Recruitment Privacy Policy

Effective date: 27 August 2025
Version: 1.0

This notice explains how Tetra Consulting Limited (“Tetra”, “we”, “us”) handles personal data about job applicants and candidates during recruitment, including applications submitted via Sage HR and any recruitment agencies or job boards. It supplements our Website Privacy Notice.

1) Who we are and how to contact us

  • Controller: Tetra Consulting Limited (Company No. 03557123)
  • Registered office: 8 Bloomsbury Street, Bloomsbury, London, WC1B 3SR
  • Privacy contact: privacy@tetraconsulting.co.uk
  • Data Protection Officer (DPO): Neil Burman, dpo@tetraconsulting.co.uk
  • ICO registration: ZA862300

2) What data we collect

  1. a) Information you provide
    Identity and contact details; CV/resumé; application answers; work and education history; professional qualifications; right‑to‑work documents; interview notes; assessment/test results; salary expectations; availability.
  2. b) Information from others
    Recruitment agencies; referees; former employers; professional networking sites (e.g., LinkedIn); background check providers (where the role requires checks); and publicly available sources.
  3. c) Special category data (only if necessary)
    We try not to collect sensitive data, but recruitment may involve health or disability information related to reasonable adjustments, and (optionally) equal opportunities monitoring. Where processed, we rely on an appropriate UK GDPR/DPA 2018 condition.
  4. d) Criminal offence data (only if necessary)
    For certain roles, we may conduct vetting/DBS checks where lawful and proportionate. Where processed, we rely on a DPA 2018 Schedule 1 condition (e.g., employment, social security and protection; or regulatory requirements).

3) Why we use your data and our lawful bases

Purpose

Lawful basis

Typical data

Retention

Manage applications and assess suitability

Contract(pre‑contract steps) and/or Legitimate interests

Application, CV, interview notes

12 months after hiring decision (unsuccessful)

Communicate with you about the process

Legitimate interests

Contact details; status

12 months

Right‑to‑work and identity checks

Legal obligation

Passport/visa/right‑to‑work data

Copies deleted if unsuccessful; retained in personnel file if hired

Equal opportunities monitoring (optional)

Substantial public interest(equality of opportunity) or Consent

Demographic data

Aggregated/anonymised where possible; raw data 6 months

Background/DBS checks (role‑dependent)

Legal obligationand/or Legitimate interests + DPA Sch.1 condition

Vetting results

Per check provider policy; key outcomes up to 12 months

Keep your details for future roles (talent pool)

Consent

CV; contact details

Up to 24 months or until withdrawn

Defend legal claims

Legitimate interests

Relevant records

Up to 6 years where needed

For successful candidates, relevant data transfers to your personnel file and is retained under our Employee Privacy Notice and retention schedule.

4) Who we share data with

  • Sage HR (applicant tracking/HRIS).
  • Recruitment agencies and job boards (if applicable).
  • Referees and former employers (with your consent where required).
  • Background screening providers/DBS when role‑appropriate and lawful.
  • IT, hosting and email service providers, and our professional advisors.
  • Regulators or authorities where required by law.

We do not sell applicant data.

5) International transfers

Some providers may be outside the UK. Where a transfer is restricted, we use the UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses. For eligible US providers we may rely on the UK‑US Data Bridge. Details of safeguards for specific services are available on request.

6) Your rights

You have rights to access, rectify, erase, restrict or object to processing, data portability, and to withdraw consentwhere we rely on consent (e.g., talent pool). You also have the right to complain to the ICO.

How to request deletion (erasure)

Email privacy@tetraconsulting.co.uk or dpo@tetraconsulting.co.uk with your name, the email address used in your application, and the vacancy or date if known. We may ask for proof of identity. We will erase data where the right applies and confirm the outcome. We may retain limited information to meet legal obligations or maintain a suppression record.

7) Security

We use technical and organisational measures appropriate to the risk, including access controls, encryption in transit, logging, and vendor due diligence.

8) Automated decision‑making

We do not make hiring decisions based solely on automated processing. Where we use tests or screening tools, scores may inform decisions but are reviewed by people.

9) Changes to this notice

We may update this notice from time to time. Significant changes will be highlighted on this page. Please review periodically.

Questions? Contact privacy@tetraconsulting.co.uk or dpo@tetraconsulting.co.uk.