Introduction

Skillfinder International ("we", "us") is committed to protecting and respecting your privacy and personal data.

Our Group means our subsidiaries, our ultimate holding company and its subsidiaries, and our associated companies as defined in section 1159 of the UK Companies Act 2006.

This Privacy Notice sets out the basis on which personal data we collect from you, or that you provide to us, will be used.

The UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and the Data (Use and Access) Act 2025 govern how organisations process personal data in the United Kingdom. Where we interact with individuals in the European Union, the EU GDPR may also apply.

We are committed to the data protection principles of lawfulness, fairness and transparency; purpose limitation; data minimisation; accuracy; storage limitation; integrity and confidentiality; and accountability.

This Notice applies to website users, candidates, clients, suppliers, employees and consultants where relevant, and other individuals whose details we may process in connection with our recruitment and related services.

For the purposes of UK data protection legislation, the data controller is I.T. Skillfinder Limited of Leaf B, 4th Floor, Tower 42, 25 Old Broad Street, London EC2N 1HQ. Our nominated representative is Tracey Stone, Operations Director. Where another Skillfinder Group entity acts as controller in its own right, that entity and the applicable local legal requirements will apply to the relevant processing.

Who we are and what we do

We are a recruitment business as defined in the Employment Agencies and Employment Businesses Regulations 2003. We collect personal data to enable us to provide recruitment, staffing and related services.

·        prospective and placed candidates for permanent or contract roles;

·        prospective and live client contacts;

·        supplier and business-partner contacts;

·        employees and consultants; and

·        other individuals relevant to recruitment, onboarding, references, compliance or service delivery.

Information you give to us or we collect about you

This includes information you provide through our website, applications, correspondence, telephone calls, email, recruitment processes, contracts or other interactions with us.

Depending on the circumstances, this may include your name, address, personal and business contact details, financial information, compliance documentation, references, qualifications, employment history, right-to-work information, curriculum vitae, photograph and links to professional profiles available in the public domain.

Information we collect when you visit our website

We may collect technical information such as your IP address, browser type and version, login information where applicable, and information about how you use our website.

We may use analytics tools, including Google Analytics where configured, to understand website usage, improve our services and support security and performance.

Information we obtain from other sources

We may obtain information from sources such as LinkedIn, corporate websites, job boards, online CV libraries, business cards, recommendations, clients, referees, screening providers, suppliers and professional advisers.

Where we obtain personal data indirectly, we will provide privacy information within the period required by applicable law unless an exemption applies.

Purposes of data collection and lawful bases

We use personal data to provide recruitment and related services, manage candidate and client relationships, arrange introductions, interviews, placements and engagements, administer contracts and payments, complete compliance and onboarding requirements, maintain records, protect our systems, prevent fraud, meet legal and regulatory obligations, and improve our services.

Our lawful bases may include legitimate interests under Article 6(1)(f) UK GDPR, contractual necessity under Article 6(1)(b), legal obligation under Article 6(1)(c), and consent where consent is the appropriate lawful basis.

Where we rely on legitimate interests, we consider whether the processing is necessary and whether our interests are appropriately balanced against the rights and interests of the individual.

Special category and criminal-offence data

Where we process special-category personal data, we do so only where there is an appropriate Article 9 condition, for example in connection with employment, social-security or social-protection obligations, equality or diversity information, health or reasonable-adjustment information, or explicit consent where appropriate.

Criminal-offence information is processed only where lawful and necessary, for example where screening is required by law, the nature of a role or a client requirement. Appropriate additional confidentiality and access controls are applied.

Our Legitimate Business Interests

As a recruitment business and recruitment agency, we introduce candidates to clients for permanent employment and professional contract engagements. The exchange of candidate and client contact data is a fundamental part of providing these services.

To support candidates’ career aspirations and clients’ resourcing needs, we maintain candidate and client records containing both current and historical information where there remains a lawful basis to do so.

Candidate Data

Depending on the relevant circumstances, applicable local law and client requirements, candidate information may include:

·        name, contact details, age/date of birth where relevant, sex/gender, photograph and marital status;

·        education, qualifications, employment history and referee details;

·        immigration status, nationality/citizenship, place of birth and copies of identity or right-to-work documents;

·        financial, tax, social-security or payment-related information where required;

·        diversity, health or disability-related information where lawfully processed;

·        criminal-record information where required for a particular role;

·        remuneration, pensions and benefits information where relevant;

·        career interests, role preferences and information inferred from interaction with our services;

·        information provided by you, referees, clients or other lawful third-party sources; and

·        technical and service-usage information such as IP address and dates, times or frequency of access.

This list is not exhaustive. We seek to collect only information that is relevant and proportionate to the purpose for which it is processed.

Client Data

The personal data we collect about clients is generally limited to business contact details and information needed to establish, manage and support the relationship, including recruitment activity, contracts, compliance, introductions and engagement administration.

Consent

Where consent is the appropriate lawful basis, we will request it for the specific processing activity and record the response. You may withdraw consent at any time without affecting the lawfulness of processing carried out before withdrawal.

Other uses we may make of your data

·        to notify you about changes to our services;

·        to administer, secure and improve our website and systems;

·        for troubleshooting, analysis, testing, research, statistics and surveys;

·        to support appropriate marketing and business-development activities; and

·        to provide relevant service, role or opportunity information.

Artificial Intelligence (AI)

We may use Artificial Intelligence (AI) or automation tools to assist with activities such as content generation, CV formatting, recruitment support, data deduplication and analytics.

These tools are intended to assist rather than replace human judgement. Where AI-generated output may affect an individual, appropriate human review is applied before material action is taken.

We do not currently use solely automated decision-making that produces legal or similarly significant effects on individuals within the meaning of applicable data-protection law. No candidate is rejected or excluded solely by automated means without meaningful human involvement.

Where third-party AI providers process personal data on our behalf, appropriate contractual, privacy and security arrangements are required. We monitor developments in applicable AI law and regulatory guidance.

Cookies

Our website may use cookies and similar technologies for functionality, security, analytics and other permitted purposes. Where consent is required, we will seek it through the applicable website controls. Further information is provided through our website cookie and marketing-preference information where applicable.

Disclosure of your information

We may share personal data where necessary with:

·        other Skillfinder Group entities;

·        clients and candidates for recruitment, onboarding and engagement purposes;

·        business partners, suppliers and subcontractors;

·        CV verification, background-screening and compliance providers;

·        analytics, search, IT, cloud and technology providers;

·        payment, accounting, insurance, legal and professional advisers;

·        regulators, public authorities or law-enforcement bodies where required; and

·        prospective purchasers or counterparties in connection with a business or asset transaction where lawful.

Where third parties process personal data on our behalf, appropriate contractual and data-protection requirements are applied. Where a recipient acts as an independent controller, it is responsible for its own lawful processing.

International transfers

We aim to store and process personal data primarily within the United Kingdom and European Economic Area where practicable.

Where personal data is transferred outside the UK or EEA, appropriate safeguards are used where required, including adequacy arrangements, Standard Contractual Clauses, the UK International Data Transfer Addendum or other lawful transfer mechanisms.

Security

We maintain organisational and technical measures intended to protect personal data from unauthorised access, loss, misuse, alteration or disclosure.

These measures include access controls, confidentiality requirements, endpoint and email security, secure cloud and CRM services, backup arrangements, staff awareness, incident-response procedures and supplier controls appropriate to the systems and information concerned.

No transmission or storage system can be guaranteed to be completely secure. We therefore apply proportionate controls and investigate suspected security incidents in accordance with our incident-response procedures.

Retention of your data

We retain personal data only for as long as necessary for the purpose for which it was collected, taking account of legal, regulatory, contractual, accounting and legitimate business requirements.

Candidate data may be retained for up to six years from the date of last meaningful contact where there remains a lawful basis to retain it, unless earlier deletion is appropriate or a longer period is required by law or contract.

Financial and contractual records are generally retained in accordance with applicable statutory requirements, commonly for up to seven years.

We may delete, archive, anonymise or pseudonymise information where appropriate. More detailed retention periods and criteria are set out in Skillfinder’s Data Retention & Deletion Policy.

Your Rights

Subject to applicable law and any relevant exemptions, you may have the right to:

·        request access to your personal data;

·        request correction of inaccurate or incomplete personal data;

·        request erasure of personal data;

·        object to processing based on legitimate interests or for direct marketing;

·        request restriction of processing;

·        request data portability where applicable;

·        withdraw consent where processing is based on consent; and

·        raise a complaint with us or the relevant supervisory authority.

These rights are not absolute and may depend on the circumstances and lawful basis for processing.

Do you have to provide us with your personal data?

You may choose not to provide personal data. However, where particular information is needed for us to provide a requested service, comply with law, complete screening or onboarding, or enter into or perform a contract, we may be unable to proceed without it.

Access to information / Subject Access Requests

You may request access to personal data we hold about you by contacting SARS@Skillfindergroup.com.

We will respond without undue delay and normally within one month of receipt, subject to applicable law. We may request reasonable evidence of identity where necessary.

Where a request is genuinely unclear and clarification is reasonably required to identify the information or processing concerned, we may ask for clarification. The statutory response period may be paused while we await the clarification, in accordance with applicable law.

In complex cases, or where multiple requests are received, the response period may be extended where permitted by law. Searches undertaken will be reasonable and proportionate.

A fee will not normally be charged, although a reasonable fee may be permitted in limited circumstances under applicable law.

Marketing

We may contact candidates, clients and business contacts about services or opportunities where we have an appropriate lawful basis. You may object to direct marketing at any time.

Marketing preferences can be updated by contacting DataProtection@Skillfindergroup.com or by using an unsubscribe or preference mechanism included in the relevant communication.

Complaints Procedure

If you have concerns about how we handle your personal data, we encourage you to raise them with us in the first instance by contacting DataProtection@Skillfindergroup.com.

We will acknowledge a data-protection complaint within 30 days, take appropriate steps to investigate it without undue delay, keep you informed where appropriate, and communicate the outcome without undue delay.

If you remain dissatisfied, you have the right to complain to the Information Commissioner’s Office or, where applicable, another competent supervisory authority.

Changes to our Privacy Notice

Any changes we make to this Privacy Notice will be published through the appropriate channel and, where material or required, notified directly to affected individuals.

Contact

Questions, comments and requests regarding this Privacy Notice should be addressed to DataProtection@Skillfindergroup.com.

Postal address: Data Protection Team, Skillfinder International, Leaf B, 4th Floor, Tower 42, 25 Old Broad Street, London EC2N 1HQ.

Review and Governance

This Privacy Notice is reviewed at least every six months and updated where necessary to reflect changes in legislation, regulatory guidance, business practices, technology or data-processing activity.

Notice Status and Review

​

​