GDPR and Data Protection Policy

Last Update: 20 August 2026
Next Review: 02 August 2027
Version: 1.0v

Owner: Senior Management

Halo Recruitment Group Ltd (“Halo Recruitment Group”, “Halo”, “we”, “us” or “our”) is committed to protecting the privacy, confidentiality and security of all personal data processed in connection with its recruitment and workforce activities.

This GDPR and Data Protection Policy establishes the standards, responsibilities, controls and procedures that Halo Recruitment Group Ltd follows when collecting, using, storing, accessing, sharing, transferring and deleting personal data.

Halo Recruitment Group Ltd will process personal data in accordance with:

• the UK General Data Protection Regulation (“UK GDPR”);
• the Data Protection Act 2018;
• the Privacy and Electronic Communications Regulations 2003 (“PECR”), where applicable; and
• other applicable UK data protection legislation and regulatory guidance.

All employees, directors, contractors and other individuals processing personal data on behalf of Halo Recruitment Group Ltd must comply with this policy.

Halo Recruitment Group Ltd provides recruitment and workforce solutions, including permanent, temporary, contract and agency recruitment services.

The Company’s details are:

Halo Recruitment Group Ltd
Company Number: 16802216
Registered Office: 16 Kings Road, Feltham, TW13 5AU
Website: www.halorecruitmentgroup.co.uk
Email: info@halorecruitmentgroup.co.uk
Telephone: 0208 064 2515

Halo Recruitment Group Ltd will normally act as the Data Controller for personal data processed in connection with its recruitment, employment and business activities.

Senior Management is responsible for overall data protection governance.

This policy applies to personal data processed about:

• candidates;
• prospective candidates;
• temporary workers;
• agency workers;
• contractors;
• consultants;
• employees;
• prospective employees;
• permanent placements;
• client contacts;
• prospective clients;
• referees;
• suppliers;
• service providers;
• website users;
• individuals making enquiries; and
• any other individual whose personal data is processed by Halo Recruitment Group Ltd.

This policy also applies to all directors, employees, contractors and authorised third parties handling personal data on behalf of the Company.

Halo Recruitment Group Ltd will only collect personal data that is reasonably necessary for legitimate recruitment, employment, compliance, contractual or business purposes.

Information processed may include:

• names;
• postal addresses;
• telephone numbers;
• email addresses;
• dates of birth;
• CVs;
• employment histories;
• education records;
• qualifications;
• professional registrations;
• employment references;
• Right to Work documentation;
• passport and identity documentation;
• visa and immigration information;
• National Insurance numbers;
• driving licence information;
• photographs used for identification;
• employment preferences;
• availability;
• salary and pay information;
• timesheets;
• attendance records;
• payroll information;
• bank account details;
• training records;
• compliance documentation;
• interview notes;
• candidate assessments;
• communications with Halo;
• client information;
• contractual information; and
• information relating to placements and assignments.

Personal data must be adequate, relevant and limited to what is necessary for the intended purpose.

Halo Recruitment Group Ltd may process special category personal data where necessary, particularly in connection with healthcare, safeguarding and regulated recruitment.

This may include information concerning:

• health;
• disabilities;
• reasonable adjustments;
• racial or ethnic origin;
• religious or philosophical beliefs;
• trade union membership;
• biometric information where applicable;
• sexual orientation; and
• other information defined as special category data under UK GDPR.

Special category personal data must only be processed where:

• there is an appropriate lawful basis under Article 6 UK GDPR;
• an appropriate condition under Article 9 UK GDPR applies; and
• any requirements under the Data Protection Act 2018 are satisfied.

Access to special category information will be restricted to authorised personnel with a legitimate requirement to access it.

Due to the nature of recruitment undertaken by Halo Recruitment Group Ltd, particularly within healthcare, care, safeguarding and regulated environments, criminal offence information may need to be processed.

This may include:

• DBS status;
• DBS certificate information;
• criminal convictions;
• cautions;
• barred list information;
• safeguarding information; and
• other relevant background screening information.

Such information will only be processed where legally permitted and necessary for the relevant role or assignment.

Criminal offence information will be subject to enhanced access controls and appropriate security measures.

Copies of DBS information will not be retained for longer than necessary and will be securely deleted or destroyed when no longer required.

Personal information may be collected directly from individuals through:

• applications;
• candidate registration;
• CV submissions;
• compliance forms;
• interviews;
• telephone calls;
• emails;
• website enquiries;
• recruitment portals; and
• other communications.

Information may also be obtained from:

• job boards;
• professional networking websites;
• recruitment databases;
• publicly available professional sources;
• previous employers;
• referees;
• clients;
• professional bodies;
• regulatory organisations;
• the Disclosure and Barring Service;
• Right to Work verification services;
• compliance screening providers;
• recruitment partners; and
• other lawful third-party sources.

Where information is obtained indirectly, Halo Recruitment Group Ltd will provide appropriate privacy information where required by law.

Personal data may be processed for purposes including:

• registering candidates;
• assessing suitability;
• matching individuals to vacancies;
• presenting candidates to clients;
• arranging interviews;
• managing temporary assignments;
• managing permanent placements;
• maintaining candidate relationships; and
• contacting candidates regarding relevant opportunities.

• verifying identity;
• carrying out Right to Work checks;
• checking employment history;
• obtaining references;
• verifying qualifications;
• checking professional registrations;
• verifying mandatory training;
• conducting DBS and safeguarding checks where required; and
• satisfying client and framework compliance requirements.

• administering assignments;
• maintaining worker records;
• processing timesheets;
• payroll administration;
• calculating holiday entitlement;
• maintaining employment records; and
• meeting statutory employment obligations.

• managing client relationships;
• understanding staffing requirements;
• providing recruitment services;
• managing contracts;
• communicating regarding candidates and assignments;
• issuing invoices; and
• administering accounts.

• maintaining records;
• responding to complaints;
• investigating incidents;
• preventing fraud;
• defending or pursuing legal claims;
• meeting tax and accounting obligations;
• conducting audits;
• managing information security; and
• maintaining the effective operation of the business.

An appropriate lawful basis must be identified before personal data is processed.

Depending on the circumstances, Halo Recruitment Group Ltd may rely upon:

Processing may be necessary to enter into or perform a contract.

This may include:

• candidate registration;
• assignment administration;
• employment administration; and
• payment processing.

Processing may be necessary to comply with legal obligations, including:

• Right to Work requirements;
• employment law;
• tax legislation;
• safeguarding obligations;
• health and safety requirements; and
• regulatory requirements.

Halo Recruitment Group Ltd may rely upon legitimate interests where processing is necessary and the interests are not overridden by the rights and freedoms of the individual.

Legitimate interests may include:

• providing recruitment services;
• sourcing candidates;
• matching candidates to vacancies;
• maintaining candidate and client relationships;
• developing the business;
• maintaining security;
• preventing fraud; and
• protecting the Company’s legal interests.

Where consent is relied upon, it must be:

• freely given;
• specific;
• informed;
• unambiguous;
• recorded; and
• capable of being withdrawn.

Withdrawal of consent will not affect processing lawfully undertaken before consent was withdrawn.

Halo Recruitment Group Ltd may identify individuals who appear suitable for employment opportunities through:

• job boards;
• recruitment databases;
• professional networking websites;
• referrals;
• previous applications;
• professional directories; and
• publicly available professional information.

Where prospective candidates are approached, Halo Recruitment Group Ltd must have an appropriate lawful basis for doing so.

Individuals may request at any time that they are no longer contacted about recruitment opportunities.

Where lawful and necessary, personal information may be shared with:

• prospective employers;
• existing clients;
• NHS organisations;
• healthcare providers;
• care providers;
• facilities management organisations;
• professional regulators;
• the Disclosure and Barring Service;
• Right to Work verification providers;
• compliance screening providers;
• training providers;
• payroll providers;
• umbrella companies;
• pension providers;
• accountants;
• auditors;
• insurers;
• legal advisers;
• IT providers;
• recruitment software providers;
• cloud hosting providers;
• government departments;
• HM Revenue & Customs;
• law enforcement agencies; and
• regulators.

Personal data must only be shared where there is a legitimate and lawful reason.

Halo Recruitment Group Ltd will not sell personal data.

Where a candidate is being considered for a role or assignment, relevant information may be disclosed to the prospective client.

This may include:

• CV information;
• employment experience;
• qualifications;
• professional registrations;
• training status;
• compliance status;
• availability;
• references; and
• other relevant recruitment information.

Sensitive information will only be disclosed where necessary and lawful.

Only the minimum personal data reasonably required for the purpose should be shared.

Halo Recruitment Group Ltd does not routinely intend to transfer personal data internationally unless required for an approved business or operational purpose.

Where personal data is transferred outside the United Kingdom, the Company will ensure that the transfer complies with Chapter V of the UK GDPR.

Appropriate safeguards may include:

• UK adequacy regulations;
• the International Data Transfer Agreement;
• the UK Addendum to the EU Standard Contractual Clauses;
• another permitted safeguard; or
• a lawful exception under UK GDPR.

Where necessary, an appropriate transfer risk assessment will be completed and supplementary safeguards implemented.

Halo Recruitment Group Ltd will maintain appropriate technical and organisational controls to protect personal information against:

• unauthorised access;
• accidental loss;
• destruction;
• misuse;
• alteration; and
• unlawful disclosure.

Controls may include:

• role-based access controls;
• appropriate user permissions;
• secure passwords;
• multi-factor authentication where appropriate;
• encryption where appropriate;
• secure recruitment systems;
• secure supplier systems;
• secure cloud storage;
• secure electronic transmission;
• encrypted email where appropriate;
• secure file transfer services;
• antivirus and malware protection;
• cyber-security controls;
• backup and recovery arrangements;
• staff confidentiality requirements;
• incident management procedures;
• access reviews; and
• mandatory data protection and information security training.

Only authorised individuals with a legitimate business need may access personal data.

Personal data must not be retained for longer than necessary.

Retention periods will take account of:

• the nature of the information;
• the purpose for which it was collected;
• legal obligations;
• regulatory requirements;
• contractual requirements;
• records management requirements; and
• limitation periods relating to legal claims.

As a general principle:

• unsuccessful candidate records will normally be retained for up to 12 months following completion of the recruitment process, unless longer retention is required;
• active candidate records may be retained while the candidate remains registered and available for opportunities;
• employee and temporary worker records will be retained in accordance with applicable employment and legal requirements;
• compliance records may be retained where necessary to demonstrate compliance;
• financial and accounting information will be retained for statutory periods; and
• information relevant to disputes or legal claims may be retained for the applicable limitation period.

When information is no longer required, it will be securely:

• deleted;
• destroyed; or
• anonymised.

Halo Recruitment Group Ltd recognises the rights individuals have under UK data protection law.

These may include:

Individuals have the right to receive appropriate information explaining how their personal data is processed.

Individuals may request confirmation of whether their personal data is processed and obtain a copy of their information.

Individuals may request correction of inaccurate or incomplete information.

Individuals may request deletion of personal information in certain circumstances.

The right to erasure is not absolute.

Individuals may request restriction of processing in certain circumstances.

Where applicable, individuals may request information they have provided in a structured, commonly used and machine-readable format.

Individuals may object to certain processing based upon legitimate interests.

Individuals have an absolute right to object to direct marketing.

Individuals may have rights in relation to decisions based solely upon automated processing where those decisions produce legal or similarly significant effects.

Halo Recruitment Group Ltd does not ordinarily make significant recruitment decisions solely by automated means without appropriate human involvement.

Where processing is based upon consent, consent may be withdrawn at any time.

Requests regarding personal data should be directed to:

Halo Recruitment Group Ltd
16 Kings Road
Feltham
TW13 5AU

Email: info@halorecruitmentgroup.co.uk
Telephone: 0208 064 2515

The Company may verify the identity of the requester before releasing personal data.

Valid requests will be handled within applicable statutory timescales.

Any employee receiving a data protection request must promptly refer it to Senior Management.

Halo Recruitment Group Ltd will ensure that marketing activities comply with applicable UK GDPR and PECR requirements.

Where legally required, consent will be obtained before electronic marketing communications are sent.

Individuals must be provided with an appropriate method of opting out.

Marketing objections and unsubscribe requests must be respected.

This does not prevent Halo Recruitment Group Ltd from sending legitimate service communications relating to:

• active recruitment applications;
• assignments;
• placements;
• contractual matters; or
• compliance requirements.

Where Halo Recruitment Group Ltd uses cookies or similar website technologies, appropriate controls will be maintained.

Strictly necessary cookies may be used where required for website functionality.

Where consent is legally required for non-essential cookies, those cookies must not be placed until appropriate consent has been obtained.

Relevant information should be made available through the Company's Cookie Policy or website cookie management system.

Halo Recruitment Group Ltd's website may contain links to third-party websites.

The Company is not responsible for the privacy practices or security of external websites.

Individuals should review the privacy information provided by third-party websites before submitting personal information to them.

All employees and individuals working for or on behalf of Halo Recruitment Group Ltd must immediately report any actual or suspected personal data breach.

Examples may include:

• information sent to the wrong recipient;
• lost documentation;
• stolen devices;
• unauthorised system access;
• cyber-security incidents;
• accidental deletion;
• unauthorised disclosure; and
• loss or destruction of personal information.

Halo Recruitment Group Ltd will:

1. record the incident;
2. investigate the circumstances;
3. contain the breach where possible;
4. assess the information and individuals affected;
5. assess the potential risks;
6. take appropriate remedial action; and
7. determine whether notification is required.

Where a personal data breach is likely to result in a risk to individuals' rights and freedoms, Halo Recruitment Group Ltd will notify the Information Commissioner's Office without undue delay and, where feasible, within 72 hours of becoming aware of the breach.

Where a breach is likely to result in a high risk to an individual, the affected individual will also be notified where legally required.

A record of personal data breaches will be maintained, including incidents that do not require notification to the ICO.

Halo Recruitment Group Ltd's recruitment services are primarily intended for adults of working age.

The Company will not intentionally process children's personal information unless there is a legitimate, lawful and necessary reason for doing so.

Where children's information is processed, appropriate additional safeguards will be applied.

Individuals who have concerns regarding the way Halo Recruitment Group Ltd processes their personal information should initially contact:

Halo Recruitment Group Ltd
16 Kings Road
Feltham
TW13 5AU

Email: info@halorecruitmentgroup.co.uk
Telephone: 0208 064 2515

Data protection complaints will be investigated and appropriately documented.

Individuals also have the right to complain to the Information Commissioner's Office (ICO).

This policy will be reviewed at least annually and may be updated earlier where required because of:

• changes in legislation;
• ICO guidance;
• regulatory requirements;
• changes to Company activities;
• changes to systems or suppliers;
• new processing activities;
• data protection incidents; or
• internal compliance reviews.

Material changes will be communicated to relevant employees and stakeholders where appropriate.

For questions relating to data protection or this policy, contact:

Halo Recruitment Group Ltd
Company Number: 16802216
Registered Office: 16 Kings Road, Feltham, TW13 5AU
Email: info@halorecruitmentgroup.co.uk
Telephone: 0208 064 2515
Website: www.halorecruitmentgroup.co.uk

Halo Recruitment Group Ltd will consider data protection requirements when developing or implementing:

• new recruitment systems;
• software;
• technologies;
• business processes;
• services;
• suppliers; and
• processing activities.

The Company will seek to ensure that only personal data necessary for the relevant purpose is collected and that appropriate privacy and security controls are incorporated from the outset.

A Data Protection Impact Assessment (“DPIA”) will be considered where proposed processing is likely to result in a high risk to individuals.

This may include:

• large-scale processing of sensitive information;
• significant use of new technology;
• systematic monitoring;
• high-risk profiling;
• extensive automated decision-making; or
• other high-risk processing.

Where a DPIA is required, the assessment must be completed and appropriate risks addressed before the processing begins.

Halo Recruitment Group Ltd will maintain appropriate records documenting its processing activities.

Records may include:

• categories of data subjects;
• categories of personal information;
• purposes of processing;
• lawful bases;
• categories of recipients;
• international transfers;
• retention periods; and
• security controls.

Processing records will be reviewed periodically and updated when significant changes occur.

Where Halo Recruitment Group Ltd appoints a third party to process personal information on its behalf, appropriate due diligence will be undertaken.

Where required, a written Data Processing Agreement will be maintained.

Processors must provide appropriate guarantees relating to:

• confidentiality;
• data security;
• processing only on authorised instructions;
• management of sub-processors;
• assistance with data subject requests;
• reporting security incidents; and
• secure deletion or return of information when services end.

Third-party suppliers handling personal data will be reviewed proportionately according to the nature and risk of the services provided.

All employees, contractors and other authorised personnel must maintain the confidentiality of personal information.

Personal information must not be:

• accessed without authority;
• disclosed without a lawful reason;
• copied unnecessarily;
• stored on unauthorised systems;
• sent using unapproved transmission methods; or
• used for personal purposes.

Confidentiality obligations continue after an individual's employment or engagement with Halo Recruitment Group Ltd ends.

Relevant staff will receive appropriate data protection and information security training.

Training may include:

• UK GDPR principles;
• recognising personal information;
• confidentiality;
• special category information;
• secure handling of candidate data;
• cyber-security;
• phishing awareness;
• data subject rights;
• Subject Access Requests; and
• personal data breach reporting.

Training will be refreshed periodically and when significant changes in responsibilities or legislation occur.

Halo Recruitment Group Ltd will periodically review the effectiveness of its data protection controls.

Reviews may cover:

• recruitment records;
• candidate files;
• compliance documentation;
• access permissions;
• data retention;
• data sharing;
• supplier arrangements;
• system security;
• privacy notices;
• processing records;
• data protection training; and
• data breach records.

Any weaknesses or non-compliance identified will be documented and corrective action taken.

All employees, directors, workers and contractors handling personal information on behalf of Halo Recruitment Group Ltd are responsible for complying with this policy.

They must:

• only access information necessary for their duties;
• keep information confidential;
• use approved Company systems;
• maintain information security;
• avoid unnecessary collection or duplication;
• promptly report personal data breaches;
• promptly escalate data subject requests;
• follow retention requirements;
• complete required training; and
• comply with Company privacy and security procedures.

Serious or deliberate breaches of this policy may result in disciplinary action and may also constitute a breach of applicable law.