Home / Privacy Policy

Privacy Policy

⚠️

This is an unreviewed draft, not a compliant published policy. It sets out a sensible structure under the UK GDPR and the Data Protection Act 2018, but it has not been reviewed by a data protection specialist, and it describes intended practice rather than audited fact. Publishing an inaccurate privacy notice is itself a compliance failure — every statement below must be verified against what the Platform actually does before this goes live. Items in [SQUARE BRACKETS] must be completed.

Version 0.1 — DRAFT · Last updated 15 July 2026

1. Who we are

[LEGAL ENTITY NAME] (“we”) is the controller of personal data processed through the Hire IT Manager platform. We are registered in England and Wales, company number [COMPANY NUMBER], registered office [REGISTERED ADDRESS].

ICO registration number: [ICO REGISTRATION NUMBER].

Data protection contact: [DPO / PRIVACY CONTACT NAME AND EMAIL].

[TO CONFIRM: whether a statutory DPO is required, and whether we act as controller or processor for each category below — the answer differs for verification data and may differ for data shared with Clients.]

2. What we collect

If you're an IT Manager

Profile data: name, contact details, location, role history, skills, day rate, availability, stated IR35 position.
Verification data: identity documents, right-to-work evidence, residency confirmation, reference responses.
Preference data: employers you've asked to be hidden from, the roles you want to hear about.
Engagement data: briefs you're matched to, messages, contracts, gig delivery records.

If you're a Client or Recruiter

Account data: name, work email, company, role, company size, sector.
Brief data: project descriptions, budget, timelines, engagement type.
Transaction data: fees, invoices, payment references (card details are handled by [PAYMENT PROVIDER], not by us).

Everyone

Technical data: IP address, device and browser information, pages viewed. See section 8 on cookies.

Identity documents may reveal information capable of being special category data or criminal-offence data. [TO CONFIRM: whether any special category data is in fact processed, and if so which Article 9 condition and DPA 2018 Schedule 1 condition applies, and whether an Appropriate Policy Document is required.]

3. Why we use it, and our lawful basis

To operate your account and provide the Platform — performance of a contract.
To match profiles to briefs, including the off-market sweep — legitimate interests (operating a talent marketplace users have chosen to join), balanced against your preferences, which you control.
To verify identity, right to work and references — legitimate interests and compliance with legal obligations. This is the core promise of the Platform.
To take payment and pursue fees — performance of a contract and legitimate interests.
To prevent fraud, scraping and misuse — legitimate interests.
To send service messages — performance of a contract.
To send marketing — consent, or the soft opt-in where permitted. You can withdraw at any time.
To meet tax, accounting and legal obligations — legal obligation.

Where we rely on legitimate interests we have carried out (or must carry out) a balancing assessment. [TO CONFIRM: complete and document an LIA for the off-market sourcing activity in particular — contacting people who are not actively looking is the highest-risk processing on this Platform and needs a defensible assessment.]

4. Automated matching

The match engine scores profiles against briefs and produces a ranked shortlist with a confidence score. This affects which opportunities you're shown or approached about.

Hiring decisions are made by humans. We do not consider this to be a decision producing legal or similarly significant effects taken solely by automated means, because the engine shortlists and a person decides. [TO CONFIRM: this analysis must be checked against Article 22 UK GDPR by a specialist. If the engine ever gates access to opportunities without human involvement, the position changes and additional safeguards are required.]

You can ask us how a score was reached, and you can correct the profile data behind it at any time.

Clients — your profile, once you've engaged with a brief or agreed to an approach. Employers you've hidden from won't see you.
Recruiters — database access, subject to your contact preferences.
Verification providers — [NAME PROVIDERS] for identity and right-to-work checks.
Payment providers — [NAME PROVIDER] for holding and releasing funds.
Infrastructure and support suppliers — [NAME HOSTING / EMAIL / ANALYTICS PROVIDERS], under contract.
Professional advisers, insurers, and authorities where legally required.

We do not sell personal data.

6. Where data is held

We intend to store and process personal data in the UK. This matters here more than on most platforms: “UK data residency” is something we advertise, so it has to be true of every supplier in the chain, not just our own servers.

[TO CONFIRM: audit every processor — hosting, email, analytics, support tooling, verification and payment providers — and confirm no data leaves the UK. If any transfer does occur, name the country, the safeguard relied on (adequacy regulations or the IDTA/Addendum), and correct the “UK data residency” claim on the marketing pages. An inaccurate residency claim is both a compliance and an advertising problem.]

7. How long we keep it

Active accounts: for as long as the account is open.
Closed accounts: [PERIOD] after closure, then deleted or anonymised.
Verification records: [PERIOD] — must align with the retention periods appropriate to right-to-work evidence.
Engagement and financial records: [PERIOD] to meet tax and accounting obligations.
Marketing preferences: retained as long as needed to honour your choice.

[TO CONFIRM: set and justify each period. “As long as necessary” is not a retention policy.]

8. Cookies

We use cookies that are strictly necessary to run the Platform, and [ANALYTICS / PREFERENCE / MARKETING] cookies where you consent.

Non-essential cookies are only set after consent, and you can change your choice at any time via [COOKIE SETTINGS LINK].

[TO CONFIRM: complete a cookie audit and populate a full cookie table — name, provider, purpose, duration. PECR requires consent for non-essential cookies before they are set, and this is one of the most commonly enforced failures.]

9. Your rights

Under the UK GDPR you have the right to: be informed; access a copy of your data; have inaccurate data corrected; have data erased in certain circumstances; restrict processing; data portability; object to processing based on legitimate interests, including profiling; and object to direct marketing at any time, which is absolute.

Where we rely on consent, you can withdraw it at any time without affecting prior processing.

To exercise any right, contact [PRIVACY EMAIL]. We will respond within one month, extendable by two further months for complex requests, and we'll tell you if we need to extend.

If you're unhappy with how we've handled your data you can complain to the Information Commissioner's Office at ico.org.uk, or by calling their helpline. We'd rather you came to us first so we can put it right.

10. Security

We use technical and organisational measures appropriate to the risk, including encryption in transit, access controls and logging.

[TO CONFIRM: document the actual measures, including how identity documents are stored and who can access them, and establish a personal data breach procedure that can meet the 72-hour notification deadline. Do not publish a security claim you cannot evidence.]

11. Changes to this policy

We'll update this policy as the Platform changes. Where a change is material we'll tell you by email before it takes effect, and we'll keep the version number and date at the top current.