Privacy Notice

1 About this notice

Placing People Direct Ltd. (“PPD”, “we”, “us” or “our”) provides recruitment services for permanent roles in England. This notice explains how we collect and use personal information when you register with us, apply for a vacancy, receive our recruitment services, subscribe to job alerts, contact us, leave a review, represent an employer or partner, or visit our UK website.

We may provide additional privacy information when collecting information for a particular service. Please read it alongside this notice.

2 Who is responsible for your information?

Placing People Direct Ltd. is the data controller for the personal information described in this notice. This means we decide why and how to use it.

For privacy enquiries, requests or complaints, email info@placingpeopledirect.co.uk.

An employer that receives a candidate’s information from us will usually be a separate data controller for its own recruitment decisions. Its privacy notice will explain how it uses that information.

3 Who this notice covers

This notice applies to candidates and applicants, job alert subscribers, employer clients and their representatives, prospective clients, employment referees, recruitment and training partners, people who leave reviews about PPD, website visitors, and people who contact us.

Our website may contain links to websites or services operated by others. Their own privacy notices explain how they use information collected through those services.

4 Information we collect

Depending on your relationship with us, we may collect:

• Identity and contact information: your name, title, email address, telephone number and address where relevant.
• Recruitment information: your CV, employment history, qualifications, standard examination results, continuing professional development (CPD) and other training records, professional registrations, skills, employment references, job preferences, availability, salary expectations, applications, interview information, feedback and placement history.
• Certificates and eligibility information: copies of relevant qualifications and training certificates; information about nationality, visa status and right to work; identity documents; and information needed to check suitability for a role.
• Sensitive information where relevant: information about health or disability needed to consider adjustments or role requirements, and criminal offence information contained in or associated with a DBS check. We may receive other sensitive information that you choose to include in an application.
• Client and partner information: professional contact details, vacancy requirements, correspondence, agreements, invoices and other records relating to our services.
• Communications and preferences: enquiries, messages, job alert subscriptions and records of requests not to receive communications.
• Public review information: the name or profile name displayed with a Google Business Profile review, its rating, text and other information the reviewer has made public in that review.
• Website information: technical and usage information collected when you use our website, including information collected through cookies or similar technologies.

A DBS result can be criminal offence information even if it records no convictions. We therefore apply additional safeguards when handling it.

5 Where information comes from

You may give us information when you apply for a vacancy, register with us, upload documents, complete a website or Jotform form, subscribe to job alerts, speak with us or send us an email.

We may also receive relevant information from employers, employment referees, recruitment or training partners, job boards, professional networking sites and publicly available professional profiles. We collect information from these sources only where it is relevant to providing our services.

If you leave a review on our Google Business Profile, we receive the information you make public in that review through Google. Google is responsible for its own platform and explains its processing in its privacy information.

6 How and why we use information

We use personal information where we have an appropriate lawful basis. Our main purposes and bases are set out below. Where we rely on legitimate interests, we consider whether our interests in providing recruitment services and running our business are outweighed by the effect on the people concerned.

Purpose — Information generally used — Lawful basis

Register candidates, understand their experience and preferences, and discuss opportunities — Contact and recruitment information — Our legitimate interests in providing recruitment services; steps taken at your request before a contract where applicable

Assess applications, match candidates to vacancies and arrange interviews — Recruitment, contact and relevant eligibility information — Our legitimate interests in finding suitable candidates and providing recruitment services; steps taken at your request before a contract where applicable

Introduce a candidate to a prospective employer and manage an offer or placement — Information relevant to the vacancy and recruitment process — Our legitimate interests in arranging introductions and placements; steps taken at your request before a contract where applicable

Help a candidate explore an apprenticeship opportunity they have asked us to pursue — Relevant contact, recruitment, qualification and eligibility information — Our legitimate interests in providing the requested recruitment service; steps taken at the candidate’s request before a contract where applicable

Liaise with a candidate’s DWP or other work coach where the candidate has asked or permitted us to do so — Information relevant to the agreed discussion — Consent where we specifically ask for it; otherwise our legitimate interests in providing a service the candidate has expressly requested, where appropriate

Obtain employment references, check qualifications and carry out relevant eligibility or safeguarding checks — Reference, certificate, identity and compliance information — Our legitimate interests in assessing suitability and meeting relevant recruitment requirements; a legal obligation where a particular check is required by law. Additional conditions apply to sensitive and criminal offence information

Manage relationships with employers, clients and partners, including vacancies, agreements, correspondence and payments — Professional contact, contractual and transaction information — Performance of a contract where the individual is a party to it; our legitimate interests in running our business; legal obligation where applicable

Respond to enquiries and provide requested information — Contact details and the enquiry — Our legitimate interests in responding; steps taken at your request before a contract where applicable

Send requested job alerts and annual subscription check-ins — Subscriber email address, alert preferences and necessary subscription and sending records — Consent

Send relevant professional communications to business contacts, where permitted — Professional contact details and communication history — Our legitimate interests, subject to applicable electronic marketing rules

Display Google reviews on our website and use selected reviews in PPD documents, client presentations and funding bids — Public review text, rating and displayed name or profile name — Our legitimate interests in showing genuine feedback about our services, subject to the reviewer’s rights and the considerations in Section 9

Maintain and protect our website and systems — Relevant technical and usage information — Our legitimate interests in operating and securing our services; legal obligation where applicable

Keep appropriate records, handle complaints and legal claims, and comply with legal requirements — Information relevant to the matter — Legal obligation where applicable; our legitimate interests in resolving disputes and protecting our business

More than one basis may apply where a purpose includes different activities. We will explain if particular information is needed to progress an application or meet a legal requirement, and what may happen if it is not provided.

7 DBS checks and other sensitive information

We request and use DBS information only where it is relevant and lawful for a particular role. We may receive copies of DBS certificates and other documents through Jotform, email or other recruitment communications. Staff may need temporary access to copies while completing recruitment checks.

DBS certificate contents, other criminal offence information and certain information about health or disability require extra protection. Before using them, we identify an appropriate lawful basis and the applicable additional condition under data protection law. We restrict access to people who need the information for the relevant recruitment purpose and share it only where necessary and lawful.

Once the recruitment decision and immediate checks are complete, we delete copies of DBS certificates unless a specific, documented reason requires a copy for longer, such as a relevant dispute or safeguarding audit. Any extended retention has a recorded reason and review or deletion date. This includes copies held in form submissions, email attachments, downloads and on staff laptops.

Where appropriate, we retain a limited record of the check and recruitment decision as part of the candidate’s placement record. Other certificates, such as qualifications and training evidence, are retained only where relevant to the candidate record and are reviewed under the periods in Section 14.

Where the additional legal condition we rely on requires an appropriate policy document, we maintain one covering our handling and retention of the relevant information.

8 Who we share candidate information with

We share information relevant to an application with prospective employers considering the candidate for a role. We limit this to information appropriate to the vacancy and recruitment stage.

If a candidate wishes us to help them obtain an apprenticeship, we may share relevant details with an apprenticeship organisation or provider involved in that opportunity.

Where a candidate has asked or permitted us to coordinate with their DWP or other work coach, we may share information needed for that agreed purpose. Permission for that discussion does not mean we will send the work coach the candidate’s entire recruitment file. We will agree the purpose and scope with the candidate.

These arrangements sit alongside the other disclosures described in Section 11. Sharing information for a particular recruitment purpose does not mean that we sell it.

9 Google reviews and testimonials

We may invite people to leave a review of PPD through Google Business Profile. Leaving a review is voluntary, and the reviewer chooses what to publish through Google.

Our website may display reviews through a feed from Google. We may also select genuine reviews for use in internal documents, presentations to clients or other organisations, and funding bids. These uses may include the review text, rating and the name or profile name displayed publicly with it. We do not treat a public review as permission to disclose other information from a person’s private candidate record.

A review displayed through a live feed may change or disappear if it is changed or removed on Google. A review already placed in a document or presentation may need to be updated separately. If you have a concern about PPD’s use of your review, email info@placingpeopledirect.co.uk. You can manage the original review through Google.

10 Job alerts and communication choices

If you subscribe to job alerts, our service retains your email address, alert preferences, subscription status and dates, and limited sending records needed to provide and manage alerts and annual check-ins. A job-alert subscription does not require a CV or full candidate registration. You can unsubscribe using the link in an alert or by emailing info@placingpeopledirect.co.uk. We stop sending alerts when you unsubscribe.

We may retain the minimum information needed to record an unsubscribe request and prevent an address from being added back to a mailing list by mistake. We review these suppression records annually, but do not automatically erase them while they remain necessary to respect the request.

You can also tell us if you do not want to receive other recruitment or professional communications.

We also send active, confirmed job-alert subscribers an annual job-search check-in around their subscription anniversary. It invites them to review alert preferences and, if previously registered, contact us to update their registration details. They can unsubscribe at any time. Sending the email or receiving no reply does not renew consent or reset candidate retention periods.

11 Who else we share information with

Where necessary for the purposes described in this notice, we may share relevant information with:

• Employment referees, qualification bodies and providers involved in appropriate checks;
• Recruitment, training and referral partners involved in providing a service;
• Providers of website forms, hosting, email, recruitment, storage and other business systems;
• Professional advisers, including legal, accounting and insurance advisers; and
• Regulators, public authorities or law enforcement bodies where sharing is required or permitted by law.

We limit what we share to information relevant to the purpose. Providers acting on our instructions are required to protect information and use it for the agreed service. An employer or other recipient using information for its own purposes may be a separate data controller.

We do not sell or rent personal information to third parties.

12 Cookies

Our separate Cookie Policy (https://placingpeopledirect.co.uk/cookie-policy/) explains the cookies and similar technologies used on the UK website, their purposes and the choices available to you. Where consent is required, we ask for it before using the relevant technology.

13 International transfers and security

Some providers of the systems we use may store information outside the UK or permit access to it from another country. Where we make a transfer subject to the UK’s international transfer rules, we use an applicable legal route and required safeguards. You can contact us at info@placingpeopledirect.co.uk for information about safeguards relevant to your information.

We use measures designed to protect personal information against loss, unauthorised access, alteration and disclosure. Access to recruitment documents and sensitive information is limited to staff who need it for their work. Because documents can arrive through forms and email, our procedures also cover copies downloaded to staff devices and retained in mailboxes. We assess suspected personal data breaches and make notifications where the law requires them.

Jotform forms and deletion

We use Jotform as a processor to collect and manage form submissions and uploaded documents on our behalf. PPD remains responsible for what we collect, why we use it, retention and your rights. Jotform offers a Data Processing Addendum and GDPR-supporting features. Jotform also processes some account, service and technical information under its own privacy notice: https://www.jotform.com/privacy/.

 We store applicant information for our UK recruitment activities in Jotform's European data centre (currently Frankfurt, Germany). According to our provider, EU‑hosted data and routine backups remain within the EU. We do not routinely share applicant information with the provider’s support staff. In the rare event that technical assistance requires access to applicant information, this will be handled under the provider’s data protection arrangements and may involve support personnel located outside the UK or EU, with appropriate safeguards for international transfers. 

Jotform uses security measures including encryption during transmission, access controls and security testing. PPD manages its account and form settings to restrict access to applicant information and uploaded documents.

Further information about Jotform’s security and data protection arrangements is available at https://www.jotform.com/security/ and https://www.jotform.com/gdpr-compliance/.

We retain live submissions according to the relevant periods in this notice, rather than assuming Jotform automatically deletes them. Deleting a submission normally moves it into Trash, where Jotform says it remains for up to 30 days unless permanently deleted sooner. Our procedure includes removing the relevant entry from Trash using Delete Forever and checking other copies, including uploaded documents, email notifications, downloads and connected systems.

Permanent deletion from the account does not mean every recovery copy disappears instantly. Jotform’s published security policy describes hourly backup snapshots retained for 30 days. Information already in a snapshot may therefore remain until that snapshot expires under the provider’s backup cycle. Such copies must remain beyond ordinary use, and any restoration must be followed by reapplying the deletion. We check provider arrangements and explain any relevant delay or lawful retention exception when responding to a request.

Minimal records after deletion and contact objections

We may retain a limited record of a rights request, the decision and action taken where necessary to demonstrate compliance or address a legal claim. This may include a record reference, the minimum identifying details, relevant permission history, dates and the reason and review date for continued retention. This is not permission to keep a full registration form, CV or supporting documents indefinitely.

If an individual or business asks us not to contact them, we keep only the identifying and contact details needed to honour that request, such as their name, company, email address or telephone number, the date and scope of the request. We use this restricted Do Not Contact record to screen outreach and new contact lists, not to market to them. We review it at least annually and retain it only while necessary to prevent unwanted contact. A marketing objection does not prevent a legally required communication or a necessary response about the request itself.

Information already shared with another organisation

Where we erase or restrict relevant information that we have disclosed, we notify the recipients unless this is impossible or involves disproportionate effort. We can tell you who those recipients are on request. We ask recipients to confirm their action and explain any information they lawfully retain. An independent organisation, such as DWP, may have its own lawful retention duties; withdrawing permission for PPD to share information does not necessarily require it to delete all its records. We explain confirmed actions and outstanding limitations rather than guaranteeing another organisation’s deletion.

14 How long we keep information

We keep personal information only while it is needed for a relevant purpose, subject to applicable legal requirements and any documented need to deal with a complaint, safeguarding matter, investigation or claim.

• Record — Standard retention period or approach
• Placed candidate’s core recruitment and placement record — Six years after the placement ends or PPD last provides recruitment services to that candidate, whichever is later. We may retain relevant records longer where a specific investigation, claim or safeguarding matter requires it, recording the reason and reviewing the need.
• Candidate not placed by PPD — Two years after the last meaningful recruitment contact or service, then delete or anonymise the record unless a particular legal matter requires longer
• Copies of DBS certificates and their contents — Delete once the recruitment decision and immediate checks are complete, unless a specific, documented reason justifies a longer period; review and delete any retained copy when that reason ends
• Limited record of a DBS check and recruitment decision — Retain where relevant as part of the applicable candidate placement or recruitment record, without routinely retaining a copy of the certificate
• Other qualification and training certificates — Retain only where relevant to the applicable candidate record; review them when that record reaches the end of its retention period
• Active job alert subscription — Retain the email address, alert preferences and necessary subscription and sending records while the subscription remains active; remove information no longer needed after unsubscribe, retaining only necessary suppression or compliance records
• Job alert suppression record — Retain the minimum information needed to honour an unsubscribe request; review annually and delete when it is no longer needed for that purpose
• Substantive client correspondence, contracts and general business records — Seven years as PPD’s standard period, subject to a documented reason for longer retention
• Standalone website enquiry that does not become a candidate or client matter — Two years after the enquiry is resolved
• Enquiry that becomes part of a candidate or client matter — Apply the retention period for the resulting matter
• Review content used in PPD materials — Review its continued use periodically and remove or update it when it is no longer needed or following an applicable rights request

The relevant period applies to information wherever PPD holds a copy, including recruitment systems, Jotform submissions, email folders and staff devices. We delete or anonymise records when their retention period ends, unless a documented exception applies.

15 Your rights

Depending on the circumstances and any applicable exemptions, you may have the right to:

• Request access to your personal information;
• Ask us to correct inaccurate or incomplete information;
• Ask us to erase information;
• Ask us to restrict its use;
• Object to processing based on legitimate interests or to direct marketing;
• Receive certain information you provided in a portable format; and
• Withdraw consent where consent is our basis for processing.

To make a request, email info@placingpeopledirect.co.uk. We may ask for proportionate information to confirm your identity. We will respond within the time required by law and tell you if a permitted extension applies.

16 Automated decisions

A person reviews every application. We do not automatically reject, rank or shortlist candidates without human review, or make recruitment decisions about individuals solely through automated processing that produces legal or similarly significant effects.

17 Changes to this notice

We may update this notice when our services, systems or legal obligations change. The date at the top shows when it was last updated. Please tell us if information relevant to your recruitment record changes so that we can keep it accurate.

18 Questions and complaints

If you have a question, wish to exercise a right or want to complain about our use of your information, email info@placingpeopledirect.co.uk. We will acknowledge a data protection complaint within 30 days, look into it, keep you informed and communicate the outcome without undue delay.

You may also complain to the Information Commissioner’s Office (ICO) through ico.org.uk/make-a-complaint (https://ico.org.uk/make-a-complaint). You do not have to complain to us before contacting the ICO.