Privacy Notice

Deerfoot Recruitment Solutions Ltd | Version v2026.3 | October 2026

Summary

Who we are. Deerfoot Recruitment Solutions Ltd is an independent IT and technology recruitment agency. We decide how your information is used, so we are the "controller" of it.

What we do with it. We use your information to find you work, to put you forward for roles you have agreed to, to run contract assignments, to work with our clients, and to meet our legal obligations.

Where it comes from. From you, or from places where you have made your professional details available, such as job boards, LinkedIn and professional profiles.

Who sees it. Our team, the clients you agree to be put forward to, and the suppliers who run our systems. We never sell your information.

How long we keep it. Normally 2 years from our last meaningful contact with you. Longer if you were placed, worked as a contractor or were introduced to a client. See section 10.

Technology and AI. We use software, including AI tools, to help us find, match and contact candidates. A recruiter always makes the decisions. See section 7.

Your rights. You can ask for a copy of your information, ask us to correct or delete it, or tell us to stop contacting you. Email dpo@deerfoot.co.uk.

1. Who we are and how to contact us

Controller: Deerfoot Recruitment Solutions Ltd, company number 03446821
Registered office: 147 Frimley Road, Camberley, Surrey, GU15 2PS
Data Protection Lead: Ben Gordon - dpo@deerfoot.co.uk
General enquiries: hello@deerfoot.co.uk | 023 8081 3001
Regulator registration: We are registered with the Information Commission (formerly the Information Commissioner's Office), registration number Z5184612
Memberships: Corporate member of the Recruitment & Employment Confederation (REC). Cyber Essentials certified.

We are a remote-first business and do not have a public office. Please contact us by email in the first instance.

2. Who this notice covers

Candidates: people who apply to us, register with us, or whom we find and approach about roles.
Contractors: people we place on contract assignments, whether through an umbrella company or their own limited company.
Referees: people whose details a candidate gives us so that we can obtain a reference.
Client contacts: people who work for our clients, prospective clients and suppliers.
People who refer others to us, for example through our Refer and Get Rewarded scheme.
Website visitors: people who use www.deerfoot.co.uk or contact us through it.

Our own employees are covered by a separate staff privacy notice.

3. The information we collect

Candidates: Name, contact details, town and postcode, CV, work history, skills, qualifications, current and expected salary or day rate, notice period, availability, job preferences, right to work status, interview notes, client feedback, and our messages with you. If you apply online, your answers to application form questions. If you take part in a video interview, the recording.
Contractors: Everything above, plus the details needed to run the assignment: your umbrella company or limited company details, contract terms, timesheets, rates, expenses, and the results of any pre-assignment checks. We deal with your umbrella or limited company for payment and do not hold your personal bank details unless you give them to us for another reason.
Referees: Name, job title, organisation, contact details and the reference you provide.
Client contacts: Name, job title, employer, business contact details, our notes of calls and meetings, vacancy details, and whether you want to hear from us.
People who refer others: Name, contact details, who you referred, your choice of reward (Amazon voucher or charity donation) and a record of rewards paid.
Website visitors: What you submit through our forms. With your consent, information about how you use the site collected by analytics cookies (see section 13).

Special category and criminal offence information

Some information is more sensitive and the law gives it extra protection. We only collect it in these situations:

Health and disability: only if you tell us, for example so that an interview can be adjusted for you. We only share it with a client if you agree.
Criminal records: only where a role requires a check (for example security-cleared or regulated roles). The check is carried out by the client or, on our behalf, by our screening provider Tifo (PayStream). We record the outcome, not the certificate.
Diversity information (such as ethnicity or gender): only when a client asks for it for their own monitoring. Answering is always optional, it is kept separate from your CV, and we pass it only to that client's HR or diversity contact.

Identity documents such as passports and share codes are needed for right to work checks. They are not special category information, but we keep them secure and only as long as needed (section 10).

4. Where we get your information

From you: when you apply to an advert, register on our website or forms, send us your CV, or speak to us.
From job boards and CV databases where you have made your CV available to recruiters, such as Agency Central and the boards we advertise on through Broadbean.
From professional networking sites and public professional profiles, such as LinkedIn and GitHub. We may use search tools, including AI sourcing tools with their own databases of public professional profiles (such as Pin), to find profiles that match a role.
From contact-finding services built into our systems, which may supply a business or personal email address or phone number so that we can reach you.
From referrals: someone who knows you and recommends you, for example through our Refer and Get Rewarded scheme. We ask them to refer you only with your agreement, and our first message to you says who referred you.
From clients: interview feedback and, for contractors, assignment information.
From screening providers: right to work results from TrustID, and screening results from Tifo (PayStream) or the client.
From your referees, if you have given us their details.

If we obtain your details from somewhere other than you, our first message to you says where we found them and links to this notice. If we hold your details without contacting you, we provide this information within one month.

5. How we use your information and our lawful basis

Data protection law requires us to have a lawful basis for each use. These are ours:

Keep your details on our database and match you to suitable roles. Lawful basis: Legitimate interests - finding people work is our business, and people who make their CV available to recruiters expect to be contacted about relevant roles
Contact you about roles, including when we have found your profile. Lawful basis: Legitimate interests
Put you forward to a client for a specific role. We always get your agreement first, as recruitment rules require. Lawful basis: Legitimate interests
Arrange interviews, share feedback and manage offers. Lawful basis: Legitimate interests; contract, where you have engaged us
Carry out right to work checks when a client offers you a role. Lawful basis: Legal obligation, where the law makes us responsible for the check; otherwise legitimate interests (helping our client meet its legal obligation and confirming you can take the role)
Engage and administer contractors, including timesheets and payments to umbrella or limited companies. Lawful basis: Contract; legal obligation
Keep the records the Conduct of Employment Agencies and Employment Businesses Regulations 2003 require. Lawful basis: Legal obligation
Keep records to deal with queries, fee disputes or legal claims. Lawful basis: Legitimate interests
Health, criminal record and diversity information (section 3). Lawful basis: Your explicit consent, or where the law requires or permits it (see section 6)
Manage our relationships with clients and suppliers, and send business contacts relevant market updates and candidate information. Lawful basis: Legitimate interests. You can opt out at any time
Run our referral scheme: contact the people referred to us and pay rewards to the people who referred them. Lawful basis: Contract (the scheme terms) for people who refer; legitimate interests for the people they refer
Respond to rights requests and complaints, and cooperate with our regulator. Lawful basis: Legal obligation
Audits by the REC and clients, quality checks, training and improving our service. Lawful basis: Legitimate interests
Website analytics. Lawful basis: Consent, given through our cookie settings

Where we rely on legitimate interests, we have assessed that our interests are balanced against your rights. You can ask us for details, and you can object at any time (section 11).

If you do not give us information we need, such as proof of your right to work, we may not be able to put you forward or place you.

6. Sensitive information: the conditions we rely on

Health information: your explicit consent, or where it is needed for employment or social security obligations (Data Protection Act 2018, Schedule 1, paragraph 1).
Criminal record information: your consent, when you authorise the check and the sharing of its outcome with the client (Data Protection Act 2018, Schedule 1, paragraph 29). Where the law requires a check for a role, the client relies on its own legal condition.
Diversity information: your explicit consent. You can decline or withdraw it without affecting your application. We send it only to the client's HR or diversity contact, never to the hiring manager.

Where we rely on a condition in Schedule 1, we keep an Appropriate Policy Document explaining how we protect that information. You can ask us for a copy.

7. How we use technology and AI

We use software to work efficiently. Some of it uses artificial intelligence (AI). This is what it does:

Recruit CRM: Our candidate database. Its AI features suggest and rank candidates who may match a role.
Pin: Searches public professional profiles, uses AI to assess how closely people match a role, and finds contact details (including personal email addresses and phone numbers). It sends introductory emails and LinkedIn connection requests about specific roles using templates our team writes, and drafts replies that a consultant reviews before anything is sent.
HireAra: Formats CVs into our standard layout and drafts profile summaries for us to check.
Claude (Anthropic): Helps our team draft notes, emails and summaries, and with admin tasks in our systems.
Odro: Hosts recorded and live video interviews.

Our commitments:

A person makes the decisions that matter. AI may suggest, rank or approach candidates and draft replies, but a consultant reviews every reply before it is sent, and AI never rejects you for a role. A Deerfoot consultant reviews every candidate before deciding who to put forward to a client, and personally reviews everyone who replies with interest. We do not make decisions that significantly affect you based solely on automated processing.
We check AI output for accuracy before we use it, and we do not use AI to guess protected characteristics such as age, gender or ethnicity.
We assess each tool, including where it stores data and whether the supplier can use our data to train its AI models.
You can ask us how technology was used in relation to you, ask for a person to review anything, and challenge an outcome. Email dpo@deerfoot.co.uk.

8. Who we share your information with

Clients: only for roles you have agreed to be put forward for. Once a client receives your details, it is responsible for its copy.
Umbrella companies and your limited company: for contractors, to arrange payment and the assignment.
Screening providers: TrustID for right to work checks, and Tifo (PayStream) for pre-assignment screening and criminal record checks where needed.
Insurers and professional advisers, and a buyer or investor if our business is ever sold or restructured, under confidentiality.
Service providers who run our systems (listed below). They only act on our instructions and under contracts that protect your information.
Professional advisers and auditors, including the REC and clients auditing our compliance.
Authorities: where the law requires it, for example HMRC, the Home Office, the police or a court. We check every request first.

Our main service providers:

Recruit CRM: Candidate and client database. Data stored in: USA
Microsoft 365: Email, documents, Teams. Data stored in: UK (email currently held in the EU)
Cognito Forms: Application and registration forms. Data stored in: USA
Pin: AI sourcing and outreach. Data stored in: USA
Anthropic (Claude): AI assistant for our team. Data stored in: USA
HireAra (Access UK Ltd): CV formatting (uses OpenAI, Affinda and Textkernel). Data stored in: UK, with processing in the USA and Australia
Odro: Video interviews. Data stored in: Ireland and UK
Broadbean: Job advert posting and responses. Data stored in: UK and EEA
TrustID: Right to work and ID checks. Data stored in: UK
Tifo (PayStream): Screening and onboarding checks. Data stored in: UK
Timesheet Portal (Anfold Software): Contractor timesheets. Data stored in: UK and EEA
Xero: Accounts and invoicing. Data stored in: USA

We do not sell your information, and we do not share it with anyone for their own marketing.

9. Transfers outside the UK

Some providers store or process information outside the UK, mainly in the USA. We protect these transfers with one of the following:

where the provider is certified under the UK Extension to the EU-US Data Privacy Framework (the "UK-US data bridge"), or the country has UK approval; or
where we have the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses in place, and we have assessed that protection is not materially lower than in the UK.

You can ask us for more detail about the safeguards for a particular provider.

10. How long we keep your information

Candidates we have not put forward to a client: 2 years from our last meaningful contact with you
Candidates put forward to a client but not placed: Full record: 2 years from our last meaningful contact. A short record of the introduction (your name, the client, the role, the date and the CV sent): 6 years from the end of the period in which that client would owe us a fee if they hired you (usually 6 months), to resolve any fee dispute
Candidates placed in a permanent role: 6 years from your start date
Contractors: 6 years from the end of your last assignment
Right to work evidence: Deleted if you do not progress to an offer. Otherwise kept for 2 years after the assignment ends or, for permanent roles, 2 years from your start date
Criminal record check outcomes: Up to 6 months from the hiring decision; we do not keep certificates
Diversity information: Passed to the client and deleted within 30 days; never kept on our database
Client contacts: While we work together, then 2 years from our last contact
Referral scheme: Referral details: up to 2 years from the referral. Records of rewards paid: 6 years, as part of our financial records. Anyone referred to us is then covered by the candidate or client contact periods above
People who ask us not to contact them: A minimal record (name, email and the date), so that we do not contact you again

Before we delete a candidate record, we may contact you once to ask whether you want us to keep it. If you do not reply, we delete it. The law requires us to keep candidate records for at least one year after we last provided work-finding services to you. Our full Retention Schedule is available on request.

11. Your rights

Access: Ask for a copy of the information we hold about you.
Rectification: Ask us to correct information that is wrong or incomplete.
Erasure: Ask us to delete your information. We will unless we need to keep something for a legal reason, and we will tell you what and why.
Restriction: Ask us to pause using your information while a concern is looked into.
Objection: Object to us using your information on the basis of legitimate interests. If you object to marketing or to being contacted about roles, we will stop.
Portability: Ask for information you gave us in a format you can reuse, where we rely on consent or contract.
Withdraw consent: Where we rely on consent, withdraw it at any time. This does not affect what we did before.
Automated decisions: Ask for a person to review any decision and to challenge it. We do not make decisions about you solely by automated means.

How to use your rights: email dpo@deerfoot.co.uk, use our online form, or tell any member of our team. There is no charge. We respond within one month. If a request is complex we can extend this by up to two further months, and we will tell you within the first month. We will only ask for identification if we are not sure who you are; if we do, the month starts when we receive it. If we hold a lot of information about you, we may ask you to tell us what you are looking for, and the time limit is paused until you reply.

12. Marketing and job alerts

We contact candidates about roles, and business contacts about our services and market updates. Every message includes a way to opt out, or you can reply "stop" or email us. When you opt out, we add you to a do-not-contact list so that it sticks.

13. Cookies

Our website uses cookies that are strictly necessary for it to work. We only use analytics and any marketing cookies if you agree through our cookie settings, which you can change at any time. See www.deerfoot.co.uk/cookie-information for the full list.

14. Keeping your information secure

We are Cyber Essentials certified. Access to our systems is protected by multi-factor authentication and limited to the people who need it. Our core platforms encrypt data in transit and at rest. Our team is trained in data protection every year and works to written rules for home working, devices and handling documents.

15. Complaints

If you are unhappy with how we have handled your information, please tell us first so that we can put it right:

email dpo@deerfoot.co.uk with "Complaint" in the subject line,
use our online form, or
write to the Data Protection Lead, Deerfoot Recruitment Solutions Ltd, 147 Frimley Road, Camberley, Surrey, GU15 2PS.

We will acknowledge your complaint within 30 days (usually much sooner), look into it, keep you updated and tell you the outcome.

If you are still unhappy, you can complain to the Information Commission (formerly the Information Commissioner's Office) at ico.org.uk/make-a-complaint or on 0303 123 1113. The Commission will normally expect you to have raised your complaint with us first.

16. Changes to this notice

We review this notice at least once a year. This version (v2026.3) was published in October 2026. If we make significant changes, we will update this page and, where appropriate, tell you.