Four Recruitment Privacy Notice


Four Recruitment Privacy Notice



In line with the new General Data Protection Regulation (GDPR) all organisations who process personal data must ensure that they comply with it’s regulations and principles.

We must ensure that:

i)      We are lawful, fair and transparent in the way that data is processed
ii)     Personal data is used for a specific purpose
iii)    We only record data that is required
iv)    Have a duty to keep data accurate 
v)     Data is only kept for as long as is required
vi)    All data is stored securely

This Privacy Notice will detail how we comply with the above principles as well as your rights as the data owner.

1) Who are we?
Four Recruitment are a recruitment consultancy based in the North West of England. We specialise in the                        recruitment into the Finance and Human Resources sectors under the name of “Four Financial” and “Four HR”.              Under GDPR we are defined as a “Data Controller”.

2) What data do we collect?
Personal data refers to any data that can be used to identify a natural person and we only process information that        we need in order assist with your job search. Depending on your relationship with us, we may collect some or all of        the information detailed below (please note this list is not exhaustive):

For Candidates:
i)       Name
ii)      Address
iii)     Date of birth
iv)     Contact numbers
v)      Email information
vi)     Social Media information
vii)    Employment history including salary and benefits
viii)   Education & Qualifications
ix)     Referee information 
x)      Any other information given to us by your referee
xi)     Visa information
xii)    If you have any criminal convictions
xiii)   If you have any CCJ’s
xiv)   If you have been involved in any disciplinary action
xv)    If you have any medical conditions or disabilities
xvi)    Copy of passport or other proof of identification and eligibility to work in the UK e.g. driving licence, birth                            certificate
xvii)   P45 information
xviii)  Gender
xix)    Bank detail
xx)     National insurance details
xxi)    Emergency contact details
xxii)   Next of kin details

For Clients:
For clients we process minimal information on you and/or employees of your organisation so that we are able to assist with any recruitment needs you may have. Types of information processed are: company address, contact number, work emails, job titles and website. We log any interaction between clients and Four Recruitment in relation to candidates in the form of CV submits, interviews, placements and with clients and Four Recruitment is the form of emails and telephone calls.

For Suppliers:
In order to make sure that our relationship runs without any hitches we hold a small amount of information on our suppliers. This information will be held about our contacts within your business and usually relates to name, address, contact number and emails. We will also hold you bank details so that we can pay you.

Other Information we may hold:
As mentioned above we are required to obtain referee information and act this information to enable you to secure your role. This information is usually name, company, job title, contact number and email.
We also hold emergency contact and next of kin information for our members of staff. If your information is provided to us for this purpose it will only be used for the nature it was given and the information provided is usually name, address, relationship, contact and email.

3) How do we collect your data?
The majority of the data we hold is freely given by the data owner and can be provided in a number of different ways. 

For Candidates:
i)       when you apply into one of our job adverts
ii)      when we source your data from a 3rd party (e.g. Job boards, Linked In)
iii)     when you upload your CV to our website 
iv)     when you directly email in your CV

For Clients:
i)       when we have been involved in previous recruitment activity within your business
ii)      when we have received calls from yourself in relation to recruitment within your business
iii)     when our consultants have contacted you by means of business development activity
iv)     when we have attended the same networking events
v)      when you have been identified as a reference provider

For Suppliers:
i)      when a purchase has been made
ii)     from information provided on your invoice

i)      by the completion of relevant forms by the employee when starting with Four

4) What is our Legal Basis for Processing your data?
We hope you will agree that we have your best interests at heart when you provide your data and we will do our upmost to protect your data and support you in your job search GDPR states that we are required to let you know under which legal basis your data is processed.

We are using Legitimate Interest as our legal basis for processing the following data:

Legitimate Interest – Article 6(1)(f) says:
“processing is necessary for the purpose of the legitimate interest pursued by the controller or by the third party except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data”

For Candidates:
When you are providing us with your CV, applying to one of our adverts or uploading it onto a job board it is reasonable to expect that you will be contacted about your job search and any potential vacancies as this is the purpose for providing the information in the first place.

You may not be successful in your initial application however using the information you have provided we can let you know about any future vacancies we work on that you maybe suitable for.

We will always have an initial telephone conversation with you so we can fully understand what you have done and what you are looking for so we can provide you with a tailored service and we also provide you with what you can expect from us and how your data with be used. We also arrange face to face meetings but if this is not possible these can be completed by Skype or Facetime.

For Clients:
We want to make sure that we provide you with the best possible service so we hold data on you and contacts within your business that we may need to speak to. In addition, we also log details of conversations, emails sent and received, meetings, vacancies and placements. 

For Suppliers:
In order to ensure prompt payment for services you have provided we will need to hold certain information on you and your business so that payments can be made within the required timescales.

For Others:
We may hold your information if it has been provided to us to use as a reference for a new employee or a candidate for whom we have secured a new position. 

For all the above we feel this data is necessary for our legitimate interest as a recruitment consultancy to provide a comprehensive recruitment service to our candidates, clients and new 

If you are a member of staff of Four or are working for Four on a temporary contract with one of our clients then there is certain data that we require in order to process payroll – for this information we are using Legal Obligation as the legal basis for processing.
Legal Obligation – Article (6)(1)( c) says:
“processing is necessary for compliance with a legal obligation to which the controller is subject.”

5) Why do we collect your data?
Our core business activity is to provide opportunities for our candidates and to support our clients to enable us to            provide the best candidate to suit the business needs. So we can do this we need to understand:

For Candidates:
i)       Who you are, what type of roles you are looking for.
ii)      Have means to contact you via phone and/or email
iii)     Where you live in order to be able to contact you about opportunities
iv)     Your work history and qualifications

For Clients:
i)       Your position within the business to ascertain who is the correct person to speak to
ii)      Have means to contact you via phone and/or email

6) How do we use your data?
Your data is used for Recruitment and Marketing activity.

For Candidates:
In order to be able to place the right candidate in the right job, your data may be used in one or more of the following ways:
i)        Storing and updating your information on our CRM system so that we can contact you about recruitment                          opportunities
ii)       Using your data to identify your suitability for recruitment opportunities we may have
iii)      Speaking to clients about you in relation to recruitment within their business
iv)      With your agreement – sending your CV to clients in relation to a specific vacancy
v)       Emailing and speaking to clients about you and your experience to generate further recruitment opportunities
vi)      Emailing you information relating to specific recruitment or marketing information which we think maybe of                  interest to you
vii)     Speaking to previous employers whom you have provided information for to provide a reference
viii)    If placed in a temporary position we will use your financial details to provide payroll services

For Clients:
In order to find you the best candidate, your data maybe used in one or more of the following ways:
i)       Storing and updating your information on our CRM system so that we con contact you in relation to recruitment             activities
ii)      Calls in relation to potential candidates 
iii)     Calls in relation to recruitment activity within your business
iv)     Emails in relation to potential candidates
v)      Marketing information about events we are holding that maybe of interest to you
vi)     Marketing information in relation to the services we can provide
vii)    Keeping records of conversations, emails and meetings to refer to if needed in relation to any dispute

For some of the above activities your consent is required and for more information on how we get and manage your consent please refer to section 11, in this document.

7) Who do we share your data with?
In some circumstances we may need to share you details with a 3rd party, details of this are listed below:

For Candidates:
i)        CRM system provider with whom we have an appropriate data processing agreement
ii)       Potential new employers
iii)      Past employers named as reference providers
iv)      Umbrella companies used to provide payroll services
v)       Our accountant to provide payroll services

For Clients:
i)        Information maybe shared with potential candidates if you have requested us to do so.

8) How do we safeguard your data?
Your data is of the upmost importance to us and as such we ensure all relevant security is in place in order to keep your data safe and protected from any potential threats.
For more information please refer to our Data Protection Policy.

However, if you think we have not taken care of your data and it has been misused our contact information can be found at the end of this document

9) How long do we keep your data for?
For more information please refer to our Retention & Erasure Policy.

10) Your Rights.
GDPR provides the following rights.

i)        The Right to be Informed - you have the right to be informed about the collection and use of your personal data              and you must be provided with certain information including: the purpose for processing your personal data, our            retention periods for the data and who it will be shared with.
          All this information is provided by means of this Privacy Notice

ii)       The Right of Access – you have the right to access your personal data and any supplementary information. This is            known as a Data Subject Access Request (DSAR) and when received we are legally required to provide this                        information within one month. This information will be provided free of charge unless we feel the request is                      manifestly unfounded or excessive, particularly if it is repetitive. A fee may also be charged if further copies of the            same information are requested.

iii)     The Right to Rectification – you have the right to have any inaccurate personal data rectified or completed if                      incomplete. You can request this to be done verbally or in writing and we have one calendar month to respond.                There is no fee attached to this request however if we feel the request is manifestly unfounded or excessive,                      particularly if it is repetitive – we can charge a fee or refuse the request. If either of these apply we will provide you            with our reasons for such action.

iv)     The Right to Erasure (this is also known as the right to be forgotten) – you have the right to have your personal                  data erased if:

a.       The data is no longer necessary for the reason it was originally collected or processed
b.       Your data has been processed on legitimate interest and you object to the processing of your data and we                        cannot provide and overriding legitimate interest to continue processing.
c.       The data has been processed unlawfully (in breech of GDPR)
d.       It has to be erased to comply with a legal obligation

If we have to process your data for one of the following reasons, the right to erasure does not apply:
a.       to exercise the right of freedom of expression and information
b.       to comply with a legal obligation
c.       for the performance of a task carried out in the public interest
d.       for archiving purposes in the public interest, scientific research, historic research or statistical purposes
e.       in the defence of a claim

v)      The Right to Restrict Processing – you have the right to restrict the processing of your data in certain                                   circumstances. When processing is restricted we are allowed to store enough information to ensure future                         restriction is respected. We will stop processing data if:
a.      you do not agree with the accuracy of your personal data
b.      the data has been unlawfully processed
c.      to establish or defend a legal claim
d.      you object to our legal ground for processing your data

We can only continue to process your data when the above has been resolved and we will inform you before any restriction is lifted. If your data is restricted it can only be stored unless:
a.      you give your consent to processing
b.      it is defence of a legal claim
c.      it is for the protection of another person
d.      it is for reasons of important public interest

vi)     The Right to Data Portability – you have the right to transfer your details across different services. This right only               applies in certain circumstances and:
a.      to data that has been provided to a controller by an individual
b.      where processing is based on consent or for the performance of a contract
c.      when processing is carried out by automated means

When we receive a portability request we must respond within one month and no fee is applicable. We must provide the information in a structured, commonly used and machine readable form.

vii)    The Right to Object – you can object to the processing of your data when it is processed under one of the                           following:
a.      our legitimate interest
b.      performance of a task in the public interest/exercise of official authority
c.      direct marketing
d.      processing for scientific/historical research or statistical purposes

We must stop processing your data unless:
a.      we can demonstrate compelling legitimate grounds for processing which override your interest
b.      it is being processed for the establishment, exercise or defence of a legal claim
If your objection relates to direct marketing we must stop this immediately

If your data has been shared with a third party and you request one of your “rights” listed above we will notify them and act upon the requirements of your request unless this is not possible or involves disproportionate effect

If you feel we have not handled your request efficiently or are unhappy with the service we have provided in relation to the processing of your data then you can raise your concerns with the Information Commissioners Office (ICO) https://ico.org.uk/global/contact-us/

11) Consent
As a business, and to comply with Article 6 of GDPR, we have agreed that the legal basis for processing your data will be (depending on your relationship with us) either “Legitimate Interest” or “Contract”. As well as complying with the GDPR in relation to direct marketing we have to comply to The Privacy and Electronic Communications Regulations (PECR).

In certain circumstances we are required to have your consent to perform certain activities. This consent can be given in the form of an opt-in or soft opt-in option.

We have to ensure your consent is freely given, you understand what you are consenting to, and are able to opt-out and back in at any time.

We are permitted to market information to you in relation to the recruitment services we offer until you advise us otherwise by way of opting out.

You can opt in or out verbally during our initial registration call/meeting, using the tick box on our Registration Form of in writing to Four Recruitment at the address below. If you are opted in and wish to opt out you can also click on the link provided in one of our marketing emails.

12) Contact Details
If you need to contact us for any reason our details are:

Four Recruitment                    
Lower House Farm
Mansell Way            
BL6 6JL                

Contact Number:
01204 326 444

General Email Address:

Phil Sofield