Recruitment & Website Privacy Notice

1. Who We Are

Spinwell Global Limited (“Spinwell”) provides recruitment, staffing, contractor and related business services. Spinwell acts as a Controller where it determines why and how personal information is processed, including for its candidate database, recruitment services, direct employment recruitment, website operation and business administration. Where Spinwell processes personal information solely on documented instructions from a client or another Controller, Spinwell acts as a Processor for that processing and the relevant client or other organisation remains responsible for its Controller obligations.

Spinwell Global Limited
Company number: 07527825
Registered office: 1 Rushmills, Northampton, Northamptonshire, England, NN4 7YB
Privacy contact: dpo@spinwellglobal.com
Telephone: +44 203 510 9454

2. Scope of this Notice

This notice applies to personal information relating to:

candidates and prospective candidates;
permanent-placement candidates;
temporary workers and contractors;
individuals applying for employment directly with Spinwell;
individuals who register, log in, apply for vacancies or use candidate-facing website services;
website visitors, including individuals who browse without registering or applying;
client and prospective-client representatives;
suppliers and service providers;
referees and other professional contacts; and
other identifiable individuals whose information Spinwell processes in connection with recruitment or business operations.

3. Personal Information We May Process

Depending on the relationship and purpose, information may include:

name, contact details, location and communication details;
CVs, employment history, education, qualifications, skills, experience and professional memberships;
salary or rate expectations, availability and role preferences;
application, interview, assessment, submission, client feedback and placement information;
account and login information associated with website registration;
Right to Work, identity, immigration and compliance information where required;
security-clearance information where relevant to a role;
references and referee information;
contract, assignment, payroll, invoicing, company, insurance, VAT and financial administration information where relevant;
website and device information such as IP address, browser or device information and cookie identifiers where applicable;
recruitment communications, preferences, job-alert choices and marketing preferences; and
other information reasonably necessary for the relevant recruitment, employment, compliance, client or business purpose.

4. Special Category and Criminal Offence Information

Some recruitment or employment activities may involve special category personal information, for example health information or equality and diversity information. Criminal conviction and offence information is subject to separate legal protection and may include Disclosure and Barring Service information or other lawful criminal-record vetting information.

Spinwell will process special category personal information only where there is an appropriate Article 6 lawful basis and a specific Article 9 condition. Depending on the purpose, the conditions Spinwell may rely on include Article 9(2)(b) where processing is necessary for obligations or rights in employment and social protection law, and Article 9(2)(a) where explicit consent is genuinely appropriate. Criminal conviction and offence information will only be processed where there is an appropriate Article 6 lawful basis and lawful authority under Article 10 UK GDPR and the Data Protection Act 2018.

5. Where We Obtain Information

We may obtain personal information:

directly from you, including through applications, registration, CV uploads, interviews, forms, emails, calls and other communications;
from clients, hirers and their representatives;
from job boards and CV databases;
from professional networking platforms where recruitment use is permitted and reasonably expected;
from referrals;
from publicly accessible professional sources where lawful and proportionate;
from screening, verification, compliance or reference providers;
from umbrella companies, payroll providers or other parties involved in an assignment; and
from existing Spinwell records where continued processing remains lawful.

Where we obtain personal information from another source, we will provide applicable privacy information within the legally required timeframe, subject to any lawful exception.

6. Why We Use Personal Information and Our Lawful Bases

Spinwell identifies an appropriate lawful basis before processing personal information. The basis depends on the purpose and circumstances. The main processing purposes relevant to this website and our recruitment services are summarised below.

Purpose	What we use the information for	Main lawful basis / legal route
Candidate registration, applications and work-finding services	Create and maintain a candidate profile, assess suitability, communicate about opportunities and provide recruitment services.	Steps at your request before entering into a contract and/or performance of contractual recruitment terms, together with legitimate interests where appropriate.
Candidate sourcing and identification	Identify potential candidates from authorised recruitment sources and assess whether an opportunity may be relevant.	Legitimate interests, subject to necessity, reasonable expectations and balancing of individual rights.
Contact about specific recruitment opportunities	Contact individuals about roles that reasonably match their professional profile or stated preferences.	Legitimate interests and/or performance of recruitment services, depending on the relationship and circumstances. Electronic direct marketing rules are considered separately where applicable.
Candidate submission to clients or hirers	Introduce candidates for identifiable recruitment requirements and progress recruitment activity.	Steps before contract/performance of recruitment services and legitimate interests, subject to fairness, transparency and data minimisation.
Compliance, onboarding and verification	Complete lawful identity, employment, assignment, security, Right to Work, screening, reference and client compliance requirements.	Legal obligation, contract and/or legitimate interests as applicable. Additional statutory conditions apply to special category and criminal offence information.
Right to Work records where Spinwell is the employer	Conduct and evidence statutory Right to Work checks.	Legal obligation.
Payroll, contracts, invoicing, accounting and tax	Administer assignments, payments, contracts, invoices and statutory financial records.	Contract and legal obligation, with legitimate interests where appropriate for related administration and claims.
Client and supplier relationship management	Establish, manage and administer business relationships, services, contracts and communications.	Contract and legitimate interests.
Website accounts, authentication and security	Provide registration and account features, protect accounts, investigate misuse and maintain website security.	Contract and/or legitimate interests. Strictly necessary storage technologies may be used without cookie consent where the legal exception applies.
Job alerts and general electronic marketing	Send general vacancy alerts, newsletters or marketing communications where selected.	Consent where required by the Privacy and Electronic Communications Regulations. Consent can be withdrawn at any time.
Legal, regulatory, audit and claims management	Comply with legal obligations, respond to regulators, protect rights, investigate complaints and establish, exercise or defend legal claims.	Legal obligation and legitimate interests, with additional conditions where sensitive information is involved.

Some information is required so that Spinwell can comply with legal or contractual obligations or take steps connected with an application, engagement or placement. For example, Right to Work and certain compliance information may be required by law, and information needed to enter into or administer a contract may be contractually necessary. If required information is not provided, Spinwell may be unable to progress an application, complete onboarding, make or continue a placement, or provide the relevant service.

7. Legitimate Interests

Where Spinwell relies on ordinary legitimate interests, we consider the purpose, whether the processing is reasonably necessary, and whether the individual’s rights, freedoms, interests and reasonable expectations override Spinwell’s interest.

Legitimate interests may be relevant to recruitment sourcing, candidate matching, client relationship management, website security, business administration and legal claims. The fact that information is publicly available does not by itself make processing lawful.

8. Recruitment Communications and Marketing

Recruitment communications about a specific opportunity reasonably connected with your profile are distinguished from general marketing and vacancy newsletters.

Where the Privacy and Electronic Communications Regulations require consent for electronic marketing, Spinwell will use an appropriate opt-in and will provide a straightforward way to withdraw consent. Withdrawing marketing consent does not prevent Spinwell from contacting you where another lawful basis applies to a specific recruitment, contractual, compliance or legal communication.

9. Artificial Intelligence, Profiling and Automated Processing

Spinwell does not use automated technology to make final recruitment decisions or to reject a candidate without meaningful human review. Approved recruitment technology may support activities such as CV parsing, candidate searching, skills identification, matching, ranking, prioritisation, summarisation, database searching and compliance workflows. These tools support, rather than replace, professional judgement.

Where automated technology materially contributes to a recruitment assessment or recommendation, a suitably authorised person must review the relevant information, consider the automated output critically and be able to reach a different decision.

AI-generated or inferred information is not automatically treated as verified fact and must be checked where it is material to a decision.

If Spinwell uses solely automated decision-making that produces a legal or similarly significant effect, applicable safeguards will be provided, including information about the decision, an opportunity to make representations, meaningful human intervention and the ability to contest the decision where required by law.

10. Who We May Share Information With

Where necessary and lawful, personal information may be shared with:

clients, hirers and prospective employers in connection with an identifiable recruitment requirement;
authorised recruitment, applicant tracking and Customer Relationship Management system providers, including the provider of our current recruitment website platform;
Microsoft 365 and other authorised business technology providers;
job boards, CV databases and professional recruitment services where relevant;
screening, verification, reference, Right to Work, Disclosure and Barring Service or security-related providers where applicable;
payroll, finance, umbrella, accounting and assignment administration providers where applicable;
professional advisers, insurers, auditors and legal representatives where required;
regulators, government bodies, law-enforcement agencies, courts or other competent authorities where legally required or appropriate; and
other parties where you have requested or authorised a specific disclosure, or where another lawful basis permits it.

Candidate information will not be indiscriminately circulated to organisations without an identifiable recruitment purpose.

11. International Transfers

Spinwell may use suppliers, clients or business services that involve personal information being accessed or transferred outside the United Kingdom.

Where a transfer is a restricted transfer under UK data protection law, Spinwell will use a lawful transfer route. Depending on the circumstances, this may include UK adequacy regulations, an approved safeguard such as the International Data Transfer Agreement or UK Addendum, Binding Corporate Rules where applicable, or a permitted statutory exception. Where required, Spinwell will complete the applicable transfer risk assessment or data protection test.

You may contact dpo@spinwellglobal.com for further information about safeguards relevant to a particular transfer.

12. How Long We Keep Personal Information

Retention timeframes are category-specific and do not automatically renew because of automated matching, database migration, system synchronisation or an unanswered automated communication. The standard 24-month period applies to active candidate records as described in this notice; separate statutory or evidential requirements continue to apply to payroll, compliance, placement and other records.

Spinwell does not retain identifiable personal information indefinitely. Retention depends on the purpose, legal or regulatory requirements, contractual requirements, evidential needs, sensitivity and risks of continued retention.

Information	Standard period	Trigger / note
Active candidate profile and CV	Up to 24 months	From the last meaningful interaction. Review, delete or anonymise unless continued retention remains justified.
Prospective candidate sourced but never engages	12 months maximum	From collection, subject to earlier deletion where the recruitment purpose ends.
Recruitment interview or assessment notes	6 months	From conclusion of the recruitment exercise unless required for a complaint, claim or continuing lawful purpose.
Candidate submission where no placement occurs	Up to 24 months	From last meaningful interaction or conclusion of the recruitment exercise, whichever is later.
Placed contractor / temporary worker contractual records	6 years	From end of the contractual relationship, subject to any category-specific legal requirement.
Permanent placement commercial records	6 years	From completion or termination of the relevant contractual transaction.
Right to Work evidence where Spinwell is employer	Employment plus 2 years	Statutory retention period after employment ends.
DBS certificate information	Normally no longer than 6 months after the decision	Only where needed to resolve disputes, complaints or other justified matters. Minimum check evidence may be retained where lawful.
Identifiable equality/diversity recruitment information	6 months, then anonymise where practicable	From recruitment outcome unless another lawful purpose requires identifiable information.
Client operational contact information	24 months after last meaningful business contact	Review at expiry and delete unless a continuing purpose exists.
Data protection rights request, complaint or personal data breach record	6 years after closure	Accountability and evidential record.
Marketing suppression / objection record	As long as required to honour the objection	Only the minimum information necessary should be retained.

These are maximum standard periods where described as Spinwell standards. Information may be deleted earlier where its purpose has ended, no continuing lawful basis exists, continued retention is no longer proportionate, or a valid erasure request requires deletion.

Automated matching, enrichment, AI processing, system migration, system synchronisation, internal searches, automated communications receiving no response and similar technical activity do not by themselves restart a candidate retention period.

13. Meaningful Candidate Interaction

Where retention runs from the last meaningful interaction, examples include applying for a role, registering with Spinwell, submitting an updated CV, responding meaningfully to a recruiter, discussing a vacancy, confirming availability, attending an interview, agreeing to representation, commencing or completing an assignment, or affirmatively requesting continued recruitment services.

14. Security

Spinwell applies technical and organisational measures appropriate to the nature, volume and risks of the information processed. Depending on the system and processing risk, these controls include access based on business need and least privilege, multi-factor authentication, role-based access, encryption, password controls, endpoint security, secure backups, logging and monitoring, network-security controls, device management, vulnerability management, security testing, physical security, access reviews and employee training. Security controls are subject to periodic review and testing under Spinwell’s internal information-security and data-protection framework.

15. Your Data Protection Rights

Depending on the circumstances and lawful basis, you may have rights including:

the right to be informed;
the right of access;
the right to rectification;
the right to erasure;
the right to restriction of processing;
the right to data portability;
the right to object;
the right to withdraw consent where consent is relied upon; and
rights relating to automated decision-making.

The applicability of a particular right depends on the circumstances. Requests can be made verbally or in writing and do not need to use a particular form.

To exercise a data protection right, contact dpo@spinwellglobal.com.

16. Data Protection Complaints

You may complain to Spinwell if you are concerned about how your personal information has been handled. Complaints can be sent to dpo@spinwellglobal.com. Spinwell will provide an accessible complaint route, acknowledge a data protection complaint within 30 days, investigate appropriately and without undue delay, provide progress information where necessary, and communicate the outcome. Your right to contact the Information Commissioner’s Office remains unaffected.

You may complain to Spinwell if you are concerned about how your personal information has been handled. Send complaints to dpo@spinwellglobal.com.

You also have the right to complain to the Information Commissioner’s Office (ICO). The ICO can be contacted through its website at ico.org.uk or by telephone on 0303 123 1113.

17. Cookies and Similar Technologies

Our websites use cookies and similar technologies. Strictly necessary technologies may be used without consent where a PECR exception applies. Certain statistical technologies, and certain technologies used to adapt a service’s appearance or functionality to a user’s preferences, may also be used without consent where the specific statutory conditions are met and any required information and objection mechanism are provided. Otherwise, consent is obtained before non-essential cookies or similar technologies are stored or accessed. Further details and available controls are set out in our Cookie Policy and Cookie Preferences.

18. Changes to this Notice

We may update this notice where our processing, systems, suppliers or legal obligations change. The current version will be published with its last-updated date.