Data Protection & GDPR Policy

This policy explains how Educated Appointments Ltd manages personal data in line with UK data protection law, including the UK GDPR and Data Protection Act 2018.

It applies to personal data we handle as part of our recruitment business, including candidate records, client and employer contacts, supplier information, website enquiries, recruitment activity records and related business administration.

Educated Appointments Ltd is a recruitment business specialising in the Further Education, Skills, Training and Apprenticeship sectors.

For the personal data we decide to collect and use for our own recruitment and business purposes, Educated Appointments Ltd acts as the data controller.

Where we process personal data strictly on behalf of another organisation, we will follow the relevant contractual and data protection requirements for that arrangement.

We may collect and use personal data including:

• Candidate contact details, CVs, employment history, qualifications, experience and role preferences.
• Recruitment notes, interview notes, application history, suitability assessments and employer feedback.
• Right to work status, DBS status, references, certificates and safer recruitment information where relevant.
• Client, employer and supplier contact details, job titles, business emails, phone numbers and communication history.
• Vacancy details, recruitment briefs, candidate submissions, placement information and commercial records.
• Website enquiry information, email correspondence, call notes, SMS, WhatsApp or LinkedIn communication where relevant.
• Technical information linked to our website, CRM, document storage, email and business systems.

We may collect personal data from:

• Candidates directly, including CVs, phone calls, emails, forms and conversations.
• Job boards, professional networking platforms and publicly available professional sources.
• Clients, employers, training providers and recruitment contacts.
• Referrals and previous recruitment conversations.
• Website forms, email enquiries and business communication channels.
• Our CRM, recruitment records, document systems and operational tools.

We use personal data for purposes including:

• Recruiting candidates for suitable vacancies.
• Matching candidates to roles and assessing suitability.
• Creating candidate profiles, formatted CVs and employer introductions.
• Managing applications, interviews, offers, placements and aftercare.
• Maintaining client, employer and supplier relationships.
• Supporting safer recruitment, right to work, compliance and audit requirements.
• Managing our CRM, business records, communications and administration.
• Responding to enquiries, requests, complaints or data protection rights.
• Improving our recruitment systems, website, processes and candidate/client experience.

We only process personal data where we have a lawful basis to do so. Depending on the circumstances, this may include:

• Legitimate interests, where processing is necessary for recruitment activity, candidate management, client service, business administration or maintaining professional recruitment records.
• Consent, where we ask for clear permission for a specific activity, such as optional vacancy updates or keeping candidate details on file where consent is appropriate.
• Contract or pre-contract steps, where processing is needed in relation to a possible role, placement, client arrangement or supplier relationship.
• Legal obligation, where we need to process or retain information to meet legal, tax, employment, right to work, safer recruitment or regulatory requirements.
• Vital interests, in rare cases where processing may be necessary to protect someone’s life or safety.

Where we process special category data or criminal offence data, such as certain DBS or safeguarding-related information, we will only do so where there is an appropriate lawful basis and an additional condition under data protection law.

Recruitment records may contain information about candidates, clients, employers, vacancies, applications, interviews, feedback, offers and placements.

Candidate information is used to support appropriate recruitment activity. Client and employer contact information is used to manage recruitment relationships, vacancies, candidate submissions, safer recruitment processes and related business administration.

We aim to ensure personal data is relevant, proportionate and accurate for the recruitment purpose it is used for.

We may use secure AI-assisted tools to support recruitment administration and workflow activity. This may include formatting CVs, drafting candidate profiles, summarising notes, comparing experience to vacancy requirements, helping with search activity and supporting recruitment communications.

AI-assisted tools are used to support our recruiters and improve administration. They do not replace human judgement. Recruitment decisions, candidate suitability and employer recommendations remain subject to human review.

We do not knowingly use AI-assisted tools to make solely automated decisions with legal or similarly significant effects on individuals without appropriate safeguards.

We may share personal data where it is necessary and appropriate for recruitment, compliance, business administration or legal purposes. This may include sharing relevant information with:

• Clients, employers and training providers considering candidates for suitable vacancies.
• Technology suppliers that support our CRM, email, website, document storage, analytics, communication or AI-assisted administration.
• Professional advisers, insurers, accountants or legal advisers where required.
• Regulators, public authorities or law enforcement bodies where legally required.

We will not sell personal data. We will only share information where there is a legitimate reason, legal basis, contractual need or appropriate consent.

Some of the systems and suppliers we use may process or store data outside the United Kingdom.

Where this happens, we will take reasonable steps to ensure that appropriate safeguards are in place, such as using suppliers with recognised transfer mechanisms, contractual protections or appropriate data protection commitments.

We take appropriate steps to protect personal data from unauthorised access, loss, misuse, alteration or disclosure. These steps may include:

• Using secure CRM and document storage systems.
• Restricting access to personal data to those who need it for their role.
• Using account security, passwords and access controls.
• Reviewing data access and keeping recruitment records organised.
• Taking care when sharing candidate documents and employer-facing profiles.
• Releasing sensitive supporting documents only where appropriate and necessary.

We will only keep personal data for as long as reasonably necessary for recruitment, compliance, legal, audit, dispute, safeguarding, safer recruitment and legitimate business purposes.

Retention periods may vary depending on the type of record, the recruitment activity involved, legal requirements, client requirements and whether there has been a placement, application, complaint or dispute.

Where data is no longer needed, we will delete it, anonymise it or restrict it where appropriate.

We aim to keep personal data accurate and up to date. Candidates, clients and contacts should tell us if information we hold about them changes.

Where inaccurate information is identified, we will take reasonable steps to correct it.

Individuals have rights under data protection law. Depending on the circumstances, these may include the right to:

• Request access to personal data we hold about them.
• Ask us to correct inaccurate or incomplete data.
• Ask us to delete personal data.
• Object to certain processing.
• Ask us to restrict certain processing.
• Withdraw consent where processing is based on consent.
• Ask for data portability in certain circumstances.
• Complain to the Information Commissioner’s Office.

Some rights are subject to conditions and exemptions. We may need to verify identity before responding to a request.

Individuals can request a copy of personal data we hold about them by contacting us using the details below.

We will respond to valid subject access requests in line with data protection law. If a request is complex, unclear or involves information about other people, we may need to ask for clarification or apply relevant exemptions.

If we become aware of a personal data breach, we will assess the nature, scope and risk of the breach and take appropriate action.

Where required, we will notify the Information Commissioner’s Office and affected individuals in line with applicable data protection law.

Everyone working for or on behalf of Educated Appointments Ltd who handles personal data must take care to protect it and only use it for appropriate business purposes.

Access to personal data should be limited to what is necessary for recruitment, client management, administration, compliance or related business activity.

If you have any questions about this policy, how we use personal data, or if you want to exercise your data protection rights, contact:

Educated Appointments Ltd
Email: info@educatedappointments.co.uk

You also have the right to complain to the Information Commissioner’s Office if you are unhappy with how your personal data has been handled.