Loom Talent Limited – Privacy Notice
1. Who we are
Loom Talent Limited (company number 14937917) (“Loom Talent”, “we”, “us” or “our”) is a recruitment business based in Nottingham, operating in the UK, US and Europe. We place management and leadership talent across logistics and supply chain, finance and accounting, HR, and sales and commercial functions.
Registered office: Suite L210, Landmark Business Centre, Tudor Square, West Bridgford, Nottingham, NG2 6BT.
ICO registration number: ZB713916.
For the purposes of UK data protection law (the UK GDPR and the Data Protection Act 2018), Loom Talent Limited is the controller of the personal data described in this notice. This notice explains what we collect, why, who we share it with, how long we keep it, and the rights you have.
2. The personal data we collect
Candidates
- Identity and contact details: name, email address, phone number, home location or postcode area.
- Career information: your CV, work history, qualifications, skills, current and expected salary, notice period, and role preferences.
- Recruitment records: notes from our conversations with you, interview feedback, and records of the roles we have discussed or put you forward for.
- Right to work and compliance information, where a placement requires it.
- References, where you have given us referee details.
- Other recruitment-related information: where necessary and lawful, this may include date of birth, gender, identification documents, background-check information and other information relevant to your suitability for a particular role, depending on the role and circumstances.
- We may also process special category personal data, such as health or disability information, and criminal offence data where necessary for a recruitment process and permitted by law. We will only process this information where we have an appropriate lawful basis and meet any additional legal conditions and safeguards that apply.
Clients and business contacts
- Name, job title, employer, work contact details.
- Records of vacancies, briefs, meetings and correspondence.
Website visitors
- Details you submit through our forms: enquiries, CV submissions, vacancy uploads, account registration, salary survey and other downloads.
- Technical data collected through cookies and similar technologies, described in the Cookies section below.
Suppliers and other business contacts
We may also process business contact details, correspondence, contractual information and relevant financial records relating to suppliers, professional advisers and other organisations with which we work.
3. How We Collect Your Data
We may collect personal data:
- Directly from you when you register with us, apply for a role, submit a CV, send us a vacancy, download a resource, complete a website form or speak to us.
- From publicly available professional sources, such as professional networking sites and job boards, where your profile has been made available for recruitment purposes.
- From referees you have named and clients providing feedback on introductions or interviews.
- Other recruitment-related sources where relevant and lawful.
Where we obtain personal data indirectly, we will provide the privacy information required by applicable data protection law.
4. How we use it and our lawful bases
We use personal data to run a recruitment business: matching candidates to roles, running briefs for clients, arranging interviews, checking suitability, making placements, and keeping in touch about work you have asked us about.
- Legitimate interests: finding and introducing candidates to suitable roles, sourcing candidates for client briefs, keeping business records, and improving our services. We balance these interests against your rights and expectations.
- Contract: taking the steps needed to place you in a role, or to deliver a recruitment service a client has engaged us for.
- Consent: where we rely on it, for example some marketing communications. You can withdraw consent at any time.
- Legal obligation: right to work checks, tax and accounting records, and other obligations that apply to recruitment businesses, including the Conduct of Employment Agencies and Employment Businesses Regulations 2003.
Where we process special category data or criminal offence data, we will also identify and rely on an applicable additional legal condition where required.
We will discuss relevant opportunities with you before putting you forward to a prospective employer and will obtain your agreement before making an introduction.
Our agreement with you to make an introduction is separate from the lawful basis we rely on to process your personal data under data protection law.
We do not use personal data for solely automated decision-making that produces legal or similarly significant effects on individuals.
6. International data transfers
As a recruitment business that may work with candidates and clients internationally, we may need to transfer personal data to, or allow access to personal data from, countries outside the UK.
We store and process data in the UK or European Economic Area wherever possible. However, the location of processing depends on the services and systems used and the relevant business requirements.
Where personal data is transferred outside the UK, we will ensure that the transfer complies with applicable data protection law. Depending on the circumstances, this may include:
- A UK adequacy regulation or another recognised basis for permitting the transfer.
- The UK International Data Transfer Agreement (IDTA) or the UK Addendum to the relevant European Commission Standard Contractual Clauses.
- A transfer risk assessment and additional technical, organisational or contractual safeguards where required.
We will not rely on the existence of a contract with a service provider alone as proof that an international transfer is lawful.
7. How long we keep personal data
We retain personal data only for as long as necessary for the purposes for which it was collected, taking account of our recruitment activities, the nature of our relationship with you, applicable legal and regulatory requirements and the need to establish, exercise or defend legal claims.
Our retention arrangements include the following:
- Candidate records: normally retained for up to two years after the last meaningful contact, subject to the nature of the ongoing recruitment relationship, applicable legal requirements and any other lawful reason for retaining the information. Where a different period is justified, we will apply our documented retention criteria.
- Client and supplier records: generally retained for six years after the end of the relevant contractual relationship, where appropriate, subject to applicable legal and accounting requirements.
- Employee and contractor records: retained in accordance with the relevant employment, payroll and personnel retention requirements and any separate privacy information provided.
- Website and enquiry records: retained for as long as reasonably necessary to respond to enquiries, manage the relevant relationship and meet applicable legal requirements.
Certain recruitment, financial and business records may be subject to specific statutory or regulatory retention requirements. The applicable period depends on the type of record; we do not assume that every recruitment record is subject to the same minimum retention period.
When personal data is no longer required, we will securely delete it, destroy it or anonymise it where appropriate.
You may ask us to erase your personal data. We will assess each request under applicable data protection law. We will erase information where required, but some information may lawfully need to be retained, for example to comply with a legal obligation or to establish, exercise or defend legal claims. Where appropriate, we will explain the outcome of your request.
9. How we protect personal data
We use appropriate technical and organisational measures to protect personal data against unauthorised access, accidental loss, destruction, alteration or disclosure.
These measures include, as appropriate to our systems and activities:
- Access controls and restricting access to people who need the information for their work.
- Password protection and appropriate system security measures.
- Encryption in transit and other security protections where supported and appropriate.
- Staff awareness of confidentiality, data protection and information security responsibilities.
- Secure handling, storage and disposal of personal data.
No system can be guaranteed to be completely secure. If a personal data breach occurs, we will investigate and take appropriate steps to contain and address it. We will notify the Information Commissioner's Office and affected individuals where required by applicable law.
10. Your data protection rights
Depending on the circumstances and the applicable legal requirements, you may have the following rights:
- Right to be informed: to receive clear information about how we process your personal data.
- Right of access: to request a copy of your personal data.
- Right to rectification: to ask us to correct inaccurate or incomplete information.
- Right to erasure: to request deletion of your personal data where the legal conditions are met.
- Right to restriction: to ask us to restrict processing in certain circumstances.
- Right to data portability: to receive certain personal data you have provided to us in a structured, commonly used and machine-readable format, where the right applies.
- Right to object: to object to processing based on legitimate interests and to direct marketing. We will stop processing for direct marketing purposes when you object.
- Right to withdraw consent: where we rely on consent, you may withdraw it at any time.
Your right to object
These rights are subject to the conditions and exceptions set out in data protection law. For example, the right to erasure is not absolute, and the right to data portability does not apply to every type of processing.
Automated decision-making and profiling: You have rights in relation to certain decisions made solely by automated means, including profiling, where those decisions have legal or similarly significant effects on you. Loom Talent does not use AI or automated systems to make solely automated candidate-shortlisting decisions.
To exercise your rights, please contact us using the details in Section 12. We will respond without undue delay and normally within one month. Where permitted by law, this period may be extended by up to a further two months if your request is complex or you have made multiple requests. If an extension is necessary, we will inform you within the initial month and explain why.
You also have the right to complain to the Information Commissioner's Office (ICO) if you are concerned about how we handle your personal data. We would welcome the opportunity to address your concerns, but you are not required to contact us before making a complaint.
ICO website: https://ico.org.uk/
11. Changes to this notice
We may update this notice from time to time to reflect changes in our business, the personal data we process, our systems or applicable law.
The date at the top of this notice indicates when it was last updated. Significant changes will be flagged on this page.
12. Contact us
If you have questions about this notice or wish to exercise your data protection rights, please contact:
Loom Talent Limited
Registered office: Suite L210, Landmark Business Centre, Tudor Square, West Bridgford, Nottingham, NG2 6BT
Email: enquiries@loomtalent.com
ICO registration number: ZB713916
You can also contact the Information Commissioner's Office at https://ico.org.uk/ if you wish to raise a concern about how your personal data is handled.