CANDIDATE DATA PROTECTION NOTICE

Last updated: December 2025

This notice explains how Higgins Recovery Group Ltd (“we”, “us”, “our”) collects, uses, and protects personal data relating to candidates (“you”) as part of our recruitment activities.

We are committed to processing your data fairly, lawfully, and transparently in accordance with UK data protection law (UK GDPR and the Data Protection Act 2018).

1. Who We Are

Higgins Recovery Group Ltd
Company Number: 16889360
Registered in England & Wales
Email: phil@higginsrecoverygroup.co.uk
Phone: +44 7535 436400

We act as the Data Controller for the personal data you provide to us as a candidate.

2. What Data We Collect About You

We may collect the following personal data as part of our recruitment services:

Personal information

  • Name

  • Contact details (email, phone number)

  • Location and job preferences

Professional information

  • CV / résumé details

  • Employment history

  • Qualifications, certifications, skills

  • References (when provided)

  • Notice period and salary expectations

  • Right-to-work confirmation (if required by clients)

Interaction information

  • Notes from calls and interviews

  • Communication records

  • Availability and scheduling information

We only collect what is relevant to assessing your suitability for roles.

3. How We Collect Your Data

We may collect your information through:

  • CVs or applications you send to us

  • Contact forms on our website

  • Email, phone, or messaging conversations

  • Online profiles you choose to share (e.g., LinkedIn)

  • Introductions or referrals

  • Meetings or video calls

We do not collect candidate data from third parties without your knowledge.

4. How We Use Your Data

We use candidate data to:

  • Assess suitability for specific roles

  • Match you with relevant job opportunities

  • Introduce you to client organisations (with your knowledge)

  • Contact you regarding roles that may interest you

  • Maintain accurate recruitment records

  • Fulfil legal or compliance obligations (e.g., right-to-work checks when required)

We will not submit your CV to any employer without your permission or reasonable expectation.

5. Legal Basis for Processing (UK GDPR)

We rely on the following lawful bases:

Legitimate Interests

To operate a recruitment business, match candidates with roles, and communicate with you effectively.

Contract

Where processing is necessary to take steps at your request prior to entering into a recruitment agreement (such as submitting your CV to a client).

Consent

When you voluntarily provide information through our website or ask us to keep your details on file for future roles.

Legal Obligation

For compliance checks required by clients or regulators.

6. Who We Share Your Data With

We may share your data with:

  • Client organisations who are recruiting for relevant roles

  • Technology providers essential to our operations (email host, ATS/CRM tools, scheduling tools, website host)

  • Professional advisers if necessary (legal or compliance)

  • Regulators or authorities if legally required

We do not share or sell your personal data to third parties for marketing.

7. International Transfers

Some technology partners (such as Squarespace or email providers) may process data outside the UK.
In such cases, we rely on appropriate safeguards such as standard contractual clauses or adequacy decisions.

8. How Long We Keep Your Data

We keep candidate data for:

  • Up to 24 months from your last meaningful interaction with us
    (this includes calls, emails, CV updates, or job discussions)

After 24 months of inactivity, your data will be securely deleted unless:

  • we are required to retain certain information for legal or compliance reasons, or

  • you request us to keep your data for longer

You may request deletion at any time.

9. Your Rights as a Candidate

Under UK GDPR, you have the right to:

  • Access your personal data

  • Request correction of inaccurate information

  • Request deletion (“right to be forgotten”)

  • Restrict processing

  • Object to processing

  • Request transfer of your data

  • Withdraw consent where processing is based on consent

To exercise your rights, contact:
phil@higginsrecoverygroup.co.uk

If you are unhappy with our handling of your data, you can lodge a complaint with the UK Information Commissioner’s Office (ICO):
https://ico.org.uk/make-a-complaint/

10. Updates to This Notice

We may update this Candidate Data Protection Notice to reflect changes in law or business practices.
The “Last updated” date above shows the most recent revision.