Data Protection, Privacy & Record Retention Policy

Version 2.0 · Effective date: 1 April 2026 · Review date: April 2027 · Policy owner: Director

1. Purpose

WhoFoundWho Ltd ("WhoFoundWho", "WFW", "we", "our", "us") is committed to protecting the privacy and personal information of candidates, clients, employees, contractors and other individuals with whom we conduct business. This policy explains how personal information is collected and used; the lawful basis for processing; how long information is retained; how information is protected; and individuals' rights under UK data protection law.

This policy has been prepared in accordance with:

• UK General Data Protection Regulation (UK GDPR)
• Data Protection Act 2018
• Privacy and Electronic Communications Regulations (PECR), where applicable
• Current guidance issued by the UK Information Commissioner's Office (ICO)

2. Company details

Data Controller: WhoFoundWho Ltd, 124 City Road, London EC1V 2NX.
Email: register@whofoundwho.co.uk

For all privacy enquiries, Subject Access Requests or data protection concerns, please contact the Director using the details above.

3. Scope

This policy applies to personal data relating to:

• Job applicants
• Candidates
• Temporary workers
• Contractors
• Clients
• Prospective clients
• Suppliers
• Employees
• Website users

4. Categories of personal data

Depending upon the services provided, we may collect:

• Identification information: name, address, date of birth, National Insurance number, passport details, driving licence
• Contact information: telephone numbers, email addresses, postal addresses
• Employment information: CV, employment history, qualifications, professional memberships, skills, references, salary expectations, availability
• Recruitment information: interview notes, client feedback, assessment results, Right to Work documentation, DBS information (where required)
• Financial information: bank details, payroll information, invoice details
• Technical information: IP addresses, website analytics, browser information, device identifiers

5. Special category and criminal conviction data

Where necessary for recruitment or legal compliance, we may process:

• Racial or ethnic origin
• Health information relevant to employment
• Disability information
• Immigration status
• Trade union membership (where required)
• Criminal conviction information
• DBS disclosures
• Children's Barred List checks
• Adult Barred List checks

Special Category Data is only processed where an appropriate lawful condition under Article 9 UK GDPR applies. Criminal conviction data is processed in accordance with Part 3 of the Data Protection Act 2018 and only where legally permitted.

6. How we collect information

Information may be obtained directly from candidates, clients, employees, website forms, email correspondence, telephone conversations and video interviews. We may also receive information from:

• LinkedIn
• Job boards
• Professional networking sites
• Referees
• Background screening providers
• DBS providers
• Identity verification providers
• Publicly available sources

7. Lawful basis for processing

8. Special category processing conditions

9. How we use personal information

We use personal data to: match candidates with vacancies; introduce candidates to clients; verify qualifications; verify Right to Work; obtain employment references; conduct background checks; arrange interviews; manage temporary workers; process payroll; meet legal obligations; prevent fraud; improve our recruitment services; maintain business records; respond to enquiries; and send relevant job opportunities.

10. Sharing personal data

We may share information with current and prospective employers, clients, payroll providers, accountants, auditors, solicitors, banks, insurance providers, cloud software providers, IT support providers, identity verification providers, DBS providers, government authorities where legally required, HMRC and law enforcement agencies. All third-party processors are required to process information securely and only in accordance with our instructions.

11. International transfers

Where personal information is transferred outside the UK, we will ensure appropriate safeguards are in place. These may include the UK International Data Transfer Agreement (IDTA), the UK Addendum to EU Standard Contractual Clauses, Adequacy Regulations, or other lawful transfer mechanisms recognised under UK GDPR.

12. Data security

WhoFoundWho implements appropriate technical and organisational measures including role-based access controls, a strong password policy, multi-factor authentication where available, encryption of laptops and mobile devices, encrypted cloud storage, secure backups, anti-virus and endpoint protection, firewalls, software updates and patch management, confidentiality agreements, staff data protection training, access logging where available, and secure disposal of paper and electronic records. All suspected personal data breaches are investigated promptly and, where required, reported to the Information Commissioner's Office within the statutory timeframe.

13. Record retention schedule

Records are retained only for as long as necessary to fulfil business, legal and regulatory requirements.

Information will be securely deleted or anonymised when retention periods expire unless a legal obligation requires longer retention. Where litigation, investigation or regulatory action is anticipated, records may be retained for longer.

14. Individual rights

Under UK GDPR, individuals have the right to: be informed; access their personal information; request rectification; request erasure; restrict processing; object to processing; data portability (where applicable); withdraw consent where consent is relied upon; and not be subject to solely automated decision-making where applicable. Requests should normally be responded to within one calendar month.

15. Subject Access Requests

Individuals may submit a Subject Access Request at any time. Identity may be verified before information is disclosed. Requests should be submitted using the contact details contained within this policy.

16. Data accuracy

We take reasonable steps to ensure personal information remains accurate and up to date. Candidates are encouraged to notify us promptly of any changes to their contact details, employment history, qualifications, Right to Work status and availability.

17. Cookies and website data

Our website may use cookies to improve website performance, understand visitor behaviour, remember preferences and measure website traffic. Where required, cookie consent will be obtained before placing non-essential cookies.

On this website specifically: we use Google Analytics to measure site traffic so we can keep improving. No analytics cookies are set until you accept them via the cookie banner shown on your first visit. Your choice is stored on your own device, and you can change it at any time using the "Cookie settings" link in the footer of any page. If you decline, no analytics cookies are set.

18. Data breaches

Any employee becoming aware of a suspected data breach must report it immediately to the Director. Breaches will be assessed promptly and, where required, reported to the Information Commissioner's Office and affected individuals in accordance with UK GDPR.

19. Complaints

If an individual believes their personal information has been handled incorrectly, they should contact WhoFoundWho in the first instance. Individuals also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.

20. Policy review

This policy will be reviewed annually or sooner where legislation changes; ICO guidance changes; business operations change materially; or following a significant data protection incident. The latest version will always be made available upon request.

Questions about this policy or how we handle your information? Get in touch or email register@whofoundwho.co.uk.