GDPR
1. Who we are
This policy explains how This is Alexander Faraday Recruitment (“This is AFR”, “we”, “us”) collects, uses and protects personal data when we find people work and help organisations hire. We are the data controller for that data under the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and the Data (Use and Access) Act 2025.
This policy covers:
- Candidates – anyone who applies for a role, sends us a CV, or whom we approach about a role
- Clients – contacts at organisations we recruit for, or might
- Referees and emergency contacts – people a candidate names to us
- Website visitors – anyone using thisisafr.com
| Detail | |
| Legal entity | This is Alexander Faraday Limited |
| Company number | 12424738 |
| Registered address | Tolworth Rd, Surbiton, Surrey, KT6 7SZ |
| ICO registration | ZA645818 |
| info@thisisafr.com | |
| Phone | 020 3488 2021 (Mon–Fri, 8am–6pm) |
| Data protection lead | A Hillman |
We recruit across HR, Training/L&D and Recruitment; head office roles (finance and payroll, PA/EA and administration); senior operations; health and safety and food safety; engineering and construction; and life sciences and manufacturing, throughout the UK.
2. What personal data we collect
We collect only what we need to recruit well and meet our legal duties.
| Who | Data we may hold |
| Candidates | Name, contact details, CV, employment and education history, qualifications and certifications, skills, current and expected salary and benefits, notice period, job preferences, location and willingness to travel, interview notes and feedback, references, right-to-work documents, call recordings and notes, correspondence |
| Clients | Name, job title, employer, work email and phone, job specifications, hiring feedback, terms of business, invoicing contacts, correspondence |
| Referees and emergency contacts | Name, contact details, relationship to the candidate, and (for referees) the reference given |
| Website visitors | IP address, browser and device data, pages visited, cookie data, and anything you enter in a contact or newsletter form |
Special category and criminal offence data
We do not ask for special category data (such as health, ethnicity, religion or sexual orientation) unless it is needed. Where it is, we handle it under section 4.
- Health and disability – only to make reasonable adjustments for interview or work, or where a role legally requires a health check
- Diversity monitoring – only where a client asks, always optional and anonymised where possible
- Criminal records (DBS) – only where a role lawfully requires a check, and only with your knowledge
3. Where we get it and our lawful basis
Most data comes from you directly: applications, CVs, calls, emails, interviews and our website forms. We also collect it from:
- Job boards and CV databases you have registered with (e.g. LinkedIn, Reed, Totaljobs, CV-Library)
- Professional networking sites and public profiles
- Referrals from people who know you
- Referees you name, and clients giving interview feedback
If we get your details from someone other than you, we will tell you within one month, and at the latest the first time we contact you.
| Purpose | Lawful basis (UK GDPR Art. 6) |
| Finding you suitable roles, sending your CV to clients, arranging interviews | Legitimate interests (running a recruitment business); contract when you have asked us to represent you |
| Sending your CV to a specific client | We always discuss the role with you and get your agreement first |
| Supplying candidates and managing client accounts | Contract; legitimate interests |
| Right-to-work checks, agency regulation records, tax and accounting | Legal obligation |
| Marketing emails to individuals (e.g. newsletter) | Consent – unsubscribe at any time |
| Business-to-business marketing to client contacts | Legitimate interests (you can opt out at any time) |
| Non-essential website cookies | Consent |
Where we rely on legitimate interests, we have balanced our interests against your rights and you can object at any time (section 7).
4. How we use it
We use personal data to:
- Match candidates to roles and contact them about opportunities
- Introduce candidates to clients, with the candidate’s agreement for each role
- Arrange interviews, collect feedback and manage offers
- Take references and carry out right-to-work and other lawful pre-employment checks
- Keep records required by the Conduct of Employment Agencies and Employment Businesses Regulations 2003
- Manage client relationships, terms and invoicing
- Send newsletters and updates where you have agreed or not opted out
- Improve our website and services, and keep our systems secure
Special category data
We process health, diversity or criminal record data only where UK GDPR Article 9 or 10 and the Data Protection Act 2018 allow it. That means employment law obligations, equality monitoring, or your explicit consent. We keep it separate from your general record and share it only where strictly needed.
Automated decisions
We do not make decisions about you based solely on automated processing. Our consultants may use database search and matching tools to find suitable candidates, but a person always reviews and decides.
5. Who we share it with
We never sell personal data. We share it only as below.
- Clients – your CV and relevant details, for a role you have agreed to be put forward for
- Referees – to confirm the information you have given us
- Service providers (processors) acting on our instructions under a written contract, including:
- Chameleoni – our recruitment database and CRM
- Twilio – telephony and call handling
- Microsoft 365
- Website host and newsletter or email marketing platform
- Background or right-to-work check provider, if used
- Accountants and payroll provider, if supplying temporary workers
- Regulators and authorities – such as HMRC, the Home Office or the police, where the law requires
- Professional advisers – lawyers, auditors and insurers, under confidentiality
- A buyer or successor – if our business is sold or merged, under equivalent protections
International transfers
We aim to keep data in the UK. Some providers may store or access data outside the UK (for example, Twilio in the United States). Where that happens we rely on a UK adequacy decision (including the UK–US Data Bridge) or the ICO’s International Data Transfer Agreement or Addendum, plus a transfer risk assessment. Ask us for details.
6. How long we keep it and how we protect it
We keep data only as long as we need it, then delete or anonymise it.
| Data | How long |
| Candidate records with no meaningful contact | 5 years from last meaningful contact, then deleted unless you ask us to keep you on file |
| Records required by the 2003 Conduct Regulations | At least 1 year from creation or last supply of services |
| Right-to-work copies (workers we employ or pay) | Duration of the assignment plus 2 years |
| Client and invoicing records | 6 years after the end of the financial year (tax law) |
| Marketing consent and opt-outs | Until you withdraw; we keep a suppression record so we don’t contact you again |
| Call recordings | 12 months, but happy to delete at your request |
| Website analytics | Per the cookie settings in section 7 |
“Meaningful contact” means a two-way exchange, such as a call, an email reply, an application or an interview.
Security
We use access controls and passwords, encrypted devices and connections, staff training and confidentiality duties, and restrict special category data to those who need it. Our processors must meet the same standards. If a breach is likely to put you at risk, we will report it to the ICO within 72 hours and tell you without undue delay.
7. Your rights, cookies and complaints
You have the right to:
- Access – get a copy of the data we hold on you
- Rectification – have inaccurate data corrected
- Erasure – have your data deleted where we no longer need it
- Restriction – limit how we use it while a concern is resolved
- Object – to processing based on legitimate interests, and to direct marketing at any time
- Portability – receive data you gave us in a usable format
- Withdraw consent – where we rely on consent, without affecting earlier processing
Email info@thisisafr.com to use any right. We may ask for ID. We respond within one month, extendable by two months for complex requests, and there is normally no charge.
Cookies
Our website uses essential cookies to work, and analytics cookies only if you accept them in our cookie banner. You can change your choice or clear cookies in your browser at any time. [e.g. Google Analytics, WordPress]
Complaints
Please raise any concern with us first at info@thisisafr.com; we will acknowledge it within 30 days and respond without undue delay. If you are unhappy with our answer, you can complain to the Information Commissioner’s Office (ICO) at ico.org.uk or on 0303 123 1113.
Changes to this policy
We review this policy at least yearly and will post updates on this page. Last updated: 26 October 2026.
Contact us
This is Alexander Faraday Recruitment · info@thisisafr.com · 02034882021