Privacy Notice

The Company is a recruitment business which provides work-finding services to its clients and work-seekers. The Company must process personal data (including special categories of personal data) so that it can provide these services — in doing so, the Company acts as a data controller.

You may give your personal details to the Company directly, such as on an application or registration form or via our website, or we may collect them from another source such as a jobs board. The Company must have a legal basis for processing your personal data. For the purposes of providing you with work-finding services and/or information relating to roles relevant to you, we will only use your personal data in accordance with this privacy statement. We will comply with current data protection laws at all times.

Contents

1. Collection and use of personal data
2. Information provided when data is not collected directly from you
3. Overseas transfers
4. Data retention
5. Your rights
6. Automated decision making
7. Cookies
8. Login files
9. Links to external sites
10. Sale of the business
11. Data security
12. Changes to this privacy statement
13. Complaints or queries

1. Collection and Use of Personal Data

a. Purpose of processing and legal basis

The Company will collect your personal data (which may include special categories of personal data) and will process your personal data for the purposes of providing you with work-finding services. This includes contacting you about job opportunities, assessing your suitability for those opportunities, updating our databases, putting you forward for job opportunities, arranging payments to you, and developing and managing our services and relationship with you and our clients.

If you have opted-in we may also send you marketing information and news via email/text. You can opt-out from receiving these at any time by clicking "unsubscribe".

The legal bases we rely upon are:

• Your consent
• Where we have a legitimate interest
• To comply with a legal obligation
• To fulfil a contractual obligation

b. Legitimate interest

Where the Company has relied on a legitimate interest to process your personal data, our legitimate interests are:

• Managing our database and keeping work-seeker records up to date
• Providing work-finding services to you and our clients
• Contacting you to seek your consent where we need it
• Giving you information about similar products or services

c. Statutory/contractual requirement

The Company has certain legal and contractual requirements to collect personal data (e.g. to comply with the Conduct of Employment Agencies and Employment Businesses Regulations 2003, immigration and tax legislation, and in some circumstances safeguarding requirements). If you do not give us the personal data we need, we may not be able to continue to provide work-finding services to you.

d. Recipients of data

The Company will process your personal data with the following recipients:

• Clients (who we may introduce or supply you to)
• Your former employers (for references)
• Payroll service providers
• Other recruitment agencies in the supply chain
• Auditors assessing compliance
• GB Group (for DBS checks and Right to Work verification)
• HMRC (for tax and National Insurance purposes)
• The Gangmasters and Labour Abuse Authority (GLAA)
• The Recruitment and Employment Confederation (REC)
• Our insurance providers
• Our legal advisers
• Cloud storage and email service providers

2. Information Provided When Data Not Collected Directly

Categories of data collected:

Personal data: Name, address, mobile number, email, National Insurance number, nationality (through Right to Work check), date of birth, bank details, employment history, qualifications, references, CV/resume, photographs.

Special categories: Health information including disability, criminal convictions (DBS).

Sources:

Indeed, LinkedIn, CV Library, Facebook, TikTok, former employers, referees, GB Group (DBS provider), HMRC, software providers. This information may come from publicly accessible sources.

3. Overseas Transfers

The Company will not transfer the information you provide to us to countries outside the UK and/or the European Economic Area (EEA) for the purposes of providing you with work-finding services.

4. Data Retention

The Company will retain your personal data only for as long as is necessary. Key retention periods:

• Work-seeker records: At least 1 year from creation or last provision of services (Conduct Regulations 2003)
• Right to Work records: Duration of employment + 2 years
• Working time records: 2 years from creation
• Payroll, holiday pay, sick pay, pension records: 3 to 6 years (HMRC requirements)
• Consent-based data: 6 years from last working date, or until consent withdrawn

5. Your Rights

You have the following data protection rights:

• The right to be informed about personal data we process
• The right of access to your personal data
• The right to rectification
• The right to erasure in certain circumstances
• The right to restrict processing
• The right to data portability
• The right to object to processing based on legitimate interest
• The right not to be subjected to automated decision making
• The right to withdraw consent at any time

To exercise any of these rights, contact: Vasile Gangal, Director at support@gangalrecruitment.com

6. Automated Decision Making

The Company does not use automated decision-making or profiling in our recruitment processes. All decisions are made by our team with human oversight.

7. Cookies

We may obtain data about you from cookies — small text files placed on your computer by websites you visit. They are used to make websites work efficiently and to provide information to site owners. Most web browsers allow control of cookies through browser settings. For more information visit www.allaboutcookies.org.

8. Login Files

We use IP addresses to analyse trends, administer the site, and gather broad demographic information. IP addresses are not linked to personally identifiable information.

9. Links to External Websites

Our website may contain links to other external websites. The Company is not responsible for the privacy practices of other sites. This privacy statement applies solely to information collected by the Company's website.

10. Sale of Business

If the Company's business is sold or integrated with another business, your details may be disclosed to our advisers and any prospective purchasers. Where this results in transfer to a different data controller, we will notify you.

11. Data Security

We use industry-standard security measures including:

• Password-protected access to systems
• Secure cloud storage with encryption
• Regular backups
• Secure email communications
• Limited access to personal data (authorised personnel only)
• Regular software updates
• Antivirus and firewall protection

If you have questions about security, email support@gangalrecruitment.com.

12. Changes to This Privacy Statement

We will update this privacy statement from time to time. We will post any changes with revision dates. If we make any material changes, we will notify you.

13. Complaints or Queries

If you wish to complain about this privacy notice, please contact:

Vasile Gangal
Email: support@gangalrecruitment.com
ICO Registration: CSN4843721

You also have the right to raise concerns with the Information Commissioner's Office on 0303 123 1113 or at https://ico.org.uk/make-a-complaint/.