Privacy Policy
The General Data Protection Regulation (GDPR) (Regulation (EU) 2016/679) has supplanted the Data Protection Regulation (Directive 95/46/EC) since May 25, 2018. This regulation aims to standardise data protection laws across EU member states, amplifying privacy rights for individuals and establishing a stringent framework within which commercial organisations can operate legally. Despite the UK’s departure from the EU on December 31, 2021, GDPR remains applicable in the UK. Your rights under the GDPR are elucidated in this notice, and we encourage you to carefully review it to comprehend our perspectives and practices concerning your personal data and how we intend to handle it.
Who governs your personal data?
Tripod Group Limited (Tripod Group), a company registered in England and Wales with Company Number 09580248, is the Data Controller.
Address: Tripod Partners, National House, Wardour Street, Soho, London, W1F 0TA.
The Data Controller’s data protection representative is the Data Protection Officer. You can reach them at dpo@tripodpartners.co.uk or by calling 020 3096 5000. Any mention of our Group encompasses our subsidiaries, ultimate holding company, and its subsidiaries, as well as our associated companies as defined in section 1159 of the UK Companies Act 2006.
What constitutes personal data?
Personal data includes information that can identify you as a living individual. It encompasses general personal data such as name, address, National Insurance number, and online identifiers/location data. Additionally, there is sensitive personal data, which covers information related to physical and mental health, sexual orientation, race or ethnic origin, religious beliefs, trade union membership, and criminal records. Sensitive personal data requires a higher level of protection.
Who we are, what we do, and how we acquire your data
Tripod Group operates as a recruitment agency and recruitment business under the Employment Agencies Act 1973. We also offer training, event organisation, and consultancy services as needed. To facilitate our business operations, we collect personal data from the following individuals:
- Prospective and placed candidates for permanent or temporary roles;
- Prospective and live client contacts, including referee contacts provided by candidates;
- Supplier contacts to support our services;
- Employees, consultants, temporary workers, and contractors.
Whether you applied directly to us or we sourced your details from a jobs board or social networking site, we process your data based on a legal basis. Among the six legal bases for data processing, we primarily rely on (1) your consent for sending direct marketing messages unrelated to our recruitment services, (2) the necessity of processing for the performance of a contract with you, or (3) our legitimate interest in processing your personal data.
Our collection of information about you serves to carry out our core business and related activities.
Section 1
Data Collection and Utilisation
This section applies to individuals interested in using or presently engaging with our Recruitment Services or exploring opportunities with us (referred to as ‘candidates’).
The personal data we gather or receive includes the following, as applicable:
- Name
- Address
- Email and other contact details
- Date of birth
- Job history (including information related to placements through us)
- Educational history, qualifications & skills
- Visa and other right-to-work or identity information
- Passport
- Bank details
- National insurance and tax (payroll) information
- Next of kin and family details
- Contact details of referees
- Personal information related to hobbies, interests, and pastimes
- Information contained in references and pre-employment checks from third parties
- Other sensitive personal information, such as health records (see ‘Sensitive Personal Data’ section below)
- Your marketing preferences
We may obtain your personal data from the following sources (please note that this list is not exhaustive):
- You (e.g., a Curriculum Vitae, application, or registration form)
- A client
- Other candidates
- Online job sites
- Marketing databases
- The public domain
- Social Media, such as LinkedIn
- At interviews
- Conversations on the telephone or video conferencing (which may be recorded)
- Notes following a conversation or meeting
- Our websites and software applications
If you are a candidate, and we have obtained your personal data from a third party, such as an online job board, it is our policy to advise you of the source when we first communicate with you.
Utilisation of Your Personal Data:
The processing of your personal information may include:
- Collecting and storing your personal data, whether in manual or electronic files
- Notifying you of potential roles or opportunities
- Assessing and reviewing your suitability for job roles
- Introducing and/or supplying you to actual or potential clients
- Engaging you for a role with us or with our clients, including any related administration (e.g., timesheets and payroll)
- Collating market or sector-specific information and providing the same to our clients
- Sending information to third parties with whom we have or intend to enter into arrangements related to our Recruitment Services
- Providing information to regulatory authorities or statutory bodies, and our legal or other professional advisers, including insurers
- Marketing our Recruitment Services
- Retaining a record of our dealings
- Establishing quality, training, and compliance with our obligations and best practices for the purpose of backing up information on our computer systems
Reasons for Processing Your Personal Data and Legal Justification:
Our legal basis for processing personal data is our legitimate business interests, described in more detail below. We may also rely on contract, legal obligation, and consent for specific uses of data.
We will rely on a contract if we are negotiating or have entered into a placement agreement with you or your organisation or any other contract to provide services to you or receive services from you or your organisation.
We will rely on legal obligation if we are legally required to hold information on you to fulfil our legal obligations.
In some circumstances, we will rely on consent for particular uses of your data, and you will be asked for your express consent if legally required. Examples of when consent may be the lawful basis for processing include permission to introduce you to a client (if you are a candidate).
Automated Decisions:
We may use software to review the personal data of individuals recorded on our database or who have applied for specific roles. The software may determine suitability for a specific role via targeted questions relating to the role and/or may identify and select individual personal information according to stored characteristics. For example, the software may enable us to quickly identify individuals from our database who have specific skills, e.g., a Nurse, and exclude individuals whose characteristics do not match particular requirements of a job role.
If you believe that any assessment made by the software regarding your suitability for a particular job role is incorrect, you may request an explanation.
Entering into and Performing a Contract with You:
To provide our Recruitment Services, we may enter into a contract with you and/or a third party. We will need certain information, such as your name and address, to enter into a contract. A contract will contain obligations on both your part and our part, and we shall process your data as necessary for the purpose of those obligations, including processing payroll on your behalf.
Compliance with Legal Obligations (Regulatory and Statutory Obligations):
We must comply with various statutory provisions when providing our Recruitment Services, necessitating the processing of personal data. This includes the Conduct of Employment Agencies and Employment Businesses Regulations 2003, which, among other things, requires us to:
- Verify your identity
- Assess your suitability for an external job role
- Maintain records for specific periods
When we engage a person to work for us (whether directly or as supplied to a client), other statutory obligations must be complied with, including payroll, tax, social security, HMRC reporting requirements, and any other law or regulation.
We are also required to comply with statutory and regulatory obligations relating to business generally, such as tax, bribery, fraud/crime prevention, and data protection legislation, and cooperating with regulatory authorities such as HMRC or the Information Commissioner’s Office.
Our Legitimate Interests (Carrying on the Commercial Activity of Providing Recruitment Services):
In providing our Recruitment Services, we will carry out processing of personal data that is necessary for the purpose of our legitimate interests, including:
- Retaining records of our dealings and transactions and using such records, where applicable, for the purposes of
- Establishing compliance with contractual obligations with clients or suppliers
- Addressing any query or dispute that may arise, including establishing, exercising, or defending any legal claims
- Protecting our reputation
- Maintaining a backup of our system, solely for the purpose of being able to restore the system in the event of a system failure or security breach
- Evaluating quality and compliance, including compliance with this Privacy Notice
- Determining staff training and system requirements
Using your personal data to:
- Assess suitability and contact you regarding potential opportunities and/or our services
- Collate market information or trends, including providing analysis to potential or actual clients
- Source potential opportunities or roles as part of our Recruitment Services
- Personalise your experience and our offering, whether via our website or otherwise
This means that for our commercial viability and to pursue these legitimate interests, we may continue to process your personal data for as long as we consider necessary for these purposes.
Consent to Our Processing of Your Data:
We may process your personal data based on your consent for a specific purpose. For example, if you apply for a specific role, you may have consented to our processing of the data provided for the purpose of progressing your application and considering your suitability for that role. In other cases, you may have provided your written or verbal consent to the use of your data for a specific reason, such as receiving marketing updates on some of our additional services.
You retain the right to withdraw your consent for the processing of your personal information for a specific purpose at any time. However, it’s important to note that we may continue retaining or using your personal information if we have a legitimate interest, or there is a legal or contractual obligation to do so. In such cases, our processing will be limited to what is necessary to fulfill those interests or obligations. The withdrawal of consent will not impact the lawfulness of any processing based on consent before its withdrawal.
What if we receive your personal data from a third party?
As part of our business operations, we engage in research on individuals to fill job roles. This may involve obtaining personal data from online sources, such as social media platforms like LinkedIn and job boards. Some information is publicly available, while other data is acquired from subscribed sites or providers. Occasionally, we may also receive personal information about you from hiring organisations, colleagues, former employers, or those for whom you’ve provided services.
If information from third-party sources proves irrelevant or you’ve communicated your preference not to receive our services, we will discard it. However, a limited record may be maintained to prevent process duplication. Any processing of information believed to be useful for our Recruitment Services will adhere to this Privacy Notice. You have the right to object to processing; please refer to Section 4, ‘Your rights.’
Sensitive Personal Data (SPD)
Sensitive personal data encompasses intensely personal information typically unrelated to your suitability for a job role. Examples of SPD include information revealing political, religious or philosophical beliefs, sexual orientation, race or ethnic origin, or health-related details.
Regardless of the nature of your dealings with us, we request that you refrain from providing sensitive personal data unless absolutely necessary. However, if you choose to share such data in conversation, we will only use it for the purpose of our relationship with you or for providing our Recruitment Services. This may include one or more of the following reasons:
- Explicit consent provided by you
- Evaluation of your suitability for job roles or working capacity
- Processing necessary for obligations or rights under employment, social security, or social protection law
- Maintenance of records of our dealings for addressing any later dispute, including but not limited to the establishment, exercise, or defense of legal claims
Sharing Personal Data:
We will not share your personal information unless authorised. Categories of individuals or entities with whom we may share your personal information include:
- Individuals, hirers, and other third parties necessary for providing our Recruitment Services
- Regulatory authorities or statutory bodies as required by information requests or legal obligations
Parties processing data on our behalf include:
- IT support
- Storage service providers, including cloud
- Background screening providers
- Legal and professional advisers
- Insurers
Section 2:
This section applies if you are an individual working for a third party (such as a client employer) with whom we engage.
We may collect your personal data in the course of our interactions, which may include the following:
- Your contact information, such as your full name, job role, contact telephone number, and email.
- Your statements and opinions about candidates and/or other personnel, e.g., a reference.
- Information related to our relationship with you or the party you work for, including records of any meetings or discussions.
- Your marketing preferences.
We may obtain your personal data from various sources (please note that this list is not exhaustive):
- You, including when you provide us with your contact details or other information for the purposes of using our Recruitment Services.
- Staff or other representatives of the organisation you represent.
- Marketing databases.
- Social media.
- The public domain.
- Conversations, with you or others, on the telephone or video conferencing (which may be recorded) or in meetings.
- Notes following a conversation, with you or others, or meetings you attend.
How we will use your personal data:
We will process your personal data in the context of our interactions with the third party for whom you work and as part of our Recruitment Services. This may involve:
- Collecting and storing your personal data, whether in manual or electronic files.
- Using the data to communicate with you.
- Sending information to third parties with whom we have or intend to enter into arrangements related to our Recruitment Services.
- Actions necessary to fulfil any obligation on us pursuant to a contract between ourselves and the third party you work for.
- Collating market or sector-specific information and providing the same to our clients.
- Providing information to regulatory authorities or statutory bodies and our legal or other professional advisers, including insurers.
- Retaining records of our dealings with you and the organisation you represent.
- Establishing quality, training, and compliance with our obligations and best practice.
Why we process your personal data:
Compliance with legal obligations (regulatory and statutory obligations):
We must comply with various statutory provisions when providing our Recruitment Services, which necessitate the processing of personal data. These include the Conduct of Employment Agencies and Employment Businesses Regulations 2003, which, among other things, requires us to assess the suitability of candidates and obtain information from Clients.
We are also required to comply with statutory and regulatory obligations relating to business generally, such as tax, bribery, and fraud/crime prevention legislation, and cooperating with regulatory authorities such as HMRC.
Our legitimate interests (carrying on the commercial activity of Recruitment Services):
In providing our Recruitment Services, we will carry out some processing of personal data, which is necessary for the purpose of our legitimate interests, including:
- For our commercial viability and to pursue these legitimate interests, we may continue to process your personal information for as long as we consider reasonably appropriate for these purposes.
Using your personal data:
- To contact you regarding our Recruitment Services.
- To assess the suitability of Candidates and roles, for example, referencing or other feedback.
- To collate market information or trends, including providing analysis to potential or actual Clients.
- As otherwise necessary to provide our Recruitment Services and/or to meet our obligations towards either the party whom you represent or other Clients or suppliers.
- To personalise your experience and our offering, whether via our website or otherwise.
Retaining records of our dealings and transactions and where applicable, use such records for the purposes of:
- Establishing compliance with contractual obligations with Clients or suppliers.
- Addressing any query or dispute that may arise, including establishing, exercising, or defending any legal claims.
- Protecting our reputation.
- Maintaining a backup of our system, solely for the purpose of being able to restore the system to a particular point in the event of a system failure or security breach.
- Evaluating quality and compliance, including compliance with this Privacy Notice.
- Determining staff training and system requirements.
Consent
We may process your personal data based on your consent for a specific purpose. For instance, if you’ve shared your contact details with us to receive information about our additional services, your consent allows us to process the data for that purpose. In other instances, you might have given your written or verbal consent, such as when providing references.
You have the right to withdraw your consent for the processing of your personal data for a particular purpose at any stage (refer to Section 4 ‘Your rights’). However, it’s essential to note that we may continue to retain or use your personal information if we have a legitimate interest or a legal or contractual obligation to do so. Our processing will be limited to what is necessary to fulfill those interests or obligations, and withdrawal of consent will not affect the lawfulness of any processing based on consent before its withdrawal.
What if we obtain your personal data from a third party?
As part of our business activity, we engage in researching information for finding and filling job roles. This involves obtaining personal data from sources like job boards, advertisements, LinkedIn, or other social media, where some information is publicly available, and other data comes from subscribed sites or providers. Periodically, we may also receive personal data about you from hiring organisations, colleagues, former employers, or individuals for whom you have provided services or been otherwise engaged.
If information from third-party sources proves to be of no use to us, we will discard it. However, we may keep a limited record to prevent duplication. If we believe the information could be valuable for providing our Recruitment Services, any processing will adhere to this Privacy Notice. You retain the right to object to processing.
Section 3:
This section is applicable to all personal data.
Transfer of Data to Other Jurisdictions
During the provision of our Recruitment Services, we may transfer data to countries or international organisations outside of the European Economic Area (EEA). This transfer may involve Clients, Candidates, or third parties providing support services. When such information is transferred, it might be to a country with an adequacy decision from the EU Commission. If not, it is our policy to identify risks and, where reasonably practicable, ensure appropriate safeguards are in place.
If You Choose Not to Provide Necessary Data
There could be instances where we require data essential to meeting statutory or contractual obligations or performing our Recruitment Services. If you opt not to provide requested information, kindly notify us. However, be aware that this decision might result in our inability to offer you, or the represented party, Recruitment Services. In some cases, this could lead to a breach of the contract with you or a third party you represent.
Group Companies & Transfer
While this Privacy Notice pertains to Tripod Group Limited, your data may be accessible to and shared with other organisations within our group, including Tripod Group Limited. This sharing occurs for purposes outlined in this Privacy Notice or in cases of shared administration systems and staff.
In scenarios like sales, mergers, liquidation, receivership, or asset transfer to a third party, we may need to transfer your information. Such transfers are contingent upon the third party’s agreement to adhere to this Privacy Notice, with processing strictly following these guidelines.
Data Security and Confidentiality
Our policy is to ensure, to the extent reasonably practicable, that our systems and records remain secure and inaccessible to unauthorised third parties, aligning with contemporary practices.
Retaining Your Data
Purpose/Activity: To register you as a new candidate
Type of data: (a) Identity, (b) Contact, (c) Special Categories
Lawful basis: Performance of a contract with you
Data retention: 7 years after you last contact us
Purpose/Activity: To put you forward for vacancies
Type of data: (a) Identity, (b) Contact, (c) Special Categories
Lawful basis: (a) Performance of a contract with you, (b) Necessary for our legitimate interests (to place candidates with employers)
Data retention: 7 years after you last contact us
Purpose/Activity: To manage our relationship with you which will include:(a) Notifying you about changes to our terms or privacy policy, (b) Asking you to leave a review or take a survey,
Type of data: (a) Identity, (b) Contact, (c) Transaction, (d) Marketing and Communications
Lawful basis: (a) Performance of a contract with you, (b) Necessary to comply with a legal obligation, (c) Necessary for our legitimate interests (to keep our records updated and to study how customers use our products/services)
Data retention: 7 years after you last contact us
Purpose/Activity: To administer and protect our business and this website (including troubleshooting, data analysis, testing, system maintenance, support, reporting and hosting of data)
Type of data: (a) Identity, (b) Contact, (c) Technical, (d) Usage
Lawful basis: (a) Necessary for our legitimate interests (for running our business, provision of administration and IT services, network security, to prevent fraud and in the context of a business reorganisation or group restructuring exercise), (b) Necessary to comply with a legal obligation
Data retention: 3 years after the data is collected for this purpose
Purpose/Activity: To deliver relevant website content and advertisements to you and measure or understand the effectiveness of the advertising we serve to you
Type of data: (a) Identity, (b) Contact, (c) Technical, (d) Usage, (e) Marketing and Communications, (f) Transaction
Lawful basis: Necessary for our legitimate interests (to study how customers use our services, to develop them, to grow our business and to inform our marketing strategy)
Data retention: 3 years after the data is collected for this purpose
Purpose/Activity: To use data analytics to improve our website, products/services, marketing, customer relationships and experiences
Type of data: (a) Technical, (b) Usage
Lawful basis: Necessary for our legitimate interests (to define types of customers for our services, to keep our website updated and relevant, to develop our business and to inform our marketing strategy)
Data retention: 3 years after the data is collected for this purpose
Purpose/Activity: To make suggestions and recommendations to you about jobs or services that may be of interest to you
Type of data: (a) Identity, (b) Contact, (c) Technical, (d) Usage
Lawful basis: Necessary for our legitimate interests (to develop our services and grow our business); Consent
Data retention: 3 years after the data is collected for this purpose
If you believe earlier deletion of your data is necessary, inform us in writing. Refer to Section 4 ‘Your Rights’ below.
Changes to This Privacy Notice
This Privacy Notice undergoes regular review and may be updated to reflect changes in our business, legal practices, or commercial operations. Any relevant updates concerning your data processing will be communicated to you.
Section 4
‘Your Rights’
Sensitive personal data (SPD) is information intensely personal and typically irrelevant to our interactions regarding Recruitment Services. Examples of SPD include details revealing political, religious or philosophical beliefs, sexual orientation, race or ethnic origin, or health information.
Regardless of the basis for our interactions, we urge you not to provide sensitive personal data unless absolutely necessary. If shared, such data, disclosed in conversation, will only be used for our relationship with you or for providing Recruitment Services. This may include:
- Explicit consent for processing
- Necessity for obligations or rights under employment, social security, or social protection law
- Record-keeping for future dispute resolution, including legal claims
Who We Share Personal Data With:
We will not share your personal data without entitlement. Categories of entities with whom we may share your personal information include:
- Candidates and other third parties essential for providing Recruitment Services
- Regulatory authorities or statutory bodies, pursuant to information requests or legal obligations
- Parties processing data on our behalf, including:
- Outsourced payroll providers
- IT support
- Storage service providers, including cloud services
- Background screening providers
- Legal and professional advisers
- Insurers
Complaints:
If dissatisfied with any aspect of your data processing, refer the matter initially to: dpo@tripodpartners.co.uk. This does not affect your right to complain to the Information Commissioner’s Office: https://ico.org.uk
Contact:
For inquiries, contact us at: dpo@tripodpartners.co.uk or write to us at:
Data Protection Officer
Tripod Group Limited
National House
Wardour Street
Soho
London
W1F 0TA