Privacy Policy

This Privacy Notice sets out the basis on which Charles Alan Consulting Ltd (Charles Alan) processes personal information provided to us, this information is also referred to as ‘personal data’. Charles Alan Consulting Ltd is a company incorporated and registered in England and Wales (registered number 10377542) whose registered office address is at Number 9, Park Street, Stow-on-the-Wold, Cheltenham, GL54 1AQ.

Charles Alan is referred to throughout as “we”, “us”, “our” and “ours”. 

We take our obligations in respect of the privacy of personal data very seriously and we will only process personal information as detailed in this notice, unless we inform you otherwise. In order to ensure that the personal data we hold is accurate and up to date, we request that you inform us of any relevant changes to the personal information that we might hold about you.

Our legal basis for the processing of personal data is our legitimate business interests, described in more detail below, although we will also rely on contract, legal obligation and consent for specific uses of data.

For the purposes of this Privacy Notice, our core business activity is consultancy and resourcing (“Consultancy Services”) and we collect the personal data of the following types of people to allow us to undertake our business:

• Individuals looking for a role to work with us or who wish to engage with us as part of our Consulting Services ("Candidates")
• Prospective and live client and hiring contacts ("Clients")
• Supplier contracts to support our services ("Suppliers")
• Employees, consultants and temporary workers
• Visitors to our website

Our website may contain links to and from other websites of our partner network and affiliates. Please note that if you follow a link to any of these websites then those websites will have their own privacy policies and we do not accept any responsibility or liability for those policies.

If you do not wish us to process personal data in accordance with this policy, then please do not provide it to us. Please refer to Section 3, Clause 8 (Your Rights) in respect of data that we already hold or which we receive from third parties.

If the personal information we hold about you is inaccurate, incomplete, or no longer up to date then please contact us via email at info@charles-alan.com so that we may take reasonable steps to address this.

This Privacy Notice is regularly reviewed and may be updated from time to time to reflect changes in our business, or legal or commercial practice. Where an update is relevant to our processing of your data, we shall notify you of the same.

SECTION 1 This section applies to Candidates

1. Your Personal Data

1.1 The personal data we may receive or collect for you includes the following as applicable:

• Name
• Address
• Email and other contact details
• Date of birth
• Job history (including information relating to placements through us)
• Educational history, qualifications and skills
• Visa and other right to work or identity information
• Passport
• Bank details
• National insurance and tax (payroll) information
• Next of kin and family details
• Contact details of referees
• Personal information relating to hobbies, interests and pastimes
• Information contained in references and pre-employment checks from third parties
• Other sensitive personal information such as health records (see 'Sensitive Personal Data' section below)
• Technical information such as your Internet Protocol (IP address)
• Marketing preferences

1.2 We may obtain your personal data from a number of sources including, but not limited to:

• You (e.g. a Curriculum Vitae or job application)
• A Client
• Other Candidates
• Online job boards
• Marketing databases
• The public domain
• Social media
• At interview
• Conversations with you on the telephone or video conferencing (which may be recorded)
• Notes following a conversation or meeting
• Our websites and software applications

Where you are a Candidate and we have obtained your personal data from a third party such as an online job board, it is our policy to advise you of the source when we first communicate with you.

1.3 The processing of your personal information may include:

• Collecting and storing your personal data, whether in manual or electronic files
• Notifying you of potential roles or opportunities
• Assessing and reviewing your suitability for job roles
• Introducing and/or supplying you to actual or potential Clients
• Engaging you for a role with us or with our Clients including any related administration e.g. pre-employment screening, timesheets and payroll
• Collating market or sector specific information and providing the same to our Clients
• Sending information to third parties with whom we have or intend to enter into arrangements which are related to our Consultancy Services
• Providing information to regulatory authorities or statutory bodies and our legal or other professional advisers including insurers
• Marketing our Consultancy Services
• Retaining a record of our dealings
• Establishing quality, training and compliance with our obligations and best practice
• For the purposes of backing up information on our computer systems

1.4 For entering into and performing a contract with you:

In order to provide our Consultancy Services we may enter into a contract with you and/or a third party. In order to enter into a contract we will need certain information, for example your name and address. A contract will also contain obligations on both your part and our part and we shall process your data as is necessary for the purpose of those obligations. For example, in order to process payroll, a national insurance number and bank details will be required.

1.5 For compliance with legal obligations (regulatory and statutory obligations):

We must comply with a number of statutory provisions when providing our Consultancy Services which necessitate the processing of personal data.

Where we engage a person to work for us (whether directly or as supplied to a Client), there are other statutory obligations that must be complied with including payroll, tax, social security, HMRC reporting requirements and any other law or regulation.

We are also required to comply with statutory and regulatory obligations relating to business generally, for example complying with tax, bribery, fraud/crime prevention and data protection legislation, and co-operating with regulatory authorities such as HMRC or the Information Commissioner’s Office.

1.6 For our legitimate interests (carrying on the commercial activity of Consultancy Services):

In providing our Consultancy Services, we will carry out some processing of personal data which is necessary for the purpose of our legitimate interests, which include: 

• Retaining records of our dealings and transactions and, where applicable, use such records for the purposes of:
• establishing compliance with contractual obligations with Clients or suppliers
• addressing any query or dispute that may arise including establishing, exercising or defending any legal claims
• protecting our reputation
• maintaining a backup of our system, solely for the purpose of being able to restore the system to a particular point in the event of a system failure or security breach
• evaluating quality and compliance including compliance with this Privacy Notice
• determining staff training and system requirements
• Using your personal data to:
• assess suitability and contact you regarding potential opportunities and/or our services
• collate market information or trends including providing analysis to potential or actual Clients
• source potential opportunities or roles as part of our Consultancy Services
• personalise your experience and our offering, whether via our website or otherwise For our commercial viability, and to pursue these legitimate interests, we may continue to process your personal information for as long as we consider reasonably appropriate for these purposes.

SECTION 2 This section applies to Clients 

2. Your Personal Data

2.1 We may obtain your personal data in the course of our dealings including, but not limited to:

• Your contact information, which may include your full name, job role, contact telephone number and email
• Your statements and opinions about Candidates and/or other personnel e.g. a reference
• Information relating to our relationship with you or the party for whom you work including records of any meetings or discussions
• Technical information such as your Internet protocol (IP) address
• Your marketing preferences

2.2 We may obtain your personal data from various sources including, but not limited to:

• You, including where you have provided us with your contact details or other information for the purposes of using our Consultancy Services
• Staff or other representatives of the organisation you represent
• Candidates
• Marketing databases
• The public domain
• Social media
• Conversations, with you or others, on the telephone or video conferencing (which may be recorded) or in meetings
• Notes following a conversation, with you or others, or meetings you attend

2.3 We will process your personal data in the context of our dealings with the third party for whom you work and as part of our Consultancy Services which may include:

• Collecting and storing your personal data, whether in manual or electronic files
• Using the data to communicate with you
• Sending information to third parties with whom we have or intend to enter into arrangements which are related to our Consultancy Services
• Actions necessary to further any obligation on us pursuant to a contract between ourselves and the third party you work for
• Marketing our Consultancy Services
• Collating market or sector specific information
• Providing information to regulatory authorities or statutory bodies and our legal or other professional advisers including insurers
• Retaining records of our dealings with you and the organisation whom you represent
• Establishing quality, training and compliance with our obligations and best practice

2.4 Processing Your Personal Data

2.4.1 For compliance with legal obligations (regulatory and statutory obligations):

We must comply with a number of statutory provisions when providing our Consultancy Services which necessitate the processing of personal data.

We are also required to comply with statutory and regulatory obligations relating to business generally, for example complying with tax, bribery, fraud/crime prevention and data protection legislation, and co-operating with regulatory authorities such as HMRC or the Information Commissioner’s Office.

2..4.2 For our legitimate interests (carrying on the commercial activity of Consultancy Services): In providing our Consultancy Services, we will carry out some processing of personal data which is necessary for the purpose of our legitimate interests, which include:

• Using your personal data:
• to contact you regarding our Consultancy Services
• to assess suitability of Candidates and roles, for example, referencing or other feedback
• to collate market information or trends including providing analysis to potential or actual Clients
• as otherwise necessary to provide our Consultancy Services and/or to meet our obligations towards either the party whom you represent, or other Clients or suppliers
• to personalise your experience and our offering, whether via our website or otherwise
• Retaining records of our dealings and transactions and, where applicable, use such records for the purposes of:
• establishing compliance with contractual obligations with Clients or suppliers o             addressing any query or dispute that may arise including establishing, exercising or defending any legal claims
• protecting our reputation
• maintaining a backup of our system, solely for the purpose of being able to restore the system to a particular point in the event of a system failure or security breach
• evaluating quality and compliance including compliance with this Privacy Notice
• determining staff training and system requirements 

For our commercial viability, and to pursue these legitimate interests, we may continue to process your personal information for as long as we consider reasonably appropriate for these purposes.

SECTION 3 This section applies to all personal data

3. Consent to Processing Your Data

3.1 We may process your personal data on the basis that you have consented to us doing so for a specific purpose, for example:

• If you are a Candidate and you apply for a specific role you may have consented to our processing of the data that has been provided for the purpose of progressing your application and considering your suitability for that role. In other cases you may have provided your written or verbal consent to the use of your data for a specific reason.
• If you are Client and you have provided your personal data, and that of any organisation you represent, in order that we may use these to provide you with details of our Consultancy Services, then you may have consented to our processing of the data for that purpose. In other cases you may have provided your written or verbal consent to the use of your data for a specific reason, for example references.
• If you are a Supplier and you have provided your personal data, and that of any organisation you represent, in order that we may contact and correspond with you, then you may have consented to our processing of the data for that purpose. We may also hold confidential details about any services that you may supply to us, as well as your bank and other payment details in order to pay for your services and comply with statutory obligations.

3.2  You may withdraw your consent to our processing of your personal data for a particular purpose at any time.

However, please note that we may continue to retain, or otherwise use, your personal information thereafter where we have a legitimate interest or a legal or contractual obligation to do so. Our processing in that respect will be limited to what is necessary in furtherance of those interests or obligations. Withdrawal of consent will not have any effect on the lawfulness of any processing based on consent before its withdrawal. 2. Personal Data Obtained from a Third Party

3.3  Part of our business activity involves researching information relating to individuals for the purposes of filling job roles.

This may include obtaining personal data from online sources, for example we may obtain information from social media sites such as LinkedIn and job boards, some information being publicly available but others being from sites or providers to which we subscribe. From time to time we may also receive personal information about you from hiring organisations, colleagues and former employers, or from persons for whom you have provided services or been otherwise engaged.

3.4  Where information from third party sources is of no use to us, or where you have notified us that you do not want us to provide you with services, we shall discard it.

However, we may maintain a limited record in order to avoid the duplication of process. Where we consider that information may be of use to us in pursuance of the provision of our Consultancy Services, any processing will be in accordance with this Privacy Notice. Please refer to Section 3, Clause 8 (Your Rights) below if you wish to object to such processing.

3.5 Sharing Personal Data

3.5.1 We shall not share your personal information unless we are entitled to do so. The categories of persons with whom we may share your personal information include:

• Individuals, hirers and other third parties necessary for the provision of our Consultancy Services
• Any regulatory authority or statutory body pursuant to a request for information or any legal obligation which applies to us
• Parties who process data on our behalf, which may include outsourced payroll providers, IT support, storage service providers, background screening providers
• Within our Group
• Legal and professional advisers
• Insurers

3.6. Transfer of Data

3.6.1 Although this Privacy Notice applies to us your data may be accessible to, and shared with other organisations within our Group for any of the purposes set out within this Privacy Notice, or where we have shared administration systems and staff.

3.6.2 In the course of the provision of our Consultancy Services we may transfer data to countries or international organisations outside of the European Economic Area (“EEA”). This may, for example, be to Clients or Candidates, or third parties who provide support services to us. Where information is to be so transferred, it may be to a country in respect of which there is an adequacy decision from the European Commission. However, if this is not the case, it is our policy to take steps to identify risks and, in so far as is reasonably practicable, ensure that appropriate safeguards are in place.

3.6.3 In the event of a sale, merger, liquidation, receivership or the transfer of all or part of our assets to a third party, we may need to transfer your information to a third party. Any transfer will be subject to the agreement of the third party to this Privacy Notice and any processing being only in accordance with this Privacy Notice.

3.6.4 Charles Alan regularly reviews and implements new security and encryption technologies but no data transmission over the internet can be totally secure. Whilst Charles Alan strives to protect such information, we cannot ensure or warrant the security of any information you transmit to us and any transmission is at your own risk.

3.7 Sensitive Personal Data

3.7.1 Sensitive personal data (“SPD”) is information which is intensely personal to you and is usually irrelevant to our consideration of your suitability for a job role. Examples of SPD include information which reveals your political, religious or philosophical beliefs, sexual orientation, race or ethnic origin, or information relating to your health.

3.7.2 Regardless of the basis for your dealings with us, we request that you do not provide us with any sensitive personal data unless absolutely necessary. However, to the extent that you do provide us with any sensitive personal data, such as data which you choose to share with us in conversation, we shall only use that data for the purposes of our relationship with you or for the provision of our Consultancy Services. This will be for one or more of the following reasons:

• You have explicitly consented to the processing
• For the purpose of our assessment of your suitability for job roles or working capacity
• Where processing is necessary for the purpose of obligations or rights under employment, social security or social protection law
• To maintain records of our dealings to address any later dispute, including but not limited to the establishment, exercise or defence of any legal claims

3.8 Data Security and Confidentiality

3.8.1 It is our policy to ensure, in so far as is reasonably practicable, that our systems and records are secure and not accessible to unauthorised third parties in line with contemporary practice.

3.8.2 A cookie is a small text file that is downloaded on to your computer when you visit a website, which enables the website to tailor its offerings to your preferences when you visit it. We use cookies to record the unique actions of each user on the website, to keep the user logged in if they leave the website and return and to track the user’s session on the website for analytical purposes. Full details of how we use cookies please see below.

3.9 Data Retention

3.9.1 In most circumstances your data will not be retained for more than 7 years from the last point at which we provided any services or otherwise engaged with you and it is our policy to only store your personal data for as long as is reasonably necessary for us to comply with our legal obligations and for our legitimate business interests. However, we may retain data for longer than a 7 year period where we have a legal or contractual obligation to do so, or we form the view that there is otherwise a continued basis to do so, for example where your personal information identifies specialist skill sets which may remain in demand, or we are subject to a legal obligation which applies for a longer period. Where we have secured a placement either for you (if you are a Candidate) or with you (if you are a Client), your data will be retained for a maximum period of 10 years from the last point at which we provided any services or otherwise engaged with you.

3.9.2 If however, you believe that we should delete your personal data at an earlier date, please inform us in writing of your reasons. Please refer to Section 3, Clause 8 ‘Your Rights’ below.

3.9.3 We may archive part or all of your personal data or retain it in our financial systems only, deleting all or part of it from our other systems and databases. We may also anonymise parts of your data, particularly following a request for suppression or deletion of your data.

3.10 Your Rights

3.10.1 There may be circumstances where we require you to provide data which is necessary in order for us to meet statutory or contractual obligations, or perform our Consultancy Services. If you do not wish to provide us with information we request then please notify us. However, please be aware that as a result we may be unable to provide you or the party who you represent with a Consultancy Service and in some cases may result in a breach of the contract we have with you or a third party that you represent.

3.10.2 We take the protection of your personal data very seriously and it is important that you know your rights within that context, which include rights to:

• Request a copy of the personal data that we hold;
• Object to our processing of your data where that processing is based upon legitimate interest and there are no compelling grounds for the continued processing of that data;
• Request that we restrict processing of your data in certain circumstances;
• Request that data is erased where the continued use of that data cannot be justified;
• Object to any decision, which significantly affects you, being taken solely by a computer or via another automated process;
• Withdraw your consent to our processing of your personal data for a particular purpose at any stage. However, please note that we may continue to retain, or otherwise use your personal information thereafter, where we have a legitimate interest or a legal or contractual obligation to do so. Our processing in that respect will be limited to what is necessary in furtherance of those interests or obligations;
• Request that inaccurate or incomplete data is rectified;
• Request that data provided directly by you and processed by automated means is transferred to you or another controller but this right is only applicable where our processing of your data is based either on your consent or in performance of a contract;
• Request that direct marketing by us to you is stopped (and any such marketing emails from us will always include an unsubscribe link); and
• Make a complaint to the Information Commissioner's Office.

3.10.3  Please note that should you exercise your right to request that we erase data or cease any processing activity, we may retain a record of this request and the action taken in order to both evidence our compliance, and to take steps to minimise the prospect of any data being processed in the future should it be received again from a third party source.

3.10.4  If you have any questions concerning your rights, or should you wish to exercise any of these rights, or if you are dissatisfied about any aspect of the way in which your data is processed, please contact us via email at info@charles-alan.com. This does not affect your right to make a complaint to the Information Commissioner’s Office who can be contacted through the following link: https://ico.org.uk/concerns/.