Privacy Policy

Ashcombe Recruitment respects your privacy and is committed to protecting your personal information.

This Privacy Policy explains how we collect, use, store, disclose and protect personal information relating to:

• candidates and job applicants;
• prospective candidates;
• contractors and temporary workers, where applicable;
• client contacts and prospective client contacts;
• referees and emergency contacts;
• suppliers and professional advisers;
• visitors to our website; and
• people who contact or otherwise interact with us.

It also explains your rights under UK data protection law and how you can contact us about the use of your personal information.

Ashcombe Recruitment is a specialist recruitment business supporting employers and professionals across cybersecurity, network security, IT infrastructure, managed services and related technology disciplines.

For the purposes of applicable data protection legislation, the data controller is:

• Legal company name: Ashcombe Recruitment Ltd
• Trading name: Ashcombe Recruitment
• Registered office: Unit 2, 20 Woodland Avenue, Slough, SL1 3BU, United Kingdom
• Email: enquiries@ashcomberecruitment.co.uk

In most circumstances, Ashcombe Recruitment decides why and how personal information is used and therefore acts as a data controller.

In some limited circumstances, we may act as a processor on behalf of a client. Where this applies, our use of personal information will be governed by our agreement with that client.

This policy applies to personal information collected:

• through our website;
• through job application forms;
• when you submit a CV;
• by email, telephone, video call or in-person meeting;
• through job boards and professional networking platforms;
• through referrals and recommendations;
• through publicly available professional sources;
• during recruitment, screening and placement activities;
• through client and supplier relationships; and
• through cookies and similar website technologies.

Our website may contain links to websites operated by third parties. We are not responsible for the privacy practices of those third-party websites. You should read their privacy notices before submitting information to them.

The information we collect depends on your relationship with Ashcombe Recruitment.

4.1 Candidates and prospective candidates

We may collect:

• full name;
• postal address;
• email address;
• telephone number;
• location;
• CV, employment history and career information;
• job title, responsibilities and seniority;
• technical skills, professional experience and areas of expertise;
• qualifications, training and professional certifications;
• professional memberships;
• salary, remuneration, benefits and expectations;
• notice period and availability;
• preferred working arrangements;
• preferred role types and locations;
• interview notes and screening assessments;
• information about your communication and customer-facing capabilities;
• job application and placement history;
• feedback from clients and interviewers;
• references and referee details;
• right-to-work and identity verification information;
• copies or details of identification documents where necessary;
• information required for background or security checks;
• information available through professional networking sites, job boards and publicly accessible sources;
• correspondence and records of communications with us; and
• marketing and communication preferences.

We may also create a professional candidate profile based on the information you provide and information obtained during our screening process.

4.2 Special category information

In limited circumstances, we may collect information that receives additional protection under data protection law, including information about:

• health or disability;
• reasonable adjustments;
• racial or ethnic origin;
• religious or philosophical beliefs;
• sex life or sexual orientation; and
• trade union membership.

We will only collect or use this information where there is a valid legal basis and where it is necessary, for example:

• to arrange reasonable adjustments;
• to support equal opportunities monitoring;
• to comply with employment or legal obligations;
• to establish, exercise or defend legal claims; or
• where you have given explicit consent and consent is appropriate.

We do not require candidates to provide equality and diversity information unless it is genuinely needed for a lawful purpose. Where possible, equality monitoring information will be separated from recruitment decision-making.

4.3 Criminal offence information

We may process information relating to criminal convictions or offences only where:

• it is necessary and lawful;
• the role requires an appropriate check;
• a client has a lawful and justified requirement;
• it is required by law or regulation; and
• suitable safeguards are in place.

We will not routinely request criminal offence information for roles where it is not relevant.

4.4 Client contacts and prospective clients

We may collect:

• name;
• business email address;
• business telephone number;
• company name;
• job title and department;
• professional profile information;
• hiring responsibilities;
• recruitment requirements;
• vacancy and job specification details;
• interview and candidate feedback;
• communications and meeting notes;
• commercial agreements and transaction information;
• billing and payment information;
• information about your use of our services; and
• marketing preferences.

4.5 Referees

Where you provide a reference or are named as a referee, we may collect:

• name;
• contact details;
• employer and job title;
• professional relationship with the candidate;
• information contained in the reference;
• dates of employment;
• information about the candidate’s duties, conduct or performance; and
• records of our communications with you.

Candidates should make referees aware that their details may be given to us.

4.6 Suppliers and professional contacts

We may collect:

• name;
• employer or organisation;
• job title;
• contact details;
• payment and invoicing information;
• details of services supplied;
• contractual information; and
• communications with us.

4.7 Website visitors

When you use our website, we may collect:

• IP address;
• browser type and version;
• device type;
• operating system;
• approximate geographical location;
• referring website;
• pages viewed;
• links selected;
• dates and times of visits;
• website interaction information;
• information submitted through contact forms;
• information provided through vacancy or CV-submission forms; and
• cookie preferences.

More information should be provided in a separate Cookie Policy where non-essential cookies or analytics tools are used.

We may collect personal information directly from you when you:

• submit a CV;
• apply for a vacancy;
• complete a website form;
• register your interest in recruitment services;
• contact us by email, telephone or social media;
• attend an interview or screening call;
• subscribe to job alerts or updates;
• enter into an agreement with us; or
• provide feedback or a reference.

We may also obtain information from:

• LinkedIn and other professional networking platforms;
• CV databases and job boards;
• publicly available professional profiles;
• clients and prospective employers;
• referees;
• former employers;
• professional and educational institutions;
• another candidate or professional contact who recommends you;
• recruitment technology providers;
• identity, right-to-work or background-checking providers;
• public registers and company websites; and
• event organisers, where information has been lawfully shared.

Where we obtain your personal information from another source, we will provide relevant privacy information within the period required by law, unless a lawful exception applies. This will generally be within a reasonable period and no later than one month, or earlier where the person is contacted or the information is disclosed.

6.1 Candidates

We may use candidate information to:

• provide recruitment and work-finding services;
• determine your suitability for current or future opportunities;
• understand your career objectives;
• search for relevant vacancies;
• create and maintain a candidate record;
• communicate with you about vacancies and applications;
• assess professional and technical experience;
• conduct screening interviews;
• evaluate suitability against a client’s requirements;
• present your details to clients after appropriate discussion or authorisation;
• arrange interviews and assessments;
• obtain and provide interview feedback;
• negotiate employment or engagement terms;
• support the offer and onboarding process;
• conduct lawful reference, qualification, identity, right-to-work and background checks;
• manage placements and ongoing candidate relationships;
• respond to enquiries or complaints;
• improve our recruitment services;
• maintain business and audit records;
• prevent fraud, misuse or unlawful activity;
• establish, exercise or defend legal claims;
• comply with legal and regulatory obligations; and
• send relevant job alerts or marketing communications where permitted.

6.2 Clients and prospective clients

We may use client information to:

• identify organisations that may require recruitment services;
• establish and develop business relationships;
• respond to recruitment enquiries;
• understand hiring needs;
• source and introduce candidates;
• arrange interviews and assessments;
• manage recruitment assignments;
• provide market, salary and hiring information;
• prepare proposals and agreements;
• administer fees, invoices and payments;
• obtain feedback;
• manage disputes or legal claims;
• improve and promote our services; and
• comply with legal and regulatory requirements.

6.3 Website users

We may use website information to:

• operate and secure the website;
• respond to enquiries;
• process CV submissions and applications;
• understand website performance;
• diagnose technical problems;
• prevent misuse or attacks;
• improve usability and content;
• record cookie preferences; and
• comply with legal obligations.

6.4 Marketing

We may send candidates information about:

• relevant vacancies;
• career opportunities;
• salary or market information;
• recruitment insights; and
• services that may be relevant to their professional interests.

We may send business contacts information about:

• recruitment services;
• candidate availability;
• hiring insights;
• salary or market reports;
• events; and
• related business content.

You may opt out of marketing at any time by using an unsubscribe option where available or contacting us.

Opting out of marketing will not prevent us from contacting you about an active application, assignment, placement, contract, enquiry or other service-related matter.

We will only use personal information where we have a lawful basis.

Depending on the circumstances, we may rely on the following bases.

7.1 Legitimate interests

We may process information where it is necessary for our legitimate interests or those of a third party, provided those interests are not overridden by your rights and interests.

Our legitimate interests may include:

• providing recruitment and work-finding services;
• matching candidates to suitable opportunities;
• identifying and contacting prospective candidates;
• identifying and contacting relevant business decision-makers;
• maintaining candidate and client relationships;
• responding to enquiries;
• operating and developing our business;
• ensuring the security of our systems and website;
• preventing fraud and misuse;
• maintaining accurate business records;
• improving our services;
• informing candidates about relevant professional opportunities;
• informing business contacts about relevant recruitment services; and
• establishing, exercising or defending legal claims.

Where appropriate, we carry out a legitimate interests assessment to consider:

• the purpose of the processing;
• whether the processing is necessary;
• the potential impact on the individual; and
• whether the individual’s rights override our interests.

Recruitment agencies may be able to rely on legitimate interests in appropriate circumstances, but this requires balancing the agency’s interests against the individual’s rights and reasonable expectations.

7.2 Contract

We may process information where necessary:

• to enter into a contract with you;
• to take steps at your request before entering into a contract; or
• to perform our obligations under a contract.

This may apply to certain client, contractor, supplier or employment relationships.

Submitting a CV does not necessarily create a contract between you and Ashcombe Recruitment.

7.3 Legal obligation

We may use information where necessary to comply with laws or regulatory obligations, including those relating to:

• right-to-work checks;
• tax and accounting;
• employment businesses;
• prevention and detection of crime;
• court orders;
• regulatory requests; and
• legal record-keeping.

7.4 Consent

We may rely on consent where it is appropriate, including for:

• certain electronic marketing;
• optional cookies;
• some uses of special category information; or
• a specific activity that is genuinely optional.

Where processing is based on consent, you may withdraw consent at any time. Withdrawal does not affect the lawfulness of processing that occurred before consent was withdrawn.

Consent is not necessarily the most appropriate basis for ordinary recruitment processing because candidates may not always be in a position to give freely chosen consent, so we do not rely on it automatically throughout the recruitment process.

7.5 Vital interests

In rare circumstances, we may process information where necessary to protect someone’s life.

Where special category information is processed, we will rely on both:

• an Article 6 lawful basis; and
• an applicable condition under Article 9 of the UK GDPR or relevant UK data protection legislation.

Depending on the circumstances, this may include:

• employment and social protection obligations;
• substantial public interest;
• legal claims;
• information made manifestly public by the individual; or
• explicit consent.

Criminal offence information will only be processed where permitted by law and with appropriate safeguards.

We may share candidate information with a client where:

• the client has a relevant vacancy or recruitment requirement;
• we reasonably believe the opportunity may be suitable;
• the candidate has been informed about the role or introduction; and
• sharing is appropriate and lawful.

As a general working practice, Ashcombe Recruitment should not submit an identifiable candidate CV to a client without first discussing the opportunity with the candidate and obtaining their agreement to be represented for that role.

We may initially discuss a candidate with a client on an anonymised or non-identifiable basis.

Clients receiving candidate information must use it only for legitimate recruitment and hiring purposes and must handle it in accordance with data protection law.

Where necessary and lawful, we may share personal information with:

• clients and prospective employers;
• hiring managers and interviewers;
• recruitment technology and applicant-tracking system providers;
• cloud hosting and data-storage providers;
• email, telephone and communications providers;
• website hosting and website support providers;
• customer relationship management providers;
• job boards and professional networking platforms;
• identity and right-to-work checking providers;
• background-screening providers;
• referees and reference-checking providers;
• skills-testing or assessment providers;
• payroll or umbrella companies, where relevant;
• accountants, auditors, insurers, lawyers and professional advisers;
• payment and banking providers;
• analytics and website-security providers;
• regulators, courts, law enforcement bodies and public authorities;
• organisations involved in a merger, acquisition, sale or restructuring of our business; and
• other parties where you have instructed us or authorised disclosure.

We require service providers handling personal information on our behalf to use it only for agreed purposes and to apply appropriate security and confidentiality measures.

We do not sell candidate CVs or personal information to third parties for unrelated commercial purposes.

Some suppliers we use may store or access information outside the United Kingdom.

Where personal information is transferred internationally, we will take steps required by law. Depending on the destination and circumstances, these may include:

• relying on UK adequacy regulations;
• using the UK International Data Transfer Agreement;
• using an approved UK Addendum to standard contractual clauses;
• carrying out a transfer risk assessment;
• applying contractual, organisational and technical safeguards; or
• relying on another lawful transfer mechanism.

You may contact us for more information about the safeguards used for relevant international transfers.

Before publishing this section, Ashcombe Recruitment should confirm where its website, email, CRM, applicant-tracking, analytics and cloud suppliers store data.

We retain information only for as long as reasonably necessary for the purpose for which it was collected, including legal, regulatory, tax, accounting, insurance and dispute-resolution requirements.

Our indicative retention periods are set out below.

Candidate records

We will generally retain active candidate records while:

• we are providing recruitment services;
• you remain interested in relevant opportunities; or
• we have an ongoing professional relationship with you.

We will review inactive candidate records periodically and will generally delete or anonymise them after TWO YEARS from the last meaningful contact, unless:

• you ask us to retain the information;
• there is a continuing recruitment purpose;
• an active placement or dispute exists; or
• a longer period is required by law.

Unsuccessful applications

Information relating solely to an unsuccessful application may generally be retained for Twelve Months after completion of the recruitment exercise, unless it is retained as part of a broader candidate relationship.

Client and supplier records

Client, supplier, contractual, invoicing and transaction records may generally be kept for up to six years after the relationship or relevant transaction ends, where needed for legal, tax, contractual or accounting purposes.

References and checks

Reference, right-to-work, identity and background-check information will be retained only for as long as necessary for the relevant recruitment or legal purpose. Where possible, we will record the outcome of a check rather than retaining unnecessary copies of sensitive documents.

Marketing suppression records

Where you object to marketing, we may keep limited information, such as your email address and opt-out status, to ensure that we continue to respect your request.

Website information

Website logs, analytics information and cookie data will be retained according to the periods set out in our Cookie Policy and the settings of the relevant tools.

Retention periods may be extended where information is required for legal proceedings, regulatory enquiries, safeguarding, fraud prevention or the defence of legal claims.

We take reasonable steps to ensure that personal information is accurate and current.

Please tell us when:

• your contact details change;
• your employment status changes;
• your CV needs updating;
• your availability changes;
• your job preferences change; or
• information we hold is incomplete or inaccurate.

We may periodically contact candidates and clients to confirm that records remain current.

We use appropriate technical and organisational measures designed to protect personal information against:

• unauthorised access;
• accidental loss;
• misuse;
• alteration;
• disclosure; and
• destruction.

Measures may include:

• access controls;
• strong authentication;
• secure cloud services;
• encryption where appropriate;
• device and endpoint security;
• backups;
• staff and contractor confidentiality obligations;
• supplier due diligence;
• security monitoring;
• restricted access based on business need; and
• procedures for responding to suspected personal data breaches.

No online system is completely secure. You should take care when sending sensitive information electronically and should not send unnecessary identity or special category information unless requested through an appropriate method.

We may use recruitment technology to:

• search candidate records;
• filter CVs using skills, experience, certifications or location;
• identify potentially suitable candidates;
• rank or organise search results; and
• support candidate-to-vacancy matching.

These tools assist our recruiters but do not replace professional judgment.

Unless we tell you otherwise, Ashcombe Recruitment does not make decisions producing legal or similarly significant effects based solely on automated processing. A person will review relevant information before a candidate is rejected, shortlisted, introduced or recommended where the decision could significantly affect them.

If this practice changes, we will update this policy and provide any additional information required by law.

Where we use artificial intelligence or AI-assisted technology, it may help us:

• summarise professional information;
• improve searches;
• identify relevant skills;
• organise candidate records;
• draft internal notes; or
• support administrative recruitment tasks.

We will not knowingly allow AI tools to make final hiring or placement decisions without meaningful human review.

We will seek to:

• use only appropriate and approved tools;
• minimise personal information entered into AI systems;
• avoid entering unnecessary special category information;
• review AI-generated outputs for accuracy and bias;
• maintain human oversight; and
• assess relevant suppliers’ privacy and security arrangements.

We will provide more specific information where an AI use could have a material effect on an individual, and we aim to be transparent about the purposes for which AI is used.

You have the right to object at any time to the use of your personal information for direct marketing.

You can opt out by:

• selecting an unsubscribe link in an email;
• replying to the communication;
• emailing enquiries@ashcomberecruitment.co.uk; or
• writing to us using the details in this policy.

We may retain a minimal suppression record to ensure that we do not restart marketing after you have opted out.

Our website may use cookies and similar technologies.

Essential cookies may be used to:

• operate the website;
• maintain security;
• remember privacy preferences; and
• provide requested functions.

Non-essential cookies, such as analytics or advertising cookies, should not be placed unless the required consent has been obtained.

Information about the cookies used, their purposes, providers and duration should be provided in a separate Cookie Policy and cookie-preference tool.

Depending on the circumstances and lawful basis, you may have the following rights.

Right of access

You may request confirmation that we process your personal information and ask for a copy of it.

Right to rectification

You may ask us to correct inaccurate information or complete incomplete information.

Right to erasure

You may ask us to delete personal information in certain circumstances.

This right is not absolute. We may need to retain information where required by law or where there is another valid reason to keep it.

Right to restrict processing

You may ask us to limit how we use your information in certain circumstances.

Right to object

You may object to processing based on legitimate interests.

We will stop processing unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the information is needed for legal claims.

You have an absolute right to object to processing for direct marketing.

Right to data portability

Where processing is based on consent or contract and is carried out by automated means, you may be entitled to receive information you provided in a structured, commonly used and machine-readable format.

Right to withdraw consent

Where we rely on consent, you may withdraw it at any time.

Rights relating to automated decisions

You may have rights relating to decisions based solely on automated processing that produce legal or similarly significant effects.

Right to complain

You may complain to us about how we use your information and may also complain to the Information Commissioner’s Office.

These rights do not apply identically in every situation. We will explain any relevant exemption or limitation when responding to a request.

To exercise a data protection right, contact:

• Email: enquiries@ashcomberecruitment.co.uk
• Post: Ashcombe Recruitment Ltd, Unit 2, 20 Woodland Avenue, Slough, SL1 3BU, United Kingdom

Please provide enough information for us to:

• identify you;
• understand your request; and
• locate the relevant information.

We may ask for proof of identity where reasonably necessary. We will not request more identification information than needed.

We will respond within the period required by law. In many cases this is one month, although the period may be extended for a complex request or multiple requests where the law permits. We will tell you if an extension applies.

There is normally no fee. A reasonable fee may be charged, or a request refused, where the law permits this because a request is manifestly unfounded or excessive.

Please contact us first so that we have an opportunity to investigate your concerns.

• Email: enquiries@ashcomberecruitment.co.uk
• Post: Ashcombe Recruitment Ltd, Unit 2, 20 Woodland Avenue, Slough, SL1 3BU, United Kingdom

You also have the right to complain to the UK data protection supervisory authority.

Our recruitment services are generally intended for adults and people of working age.

We do not knowingly collect personal information from children through our general recruitment services unless:

• it is necessary for a legitimate recruitment or work-experience purpose;
• the collection is lawful;
• appropriate privacy information is provided; and
• any necessary parental or guardian involvement is arranged.

If we learn that information has been collected from a child without an appropriate basis, we will take reasonable steps to delete it.

Where a personal data breach occurs, we will assess:

• the nature of the information affected;
• the likelihood and severity of harm;
• actions needed to contain and investigate the incident;
• whether the supervisory authority must be notified; and
• whether affected individuals must be informed.

We may update this Privacy Policy to reflect:

• changes to our services;
• new technology or suppliers;
• changes to our processing activities;
• changes to law or regulatory guidance; or
• improvements to our privacy practices.

The latest version will be published on our website with the updated date.

Where a change materially affects how we use personal information, we will take reasonable steps to bring it to the attention of affected individuals before the new processing begins.

Questions, requests and complaints concerning this Privacy Policy should be sent to:

• Ashcombe Recruitment
• Legal company name: Ashcombe Recruitment Ltd
• Address: Unit 2, 20 Woodland Avenue, Slough, SL1 3BU, United Kingdom
• Email: enquiries@ashcomberecruitment.co.uk