Privacy policy

This policy explains how Conexus Solutions Limited collects, uses, shares and protects personal data when you use our website, apply for or register for work with us, work with us as an interim professional or consultant, or deal with us as a client or business contact. It also explains your rights under UK data protection law.

Who we are

We are Conexus Solutions Limited, a company registered in England and Wales under company number 8335419, with our registered office at The Old Post Office, 41-43 Market Place, Chippenham, Wiltshire, SN15 3HR. We are registered with the Information Commissioner’s Office (ICO) under registration number ZA577008.

We provide recruitment, consultancy, interim placement and managed services. Depending on how we work with you, we may:

– introduce candidates to clients for permanent or fixed-term roles, for a fee;
– engage interim professionals directly as contractors, where the work is outside IR35;
– engage interim professionals through an umbrella company, where the work is inside IR35; and
– provide consultancy and managed services to clients.

For the personal data of our own candidates, interim professionals, clients and website visitors, we are the “data controller”. In some managed service work we handle personal data on behalf of a client. In that case the client is the controller and we act as its “processor” (see “Working on behalf of clients” below).

You can contact us about privacy matters at [email protected] or by post at the address above.

Who this policy applies to

– **Candidates and job applicants**, including people who register with us, send us a CV or apply for a role we advertise.
– **Interim professionals and consultants** whom we engage directly or through an umbrella company, including those who join our associate or consultant network.
– **Clients and business contacts**, including hiring managers, HR and procurement contacts.
– **Referees** named by candidates or interim professionals.
– **Website visitors** and people who sign up to our newsletter or job alerts.

What personal data we collect

Candidates and job applicants:

– identity and contact details, such as your name, address, email address and telephone number;
– your CV and covering letter, including employment history, qualifications, skills, training, professional memberships and any professional profile information you share with us;
– your job preferences, salary or day rate expectations, notice period and availability;
– records of our conversations, interviews and assessments;
– references from referees you have named; and
– the details of how you found us.

Interim professionals and consultants (when we engage you)

In addition to the above:

– right-to-work and identity documents, such as your passport, visa or share code, and a copy of the check we carried out;
– pre-engagement check information, which may include employment history and gap checks, qualification checks, proof of address, professional registration checks and, where the role legally requires it, criminal record checks (for example a DBS check for work in a school or other regulated setting);
– tax and payment details, such as your National Insurance number, UTR, bank details, VAT status and, if you work through your own company, its name, number and registered address;
– insurance details, such as professional indemnity and public liability certificates;
– our assessment of your IR35 (off-payroll working) status, and the information on which that assessment is based;
– if you are engaged through an umbrella company, the details we need to give that company so it can contract with you and pay you;
– engagement records, such as contracts, timesheets, invoices, performance feedback and any incident or complaint records.

Special category and criminal record data

We do not ask for special category data (such as health, ethnicity, religion or sexual orientation) unless there is a clear need, for example to make a reasonable adjustment for a disability, or for optional equality and diversity monitoring. If we ask, we will tell you why and whether you have to answer.

We only process criminal record information where the law permits it and the role requires it. We do not keep copies of criminal record certificates for longer than necessary (see “How long we keep your data”).

Clients and business contacts

Names, job titles, organisation, business contact details, records of our meetings and communications, and details of contracts and engagements.

Referees

The name, contact details and job title of the referee, and the reference they provide.

Website visitors, enquiries and subscribers

The details you enter in our contact forms, newsletter sign-ups and job alerts, and technical data such as your IP address, browser type, device information and the pages you visit, collected through cookies and similar technologies (see “Cookies”).

Where we get your data

We collect personal data directly from you, for example when you apply, register, complete a form or speak to us. We may also receive it from:

– clients who refer you to us or who have shared your details for a role;
– referees and former employers;
– umbrella companies, payroll providers and pre-employment check providers;
– job boards and professional networking sites; and
– publicly available sources, where we are contacting you about a suitable opportunity.

If we get your data from someone other than you, we will tell you within a month.

How we use your data

We use your personal data to:

– find, assess and match candidates and interim professionals to opportunities, and put them forward to clients;
– introduce candidates to clients for permanent and fixed-term roles, and invoice the clients our introduction fee;
– carry out right-to-work, reference and other pre-employment or pre-engagement checks;
– contract with, engage and pay interim professionals, directly or through an umbrella company, and manage their engagements;
– make and record IR35 status determinations, and comply with HMRC requirements;
– provide consultancy and managed services to clients and manage client relationships;
– respond to enquiries and send job alerts, newsletters and marketing messages where you have chosen to receive them;
– run, secure and improve our website and services;
– keep records and comply with our legal, tax and regulatory obligations; and
– establish, exercise or defend legal claims.

We may use software to help search for and match CVs to opportunities. Decisions about whether to put you forward, offer you an engagement or work with you are always made by people and not solely by automated means.

Legal basis for processing

| What we do | Legal basis (UK GDPR) |
|—|—|
| Assess candidates, find them suitable roles and share their details with clients | Legitimate interests (providing recruitment services), or steps taken at your request before entering a contract |
| Engage and pay interim professionals directly | Contract |
| Right-to-work checks, tax, payroll and other statutory records | Legal obligation |
| Pre-engagement checks (references, qualifications, employment history) | Legitimate interests (making sure candidates are suitable and meeting client requirements), or legal obligation where a check is required by law or regulation |
| Criminal record checks | Legal obligation or a condition in Schedule 1 of the Data Protection Act 2018, as applies to the role. We keep an appropriate policy document where one is required. |
| IR35 status determinations | Legal obligation and legitimate interests (managing tax compliance risk) |
| Share your details with an umbrella company | Contract and legitimate interests |
| Special category data (for example disability adjustments) | Explicit consent, or employment and social security law obligations where applicable |
| Equality and diversity monitoring | Explicit consent |
| Keep your CV on file beyond our standard retention period | Consent |
| Provide consultancy and managed services to clients, and manage client relationships | Contract and legitimate interests (running our business) |
| Respond to enquiries | Legitimate interests, or steps taken at your request before entering a contract |
| Send job alerts and marketing emails to individuals and sole traders | Consent |
| Send marketing to corporate contacts (such as a company email address) | Legitimate interests, with an easy way to opt out at any time |
| Non-essential cookies and analytics | Consent |
| Essential cookies, security and website administration | Legitimate interests |
| Accounting, tax and responding to lawful requests | Legal obligation |

Where we rely on legitimate interests, we have considered whether those interests are outweighed by your rights and freedoms. You can ask us about this at any time.

Who we share your data with

We do not sell your personal data. We share it only where necessary with:

– **Clients and prospective employers**, who receive your CV and relevant details when we put you forward. We will normally speak to you first. Once you are engaged, clients may also receive your pre-engagement check confirmations and engagement details.
– **Umbrella companies and payroll providers**, if you are engaged through one. They become a separate controller of the data they hold about you for payroll and tax purposes and will give you their own privacy notice.
– **Pre-employment check providers**, such as providers of right-to-work, DBS, qualification and employment history checks.
– **Referees**, so that we can request references you have asked us to obtain.
– **Insurers, brokers and finance providers**, where needed for insurance, credit or invoice finance arrangements.
– **Service providers (processors)** who act on our instructions, such as website hosting, applicant tracking and CRM systems, email and newsletter platforms, job boards, document storage, accounting and IT support. They are bound by contracts requiring them to protect your data.
– **Professional advisers**, such as lawyers and accountants.
– **HMRC, regulators, law enforcement and other authorities**, where we are legally required to.
– **A prospective buyer or successor business**, if our business is sold or restructured, under appropriate confidentiality.

Working on behalf of clients

In some managed service and consultancy work, we process personal data on behalf of a client, for example when we manage a client’s interim workforce programme or hold details of other suppliers’ consultants as part of that service. In those cases the client is the controller of that data and we act on its instructions as its processor. The client’s own privacy notice will explain how it uses the data, and if you want to exercise your rights in relation to that data, you should contact the client. If you contact us instead, we will pass your request on to the client.

Where our consultants work inside a client’s organisation, they may see personal data that belongs to the client. We handle it only as needed to do the work, keep it confidential, follow the client’s data protection and safeguarding policies, and do not keep it beyond what the engagement requires.

International data transfers

Some of our service providers (for example cloud, email or analytics providers) may process data outside the UK, including in the United States. Where personal data is transferred outside the UK, we make sure appropriate safeguards are in place, such as UK adequacy regulations (including the UK Extension to the EU-US Data Privacy Framework where the provider is certified), the UK International Data Transfer Agreement, or the UK Addendum to the EU Standard Contractual Clauses. You can contact us for more details of the safeguards used.

How long we keep your data

| Data | Retention period |
|—|—|
| Candidate records (CVs and registration details) | Up to 2 years after our last meaningful contact with you. We will ask whether you want us to keep your details before then. If you agree, we may keep them longer. |
| Records of candidates introduced to clients for a fee | 6 years after the introduction, for fee and tax records |
| Unsuccessful applications for our own vacancies | 6 months after the recruitment process ends, unless you agree to us keeping your details |
| Interim professional and contractor engagement records (contracts, timesheets, invoices, payment details) | 6 years after the engagement ends |
| IR35 status determinations and supporting information | 6 years after the engagement ends |
| Right-to-work documents | For the duration of the engagement plus 2 years |
| Criminal record certificates and the information they contain | No longer than 6 months after the decision is made. We keep only a record that the check was done, its date, the reference number and the outcome. |
| Other pre-engagement check records (references, qualifications, employment history) | For the duration of the engagement plus 6 years |
| Client and contract records | 6 years after the contract ends |
| Business enquiries and contact form messages | 2 years after our last contact |
| Newsletter and job alert subscriptions | Until you unsubscribe, after which we keep a minimal suppression record so we do not contact you again |
| Website analytics data | Up to 14 months |

We may keep data for longer where the law requires or where we need it to establish, exercise or defend legal claims. When we no longer need your data, we delete or anonymise it securely.

Cookies

Details of the cookies used on this site are set out in our cookie policy.

Your rights

Under UK data protection law, you have the right to:

– **be informed** about how we use your data (this policy);
– **access** the personal data we hold about you;
– **rectify** inaccurate or incomplete data;
– **erasure** of your data in certain circumstances;
– **restrict** how we use your data in certain circumstances;
– **data portability**, receiving your data in a structured, commonly used format where we process it by consent or contract;
– **object** to processing based on legitimate interests, and to direct marketing at any time;
– **withdraw consent** at any time where we rely on it, without affecting processing that took place before you withdrew it; and
– **not be subject to solely automated decisions** that have legal or similarly significant effects on you.

To exercise any of these rights, email **[privacy email address]**. We will respond within one month, and we may need to verify your identity first. There is usually no charge, though we may charge a reasonable fee or refuse requests that are manifestly unfounded or excessive. Some rights are limited where we have a legal duty to keep records, for example tax and right-to-work records. You can unsubscribe from job alerts and marketing emails at any time using the link in each message.

Data security and breaches

We use appropriate technical and organisational measures to protect personal data, including access controls, encryption where appropriate, and secure systems and suppliers. If a personal data breach is likely to result in a risk to individuals, we will report it to the ICO within 72 hours of becoming aware of it, and we will tell affected individuals where the risk is high.

How to complain

If you are unhappy with how we have handled your data, please contact us first at [email protected] so we can try to put things right. We will acknowledge your complaint within 30 days and respond without undue delay.

Children

Our website and services are not aimed at anyone under 16, and we do not knowingly collect their personal data. Where an engagement involves work in schools or with children, we may process data about a person’s suitability to work with children, as described above.

Changes to this policy

We may update this policy from time to time. The latest version will always be on this page, with the “last reviewed” date at the top. If we make significant changes, we will let you know by posting a notice on our website or contacting you by email where appropriate.