Spencer & Co Recruitment Limited – Privacy Policy
Last updated: March 2026
1. Introduction
Spencer & Co Recruitment Limited (“we”, “us”, “our”) is committed to protecting the privacy and security of personal data. This Privacy Policy explains how we collect, use, store, and protect personal information in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and applicable privacy laws.
2. Who We Are
Spencer & Co Recruitment Limited
Registered in England & Wales
Company Number: 17085097
Data Protection Contact: lucy@spencerandcorecruitment.co.uk
We act as a Data Controller when processing personal data.
3. What Personal Data We Collect
Candidates
• Name, address, email, phone number
• CV, employment history, skills, qualifications
• Right-to-work documentation
• Interview notes and assessment outcomes
• Salary expectations and preferences
• References and referee details
• Any additional information you provide
Clients
• Contact details of hiring managers
• Company and role requirements
• Communications and contractual information
Suppliers
• Business contact details
• Payment and invoicing information
4. How We Collect Personal Data
Data is collected through:
• Direct contact (CVs, emails, calls, website forms)
• Job boards and professional networking platforms
• Referrals
• Client interactions
• Public sources
• Compliance checks (e.g. right-to-work verification)
5. Legal Basis for Processing
We process personal data under the following lawful bases:
Legitimate Interests to operate as a recruitment business and match candidates with suitable roles. We ensure this processing is necessary and does not override your rights.
Contract where processing is necessary for a contract or steps prior to entering one
Legal Obligation for compliance checks and regulatory requirements
Consent for marketing communications where required
6. How We Use Personal Data
Personal data is used to:
• Provide recruitment and talent-matching services
• Assess suitability for roles
• Communicate with candidates and clients
• Carry out compliance and right-to-work checks
• Manage contracts and invoicing
• Maintain business records
• Improve our services
• Meet legal obligations
We will never sell personal data.
7. Sharing Personal Data
We may share personal data with:
• Clients (to introduce candidates)
• Background screening and compliance providers
• IT systems providers (e.g. CRM systems, cloud hosting, email platforms)
• Legal, regulatory, or government authorities
• Professional advisers (legal and accounting)
All third parties are required to protect your data and comply with UK data protection laws.
8. International Transfers
Where personal data is transferred outside the UK, we ensure appropriate safeguards are in place, including:
• Adequacy decisions
• Standard Contractual Clauses (SCCs)
• Additional security measures
This may include transfers to countries such as the United States where service providers operate.
9. Data Retention
We retain personal data only as long as necessary:
• Candidate data: up to 6 years from last contact
• Client and supplier data: up to 7 years
• Compliance data: as required by law
You may request deletion of your data at any time, subject to legal obligations.
10. Your Rights
Under UK GDPR, you have the right to:
• Access your personal data
• Request correction or deletion
• Restrict or object to processing
• Data portability
• Withdraw consent at any time
• Lodge a complaint
To exercise your rights, contact: lucy@spencerandcorecruitment.co.uk
You also have the right to complain to the Information Commissioner’s Office (ICO): https://www.ico.org.uk
11. Marketing Communications
Where we send marketing communications, we will do so:
• With your consent where required
• Based on legitimate interests where appropriate
You can opt out at any time by:
• Clicking “unsubscribe” in emails
• Contacting us directly
12. Data Security
We implement appropriate technical and organisational measures, including:
• Secure cloud-based systems
• Access controls and authentication
• Encryption and secure storage
• Staff training and confidentiality agreements
• Regular compliance reviews
13. Automated Decision-Making
We do not use automated decision-making or profiling that produces legal or significant effects.
14. Cookies
Our website uses cookies to improve user experience and analyse traffic.
Types of cookies we use:
Essential cookies – required for website functionality
Analytics cookies – help us understand website usage
Marketing cookies – used for advertising (if applicable)
Non-essential cookies are only used with your consent.
You can manage or withdraw your consent at any time via our cookie banner.
For more details, see our Cookie Policy.
15. Updates to This Policy
We may update this Privacy Policy from time to time. The latest version will always be available on our website.
16. Contact Us
If you have any questions about this policy or your personal data, please contact:
Data Protection Contact
Spencer & Co Recruitment Limited
Email: lucy@spencerandcorecruitment.co.uk
© 2026 Spencer & Co Recruitment Limited – All Rights Reserved