Privacy Policy

This policy is a template and must be reviewed by a qualified legal adviser before publication. Items in square brackets must be confirmed.

Who we are

Netox Ltd (“Netox”, “we”, “us”) is a company registered in England and Wales under company number [NUMBER]. Our office is at One New Change, St Paul’s, London EC4M 9AF.

We are the controller of the personal data described in this policy. We are registered with the Information Commissioner’s Office (ICO) under registration number [ICO REGISTRATION NUMBER].

This policy explains how we use personal data in line with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

How to contact us

For any question about this policy or your personal data, please contact us at info@netox.co.uk or write to us at our office address, marked for the attention of [Data protection lead].

Whose data we process

We process personal data about:

Candidates and contractors who apply for roles or register with us.
Client contacts and prospective clients.
Referees named by candidates.
Suppliers and their staff.
Visitors to our website and people who contact us.

The data we collect

Depending on our relationship with you, we may collect:

Identity and contact details, such as name, email address, telephone number and address.
Recruitment information, such as your CV, employment history, qualifications, skills, references, salary or rate expectations and right-to-work documents.
Information you provide in interviews or assessments.
Business information, such as job title, employer and correspondence.
Technical information, such as your browser type and the preferences stored on your device (see our Cookie Policy).

We may collect special category data, such as health information needed to make reasonable adjustments, or diversity monitoring information you choose to provide. We will only process criminal offence data where a role lawfully requires it and an appropriate condition applies.

Where we get your data

Most data comes from you directly, for example when you submit an enquiry, apply for a role or send us your CV. We may also obtain data from referees, clients, job boards, professional networking sites and publicly available sources, where lawful to do so.

How we use your data and our lawful bases

We rely on the following lawful bases under Article 6 of the UK GDPR:

Contract: to provide our services to clients and to engage candidates and contractors.
Legitimate interests: to match candidates to roles, manage client relationships, market our services to business contacts and improve our website. We balance these interests against your rights.
Legal obligation: for example, right-to-work checks, record-keeping under the Conduct of Employment Agencies and Employment Businesses Regulations 2003, and tax obligations.
Consent: where we ask for it, for example for certain marketing or optional cookies. You can withdraw consent at any time.

Where we process special category data, we rely on an additional condition under Article 9 of the UK GDPR and Schedule 1 of the Data Protection Act 2018, such as employment obligations or explicit consent.

Recruitment data and CVs

When you send us your CV or register with us, we use your information to assess your suitability for roles and to contact you about opportunities. We will not submit your CV to a client without first discussing the role with you.

Clients receiving your details are responsible for their own use of your data as independent controllers.

We may share personal data with:

Clients, where you have agreed to be put forward for a role.
Referees and background screening providers, with your knowledge.
Service providers who support our business, such as IT, hosting, email and recruitment software providers.
Payroll and umbrella companies, where relevant to a contract engagement.
Professional advisers, regulators and law enforcement, where required.

We do not sell personal data.

International transfers

We recruit in Germany, Sweden, the Netherlands and Japan as well as the UK. With your agreement, we may share your details with clients or partners in those countries. Some of our service providers may also process data outside the UK.

The UK recognises the European Economic Area, including Germany, Sweden and the Netherlands, as providing adequate protection. Japan is also subject to UK adequacy regulations [confirm current status]. For transfers to other countries, we use appropriate safeguards, such as the ICO’s International Data Transfer Agreement or Addendum to the EU Standard Contractual Clauses.

How long we keep data

We keep personal data only as long as necessary. As a guide:

Candidate data: [X] years from our last meaningful contact, unless you ask us to delete it sooner.
Records relating to placements and contract engagements: [X] years, to meet legal and tax obligations.
Client and supplier contact data: for the duration of the relationship and [X] years afterwards.
Website enquiries: [X] months unless they lead to an ongoing relationship.

Your rights

You have the right to:

Access the personal data we hold about you.
Ask us to correct inaccurate data.
Ask us to erase your data in certain circumstances.
Ask us to restrict or object to processing, including direct marketing.
Receive your data in a portable format in certain circumstances.
Withdraw consent at any time, where we rely on consent.

To exercise any of these rights, contact us using the details above. We will respond within one month, unless an extension is permitted.

Security

We use appropriate technical and organisational measures to protect personal data, including access controls and encryption where appropriate. Only authorised staff and service providers can access your data.

Complaints

If you have concerns about how we use your data, please contact us first. You also have the right to complain to the Information Commissioner’s Office at ico.org.uk or by calling 0303 123 1113.

Changes to this policy

We may update this policy from time to time. The date at the top of this page shows when it was last updated.