Ardeo Search Privacy Policy
Introduction
We are Ardeo Search Limited, a company registered in Scotland (No. SC728291). Our registered office is at 21 Young Street, Edinburgh EH2 4HU, Scotland. We are the controller of the personal data described in this notice.
This Privacy Notice explains how we use personal data in the course of our business. As a recruitment business, we need access to information about Candidates to meet our Clients' requirements. Our systems and processes are designed to give our Clients the best possible service while complying with the law and protecting individuals' privacy rights.
We may update this Privacy Notice from time to time. Where appropriate, we will contact you about any material changes. Please also check our website periodically so that you understand how we use your personal data and what your legal rights are.
Who should read this notice
This notice applies to any living, identifiable individual whose personal data we process in the course of our business. You should read it if you are a:
Candidate
Client Contact
Referee
Supplier Contact
In some cases you may fall into more than one of these categories.
Definitions
This notice uses the following defined terms.
Candidate means a person recorded in our records as seeking, or potentially suitable for, an engagement with a Client. This includes people who are not actively looking for a new role but who are in contact with us about opportunities that may interest them.
Client means a business which has engaged us to provide services, or which we have identified as a business for which we wish to provide services.
Client Contact means a person employed or engaged by a Client with whom we liaise about services we provide, or wish to provide, to that Client. Where a Client is a sole trader, the Client Contact and the Client may be the same person.
Data Protection Legislation means the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations 2003, each as amended (including by the Data (Use and Access) Act 2025). Where our processing relates to individuals in the European Economic Area (EEA), it also includes the EU General Data Protection Regulation ((EU) 2016/679) to the extent it applies.
Referee means a person who has given us a written or verbal opinion on a Candidate's work history, skills, competence or experience.
Supplier means a business which provides services to us and which may process personal data about Candidates, Client Contacts, Referees or Supplier Contacts in doing so. This includes our:
professional advisers, including accountants, tax advisers and lawyers;
insurers;
IT and software providers, including our recruitment CRM database (Bullhorn), cloud storage, email and email-delivery tools, contact-data enrichment and email-verification services, and AI-assisted productivity tools; and
independent consultants and subcontractors.
Supplier Contact means a person employed or engaged by a Supplier with whom we liaise about the services that Supplier provides.
How we obtain personal data
Where we obtain your personal data depends on how you deal with us.
If you are a Candidate, we may obtain personal data directly from you when you:
apply for a Client vacancy through us;
send us your CV, including through our website;
ask us to help you find work;
engage with us through networking activities or events; or
discuss alternative employment with us.
We may also obtain it indirectly from:
professional networking sites such as LinkedIn;
social networking sites;
job boards;
Referees, who give information about your employment experience and their opinion of your skills and aptitude;
your employer's website and other industry websites;
business information directories, and contact-data enrichment or email-verification services that help us find or confirm business contact details such as a work email address or phone number;
online industry databases; and
where appropriate, third-party background checking services such as Disclosure Scotland or the Disclosure & Barring Service.
If you are a Client Contact or Supplier Contact, we may obtain personal data directly in the course of (i) us providing services to the Client or (ii) the Supplier providing services to us. We may also obtain it indirectly from:
professional networking sites such as LinkedIn;
your employer's website and other industry websites;
business information directories, and contact-data enrichment or email-verification services that help us find or confirm business contact details; and
other people within your organisation, in the course of the services described above.
If you are a Referee, we may obtain personal data directly from you when we communicate, or indirectly from the Candidate who has nominated you.
Where we obtain your data from a source other than you, we will tell you where it came from when we first contact you, or within one month at the latest.
Types of information we hold
If you are a Candidate, we may collect, store and use:
contact details such as your name, title, addresses, telephone numbers and email addresses;
your gender, date of birth, nationality and place of residence;
your professional skills and experience;
your qualifications, training and certifications;
proof of your right to work in the country where a role is based, such as a passport and, where applicable, a visa, residence permit or similar document;
proof of your identity and address, such as a driving licence or utility bill;
information about your current or most recent role, including job title, department, reporting line, responsibilities, salary, benefits and notice period;
your motivation and reasons for seeking new employment;
information in your CV or any application document a Client asks you to complete;
background information you give us in your dealings with us;
details of Clients to whom we have introduced you;
details of interviews you have attended and our Clients' feedback; and
details of any position you take up with a Client, including role, duties, pay, department and location.
If you provide services on a freelance basis, we may also hold:
details of any limited company through which you contract and your relationship with it;
the days and times you have worked;
your bank details, tax code and National Insurance number; and
information about services you have carried out, including comments, feedback and issues.
We may also collect, store and use the following special categories of more sensitive information:
information about your race or ethnicity;
information about your health, including any medical condition and health and sickness records; and
information about criminal convictions and offences.
If you are a Client Contact, we collect, store and use your contact details, your job title and position within the Client, and any background information about your work history, role or circumstances that you give us.
If you are a Referee, we collect, store and use your contact details, your job title and employer, and any background information you give us.
If you are a Supplier Contact, we collect, store and use your contact details, your job title and position within the Supplier, and any background information about your role that you give us.
We do not collect special category data about Client Contacts, Referees or Supplier Contacts.
How we use personal data
If you are a Candidate, we may use your personal data to:
assess and verify your suitability for employment with a Client;
contact you about potential opportunities with a Client;
introduce you to Clients and arrange for you to fill a vacancy;
stay in regular contact to understand your current position, career aspirations and motivation for a move;
where applicable, pay you or arrange for a company through which you contract to pay you;
ask you for a referral;
produce anonymised statistical data;
comply with our legal obligations, bring or defend legal claims, and prevent fraud or other crime; and
conduct equal opportunities monitoring.
If you are a Client Contact, we may use your personal data to:
understand our Client's requirements;
liaise with you so we can provide our services effectively;
tell you about a Candidate's availability or interest in a role;
obtain a reference for a Candidate;
contact you about invoicing and credit control;
share market and statistical information about your sector; and
comply with our legal obligations, bring or defend legal claims, and prevent fraud or other crime.
If you are a Referee, we may use your personal data to obtain a reference on a Candidate, share that reference with our Client, and comply with our legal obligations.
If you are a Supplier Contact, we may use your personal data to liaise with you about the Supplier's services and billing, and to comply with our legal obligations.
Our lawful basis for processing
We rely on legitimate interests (UK GDPR Article 6(1)(f)) to process personal data about each category of person below. Where we must process data to meet a legal obligation, such as right-to-work checks or HMRC record-keeping, we rely on that obligation instead (Article 6(1)(c)).
Candidates. We need to maintain a database of people who are actively seeking new employment or who may be suitable for roles with our Clients. Contacting you from time to time helps us understand your current role, skills, experience and aspirations. This benefits you, because we can tell you about opportunities you might not otherwise hear of and offer career guidance. It benefits our Clients, who rely on us for suitable, pre-qualified candidates. It benefits us, as our business depends on introducing Candidates to Clients.
We may also need to process special category data about Candidates. This may include (i) information about medical conditions or disability, insofar as relevant to the work proposed; (ii) information about unspent criminal convictions and, where relevant to the role, spent convictions and police warnings; and (iii) trade union membership, but only where it relates to an employment claim or pay and working conditions on a Client site. We process this data because it is necessary for our obligations in the field of employment, as an employment agency or employment business (UK GDPR Articles 9(2)(b) and 10, and Schedule 1 of the Data Protection Act 2018). We hold it strictly in line with our data retention and special category data policies. Equal opportunities information is anonymised, so it is not personal data.
Client Contacts. We need to contact and work with people employed or engaged by our Clients, so we can provide our services, understand their requirements and run our business.
Referees. We are generally required to obtain references to meet contractual obligations to third parties, and sometimes legal obligations. We process Referee data strictly for those purposes.
Supplier Contacts. We need to contact and work with people employed or engaged by our Suppliers, so they provide us with the best possible service, which in turn benefits our Candidates and Clients.
Where we process personal data
We are based in the UK and hold your personal data primarily in the UK and the EEA. Our main systems are our recruitment CRM database (Bullhorn) and Microsoft 365, including OneDrive. We may also use Dropbox for storage, and email, email-verification, data-enrichment and AI-assisted tools to support our work. We choose UK or EEA hosting where our providers offer it.
Some of these providers are headquartered in, or may access data from, countries outside the UK, including the United States. We transfer personal data outside the UK only where one of the following applies:
Adequacy. The UK Government has recognised the destination as providing adequate protection. This covers EEA countries and certain others. For the United States, it covers organisations certified under the UK Extension to the EU-US Data Privacy Framework (the UK-US data bridge).
Appropriate safeguards. We have a contract in place with the recipient using the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, supported by a transfer risk assessment.
Your consent. In limited cases, you have expressly agreed to the transfer having been told of the possible risks.
If you are in the EEA, transfers of your data from the EEA to us in the UK are covered by the European Commission's adequacy decision for the UK.
You can ask us for details of the safeguards that apply to any transfer of your data by contacting us at the address below.
Parties with whom we may share data
Suppliers acting on our behalf. We share personal data with Suppliers who process it for us, such as our CRM provider (Bullhorn), IT, cloud storage, email and email-delivery providers, data-enrichment and email-verification services, and AI-assisted productivity tools. They act under written contracts which require them to keep the data secure and use it only on our instructions. Some may use their own approved sub-processors on the same terms. This applies to data about Candidates, Client Contacts, Referees and Supplier Contacts.
If you are a Candidate, we may also share your personal data for legitimate purposes with:
a Client, where you have expressed an interest in being introduced to them or are being supplied to them on an assignment;
any third party engaged by the Client to help with recruitment, such as a managed service company, recruitment process outsourcing provider or IT platform provider;
a company through which you contract;
a company to which you have asked us to introduce or refer you, such as an insurer or umbrella company;
background checking services such as Disclosure Scotland or the Disclosure & Barring Service;
industry bodies relevant to your sector;
our bankers and recruitment finance providers; and
government departments and agencies where we are permitted or required by law to do so.
We may also share Candidate data with Clients on an anonymised basis, where we have agreed to provide general statistical information.
If you are a Client Contact, we may share very limited data about you with a Candidate where strictly needed for the recruitment process, for example so the Candidate can contact you directly.
If you are a Referee, we will share your reference with our Clients, usually with your name, job title and employer. We will share your contact details only if you agree, so that the Client can verify the reference or ask for more information.
Automated decision-making
We do not make decisions about you using solely automated means, whether you are a Candidate, Client Contact, Referee or Supplier Contact. We may use software, including AI-assisted tools, to help organise information, match skills to roles or draft communications. A member of our team always reviews that output and makes any decision about you.
Data security
We have appropriate security measures in place to prevent your personal data from being accidentally lost, used or accessed without authorisation, altered or disclosed. We limit access to those employees, agents, contractors and other third parties who have a business need to know. They process your data only on our instructions and are subject to a duty of confidentiality. You can ask the Directors for details of these measures.
We have procedures to deal with any suspected data security breach. We will notify you and the regulator of a breach where we are legally required to do so.
Data retention
We keep your personal data only as long as necessary for the purposes we collected it for, including any legal, accounting or reporting requirements. In setting retention periods, we consider the amount, nature and sensitivity of the data, the risk of harm from unauthorised use or disclosure, why we process it, whether we can achieve that by other means, and the law.
Our standard retention period is two years from the last date we were in actual contact with you, meaning we spoke or exchanged correspondence. We will try to contact you before then; if you do not respond, we may delete your data.
Where we must keep data (i) for audit or compliance purposes, (ii) to meet contractual obligations to third parties, or (iii) for potential or actual legal proceedings, we keep it only as long as strictly necessary. For audit data we may need to produce for HMRC or to prove compliance, this is typically seven years.
We may fully anonymise your data so it can no longer be linked to you, in which case we may use it without further notice.
Your rights
Please keep us informed if your personal data changes during your dealings with us, so that what we hold stays accurate.
In certain circumstances, you have the right to:
access your personal data (a subject access request) and check that we are processing it lawfully. We do not usually charge a fee, but may charge a reasonable fee or refuse if a request is clearly unfounded, repetitive or excessive;
correct incomplete or inaccurate personal data;
erase your personal data where it is no longer needed for its original purpose, or where you have objected and there is no overriding legitimate interest to continue;
object to processing based on our legitimate interests, on grounds relating to your particular situation. You can object to direct marketing at any time, and we will stop;
restrict processing, for example while we check the accuracy of your data or consider an objection; and
transfer your data to another party where processing is based on consent and carried out by automated means. This right does not usually apply to our processing.
To exercise any of these rights, contact the Directors in writing using the details below. We may ask you to confirm your identity first, to make sure your data is not disclosed to anyone without the right to receive it. We will respond without undue delay and in any event within one month, unless the law allows us longer.
Where you have given consent to a specific use of your data, you can withdraw it at any time by contacting the Directors. We will then stop that processing unless we have another lawful basis for it.
Complaints
If you are unhappy with how we have handled your personal data or responded to a request, please complain to us first using the contact details below. We will acknowledge your complaint within 30 days, investigate it, and tell you the outcome without undue delay.
If you remain unhappy, you have the right to complain to the UK regulator, the Information Commission's Office (ICO):
Information Commission's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF Telephone: 0303 123 1113 Website: ico.org.uk/make-a-complaint
If you are in the EEA, you may also complain to the data protection authority in the country where you live or work.
Contacting us
If you have any questions about this Privacy Notice, please write to the Directors at:
Ardeo Search Limited, 21 Young Street, Edinburgh EH2 4HU, Scotland
or email info@ardeosearch.com.