In short: we use your information to help you find work or to help you hire, we never sell it, we keep it only as long as we need it, and you stay in control of it.
Who we are
Xpert-Career is a trading name of Xpert-Career Ltd, a company registered in England and Wales under company number 15911085, whose registered office is at 30 Riverhead Close, London, England, E17 5PY.
Xpert-Career (“we”, “us”, “our”) is the data controller of the personal data described in this policy. This means we decide how and why your personal data is processed, and we are responsible for looking after it in line with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, the Privacy and Electronic Communications Regulations 2003 (PECR) and the Data (Use and Access) Act 2025.
If you have any questions about this policy or how we handle your personal data, please contact us using the details at the end of this page.
Who this policy applies to
This policy explains how we collect and use personal data about:
- Candidates — people looking for work, people whose CVs we source on behalf of clients, and workers we place in temporary or permanent roles;
- Clients — the individuals we deal with at businesses that use our recruitment or CV sourcing services;
- Referees and emergency contacts provided to us by candidates;
- Suppliers and business contacts; and
- Website visitors and anyone who contacts us.
The information we collect
Candidates
- Identity and contact details — name, address, email address, telephone number, date of birth;
- CV information — employment history, qualifications, education, skills, professional memberships and training;
- Job preferences — desired roles, locations, salary expectations, notice period and availability;
- Right-to-work information — passport, visa or share-code details and other documents required by law;
- References and interview notes, assessment results and feedback from clients;
- For temporary workers — National Insurance number, bank details, tax and pay information, and timesheets;
- Any other information you choose to give us.
Clients and business contacts
- Name, job title, employer, business email address and telephone number;
- Details of vacancies, our communications with you, and billing information.
Website visitors
- Information you submit through our contact form — name, phone number, email address, subject and message;
- Information you submit through our CV upload form — your name, contact details, current and desired job title, current and desired location, desired salary range (optional) and your CV. Uploaded CVs are stored securely on our server in a private folder that is not accessible from the internet;
- Limited technical information such as your IP address, browser type and pages visited, which our hosting provider records in server logs for security purposes.
How we collect your information
We collect personal data:
- Directly from you — when you send us your CV or upload it through our website, register with us, attend an interview, contact us by phone or email, or use our website contact form;
- From job boards and professional networking sites — as part of our CV Sourcing Services we search UK job boards and CV databases where you have chosen to make your CV available to recruiters;
- From third parties — such as referees, clients (for example interview feedback), people who recommend you to us, and background-checking providers where required for a role.
Where we obtain your personal data from somewhere other than you, we will tell you within a reasonable period, and at the latest within one month, or at the point we first contact you, unless an exemption applies.
How we use your information and our lawful bases
We must have a lawful basis under Article 6 of the UK GDPR for each way we use your personal data. The table below sets out our purposes and lawful bases.
| Purpose | Lawful basis |
|---|---|
| Finding suitable roles for candidates, assessing suitability and introducing candidates to clients | Legitimate interests (running a recruitment business and helping candidates find work); steps taken at your request before entering into a contract |
| Sourcing and screening CVs on behalf of clients | Legitimate interests (providing our services to clients and connecting candidates with suitable opportunities) |
| Checking right to work in the UK, and keeping the records UK law requires recruitment businesses to hold | Legal obligation |
| Paying temporary workers, deducting tax and National Insurance, and auto-enrolment pensions | Performance of a contract; legal obligation |
| Managing our relationship with clients and suppliers, invoicing and collecting payment | Performance of a contract; legitimate interests |
| Responding to enquiries sent through our website, by email or by phone | Legitimate interests (responding to people who contact us); steps taken at your request |
| Sending information about our services to business contacts | Legitimate interests, or consent where PECR requires it. You can opt out at any time. |
| Keeping our website and systems secure, and preventing fraud | Legitimate interests |
| Establishing, exercising or defending legal claims | Legitimate interests; legal obligation |
Where we rely on legitimate interests, we have balanced our interests against your rights and freedoms. You can ask us for more information about this balancing test and you have the right to object (see Your Data Rights).
We will always discuss a role with you before we send your CV to a prospective employer.
Special category and criminal offence data
Some information is more sensitive, such as information about your health, ethnic origin, religion or sexual orientation (“special category data”), and information about criminal convictions. We only collect this information where it is necessary and the law allows it, for example:
- health information so that we and our clients can make reasonable adjustments during the recruitment process, under our obligations in employment law;
- equal opportunities monitoring information, which is optional and is used only in anonymised form to monitor and promote equality; and
- criminal record information where a role legally requires a check, for example under the Rehabilitation of Offenders Act 1974 (Exceptions) Order 1975.
We process this data under Article 9 and Article 10 of the UK GDPR and the conditions in Schedule 1 to the Data Protection Act 2018, and we hold an appropriate policy document where required.
Who we share your information with
We only share personal data where it is necessary and lawful. We may share it with:
- Clients (prospective employers) — to put candidates forward for roles, always after discussing the role with the candidate first;
- Service providers who help us run our business, such as IT, email and cloud hosting providers, website hosts, payroll providers and accountants. They act on our instructions under a written contract and must keep your data secure;
- Referees and background-check providers, where needed for a role;
- Professional advisers such as lawyers, auditors and insurers;
- Government bodies and regulators, such as HMRC, the Home Office, the police or the ICO, where we are required by law; and
- a buyer or successor if all or part of our business is sold or reorganised.
We never sell your personal data.
International transfers
Some of our service providers may store or process data outside the UK. Where personal data is transferred outside the UK, we make sure it is protected by one of the safeguards required by UK data protection law. These include a UK adequacy regulation (for example for the European Economic Area), the International Data Transfer Agreement, or the UK Addendum to the EU Standard Contractual Clauses. Contact us if you would like more information.
How long we keep your information
We keep personal data only for as long as we need it for the purposes described in this policy:
| Information | Retention period |
|---|---|
| Candidate CVs and records (no placement made) | Up to 2 years from our last meaningful contact with you |
| Records of candidates we have placed, and records required by the Conduct Regulations 2003 (SI 2003/3319) | At least 1 year from creation, or from the date we last provided services, and up to 6 years for contract and legal claim purposes |
| Right-to-work documents | For the duration of the engagement plus 2 years |
| Payroll, tax and financial records | 6 years from the end of the relevant tax year |
| Client contracts and correspondence | 6 years from the end of the contract |
| Website and email enquiries that do not lead to further dealings | Up to 12 months |
After these periods, we securely delete or anonymise the data.
How we protect your information
We use appropriate technical and organisational measures to protect your personal data against accidental loss, misuse, unauthorised access, alteration or disclosure. These include encrypted connections (HTTPS), access controls, password-protected systems, and staff training on data protection. Only people who need your data for their work can access it.
If a personal data breach is likely to cause a risk to you, we will report it to the ICO within 72 hours. If the risk to you is high, we will also tell you without undue delay.
Your rights
Under UK data protection law you have rights over your personal data, including the rights to access it, have it corrected or erased, restrict or object to its use, and data portability. Where we rely on your consent, you can withdraw it at any time.
Our Your Data Rights (GDPR) page explains each right and how to make a request.
Automated decision-making
We do not make decisions about you based solely on automated processing, including profiling, that have a legal or similarly significant effect on you. Our consultants review every application and decide which candidates to put forward.
Marketing
We may send business contacts information about our services where the law allows. We will send marketing emails to individuals only where you have agreed or where PECR otherwise permits it. Every marketing email includes a simple way to unsubscribe. You can also email us at any time to opt out.
Cookies
Our website uses only cookies and similar technologies that are strictly necessary for it to work. See our Cookie Policy for details.
Children
Our services and website are not intended for children under 16, and we do not knowingly collect personal data from them. Candidates must meet the legal minimum age for the roles they apply for.
Complaints
If you are unhappy with how we have handled your personal data, please contact us first so we can try to put things right. We will acknowledge data protection complaints within 30 days and respond without undue delay.
You also have the right to complain to the UK supervisory authority for data protection:
Information Commissioner’s Office
Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
Helpline: 0303 123 1113
Website: ico.org.uk/make-a-complaint
Changes to this policy
We may update this policy from time to time, for example to reflect changes in the law or in how we work. The “last updated” date at the top of this page shows when it was last changed. Where changes are significant, we will take reasonable steps to let you know.
Contact us
For any questions about this Privacy Policy, or to exercise your rights, please contact:
Xpert-Career Ltd
30 Riverhead Close, London, England, E17 5PY
Email: info@xpert-career.com
Telephone: +44 7473 963234