Data Protection

PRIVACY POLICY

OUR ROLE AS A DATA CONTROLLER

In order to carry out our business function, it is necessary for us to obtain personal data about candidates and submit some or all of this data to employers who we are working with to fill a vacancy.

Our legal basis for collecting this data is Legitimate Interest, because we have been instructed by our client to find suitable candidates for their vacancies, and should the vacancy be filled with a candidate we represent, we will be paid a fee. It is also in the candidates’ interests that we process their data, to represent them in an application to a contract or permanent role.

We find candidates primarily through our own networks, as well as job boards or social media sites like Linked In. We only search for candidates based on a specific job specification that we have been instructed to work on. If we find candidates who we think may be interested in the role, we contact them through the details that they have provided. We only contact candidates who we think will be expecting to be contacted (ie. have purposefully and knowingly added their details to a job board or networking site).

We do not search for candidates on a ‘general’ basis, only for a specific role we are recruiting for. We do not try to obtain personal information from anywhere online other than through job boards or career networking sites that candidates have signed up to. We do not look at personal social media pages that are not designed for career networking or job searching.

Once we contact a candidate and ascertain their interest for the role we are working on, we send that candidate our privacy statement by email so that they are fully aware of how we intend to use their data.

We have privacy agreements with all of our clients, which means that we have sent them our Privacy Policy and they have confirmed that as a Data Controller and Processor themselves, they will adhere to Data Protection Regulations in the processing of our candidates’ data.
​
OUR ROLE AS A DATA PROCESSOR

Once we contact a candidate and ascertain their interest for the role we are working on, we send that candidate our privacy statement by email so that they are fully aware of how we intend to use their data. 

Candidates also have the option to register their details with us through our website, where our privacy policy is available in full.

We have an electronic database (called a Candidate Relationship Management system) where personal information can be securely and privately held. We use this database to allow us to contact candidates, and to track the status of applications for roles that we are working on. We will hold candidates' data on our database so that we can contact them about any live applications, other suitable roles should they become available, or about any relevant and interesting news and information. Data subjects have the right to ask us to stop processing their data at any time. In this case, we will delete all the data we hold within 10 working days, unless we are legally required to keep the data. We will contact everyone on our database every year to remind them that we are holding their details, giving them the option to unsubscribe and ask us to delete their details.

We will, to the best of our ability, keep candidates’ information updated and relevant by regularly updating our Candidate Relationship Management system. Should candidates wish to be removed from the database at any time, they can contact us and ask us to delete their data from our records, following which we will delete all the data we hold within 10 working days.

​INDIVIDUAL RIGHTS

In line with the General Data Protection Regulation (GDPR), data subjects are entitled to several individual rights with regards to their data. These rights are listed below, along with twenty84’s approach to complying with them:

• The right to be informed – once we have collected the data, we provide data subjects with privacy information, including our purpose and legal basis for processing their personal data, the retention period for this data, and who it will be shared with.
• The right of access – data subjects can contact us to ask for access to their data and we will provide the information to them free of charge and within 1 month of the request.
• The right to rectification – candidates can contact us to ask that we rectify, amend or edit the personal data we hold. We will also ensure that any updates are shared with third parties with whom the data has been shared.
• The right to erasure – data subjects can request that we delete their personal data at any time. On receipt of this request we will delete the data we hold within 10 working days and inform any third parties with whom the data has been shared that the request has been made. The only exception to this would be if we had to process the data to comply with a legal obligation.
• The right to restrict processing – data subjects can contact us to request that we refrain from processing their data. We will comply with this request upon receipt and inform any third parties with whom the data has been shared.
• The right to data portability - data subjects can contact us to ask for access to their data and we will provide the information to them free of charge and within 1 month of the request. We can also transfer the data to another organisation if requested and if technologically feasible.
• The right to object – Individuals have the right to object to the processing of their personal data. If this happens we will immediately stop processing the data.
• Rights related to automated decision-making – we do not carry out automated decision-making.

COOKIE POLICY

Our website stores cookies on users' computers. Cookies are small text files stored on your computer by a website that assigns a numerical user ID and stores certain information about your online browsing.

When we use cookies, we do so to help us recognise you as a prior user of this website. The main reasons for using these cookies are so that we can remember user preferences, and so that we can analyse user behaviour, in order to improve our service offering. The cookie file does not store your personal information.

If you wish to disable and delete your cookies you can do this through your personal web browser by accessing your settings. You can also opt out of cookies at any time by contacting us.

The cookies that we use on our website are listed below. Hubspot is referenced here because they are our chosen marketing provider. They have their own privacy policy which can be accessed here.

Cookies we use:

Necessary cookies:

These help make a website usable by enabling basic functions like page navigation and access to secure areas of the website. The website cannot function properly without these cookies.

Statistics cookies:

Google Analytics – these cookies are used to collect information about how visitors use our site. We use the information to compile reports and to help us improve the site. The cookies collect information in an anonymous form including: the number of visitors to the site, the sites from which visitors came to our site, and the pages they visited whilst on our site. We use this anonymous information to understand how the site is being used in order that we might improve the user experience.

Tracking cookies:

__hstc

The main cookie for tracking visitors. It contains the domain, utk (see below), initial timestamp (first visit), last timestamp (last visit), current timestamp (this visit), and session number (increments for each subsequent session).

(Expires: 2 years)

hubspotutk

This cookie is used for to keep track of a visitor's identity. This cookie is passed to HubSpot on form submission and used when de-duplicating contacts.

(Expires: 10 years)

__hssc

This cookie keeps track of sessions. This is used to determine if we should increment the session number and timestamps in the __hstc cookie. It contains the domain, viewCount (increments each pageView in a session), and session start timestamp.

(Expires: 30 min)

__hssrc Whenever HubSpot changes the session cookie, this cookie is also set. We set it to 1 and use it to determine if the user has restarted their browser. If this cookie does not exist when we manage cookies, we assume it is a new session.

(Expires: None. Session cookie)

__hs_opt_out

This cookie is used by the opt-in privacy policy to remember not to ask the user to accept cookies again. This cookie is set when you give users the choice to opt out of cookies.

(Expires: 2 years)

__hs_do_not_track

This cookie can be set to prevent the tracking code from sending any information to HubSpot. Setting this cookie is different from opting out of cookies, which still allows anonymized information to be sent to HubSpot.

(Expires: 2 years)

__hs_testcookie

This cookie is used to test whether the visitor has support for cookies enabled.

(Expires: Session cookie)

hsPagesViewedThisSession

This cookie is used to keep track of page views in a session.

(Expires: Session cookie)

messagesUtk

This cookie is used to recognize visitors who chat with you via the messages tool. If the visitor leaves your site before they're added as a contact, they will have this cookie associated with their browser. If you have a history of chatting with a visitor and they return to your site later in the same cookied browser, the messages tool will load your conversation history with that visitor.