Protection Officer -
Joshua Saunders via email using DPO@deerfoot.co.uk or by phone on 02380 813001.

5. Source of the personal data

The Company sourced your personal data/sensitive personal data by the following means:

• A Job Board you have uploaded your profile to, or

• Referral from friend, colleague or ex-employer

The Company will make efforts to inform you which source we specifically used upon first communication, be
that by email or telephone call.

This information did not come from a publicly accessible source. The Company subscribe to several job boards
which are only accessible by paid membership.

6. Complaints or queries

If you wish to complain about this privacy notice or any of the procedures set out in it please contact The
Company’s Data Protection Officer - Joshua Saunders via email using DPO@deerfoot.co.uk or by phone on 02380
813001.

You also have the right to raise concerns with Information Commissioner’s Office on 0303 123 1113 or at
https://ico.org.uk/concerns/, or any other relevant supervisory authority should your personal data be
processed outside of the UK, if you believe that your data protection rights have not been adhered to.

7. What information will we collect?

The personal data that you provide to us (including sensitive personal data) will not be shared with any third-
party companies without prior consent from yourself. We will not sell, distribute or lease your personal
information to third parties unless we have your permission or are required by law to do so.

Through the natural course of providing recruitment services, we may collect data about you, both personal
data and sensitive personal data such as the information provided in your CV, including:

• Name, Telephone Number, Email Address

• Candidate Identification / reference number
• Home Addresses
• CV’s / Portfolios
• Job Application / Covering sheets
 • Passports / Visas (RTW documents) / Other forms of ID
• Certificates / Qualifications / Education History
• Security Clearance / CRB / DBS / credit check
• Past employer references / Referrals
• Employment contracts (for contractors)
• Salary / Payment details / NI numbers
• Interview Notes / debriefs / client feedback
• Social media pages / comments
• Test results

For the information listed above that is not collected via your CV, it will only be collected by gaining consent
directly from yourself. Not all data listed above will be required as some information will only be necessary
should we successfully secure a position for you and depending on the nature of the employment and end
client requirements, may not be needed. The consultant you engage with will be able to inform you what
information will be required for a job application and / or securing employment.

8. Retention of records – How long do we store information?

Document Type How long Source of requirement to store

Unsuccessful Candidate records: -
Including all information included in section 7 of
the Privacy notice, such as all information
provided in an application form/CV, ID, contact
details, interview and consultant notes.
we retain
1 year From the last date of engagement, supply or
Minimum – introduction to any client (Conduct of
Employment Agencies and Employment Businesses
Regulations 2003 (Conduct Regulations))
2 years Should Deerfoot IT not engage with a candidate for a
Maximum two-year period, all data will be automatically deleted.

Successful Candidates who gain employment via 6 years In order to deal with any civil action in the form of
Deerfoot IT services: - contractual claim (Limitation Act 1980). This is only 5
Including all information included in section 7 of years in Scotland, but we maintain 6 years.
the Privacy notice, such as all information
provided in an application form/CV, ID, contact
details, interview and consultant notes. And all
details of assignments / employment gained and
opt notices.
Terms of Engagement with Contract / Temporary 6 years From the last date of engagement (end of contract). In
worker and Terms of Business with clients order to deal with any civil action in the form of
contractual claim (Limitation Act 1980). This is only 5
years in Scotland, but we maintain 6 years.

References 2 years Following the introduction to a client OR 2 years after

engagement has ended, whichever is the later (Under
the DPA records are only to be kept as long as
necessary however the Conduct Regulations require
references to be kept for 1 year)