Privacy Policy

---

Heathgate Search ("we", "us", "our") is a specialist recruitment agency. This policy explains how we collect, use, store, and protect personal data when you use our website, apply for a role through us, engage us as a client, or otherwise interact with our recruitment services.

We are committed to handling personal data in line with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, as amended by the Data (Use and Access) Act 2025.

Data controller: Heathgate Search
Contact: info@heathgatesearch.co.uk

If you have any questions about this policy or how we handle your data, please contact us using the details above.

This policy covers personal data we hold about:

• Candidates — individuals who apply for roles, register with us, or whose details we identify through search and selection activity
• Clients and client contacts — individuals at organisations who engage our recruitment services
• Website visitors — anyone browsing heathgatesearch.co.uk
• Referees and other third parties — individuals named in connection with a recruitment process

From candidates

• Contact details (name, email, phone number, address)
• CV content, including employment history, qualifications, and skills
• Right-to-work and eligibility information
• Salary expectations and current/previous remuneration
• Interview notes and feedback
• References and referee contact details
• Information from publicly available sources, including LinkedIn and other professional networking sites, where we identify candidates 
• Information disclosed during conversations with our consultants

• Name, job title, and business contact details
• Recruitment requirements and role specifications
• Feedback on candidates
• Billing and contract information

• Technical data such as IP address, browser type, and device information
• Usage data via cookies and analytics tools (see our [Cookie Policy] if applicable)
• Any information you submit through contact or registration forms

We do not seek to collect special category data (such as health information, religious belief, or trade union membership) unless it is volunteered by a candidate, relevant to a specific role (for example, where reasonable adjustments are needed), or required to comply with equal opportunities monitoring requested by a client.

Where a candidate's public profile discloses special category data, we do not make assumptions about their suitability for a role based on that information. If we consider it genuinely relevant to a specific role, we will only take it into account fairly, for example, by giving the candidate the opportunity to discuss or clarify it directly with us. Where we hold special category data, we do so with explicit consent or another applicable lawful basis under Article 9 UK GDPR.

We collect personal data:

• Directly from you (via our website, email, phone, or in-person/video meetings)
• From job boards and CV databases where you have made your details available
• From professional networking platforms such as LinkedIn
• From your referees, with your knowledge
• From clients, in relation to role requirements and feedback
• From other publicly available sources, where appropriate, for headhunting purposes

PurposeLawful basisIdentifying and approaching candidates for relevant rolesLegitimate interestsSharing your CV and profile with prospective employers (with your knowledge)Consent / Legitimate interestsManaging the recruitment process, including interview coordinationContract / Legitimate interestsProviding search and selection services to clientsContractInvoicing and financial administrationContract / Legal obligationMaintaining business records and our candidate/client databaseLegitimate interestsSending relevant job opportunities or market updatesConsent / Legitimate interestsComplying with legal and regulatory obligationsLegal obligationEqual opportunities monitoring (where applicable)Legal obligation / Explicit consentWebsite operation, security, and analyticsLegitimate interests / Consent (cookies) 

We rely on legitimate interests for much of our core recruitment activity, including approaching candidates who haven't applied to us directly. Where we rely on this basis, we have carried out a legitimate interests assessment weighing our business need against your rights and interests, and concluded that our processing does not unreasonably override them. You have the right to object to processing based on legitimate interests at any time .

We may share personal data with:

• Prospective employers/clients, where a candidate is being put forward for a role , we will normally seek your agreement before sharing your CV
• Prospective candidates, in the form of anonymised or role-specific information, where relevant to a client's search
• Referees, to obtain reference checks
• Third-party service providers, such as our CRM, IT, and email platforms, who process data on our behalf under contract
• Regulatory or government bodies, where required by law

We do not sell personal data to third parties.

As we work with clients and candidates across the UK & Ireland, mainland Europe, the Nordics, and the US, personal data may be transferred outside the UK. Where this occurs, we ensure appropriate safeguards are in place, such as:

• Transfers to countries with UK adequacy regulations
• Standard Contractual Clauses or the UK International Data Transfer Addendum
• Other safeguards recognised under UK GDPR

We retain personal data only for as long as necessary for the purposes set out in this policy, typically:

• Candidate data: retained for as long as you remain an active candidate or for a reasonable period afterwards, to allow us to consider you for future roles, unless you ask us to delete it sooner
• Client data: retained for the duration of our business relationship and for a period afterwards in line with legal, accounting, and contractual requirements
• Financial records: retained as required by HMRC and other statutory obligations (generally 6 years)

We periodically review the data we hold and delete or anonymise it when it is no longer needed.

Under UK GDPR, you have the right to:

• Access the personal data we hold about you
• Rectify inaccurate or incomplete data
• Erasure of your data, in certain circumstances
• Restrict processing in certain circumstances
• Object to processing based on legitimate interests or for direct marketing
• Data portability, where processing is based on consent or contract and carried out by automated means
• Withdraw consent at any time, where consent is our lawful basis
• Request human review of any significant decision made through automated means (see Section 5)

To exercise any of these rights, contact us at info@heathgatesearch.co.uk We will respond within one month, as required by law.

You also have the right to lodge a complaint with the UK Information Commissioner's Office (ICO) at ico.org.uk if you believe your data has been mishandled.

Our website uses cookies to improve functionality and analyse site usage. You can manage your cookie preferences through your browser settings. [For full details, see our Cookie Policy.]

We take appropriate technical and organisational measures to protect personal data against unauthorised access, loss, or disclosure, including secure storage systems, access controls, and staff awareness of data protection obligations.

We may update this policy from time to time to reflect changes in our practices or legal requirements. The "Last updated" date at the top of this page indicates when it was last revised.

If you have any questions about this policy or how we handle your personal data, please contact:

info@heathgatesearch.co.uk