General Data Protection Regulation (GDPR) Privacy Statement of Cvmatograph

The Cvmatograph is committed to protecting the privacy and security of all personal information we held. It's very important to Cvmatograph to ensure the personal information you provide to us is treated with the utmost respect and your data privacy rights are safeguarded, all in accordance with this GDPR Privacy Statement.

This GDPR Privacy Statement explains how personal information about you may be collected, what we do with your data, the measures we take to keep it secure as well as the rights and choices you have over your personal information. It applies to the personal data of all candidates, clients, work seekers, suppliers, website users and other people whose details we may hold in the course of us carrying out our business.

Within the Cvmatograph we have a recruitment business that provides work-finding services to its work seekers and candidates and employees finding services for employers. It is necessary for us to process personal data (which may include sensitive personal data – now known as "special data") so that it can provide these services – in doing so, the CVmatograph acts as a Data Controller so we are obliged to ensure we only process personal data where we have legitimate grounds to do so.

You may give your personal details to CVmatograph directly, such as on an application or registration form or via our website, or we may collect them from another source such as a job board. For the purposes of providing you with work-finding services and/or information relating to roles relevant to you we will only use your personal data in accordance with this GDPR Privacy Statement.

We take care to protect the privacy of all personal data we hold which will be in compliance with current data protection laws.

1. Collection and use of personal data

We may also hold other relevant personal data that you have provided to us, or information that other parties, such as our client or your referees have provided to us, so this is not an exhaustive list. However, we will ensure the processing of any other data remains consistent with the purpose and legal basis that we already rely on under our GDPR Privacy Statement.

a. Purpose of processing and legal basis

Our recruitment business will collect your personal data (which may include special data) and will process your personal data for the purposes of providing you with work-finding services. This includes for example, contacting you about job opportunities, assessing your suitability for those opportunities, updating our databases, putting you forward for job opportunities, arranging payments to you and developing and managing our services and relationship with you and our clients.

In some cases, we may be required to use your data for the purpose of investigating, reporting and detecting crime and also to comply with laws that apply to us. Sometimes it may be necessary for us to process personal data and, where appropriate and legally required, special data in connection with exercising or defending a legal claim. We may also use your information during the course of internal and external audits to demonstrate our compliance with certain industry standards. Our telephone systems have the facility to record calls and on occasion we may utilise this facility for the purpose of quality, security and training.

As a Data Controller, we must have a legal basis to process your personal data. The legal grounds we rely upon are either:

b. Legitimate interest

Where CVmatograph has a legitimate reason to process your data provided, it is reasonable and does not go against what you would reasonably expect. Where CVmatograph has relied on a legitimate interest to process your personal data our legitimate interests is/are as follows:

c. Statutory/contractual requirement

The CVmatograph has certain legal and contractual requirements to collect personal data (e.g. to comply with the Conduct of Employment Agencies and Employment Businesses Regulations 2003, immigration and tax legislation, and in some circumstances safeguarding requirements). Our clients may also require this personal data, and/or we may need your data to enter into a contract with you. 

d. Consent

For incoming calls, we inform you prior to us answering your call that calls maybe recorded. If you object to this then please make this clear to us when we answer your call.

For outgoing calls at the time of a phone call that we wish to record we will ask for your consent to continue to do so. If you do not wish to have the call recorded, please tell us.

If you advise that you do not wish to have your call recorded our staff member will determine whether the call can be continued without recording or, in some circumstances, the call may need to be terminated.

Some call recordings are retained in an electronic format and stored with your other personal data in our database.

e. Recipients of data

The CVmatograph will process some/all of your personal data and/or special data, as necessary, with the following recipients:

We take great care to ensure your information is kept securely and all appropriate checks are carried out by us to ensure those third parties have and maintain similar standards of data protection.

2. Information collected

Categories of data:

CVmatograph collects some or all of the following personal data on you:

Personal data:

Special categories of data & information on Criminal Convictions/Offences:

Where we hold special data – we are bound by stricter rules. This could be information about your gender, age, sexual orientation, religion, social-economic background and other information such as health-related data. We currently only collect and process such special data where there are legal grounds to do so (e.g., Health & Safety measures, in compliance with the Equality Act with reference to disability access rights). If there is any other wish or need during the course of our working relationship for us to process your special data, we will only do so with your explicit consent.

Source of the personal data:

The CVmatograph sources your personal / special data from:

3. Overseas Transfers

CVmatograph does not transfer the information you provide to us to countries outside the European Economic Area ('EEA') for the purposes of providing you with work-finding services. The EEA comprises the EU member states plus Norway, Iceland and Liechtenstein.

In some cases, personal data may be saved on storage solutions that have servers outside the EEA (for example, Dropbox, Google) however only those storage solutions that provide secure services with adequate relevant safeguards will be used.

In the event we do need to transfer your data outside the EU/EEA we will only do so when we are adequately satisfied that the level of data protection, as required by that Country's laws, is at least to that which we adopt.

4. Data Retention

CVmatograph will retain your personal data only for as long as is necessary for the purpose we collect it. Different laws may also require us to keep different data for different periods of time.

If we have not had any meaningful contact (involving two-way communication, either verbal or written, with you) for a period of six years we will delete your personal data from our recruitment database and associated systems in the subsequent January or July (as such your records may remain on our database for a total of 78 months). The exception to this is where we believe in good faith that the law or other regulation requires us to preserve it (or specific personal data) for longer (e.g., some work-related medical examination data will be retained for 40 years (statutory requirement) following the end of the work assignment period and associated data subject information will be retained alongside this).

When we get your data from online applications for vacancies the information is channelled through our Applicant Tracking System and is temporarily stored there while we work through the registration process. Data held within our Applicant Tracking System will be automatically deleted after 90 days. 

We must also keep your payroll records, holiday pay, sick pay and pensions auto-enrolment records for as long as is legally required by HMRC and associated national minimum wage, social security and tax legislation. Our payroll, including holiday and sick pay, and pension records are held for 6 full tax years plus the current tax year.

Any personal data relating to individuals we deal with in our clients or suppliers organisations are retained for a period of 4 years from the date following any meaningful contact with that client or supplier. After that we will delete this information in the following January or July whichever comes first.

Despite our best endeavours some of your data may still exist within our system (e.g., backups), however, we have structured our systems so that your data is not readily accessible by any of our operational systems, processes or staff beyond our stated Data Retention periods.

5. Your rights

Please be aware that you have the following data protection rights:

        Achieved by means of this GDPR Privacy Statement

 If you make a Data Subject Access Request under your access rights, you should note that we may ask you for more information to verify your identity and provide greater detail about your request before we comply. If we are legally permitted to do so we may decline your request, in which case we will explain to you why

You can ask us to rectify any inaccurate information we hold. Where you are engaged on a temporary work assignment or are engaging via us with one of our clients about a permanent vacancy, we will notify the client about the rectification. Where appropriate we will also tell you which third parties we have disclosed the inaccurate or incomplete personal data to, so you can take action to inform them of any rectification you require

Where we agree with the request we will delete your data securely but will generally assume that you would prefer us to keep a note of your name and date of birth on our register of individuals that would prefer not to be contacted (this is aimed at minimising the chances of you being contacted in the future where your data is collected in some other unconnected circumstances). If you disagree with us holding your name for this purpose you are free to write to us at the address shown at the top of this GDPR Privacy Statement and say so

Your rights apply in the event you dispute the accuracy of the personal data or you object to our processing of your personal data on the grounds of our legitimate interests or if you consider our processing of your data unlawful

o Has been provided to us by you, and,

Has been processed automatically, and,

Has been processed by us based on your consent or in order to fulfil the requirements of a contract;

Generally, we will only disagree with you if certain limited conditions apply, being that we can show compelling grounds for processing that overrides your interests, or we are processing your data for the establishment, exercise or in defence of a legal claim.

Where you have consented to CVmatograph processing your personal data/special data you have the right to withdraw that consent at any time by contacting the person stated at the top of this GDPR Privacy Statement. Please note that if you withdraw your consent to further processing that does not affect any processing done prior to the withdrawal of that consent, or which is done according to another legal basis.

There may be circumstances where CVmatograph will still need to process your data for legal or official reasons. Where this is the case, we will tell you and we will restrict the data to only what is necessary for those specific reasons.

If you believe that any of your data that CVmatograph processes is incorrect or incomplete, please contact us using the details above and we will take reasonable steps to check its accuracy and correct it where necessary.

You can also contact us using the above details if you want us to restrict the type or amount of data we process for you, access your personal data or exercise any of the other rights listed above.

We will seek to deal with your request as quickly as we can and within 30 days (unless we have reason and are allowed to extend this period).

6. Automated decision-making

We store your details on our database and for work seekers we will assess data we hold about you against the vacancies we have been asked to fill. Whilst we will categorise your record to specific job functions and/or trades to help us in the search and assessment process none of our recruitment activities involve automated decision-making tools – there is always human interaction and/or intervention in this process.

7. Cookies

We may obtain data about you from cookies. Please note that in a few cases some of our website features may not function if you remove cookies from your browser.

8. Log Files

We use IP addresses.

9. Sale of business

If the CVmatograph’s business is sold or integrated with another business your details may be disclosed to our advisers and any prospective purchasers and their advisers and will be passed on to the new owners of the business. We will ensure that all such parties are GDPR compliant prior to such disclosure.

10. Data Security

We are passionate about protecting your information, so we have put in place appropriate measures that are designed to prevent unauthorised access to and/or misuse and/or loss of your personal data.

We have done this by putting in place sound technical and organisational measures which include a process on how we deal with any suspected breach, ensuring firewalls, anti-virus, encryption and limited access by means of secure passwords apply to our systems. We also endeavour to use secure electronic methods of transferring documents between us, for example the forms that we use to collect and store your personal data.

Only employees who need the information to perform a specific job (for example, consultants, our accounts and payroll team or our marketing personnel) are granted access to some/all of your information, as appropriate.

CVmatograph uses all reasonable efforts to safeguard your personal information. However, you should be aware that the use of email/the Internet is not entirely secure and for this reason CVmatograph cannot guarantee the security or integrity of any personal information which is transferred from you or to you via such media.

If you share a device with others, we recommend that you do not select the "remember my details" function when that option is offered.

If you have any questions about the security measures on our website, you can email the person stated at the top of this GDPR Privacy Statement.

11. Changes to this privacy statement

We will update this GDPR Privacy Statement from time to time. We will post any changes to the statement with revision dates on our website(s). If we make any material changes, we will notify you.

13. Complaints or queries

If you wish to complain about this GDPR Privacy Statement or any of the procedures set out in it, please contact us using the contact details above.

You also have the right to raise concerns with Information Commissioner's Office on 0303 123 1113 or at, or any other relevant supervisory authority should your personal data be processed outside of the UK, if you believe that your data protection rights have not been adhered to.