Privacy Policy

1. Who we are

Clarevance Group Ltd ("Clarevance Group", "we", "us", "our") is a specialist recruitment agency registered in England and Wales. We act as a data controller in respect of personal data we collect about candidates, clients and contacts.

If you have any questions about this policy or how we handle your data, please contact us at: enquiries@clarevancegroup.com

2. What personal data we collect

If you are a candidate

• Full name, contact details (email, phone, address)
• CV, work history, qualifications and professional skills
• Right-to-work documentation and identity verification
• Salary expectations and employment preferences
• References and feedback from previous employers (where provided)
• Any other information you voluntarily provide to us

If you are a client or business contact

• Name, job title and employer details
• Business contact information (email, phone, address)
• Details of roles you are seeking to fill
• Records of our communications and meetings

If you use our website

• Information submitted via our contact form (name, email, company, message)
• Basic usage data (pages visited, browser type) — only if analytics tools are in use

3. How we use your personal data

We use personal data for the following purposes:

• To match candidates to suitable roles and introduce them to prospective employers
• To contact you about relevant opportunities or services
• To fulfil our contractual obligations as a recruitment agency
• To verify your identity and right to work in the UK where required
• To maintain records of our business relationships
• To comply with our legal and regulatory obligations
• To respond to enquiries submitted via our website or email

4. Legal basis for processing

We rely on the following legal bases under UK GDPR and the Data (Use and Access) Act 2025 to process your data:

• Legitimate interests — to operate as a recruitment agency and match candidates with suitable roles
• Recognised legitimate interests — a new basis introduced by the DUAA (from February 2026) for certain processing activities such as crime prevention or safeguarding, where no balancing test is required
• Contract performance — where processing is necessary to fulfil our obligations to you
• Legal obligation — where we are required by law to process your data (e.g. right-to-work checks)
• Consent — where you have explicitly provided it, for example when submitting our contact form

5. How long we keep your data

We retain personal data only for as long as necessary for the purposes described in this policy:

• Active candidates — for up to 2 years from your last interaction with us, unless you ask us to remove your data sooner
• Placed candidates — for up to 6 years following placement, in line with standard business record-keeping requirements
• Client and contact records — for up to 6 years following the end of our business relationship
• Website enquiries — for up to 12 months, or until the purpose for which you contacted us is fulfilled

6. Who we share your data with

We do not sell your personal data. We may share it in the following limited circumstances:

• Prospective employers (clients) — we will always seek your consent before introducing you to a specific organisation
• IT and software providers — such as our CRM, email and document storage providers, who process data on our behalf under data processing agreements
• Regulatory and legal authorities — where we are required by law to disclose information

All third parties who process data on our behalf are required to do so in accordance with UK GDPR and the DUAA.

7. International data transfers

Where we transfer personal data outside the UK, we apply the updated "data protection test" introduced by the Data (Use and Access) Act 2025. This requires us to ensure that the standard of protection in the receiving country is not materially lower than the standard in the UK — replacing the previous "essential equivalence" test. We use standard contractual clauses or rely on countries with a UK adequacy determination where applicable.

Note: The European Commission renewed the UK's adequacy decision in December 2025, valid until 2031, meaning data can continue to flow freely between the UK and EEA.

8. Your rights

Under UK GDPR and the Data (Use and Access) Act 2025, you have the following rights:

• Right of access — to request a copy of the personal data we hold about you
• Right to rectification — to ask us to correct inaccurate or incomplete data
• Right to erasure — to request that we delete your data in certain circumstances
• Right to restriction — to ask us to restrict how we process your data
• Right to data portability — to receive your data in a structured, machine-readable format
• Right to object — to object to processing based on legitimate interests
• Right to withdraw consent — at any time, where processing is based on consent
• Right to complain to us directly — introduced by the DUAA (in force from 19 June 2026). You have the right to submit a data protection complaint directly to us before escalating to the ICO. See Section 9 below.

To exercise any of these rights, please contact us at enquiries@clarevancegroup.com. We will acknowledge your request within 30 days and respond without undue delay.

9. How to make a data protection complaint

Under the Data (Use and Access) Act 2025, you have a statutory right to raise a data protection complaint directly with us. If you believe we have handled your personal data incorrectly or in breach of UK GDPR, please follow the process below:

• Submit your complaint by email to enquiries@clarevancegroup.com, with the subject line "Data Protection Complaint"
• Please include your name, contact details, and a description of your concern
• We will acknowledge your complaint within 30 days of receipt
• We will investigate and provide a full response without undue delay
• We will keep you informed of the progress and outcome of your complaint

If you remain dissatisfied after we have responded, you have the right to escalate your complaint to the Information Commissioner's Office (ICO):

Website: ico.org.uk  ·  Helpline: 0303 123 1113

10. Cookies

Our website currently does not use tracking or advertising cookies. Where we use any analytics or functional cookies in future, we will comply with the updated Privacy and Electronic Communications Regulations (PECR) as amended by the DUAA, and will provide you with a clear opt-out at the point of first use. This policy will be updated accordingly.

11. Security

We take appropriate technical and organisational measures to protect your personal data against unauthorised access, loss or disclosure. However, no method of transmission over the internet is entirely secure and we cannot guarantee absolute security.

12. Changes to this policy

We may update this Privacy Policy from time to time to reflect changes in law or our practices. Any changes will be posted on this page with an updated revision date. We encourage you to review this policy periodically.

This policy was last updated in June 2026 to reflect the provisions of the Data (Use and Access) Act 2025 that came into force on 5 February 2026 and 19 June 2026.