Options Resourcing (‘The Company’) is an employment agency and business which provides work-finding services to its clients and work-seekers. The Company must process personal data (including sensitive personal data) so that it can provide these services – in doing so, the Company acts as a data controller.

The UK GDPR apply to all personal data we process regardless of how we receive the information and regardless of whether we engage you directly or receive your personal data from a third party. You may give your personal details to the Company directly, such as on an application or registration form or via our website, or we may collect them from another source such as a job board. The Company must have a legal basis for processing your personal data. For the purposes of providing you with work-finding services and/or information relating to roles relevant to you we will only use your personal data in accordance with the terms of the following statement.

1. Collection and use of personal data 

 a. Personal data we may collect from you 

In order to provide the best possible work-finding services we need to collect certain personal and sensitive personal data from you.  We only ask for details that that are needed for the provision of work-finding services. If you are a candidate this may include your name, age, contact details, details of education and qualification, work history, referees, emergency contacts, nationality/eligibility details including immigration status, driving license details, National Insurance number and in accordance with UK law and requirements, we may also collect information relating to your health, disability, diversity and details of any criminal convictions. Where relevant, we may also collect from you information needed to ensure you can be paid such as bank details.

b. Purpose of processing and legal basis 

The Company will collect and process your personal data (which may include sensitive personal data) for the purposes of providing you with work-finding services. The legal bases we rely upon to offer these services to you are:

Legitimate interest

Article 6 (1)(f) of UK GDPR says that we can process your data where it is “necessary for the purposes of the legitimate interests pursued by the controller or by a third party except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data”.

For candidates, if you are looking for a role or have posted your CV information on a job board or networking site, we will assume you are happy for us to collect and use your personal data to offer or provide to you our work-finding services as well as to share that information with prospective employers. If you are about to potentially secure a role with one of our clients, our client may also need to double check any information you’ve given us, to the extent that this is appropriate and in accordance with UK laws. We need to do these things so that we can operate as an employment agency and business to enable us to secure you roles and send you appropriate communications about roles that might be of interest to you.

For clients, to provide our work-finding services we will need to store personal data of individual contacts in your business as well as keep records of conversations and meetings.  We may also contact you about candidates who are looking for roles or to undertake a customer satisfaction survey. We think this is reasonable and these uses of your data to be necessary for our legitimate interests as an employment agency and business providing work-finding services to you. 

Legal Obligation

Article 6(1)(c) provides a lawful basis for processing where “processing is necessary for compliance with a legal obligation to which the controller is subject”. In our business of being an employment agency and business we will often have legal obligations to process and retain your personal data to comply with our responsibilities to HMRC and under UK law.

Consent

In certain circumstances, we are required to obtain your consent to the processing of your personal data in relation to certain activities. Article 4(11) of UK GDPR states that consent is “any freely given, specific, informed and unambiguous indication of the data subject’s wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the process of personal data relating to him or her.” This requires us to ensure you have given your consent freely, you know what you are consenting to and that you take positive action to give us your consent. We will keep records of the consents you have given in this way.

c. Recipient/s of data 

Where appropriate and in accordance with UK laws and requirements, we may share or process your personal data and/or sensitive personal data with the following categories of recipients:

• Any of our group companies or LLPs
• Individuals and organisations who hold information related to your reference or application for a role with, including but not limited to current, past or prospective employers
• Tax, audit or other authorities, when required by law or other regulations or requirements to share this data
• Third party service providers who perform functions for us in our business of operating as an employment agency and business (including professional advisers such as lawyers, auditors and accountants, technical support functions, payroll and billing services, intermediary service providers, outsourced IT providers and IT consultants carrying out testing and development work on our IT systems)
• Marketing technology platforms and suppliers
• Potential employers and other organisations to increase your chance of finding a role
• Third party recruitment platform providers, such as Managed Service Providers, where necessary to enable you to be placed in a role
• Third parties providing services such as checking references, qualifications, eligibility or criminal convictions, to the extent that these checks are appropriate and in accordance with UK law

d. Statutory/Contractual Requirement 

Your personal data may be required by law and/or a contractual requirement (e.g. our client may require this personal data), and/or a requirement necessary to enter into a contract. If it is required, you are obliged to provide the personal data and if you do not the consequences of failure to provide the data are:

• We may no longer be able to provide work-finding services to you to find a role
• Payments to you may be delayed.

2. Overseas Transfers

The Company may transfer only the information you provide to us to countries outside the UK and/or European Economic Area (‘EEA’) for the purposes of providing you with work-finding services. We will take steps to ensure adequate protections are in place to ensure the security of your information. The EEA comprises the EU member states plus Norway, Iceland and Liechtenstein.

3. Data retention 

The Company will retain your personal and sensitive personal data only for as long as is necessary. Different laws require us to keep different data for different periods of time.

The Conduct of Employment Agencies and Employment Businesses Regulations 2003, require us to keep work-seeker records for at least one year from (a) the date of their creation or (b) after the date on which we last provide you with work-finding services.

We must also keep your payroll records, holiday pay, sick pay and pension auto-enrolment records for as long as is legally required by HMRC and associated national minimum wage, national insurance and tax legislation.  We will regularly review how long we keep data for.

4. Your rights

Please be aware that you have the following data protection rights:

• The right to be informed about the personal data the Company processes on you
• The right of access to the personal data the Company processes on you
• The right to rectification of your personal data
• The right to erasure of your personal data in certain circumstances
• The right to restrict processing of your personal data
• The right to data portability in certain circumstances
• The right to object to the processing of your personal data that was based on a public or legitimate interest
• The right not to be subjected to automated decision making and profiling; and
• The right to withdraw consent at any time

Where you have consented to the Company processing your personal and sensitive personal data you have the right to withdraw that consent at any time. Please see Section 5 for contact details.

5. Contact details

If you wish to complain about this privacy notice or any of the procedures set out in it, or act on any of your rights set out in Section 4 please write to:

Data Protection

Options Resourcing Ltd

2^nd Floor Equity Court

73-75 Millbrook Road East

Southampton, SO15 1RJ

You also have the right to raise concerns with Information Commissioner’s Office on 0303 123 1113 or at https://ico.org.uk/make-a-complaint/ or any other relevant supervisory authority should your personal data be processed outside of the UK, if you believe that your data protection rights have not been adhered to.