Your data stays in the UK. Here's exactly how we handle it.
We're a UK-only platform, and that applies to the data as much as the talent. This page sets out what we collect, why we're allowed to, where it physically lives, how the match engine uses it, and how to make us delete it. Written to be read — not to be survived.
This is an unreviewed draft, not a published compliance statement. It sets out a defensible structure under the UK GDPR and the Data Protection Act 2018, but it has not been reviewed by a data protection specialist and it describes intended practice rather than audited fact. Two things must happen before it goes live: every claim below — above all the UK data residency claim — must be verified against what the platform actually does, and items in [SQUARE BRACKETS] must be completed. Publishing an inaccurate privacy statement is itself a breach of the UK GDPR, so an unverified promise here is worse than no page at all.
The short version
We collect what we need to match you to work or to talent — your contact details, your postcode, your skills, your rate and your availability. We keep it on servers in the United Kingdom. We don't sell it. The match engine ranks people using this data, but a human always makes the actual decision. You can see it, correct it, export it or have it deleted, and we have to respond within a month. If we get it wrong you can complain to us, and then to the ICO.
Everything below is the detailed version of that paragraph. If you only read one other section, read your rights.
Who we are
[LEGAL ENTITY NAME] (“Hire IT Manager”, “we”) is a company registered in England and Wales, company number [COMPANY NUMBER], registered office [REGISTERED ADDRESS]. We are the data controller for the personal data described on this page, which means we decide what is collected and why, and we're accountable for it.
We are registered with the Information Commissioner's Office under registration number [ICO REGISTRATION NUMBER]. Our data protection contact is [DPO / PRIVACY CONTACT NAME AND EMAIL].
When an employer or recruiter uses our platform to look at candidates, they become a controller of that data in their own right for what they then do with it. We're responsible for the platform; they're responsible for their own hiring decisions and records.
Where your data lives
This is the part most platforms are vague about, so we'll be specific. Our commitment is that personal data on this platform is stored and processed in the United Kingdom — primary storage, backups and disaster-recovery copies included. We are a UK-only marketplace and we think the data should be held to the same standard as the talent.
| What | Where it lives | Provider |
|---|---|---|
| Application database | United Kingdom — [REGION, e.g. London] | [NAME PROVIDER] |
| Uploaded documents (CVs, right-to-work evidence) | United Kingdom — [REGION] | [NAME PROVIDER] |
| Backups & disaster recovery | United Kingdom — [SECOND REGION] | [NAME PROVIDER] |
| Email & notifications | [REGION] | [NAME PROVIDER] |
| Payment & escrow processing | [REGION] | [PAYMENT PROVIDER] |
| Analytics | [REGION] | [NAME PROVIDER] |
“All data stays in the UK” is easy to say and hard to do. Payment processors, email providers, error-logging tools, analytics and even embedded web fonts routinely move data — often only an IP address, but that is still personal data — outside the UK. If any part of our stack does that, we will say so in the table above and cover it under international transfers rather than quietly claim otherwise. Where a supplier can't guarantee UK residency, the honest answer is to name it, not to round the claim up.
What we collect
It depends on who you are. We try to collect the minimum that makes the platform work.
If you're an IT Manager or job seeker
- Identity and contact — name, email, phone.
- Home postcode — used to calculate how far you are from a role. We store the postcode and its coordinates, not your street address.
- Skills — the ones you select when you register or edit your profile.
- Professional details — current or most recent role, years of experience, day rate, availability, IR35 position, how far you'll travel.
- Right-to-work evidence — see below, it's handled differently.
- Hidden-employer list — if you ask us to keep you invisible to named companies, we store that list to enforce it.
- Platform activity — applications, messages, gigs, match history.
If you're an employer or recruiter
- Contact details of the individuals using the account.
- Company information — name, size, sector, office postcode (which anchors distance matching).
- Briefs, vacancies and shortlists you create.
- Billing details, held by our payment provider rather than by us.
Everyone
- Technical data — IP address, browser, device, pages viewed. This is personal data even though it doesn't have your name on it.
Why we're allowed to use it
Under the UK GDPR we need a lawful basis for every use. Ours:
| What we do | Lawful basis |
|---|---|
| Run your account, match you, take payment | Contract — we can't provide the service without it |
| Verify identity and right to work | Legitimate interests — the UK-only, verified promise is the product, and buyers rely on it. [CONFIRM WITH SPECIALIST — may be legal obligation depending on the platform's role] |
| Keep the platform secure, prevent fraud | Legitimate interests |
| Keep records for tax and accounting | Legal obligation |
| Send marketing email | Consent — you opt in, and you can opt out any time |
| Non-essential cookies and analytics | Consent |
Where we rely on legitimate interests we've weighed our interest against your rights, and you can object.
Right-to-work evidence
Verifying that everyone on the platform has the right to work in the UK is the foundation of what we sell. It also means handling documents — passports, share codes, visas — that deserve more care than a CV.
- We collect the minimum needed to complete the check.
- Access is restricted to staff performing verification, and access is logged.
- Documents are stored encrypted, in the UK, separately from your public profile.
- Employers and recruiters see a verification status — verified or pending — not your documents.
- We delete or redact documents once the check is complete and the retention period expires. See retention.
Right-to-work documents can reveal nationality and immigration status. That isn't “special category” data under the UK GDPR in the way health or ethnicity is, but it is sensitive and can be a proxy for it, so we treat it with the same care and we don't use it for anything other than the check. It never feeds the match engine.
The match engine & automated decisions
Our engine scores people against briefs. Roughly 75% of that score comes from your skills and your distance from the role, with availability, rate and IR35 position making up the rest. That is profiling, and you're entitled to know it's happening and how it works.
The UK GDPR gives you a right not to be subject to decisions based solely on automated processing where those decisions have a legal or similarly significant effect — and being screened out of work would qualify. So:
- The engine shortlists. A human decides. We don't auto-reject anyone, and no one is hired or rejected by the algorithm alone.
- You can see your own scores and which skills matched or didn't, on your dashboard.
- You can fix the inputs — edit your skills, postcode, rate or availability and the ranking changes immediately.
- You can ask for a human review of any match outcome, and challenge it.
A match score is a confidence estimate built from what people have told us. It can't tell whether you'd get on with the team, and a high score is a reason to interview someone — never a reason to skip interviewing them. We say the same thing to employers, on the record, on our how it works page.
Your rights
These are yours by law. Exercising them is free, and we have one month to respond (extendable by two months for genuinely complex requests, in which case we'll tell you why).
| Right | What it means in practice |
|---|---|
| Access | Get a copy of everything we hold on you, and an explanation of what we do with it. |
| Rectification | Correct anything wrong — most of it you can edit yourself on your dashboard. |
| Erasure | Have your data deleted. Sometimes we must keep some of it — see retention — and we'll tell you exactly what and why. |
| Restriction | Tell us to stop using it while a dispute or correction is sorted out. |
| Portability | Get your data in a machine-readable format, or have us send it to another provider. |
| Object | Object to processing based on legitimate interests, including profiling. Object to marketing and we stop, full stop, no balancing test. |
| Automated decisions | Ask for human involvement in, and challenge, any decision made about you by profiling. See the match engine. |
| Withdraw consent | Where we relied on consent, withdraw it at any time. It doesn't undo what was lawful beforehand. |
To exercise any of these, email [PRIVACY EMAIL]. We may ask you to confirm your identity — not to obstruct you, but because handing your data to someone impersonating you would be the worse failure.
How long we keep it
The law doesn't set fixed periods; it says keep it no longer than necessary and be able to justify what you chose. Ours:
| Data | Kept for | Why |
|---|---|---|
| Active account & profile | While your account is open | To provide the service |
| Closed account | [PERIOD] after closure, then deleted | Disputes, re-registration |
| Right-to-work evidence | [PERIOD] after the check | Audit trail of verification |
| Contracts & placements | [PERIOD] | Contractual and legal claims |
| Payment & escrow records | 6 years [CONFIRM] | UK tax and accounting requirements |
| Marketing consent records | Until withdrawn + [PERIOD] | Evidence of consent |
| Server & access logs | [PERIOD] | Security and fraud prevention |
Security
- Encrypted in transit (TLS) and at rest.
- Access limited to staff who need it, with individual accounts and multi-factor authentication.
- Access to right-to-work documents and escrow records is logged.
- Fund releases require a deliberate, logged admin action — never automatic.
- Suppliers are assessed before they touch personal data, and bound by written terms.
- [PENETRATION TESTING CADENCE] and [CERTIFICATIONS, e.g. Cyber Essentials Plus, ISO 27001 — only claim these once actually held].
Certifications are verifiable. Claiming ISO 27001 or Cyber Essentials without holding them is a straightforward misrepresentation, and on a platform that sells verification it would be a fatal one. Leave the bracket empty until the certificate exists.
International transfers
Our position is that personal data stays in the UK. Where any transfer outside the UK is genuinely unavoidable — a supplier with no UK region, for example — we will only do it where one of these applies:
- The country is covered by UK adequacy regulations; or
- The transfer is covered by the UK International Data Transfer Agreement (IDTA), or the UK Addendum to the EU Standard Contractual Clauses, supported by a transfer risk assessment.
Any such transfer will be named in the table under where your data lives. We would rather list an exception honestly than make a blanket promise we can't keep.
Cookies & third parties
We use cookies that are strictly necessary to run the site and keep you signed in — these don't need your consent. Anything else — [ANALYTICS / PREFERENCE / MARKETING] — is only set if you agree, and you can change your mind at [COOKIE SETTINGS LINK].
Embedded third-party content is worth calling out specifically. Web fonts, maps, videos and analytics scripts loaded from another company's servers transmit your IP address to that company simply by loading the page — before you've clicked anything. That is a transfer of personal data, and if the provider is outside the UK it is an international transfer. Our policy is to self-host fonts and static assets so that loading a page doesn't quietly send you anywhere. [VERIFY THIS IS TRUE OF THE LIVE SITE BEFORE PUBLISHING — see the deployment note.]
If something goes wrong
If there's a personal data breach that risks your rights and freedoms, we report it to the ICO within 72 hours of becoming aware. If it's likely to be a high risk to you, we tell you too, without undue delay and in plain language — what happened, what data, what we're doing, what you should do.
Complaints & the ICO
Tell us first at [PRIVACY EMAIL] — most things are a mistake we can fix quickly. But you don't have to come to us first, and you never lose the right to go to the regulator.
You can complain to the Information Commissioner's Office, the UK's independent data protection authority, at ico.org.uk, on 0303 123 1113, or by post at Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF. Complaining to the ICO is free.
Contact us
Data protection contact: [DPO / PRIVACY CONTACT NAME AND EMAIL]
Post: [LEGAL ENTITY NAME], [REGISTERED ADDRESS]
General: hire-it-manager.co.uk
See also our Privacy Policy and Terms.
Questions about your data?
Ask us. We'd rather explain it once, properly, than have you wondering what we do with your postcode.