Privacy Policy

Last updated: 20 August 2026

Next Review: 02 August 2027

Version: 1.0v

Owner: Senior Management

Halo Recruitment Group Ltd (“Halo Recruitment Group”, “Halo”, “we”, “us” or “our”) is committed to protecting the privacy, confidentiality and security of the personal information we process.

We provide recruitment and workforce solutions, including permanent, temporary, contract and agency recruitment services across sectors including healthcare, nursing and facilities management.

This Privacy Policy explains how we collect, use, store, share and protect personal information relating to candidates, temporary workers, contractors, employees, prospective employees, clients, client contacts, referees, suppliers, website users and other individuals with whom we interact.

We process personal information in accordance with applicable UK data protection legislation, including:

• the UK General Data Protection Regulation (“UK GDPR”);
• the Data Protection Act 2018 (“DPA 2018”);
• the Privacy and Electronic Communications Regulations 2003 (“PECR”), where applicable; and
• other applicable data protection and privacy legislation.

For the purposes of UK data protection law, Halo Recruitment Group Ltd will normally act as the data controller in respect of personal information covered by this Privacy Policy.

Halo Recruitment Group Ltd
Company Number: 16802216
Registered Office: 16 Kings Road, Feltham, TW13 5AU
Website: www.halorecruitmentgroup.co.uk

Email:  info@halorecruitmentgroup.co.uk
Telephone: 0208 064 2515

Any questions about this Privacy Policy or the way we use personal information should be directed to us using the contact details above.

This Privacy Policy applies to personal information we process about individuals including:

• candidates seeking permanent employment;
• temporary workers and agency workers;
• contractors and consultants;
• individuals registering for work with Halo;
• applicants for internal roles within Halo;
• current and former employees;
• client employees and representatives;
• prospective clients;
• referees;
• emergency contacts;
• suppliers and service providers;
• visitors to our website;
• individuals making enquiries with us; and
• other individuals whose information we process in connection with our recruitment and workforce services.

The information we collect depends upon the nature of our relationship with you.

We may collect:

• full name;
• title;
• date of birth;
• postal address;
• email address;
• telephone numbers;
• CV and employment history;
• education and qualification information;
• professional experience;
• skills and competencies;
• professional memberships and registrations;
• employment preferences;
• availability for work;
• salary, pay rate and remuneration expectations;
• photographs where required for identification or recruitment purposes;
• copies of identification documents;
• passport information;
• visa and immigration information;
• Right to Work documentation;
• National Insurance number;
• driving licence details;
• references and referee contact details;
• employment history and employment gaps;
• training records;
• occupational or professional registration details;
• DBS information where applicable;
• safeguarding information where relevant;
• compliance documentation;
• interview notes and assessments;
• information supplied by clients regarding assignments or placements;
• timesheets and attendance records;
• payroll and payment information where applicable;
• bank account details where we are responsible for making payments;
• communications between you and Halo; and
• records relating to assignments, placements and employment opportunities.

We may collect:

• names;
• business contact details;
• job titles;
• organisation information;
• email addresses;
• telephone numbers;
• correspondence;
• recruitment requirements;
• vacancy information;
• contractual information;
• billing and payment information; and
• records of services provided.

When you visit our website or contact us, we may collect:

• name;
• email address;
• telephone number;
• information submitted through online forms;
• CVs or documents uploaded to our website;
• IP address;
• browser and device information;
• website usage information; and
• cookie information, where applicable.

As part of our recruitment activities, particularly within healthcare and regulated environments, it may sometimes be necessary for us to process more sensitive information known as special category personal data.

This may include information concerning:

• health or medical information;
• disabilities or reasonable adjustment requirements;
• racial or ethnic origin;
• religious or philosophical beliefs;
• trade union membership;
• biometric information where used for identification;
• sexual orientation; and
• other information classified as special category data under UK GDPR.

We will only process special category information where we have both a lawful basis under Article 6 UK GDPR and an appropriate condition under Article 9 UK GDPR and the Data Protection Act 2018.

Where appropriate, this may include processing necessary for employment, social security and social protection obligations or reasons of substantial public interest.

We will only collect sensitive information where it is relevant and necessary for the purpose for which it is being processed.

Certain roles, particularly those involving healthcare, vulnerable adults, children, regulated activities or positions of trust, may require criminal record or Disclosure and Barring Service (“DBS”) checks.

Where legally permitted and appropriate to the role, we may process information relating to:

• criminal convictions;
• cautions;
• DBS certificates or DBS status;
• barred list information;
• safeguarding concerns; and
• other relevant criminal offence information.

We will only process criminal offence information where permitted by Article 10 UK GDPR and the Data Protection Act 2018.

Access to this information is restricted to individuals who require it for legitimate recruitment, safeguarding or compliance purposes.

We will not retain DBS certificate information for longer than necessary and will handle such information securely and in accordance with applicable DBS requirements.

We may obtain information directly from you when you:

• apply for a vacancy;
• register with Halo;
• submit your CV;
• complete a registration or compliance form;
• contact us by telephone, email, social media or through our website;
• attend an interview;
• provide compliance documentation;
• undertake an assignment through us; or
• communicate with our consultants.

We may also obtain information from third parties including:

• recruitment websites and job boards;
• professional networking websites;
• publicly available professional sources;
• former employers;
• referees;
• clients;
• professional bodies;
• regulatory organisations;
• the Disclosure and Barring Service;
• Right to Work verification providers;
• compliance screening providers;
• recruitment partners or agencies;
• umbrella companies;
• payroll providers; and
• other organisations where legally permitted.

Where we obtain your information from another source, we will provide appropriate privacy information where required by law.

We may process personal information for purposes including:

• registering candidates for work;
• assessing suitability for vacancies;
• matching candidates to appropriate opportunities;
• presenting candidates to prospective employers or clients;
• arranging interviews;
• managing temporary assignments;
• managing permanent placements;
• maintaining candidate relationships;
• contacting candidates about relevant vacancies; and
• providing recruitment and workforce services.

• verifying identity;
• verifying Right to Work in the UK;
• checking employment history;
• obtaining employment references;
• validating qualifications;
• confirming professional registrations;
• checking mandatory training;
• undertaking DBS checks where required;
• carrying out safeguarding checks;
• ensuring candidates meet client compliance requirements; and
• meeting regulatory, contractual and legal requirements.

Where applicable, we may process information to:

• administer assignments;
• maintain worker records;
• process timesheets;
• calculate pay;
• manage payroll;
• manage holiday entitlement;
• administer pensions where applicable;
• fulfil employment or worker obligations; and
• maintain appropriate records.

We use client information to:

• manage client relationships;
• understand staffing requirements;
• provide recruitment services;
• fulfil contracts;
• communicate regarding candidates and assignments;
• issue invoices;
• administer accounts; and
• develop our business relationships.

We may also process information to:

• manage complaints;
• investigate incidents;
• prevent fraud;
• protect our legal rights;
• defend or pursue legal claims;
• maintain accounting and financial records;
• comply with tax obligations;
• respond to regulators or public authorities;
• perform internal audits;
• maintain information security; and
• improve our services.

Under UK GDPR, we must have a lawful basis for processing personal information.

Depending upon the circumstances, we may rely on one or more of the following:

Processing may be necessary to take steps at your request before entering into a contract or to perform a contract with you.

For example, we may process candidate information in order to register an individual, arrange assignments or provide recruitment services.

We may process information where necessary to comply with legal obligations, including:

• Right to Work requirements;
• employment law;
• tax legislation;
• safeguarding obligations;
• health and safety requirements;
• regulatory obligations; and
• other statutory requirements.

We may process information where necessary for our legitimate business interests, provided those interests are not overridden by your rights and freedoms.

Our legitimate interests may include:

• providing recruitment services;
• matching candidates to vacancies;
• identifying prospective candidates;
• maintaining candidate and client relationships;
• developing our business;
• managing and defending legal claims;
• protecting our systems;
• preventing fraud; and
• ensuring our recruitment services operate effectively.

Where we rely on legitimate interests, we consider the necessity and proportionality of the processing and the potential impact on individuals.

In limited circumstances, we may rely upon your consent.

Where consent is relied upon, it will be freely given, specific, informed and capable of being withdrawn.

You may withdraw your consent at any time.

Withdrawal of consent will not affect the lawfulness of processing undertaken before consent was withdrawn.

As a recruitment organisation, we may identify individuals who appear suitable for employment opportunities using sources such as:

• job boards;
• recruitment databases;
• professional networking websites;
• publicly available professional information;
• referrals; and
• previous applications or registrations with us.

Where we identify a prospective candidate, we may contact that individual where we believe there is a legitimate recruitment reason for doing so.

Individuals may ask us at any time to stop contacting them about recruitment opportunities.

Where necessary and lawful, we may share personal information with organisations including:

• prospective employers;
• existing clients;
• NHS organisations;
• healthcare providers;
• private healthcare organisations;
• care providers;
• facilities management organisations;
• organisations to which candidates are being supplied;
• professional regulatory bodies;
• the Disclosure and Barring Service;
• Right to Work verification providers;
• compliance service providers;
• training providers;
• occupational health providers where applicable;
• payroll providers;
• umbrella companies;
• pension providers;
• accountants;
• auditors;
• insurers;
• legal advisers;
• IT service providers;
• recruitment software providers;
• cloud hosting providers;
• email and communications providers;
• background screening providers;
• government departments;
• HM Revenue & Customs;
• law enforcement agencies; and
• regulatory or statutory authorities.

We will only disclose personal information where there is a legitimate and lawful reason to do so.

We do not sell personal information.

Where you are being considered for a vacancy or assignment, we may provide relevant personal information to the prospective client.

This may include:

• your CV;
• employment experience;
• qualifications;
• professional registrations;
• compliance status;
• availability;
• references;
• training status; and
• other information reasonably necessary for the recruitment process.

Sensitive compliance information will only be shared where necessary and appropriate.

We primarily process personal information within the United Kingdom.

However, some service providers, technology platforms or authorised support services used by Halo may process or access information from countries outside the UK.

Where personal information is transferred outside the UK, we will ensure that the transfer is permitted by applicable data protection legislation.

Where required, this may include relying upon:

• UK adequacy regulations;
• the UK International Data Transfer Agreement (“IDTA”);
• the UK Addendum to the EU Standard Contractual Clauses;
• another appropriate safeguard permitted by UK GDPR; or
• a legally recognised exception where applicable.

Where appropriate safeguards are used, we will undertake any required data protection or transfer risk assessment and implement additional technical or organisational safeguards where necessary.

Halo takes appropriate technical and organisational measures to protect personal information against:

• unauthorised access;
• accidental loss;
• misuse;
• alteration;
• destruction;
• unauthorised disclosure; and
• other unlawful processing.

Our security measures may include:

• role-based access controls;
• password protection;
• multi-factor authentication where appropriate;
• encryption where appropriate;
• secure recruitment and compliance systems;
• secure cloud storage;
• antivirus and cyber-security measures;
• restricted access to sensitive information;
• secure transmission methods;
• staff confidentiality requirements;
• data protection and cyber-security training;
• information security procedures;
• incident management procedures;
• backup and recovery arrangements; and
• regular review of access permissions and security controls.

Access to personal information is limited to employees, contractors and service providers who have a legitimate business need to access it.

We will not retain personal information for longer than is reasonably necessary for the purposes for which it was collected.

Retention periods will depend upon:

• the nature of the information;
• the reason it was collected;
• legal obligations;
• regulatory requirements;
• contractual requirements;
• limitation periods for legal claims; and
• legitimate business requirements.

As a general principle:

• candidate and recruitment records may be retained while you remain actively registered with us and for an appropriate period afterwards;
• unsuccessful candidate records will normally be retained for up to 12 months following completion of the relevant recruitment process, unless there is a lawful reason to retain them for longer;
• temporary worker and placement records may be retained for the period necessary to meet employment, tax, regulatory, contractual and legal requirements;
• financial and accounting records will normally be retained for the period required by applicable tax and accounting legislation;
• compliance information will be retained for as long as necessary to demonstrate appropriate recruitment and regulatory compliance; and
• information relating to legal disputes may be retained for the duration of the relevant limitation period and any ongoing proceedings.

Where information is no longer required, it will be securely deleted, destroyed or anonymised.

Depending upon the circumstances, UK data protection legislation gives individuals a number of rights regarding their personal information.

These may include:

You can request confirmation of whether we process your personal information and request a copy of the information we hold about you.

You may ask us to correct inaccurate or incomplete personal information.

In certain circumstances, you may ask us to delete your personal information.

This right is not absolute and we may need to retain information where there is a legal, regulatory or legitimate reason to do so.

In certain circumstances, you may request that we restrict how we process your personal information.

Where applicable, you may request personal information you provided to us in a structured, commonly used and machine-readable format.

You may object to processing based on legitimate interests in certain circumstances.

You have an absolute right to object to personal information being used for direct marketing.

You may have rights in relation to decisions made solely through automated processing where those decisions have legal or similarly significant effects.

Halo does not ordinarily make recruitment decisions that have legal or similarly significant effects on individuals solely through automated decision-making without appropriate human involvement.

Where processing is based upon consent, you may withdraw your consent at any time.

To exercise any of your data protection rights, contact:

Halo Recruitment Group Ltd
Email: info@halorecruitmentgroup.co.uk
Telephone: 0208 064 2515

We may need to request information to confirm your identity before responding to a request.

We will respond to valid requests within the timescales required by applicable data protection law.

There is normally no fee for exercising your data protection rights. However, we may charge a reasonable fee or refuse a request where permitted by law, for example where a request is manifestly unfounded or excessive.

We may contact clients, prospective clients, candidates or other business contacts regarding services or opportunities where permitted by law.

Where required, we will obtain consent before sending electronic marketing communications.

You can opt out of marketing communications at any time by:

• using the unsubscribe facility contained within the communication; or
• contacting us directly.

Opting out of marketing communications will not prevent us from contacting you about active applications, assignments, contractual matters or other necessary service communications.

Our website may use cookies and similar technologies to operate effectively, understand website usage and improve user experience.

Some cookies may be strictly necessary for the operation of the website.

Where required by law, non-essential cookies will only be placed after you have provided appropriate consent.

Further information may be provided within our Cookie Policy or website cookie management tool.

Our website may contain links to third-party websites.

Halo Recruitment Group Ltd is not responsible for the privacy practices or content of external websites.

You should review the privacy notice of any third-party website before providing personal information to it.

Halo maintains procedures for identifying, investigating and responding to personal data breaches.

Where a breach is likely to result in a risk to the rights and freedoms of individuals, we will notify the Information Commissioner’s Office where required by law.

Where a breach is likely to result in a high risk to an affected individual, we will also notify that individual where legally required.

Our recruitment services are generally directed towards adults of working age.

We do not intentionally collect personal information from children except where this is lawful, necessary and appropriate for a specific recruitment or employment purpose.

Where additional protections are required for children’s personal information, these will be applied.

If you have concerns about how Halo Recruitment Group Ltd processes your personal information, we encourage you to contact us first so that we can investigate and attempt to resolve the matter.

You also have the right to make a complaint to the UK supervisory authority:

Information Commissioner’s Office (ICO)

ICO Number: ZC026857

Further information about your rights and how to make a complaint is available through the Information Commissioner’s Office.

We may update this Privacy Policy from time to time to reflect:

• changes in legislation;
• regulatory guidance;
• changes to our recruitment services;
• changes to our systems or suppliers; or
• improvements to our privacy and information security practices.

The latest version will be published on our website and the date at the beginning of this Privacy Policy will be updated accordingly.

Where a change materially affects how we process personal information, we will take reasonable steps to bring the change to the attention of affected individuals.

For questions about this Privacy Policy, requests concerning your personal information or other data protection enquiries, please contact:

Halo Recruitment Group Ltd
Registered Office: 16 Kings Road, Feltham, TW13 5AU
Email: info@halorecruitmentgroup.co.uk
Telephone: 0208 064 2515
Website: www.halorecruitmentgroup.co.uk