Further information for EEA and UK residents
Last update – 2nd December 2025
We are subject to the UK General Data Protection Regulation (UK GDPR) and the EU General Data Protection Regulation (EU GDPR) in relation to goods and services we offer to individuals and our wider operations in the UK and European Economic Area (EEA).
(a) Details about our processing of your personal information
The table below describes the ways we plan to use your personal data, and which Lawful Basis we rely on to do so. We have also identified what our legitimate interests are where appropriate.
The table below describes the ways we plan to use your personal data, and which Lawful Basis we rely on to do so. We have also identified what our legitimate interests are where appropriate.
| Lawful Basis | Purpose Examples |
|---|---|
| Contract We use your personal information on the basis that it is necessary for us evaluate applications and candidates for a vacant role prior to entering into an employment contract for that role with the most suitable candidate. | Recruitment of candidates (contractors, employees and providers) We will use the personal information we collect about you to assess your skills, qualifications, and suitability for the role for which you applied. We may use the following personal data: Identity data Contact data Location data Candidate Data |
| Legitimate interest When we rely on this, we will carry out a Legitimate Interests Assessment to ensure we consider and balance any potential impact on you (both positive and negative), and your rights under Data Protection Law. Our legitimate business interests do not automatically override your interests – we will not use your Personal Data for activities where our interests are overridden by the impact on you unless we have your consent or are otherwise required or permitted to by law. | Managing our business We process Personal Data for our own legitimate business interest. This relates to us managing our business to enable us to maintain and monitor the performance of our website and to constantly look to improve the website and the services it offers to our users, including when we respond to your queries and complaints, where you are not a client or supplier, or a potential client or supplier. We may use the following personal data: Identity data Contact data. Technical data Marketing and communications data Provide and maintain our websites. To provide and maintain our website, including to monitor the usage of these, troubleshooting, data analysis, network security and system testing necessary for our legitimate interests in maintaining the useability, security and integrity of our website We may use the following personal data: Identity data Location data Transaction data Technical data Recommendations and marketing To make recommendations to you about services that may interest you. We may use the following personal data: Identity data Contact data. Technical Data Marketing and communications data Usage data To measure and analyse the effectiveness of the advertising we serve you. We may use the following personal data: Identity data Contact data. Location data Technical Data Marketing and communications data Usage data To make suggestions and recommendations to you about goods or services that may be of interest to you and necessary for our legitimate interests (to develop our products/services and grow our business). We may use the following personal data: Identity data Contact data. Location data Technical Data Marketing and communications data Usage data Rights and claims To enforce or apply our website terms of use, our policy terms and conditions, or other contracts. To exercise our rights, to defend ourselves from claims and to keep to laws and regulations that apply to us and the third parties we work with. We may use the following personal data: Identity data Contact data Transaction data Technical data Profile data Usage Data Data subject rights Verifying your identity when you exercise your data subject rights. Fulfilling data subject rights requests. We may use the following personal data: Identity data Contact data Location data Technical data Usage Data Candidate Data Necessary for our legitimate interests (for running our business, provision of administration and IT services, network security, to prevent fraud, and in the context of a business reorganisation or group restructuring exercise. |
| Legal obligations We may use your Personal Data to comply with laws (for example, if we are required to co-operate with a police investigation after a court order orders us to). | Legal requirement The processing is necessary for compliance with legal obligations, such as but not limited security requirements. To comply with applicable law, for example in response to a request from a court or regulatory body, where such request is made in accordance with the law. Criminal activity To detect fraudulent or criminal activity, we may share information with forces such as the police. |
| Consent We may have to get your consent to use your Personal Data, such about you or when we want to send you marketing. Wherever consent is the only reason for using your Personal Data, you have the right to change your mind and/or withdraw your consent at any time by clicking the Unsubscribe button at the bottom of an applicable email or by contacting us. | Marketing To measure and analyse the effectiveness of the advertising we serve you. We may collect IP addresses and store Cookies on visitors’ devices. We may use the following personal data, depending on what you consent to: Identity data Contact data Location data Technical Data Marketing and communications data Usage data Candidate Data Data analytics We use data analytics to improve our website, products/services, marketing, customer relationships and experiences. We may use the following personal data: Identity data Transaction data Technical Data Profile data Usage data |
(b) Details about sharing
More details about who we share your personal data with and why are set out in the table below. In most circumstances, you do not need to pay any charge for exercising your rights. We have one month to respond to you.
To exercise your rights or get more information about exercising them, please contact us at, [email protected] giving us enough information to identify you
More details about who we share your personal data with and why are set out in the table below. In most circumstances, you do not need to pay any charge for exercising your rights. We have one month to respond to you.
To exercise your rights or get more information about exercising them, please contact us at, [email protected] giving us enough information to identify you
(c) Details about Data Transfers overseas
The EEA, UK and other countries outside the EEA and the UK have differing data protection laws, some of which may provide lower levels of protection of privacy.
It is sometimes necessary for us to transfer your personal data to countries outside the UK and EEA. In those cases, we will comply with applicable UK and EEA laws designed to ensure the privacy of your personal data.
Under data protection laws, we can only transfer your personal data to a country outside the UK/EEA where:
Where we transfer your personal data outside the UK, we do so on the basis of an adequacy regulation or (where this is not available) legally approved standard data protection clauses recognised or issued further to Article 46(2) of the UK GDPR. In the event we cannot or choose not to continue to rely on either of those mechanisms at any time, we will not transfer your personal data outside the UK unless we can do so on the basis of an alternative mechanism or exception provided by UK data protection law and reflected in an update to this policy.
Where we transfer your personal data outside the EEA, we do so on the basis of an adequacy decision or (where this is not available) legally approved standard data protection clauses issued further to Article 46(2) of the EU GDPR. In the event we cannot or choose not to continue to rely on either of those mechanisms at any time we will not transfer your personal data outside the EEA unless we can do so based on an alternative mechanism or exception provided by applicable data protection law and reflected in an update to this policy.
The EEA, UK and other countries outside the EEA and the UK have differing data protection laws, some of which may provide lower levels of protection of privacy.
It is sometimes necessary for us to transfer your personal data to countries outside the UK and EEA. In those cases, we will comply with applicable UK and EEA laws designed to ensure the privacy of your personal data.
Under data protection laws, we can only transfer your personal data to a country outside the UK/EEA where:
- in the case of transfers subject to UK data protection law, the UK government has decided the particular country ensures an adequate level of protection of personal data (known as an ‘adequacy regulation’) further to Article 45 of the UK GDPR. A list of countries the UK currently has adequacy regulations in relation to is available here.
- in the case of transfers subject to EEA data protection laws, the European Commission has decided that the particular country ensures an adequate level of protection of personal data (known as an ‘adequacy decision’) further to Article 45 of the EU GDPR. A list of countries the European Commission has currently made adequacy decisions in relation to is available here.
- there are appropriate safeguards in place, together with enforceable rights and effective legal remedies for you; or
- a specific exception applies under relevant data protection law.
Where we transfer your personal data outside the UK, we do so on the basis of an adequacy regulation or (where this is not available) legally approved standard data protection clauses recognised or issued further to Article 46(2) of the UK GDPR. In the event we cannot or choose not to continue to rely on either of those mechanisms at any time, we will not transfer your personal data outside the UK unless we can do so on the basis of an alternative mechanism or exception provided by UK data protection law and reflected in an update to this policy.
Where we transfer your personal data outside the EEA, we do so on the basis of an adequacy decision or (where this is not available) legally approved standard data protection clauses issued further to Article 46(2) of the EU GDPR. In the event we cannot or choose not to continue to rely on either of those mechanisms at any time we will not transfer your personal data outside the EEA unless we can do so based on an alternative mechanism or exception provided by applicable data protection law and reflected in an update to this policy.
(d) Your Rights
Please see more details about your rights in the table below. In most circumstances, you do not need to pay any charge for exercising your rights. We have one month to respond to you.
Please see more details about your rights in the table below. In most circumstances, you do not need to pay any charge for exercising your rights. We have one month to respond to you.
| Your Right | Details |
|---|---|
| Right to be informed | We have a legal obligation to provide you with concise, transparent, intelligible, and easily accessible information about your personal information and our use of it. We have written this notice to do just that, but if you have any questions or require more specific information. |
| Right of access | You have the right to ask us for copies of your personal information. This right always applies. There are some exemptions, which means you may not always receive all the information. When you request this data, this is known as making a data subject access request (DSAR). In most cases, this will be free of charge; however, in some limited circumstances, for example repeated requests for further copies, we may apply an administration fee. |
| Right to rectification | You have the right to ask us to rectify information you think is inaccurate. You also have the right to ask us to complete information you think is incomplete. This right always applies. |
| Right to erasure | You have the right to ask us to erase your personal information in certain circumstances. We have the right to refuse to comply with a request for erasure if we are processing the Personal Data for one of the following reasons: To exercise the right of freedom of expression and information. To comply with a legal obligation. To perform a task in the public interest or exercise official authority. For archiving purposes in the public interest, scientific research, historical research or statistical purposes. For the exercise or defence of legal claims. |
| Right to restriction of processing | You may ask us to stop processing your Personal Data. We will still hold the data but will not process it any further. This right is an alternative to the right to erasure. If one of the following conditions applies, you may exercise the right to restrict processing: The accuracy of the Personal Data is contested. Processing of the Personal Data is unlawful. We no longer need the Personal Data for processing, but the Personal Data is required for part of a legal process. The right to object has been exercised and processing is restricted pending a decision on the status of the processing. |
| Right to object to processing | You have the right to object to processing in certain circumstances. You can also object if the processing is for a task carried out in the public interest, the exercise of official authority vested in you, or your legitimate interests (or those of a third party). |
| Right to data portability | This right only applies if we are processing information based on your consent or for the performance of a contract and the processing is automated |
(e) Complaints
We hope that we can resolve any query or concern you raise about our use of your information. Please contact us at [email protected] first and title your email “Complaint”. All complaints will be treated in a confidential manner, and we will try our best to deal with your concerns.
You have the right to lodge a complaint with a supervisory authority in the EEA member state where you work or normally live, or where any alleged infringement of Data Protection Law occurred.
The details of European supervisory authorities can be found here: Our Members | European Data Protection Board (europa.eu)
The supervisory authority in the UK is the ICO, which may be contacted at https://ico.org.uk/concerns or by telephone on 0303 123 1113.
The details of the supervisory authority in Switzerland can be found here: Startseite (admin.ch)
We hope that we can resolve any query or concern you raise about our use of your information. Please contact us at [email protected] first and title your email “Complaint”. All complaints will be treated in a confidential manner, and we will try our best to deal with your concerns.
You have the right to lodge a complaint with a supervisory authority in the EEA member state where you work or normally live, or where any alleged infringement of Data Protection Law occurred.
The details of European supervisory authorities can be found here: Our Members | European Data Protection Board (europa.eu)
The supervisory authority in the UK is the ICO, which may be contacted at https://ico.org.uk/concerns or by telephone on 0303 123 1113.
The details of the supervisory authority in Switzerland can be found here: Startseite (admin.ch)