Privacy policy

1. Introduction
Conexus Solutions Limited (“Conexus”, “we”, “us” or “our”) is committed to respecting your privacy and protecting your personal information.

We provide specialist recruitment, interim resourcing, executive search, education consultancy, school improvement and related services to schools, academy trusts, local authorities and other organisations. We also work with education professionals, interim leaders, consultants and other individuals who may be interested in working with us.

This Privacy Policy explains how we collect, use, store, share and protect personal information when you visit our website, contact us, register with us, apply for an opportunity, work with us or otherwise interact with our business.
It also explains your rights under applicable data protection legislation and how you can exercise them.

Please read this policy carefully. Depending on your relationship with Conexus and the services involved, not every section will apply to you.

2. Who we are
The organisation responsible for personal data processed for our own recruitment, consultancy and business activities is:
Data controller: Conexus Solutions Limited
Website: https://www.conexusgroup.co.uk/
Privacy contact: [email protected]
Postal address: 4 Queen Street, Bath, BA1 1HE
For information about our registered office and company registration details, please refer to our published company information.
For certain consultancy engagements, we may process personal data on behalf of a school, academy trust, local authority or another client. Where a client determines the purposes and essential means of that processing, the client may be the data controller and Conexus may act as its data processor. In those circumstances, our responsibilities will be governed by the relevant contractual arrangements and applicable law.
If you are unsure who is responsible for particular information, please contact us and we will explain the relevant arrangements.

3. The personal information we collect
The information we collect depends on how you interact with us.
3.1 Candidates, associates and education professionals
If you register with us, submit your CV, apply for a role or express an interest in an interim or consultancy opportunity, we may collect:
• Name, contact details and other identifying information.
• CVs, employment history, career experience and professional references.
• Qualifications, training, professional memberships and relevant skills.
• Role preferences, availability, geographical preferences and salary or day-rate expectations.
• Interview notes, communications and information relevant to assessing suitability.
• Details of applications, introductions, assignments and recruitment outcomes.
• Right-to-work verification information and other checks required for a particular role.
• Criminal-record or safeguarding-related information where the role and applicable law permit the relevant checks.
• Contractual, timesheet, payment, payroll or tax information where necessary to establish or administer an engagement.
We will seek to collect only information that is relevant and necessary for the applicable recruitment, engagement or business purpose.
3.2 Clients and business contacts
If you represent a school, academy trust, local authority or another organisation, we may collect:
• Your name, job title, work contact details and professional background.
• Information about your organisation and its recruitment or consultancy requirements.
• Details of enquiries, meetings, communications and service requests.
• Contractual, billing and payment information where relevant.
• Feedback, correspondence and records relating to the services we provide.
3.3 Referees and other third parties
Where you provide a reference or other professional information about an individual, or where an individual provides your details as a referee, we may collect relevant contact details and information relating to professional experience, suitability or an engagement.
We will use such information for appropriate recruitment, verification or business purposes and provide privacy information where required by law.
3.4 Website visitors
When you visit our website, we may collect technical and usage information, depending on the website configuration and your cookie preferences. This may include:
• IP address and general device or browser information.
• Pages visited and interactions with website features.
• Information submitted through contact forms.
• Cookie and similar technology information, where applicable.
Non-essential analytics or marketing technologies will be used only in accordance with applicable legal requirements and our Cookie Policy.
3.5 Special-category and criminal-offence information
In limited circumstances, we may need to process special-category personal data, such as health information or diversity information, or criminal-offence information relating to a relevant role or engagement.
We will only process such information where it is necessary, permitted by law and supported by the applicable additional legal condition or authorisation. We will apply appropriate access controls, safeguards and retention arrangements.
Please do not send sensitive personal information unless it is relevant and necessary for the purpose.

4. How we obtain personal information
We may obtain personal information:
• Directly from you through our website, contact forms, CV submissions, applications, telephone calls, emails, meetings or other communications.
• From schools, academy trusts, local authorities, clients and other organisations involved in a recruitment or consultancy process.
• From referees, former employers and professional contacts, where appropriate.
• From recruitment platforms, job boards and professional networking services.
• From publicly available professional sources where there is an appropriate reason and lawful basis to do so.
• From identity, qualification, right-to-work, screening or other verification providers where relevant and lawful.
• From service providers that support our business systems and administration.
If we obtain personal information from another source, we will provide the privacy information required by law, subject to any applicable exceptions.
Where the law requires us to collect particular information, we will explain this when requesting it. If you do not provide information that is necessary for a recruitment process, legal check or contractual arrangement, we may be unable to progress the relevant application or engagement.

5. How we use personal information
We use personal information for purposes including:
Recruitment and candidate management
• Registering and maintaining candidate or associate profiles.
• Reviewing experience, qualifications, skills and availability.
• Identifying relevant employment, interim or consultancy opportunities.
• Assessing suitability and facilitating interviews or introductions.
• Communicating with candidates and prospective clients.
• Obtaining references and carrying out appropriate verification checks.
• Maintaining records of recruitment activity and outcomes.
Consultancy and client services
• Understanding client requirements and delivering agreed services.
• Identifying appropriate professionals for assignments.
• Managing projects, communications and contractual relationships.
• Administering engagements, timesheets, payments and related records.
• Maintaining appropriate service and quality records.
Business administration and legal compliance
• Responding to enquiries and requests.
• Maintaining business, financial and contractual records.
• Managing complaints, disputes and legal claims.
• Protecting our website, systems, personnel and business against fraud, misuse or security threats.
• Complying with applicable legal and regulatory obligations.
Website improvement and communications
• Maintaining and improving our website and services.
• Understanding website usage where appropriate analytics technologies are enabled.
• Sending relevant business communications where permitted.
• Sending optional job alerts, newsletters or marketing communications where we have an appropriate lawful basis and have obtained consent where required.
We will not use personal information for a materially different purpose without providing further information where required by law.

6. Our lawful bases for processing
Under UK data protection law, we must have an appropriate lawful basis for processing personal data. The basis depends on the specific activity and circumstances.
We may rely on the following lawful bases.
6.1 Legitimate interests
We may process personal information where necessary for our legitimate business interests, provided those interests are not overridden by your rights and interests.
These interests may include:
• Identifying and assessing suitable candidates for relevant opportunities.
• Maintaining an appropriate recruitment and associate network.
• Introducing professionals to schools, academy trusts and other clients.
• Managing business relationships and responding to enquiries.
• Maintaining appropriate operational, security and recruitment records.
• Improving our services and protecting our business.
Where we rely on legitimate interests, we consider the potential impact on individuals and apply appropriate safeguards. You may have the right to object to processing carried out on this basis.
6.2 Contract and steps before entering into a contract
We may process personal information where necessary to take steps you request before entering into a contract or to perform a contract with you.
This may include assessing an application, arranging an engagement, administering an agreed consultancy service or managing contractual obligations.
6.3 Legal obligations
We may process personal information where necessary to comply with applicable legal obligations, including relevant employment, tax, accounting, right-to-work or other statutory requirements.
6.4 Consent
Where consent is the appropriate lawful basis, we will request it in a clear and specific manner.
You may withdraw consent at any time. Withdrawal does not affect the lawfulness of processing carried out before consent was withdrawn.
Where we rely on consent for optional electronic marketing, you can withdraw it through the unsubscribe facility in the relevant communication or by contacting us.
6.5 Special-category and criminal-offence information
Where we process special-category personal data, we will identify both an applicable lawful basis under Article 6 UK GDPR and an appropriate condition under Article 9 UK GDPR and the Data Protection Act 2018, as applicable.
Where we process criminal-offence data, we will ensure that the processing is permitted by Article 10 UK GDPR and the applicable provisions of the Data Protection Act 2018, including any required safeguards or appropriate policy documentation.
We will not assume that consent alone is sufficient for these categories of information.

7. Recruitment, references and safeguarding checks
Some education roles or engagements may require additional checks, depending on the duties involved and applicable legal requirements.
Where relevant and lawful, these may include:
• Identity and right-to-work verification.
• Qualification and professional membership checks.
• Employment history and references.
• Appropriate criminal-record or DBS checks.
• Other role-specific checks required by law or by a lawful client requirement.
The nature and level of any check will depend on the role and the rules that apply to it. We will not request a higher level of criminal-record check simply because a role is connected with education.
Where criminal-offence or safeguarding-related information is processed, access will be restricted to authorised individuals who need it for the relevant purpose. We will apply appropriate security, handling and retention controls.
We will not retain copies of DBS certificates longer than necessary. Where applicable, we will follow the relevant DBS guidance and legal requirements for handling and retaining certificate information.
Where a check is arranged by a client or another authorised provider, responsibility for obtaining, reviewing and retaining the information will depend on the applicable arrangements and law.

8. Sharing personal information
We may share personal information with third parties where necessary for the purposes described in this policy, where permitted by law or where we are required to do so.
Depending on your relationship with us, these recipients may include:
Schools, academy trusts and other clients
Where you are being considered for a role or assignment, we may share relevant information with the school, academy trust, local authority or other organisation responsible for the opportunity.
This may include your CV, experience, qualifications, availability and other relevant information. References, verification results or other sensitive information will only be shared where appropriate and lawful.
Recruitment, screening and professional service providers
We may share information with referees, screening providers, qualification-verification services and other parties involved in an appropriate recruitment or verification process.
Payroll and engagement providers
Where relevant to an engagement, we may share necessary information with umbrella companies, payroll providers, accountants or other parties involved in administering contractual, payment or tax arrangements.
Technology and business service providers
We may use third-party providers to support our website, communications, document storage, recruitment systems, IT security and business administration.
These providers may process personal information on our behalf under appropriate contractual arrangements where required.
Professional advisers and public authorities
We may disclose information to legal advisers, auditors, insurers, regulators, courts, law enforcement authorities or other bodies where necessary and permitted or required by law.
We do not sell personal information to third parties.
We aim to share only information that is relevant and necessary for the intended purpose.

9. International transfers
Some of our service providers or their systems may involve the processing or storage of personal information outside the United Kingdom.
Where personal information is transferred internationally, we will ensure that the transfer complies with applicable data protection law. Depending on the circumstances, this may involve a UK adequacy regulation, an appropriate safeguard such as the UK International Data Transfer Agreement or UK Addendum, or another lawful transfer mechanism.
Where required, we will take account of the protection available for the information and implement any necessary supplementary measures.
If you require further information about an international transfer and the safeguards used, please contact us.

10. How long we keep personal information
We retain personal information only for as long as reasonably necessary for the purposes for which it was collected, taking account of applicable legal, regulatory, contractual and business requirements.
Retention periods vary depending on the type of information and the circumstances.
Examples include:
• Candidate and associate profiles: retained while the relationship remains active and for an appropriate period afterwards, subject to our approved retention schedule.
• CVs and recruitment records: retained for the period necessary to manage relevant recruitment activity, future opportunities where appropriate, and any associated legal requirements.
• References and verification records: retained only for the period justified by the relevant recruitment, engagement or compliance purpose.
• Right-to-work records: retained in accordance with applicable legal requirements and relevant Home Office guidance.
• DBS certificate information: retained in accordance with applicable DBS guidance, legal requirements and our documented retention arrangements.
• Contracts, financial and payment records: retained for applicable statutory, accounting, contractual and legal-claims purposes.
• Enquiries and business correspondence: retained for as long as needed to respond to the enquiry and manage any resulting relationship or obligations.
• Website and cookie information: retained in accordance with the relevant technology settings, our Cookie Policy and applicable legal requirements.
We periodically review the personal information we hold and delete or anonymise it when it is no longer required, unless a lawful reason exists to retain it.
Where we retain candidate information for future opportunities, we will provide appropriate information about that use and review inactive records in accordance with our retention schedule.

11. How we protect personal information
We take appropriate technical and organisational measures to protect personal information against unauthorised access, accidental loss, destruction, alteration or disclosure.
Depending on the information and processing involved, these measures may include access controls, secure systems, staff training, confidentiality requirements, appropriate supplier arrangements, backup procedures and security monitoring.
Access to personal information is limited to individuals who need it for legitimate business purposes.
No method of electronic storage or transmission is completely secure. However, we take reasonable steps to protect the information entrusted to us and to respond appropriately to suspected security incidents.
Where a personal data breach occurs, we will assess and respond to it in accordance with applicable legal requirements, including any required notification to the Information Commissioner’s Office or affected individuals.

12. Your data protection rights
Under applicable data protection law, you may have the right to:
• Access: request a copy of your personal information.
• Rectification: ask us to correct inaccurate or incomplete information.
• Erasure: ask us to delete personal information in certain circumstances.
• Restriction: ask us to restrict the use of your information in certain circumstances.
• Objection: object to processing based on legitimate interests or to certain other processing where the law provides this right.
• Data portability: request certain information in a portable format where the legal conditions are met.
• Withdraw consent: where we rely on consent, withdraw it at any time.
• Complain: raise a concern with us or complain to the Information Commissioner’s Office.
These rights are subject to legal conditions and exceptions. For example, we may need to retain certain records to comply with legal obligations or establish, exercise or defend legal claims.
We will respond to requests in accordance with applicable law. We may need to verify your identity before responding.
To exercise your rights, contact us using the details in Section 2.

13. Marketing and communications
We may contact you about recruitment opportunities, consultancy services or business matters relevant to your relationship with Conexus.
Where we send electronic marketing communications, we will comply with applicable data protection and electronic marketing rules, including obtaining consent where required.
You can opt out of marketing emails at any time by using the unsubscribe link in the message or contacting us.
Opting out of marketing will not prevent us from sending necessary service-related, contractual or administrative communications.
We will respect your communication preferences and maintain appropriate records of consent and objections where applicable.

14. Cookies and website technologies
Our website may use cookies and similar technologies to support essential functions, maintain security, remember preferences and, where enabled, understand website usage.
Where required by law, we will obtain consent before using non-essential cookies or similar technologies.
You can find further information about the technologies used on our website and how to manage your choices in our Cookie Policy.
Cookie Policy: https://www.conexusgroup.co.uk/cookie-policy/

15. Links to other websites
Our website may contain links to third-party websites, platforms or services.
We are not responsible for the privacy practices or content of websites that we do not operate. If you visit another website, we recommend reviewing its privacy information before submitting personal information.

16. Information relating to children and school pupils
Our recruitment and consultancy services are primarily directed towards education professionals, schools, trusts and other organisations.
Where a consultancy engagement requires access to personal information relating to pupils or other children, the processing must be governed by the relevant lawful instructions, contractual arrangements, security requirements and applicable data protection law.
We will not request pupil or child information through our general recruitment forms unless it is necessary and appropriate for a specific, authorised purpose.
Where Conexus acts as a data processor for a school or another client, the applicable client agreement and data-processing arrangements will govern the relevant processing activities.

17. Automated decision-making
We do not intend to make decisions about individuals solely by automated means that produce legal effects or similarly significant effects without the safeguards required by applicable law.
Where any recruitment or other process involving automated decision-making or profiling is introduced, we will assess the applicable legal requirements and provide any additional information and safeguards required.

18. Changes to this Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in our services, systems, data-handling practices or legal requirements.
The current version will be published on our website, together with the date it was last updated.
Where required by law, we will provide additional information or notify affected individuals of material changes.

19. Contact us and complaints
If you have a question about this Privacy Policy, how we use your personal information or how to exercise your rights, please contact:
Conexus Solutions Limited
Privacy email: [email protected]
Postal address: 4 Queen Street, Bath, BA1 1HE
If you are unhappy with how we have handled your personal information, please contact us so that we can investigate your concerns.
You also have the right to complain to the Information Commissioner’s Office (ICO), the UK’s independent data protection regulator.
ICO website: https://ico.org.uk/
Make a complaint: https://ico.org.uk/make-a-complaint/
We encourage you to contact us first where appropriate, but you are not required to do so before contacting the ICO.