Candidate Privacy Notice

Company number: 09943794 | Registered office: 65 Broadway, London, E15 4BQ, United Kingdom
Website: www.attop.co.uk | Privacy enquiries: info@attop.co.uk

1. About this Notice

Attop Group Limited (“Attop Group”, “we”, “us” or “our”) respects the privacy of people who register with us, seek work, apply for vacancies or undertake assignments through our recruitment and staffing services. This Candidate Privacy Notice explains what personal data we process, how we obtain it, why we use it, who may receive it, how long it is kept and the rights available to you. It covers prospective, current and former candidates, agency workers and contractors, including individuals contacted about potential opportunities. It should be read alongside our general Website Privacy Notice and Cookie Policy. This notice does not itself constitute a contract of employment or a guarantee of work.

2. Our Identity and Contact Details

ATTOP GROUP LTD is registered in England and Wales under company number 09943794. Our registered office is 65 Broadway, London, E15 4BQ, United Kingdom. Our website is www.attop.co.uk and our privacy contact is info@attop.co.uk. We generally act as an independent controller when deciding how to source, assess, contact and present candidates. A hiring employer may separately control information it receives for its own selection and employment purposes. Depending on the actual contractual arrangements, the roles of the parties may differ; we assess them for each processing activity. Contact us if you need further information about a particular arrangement.

3. Who This Notice Covers

This notice covers people who send us a CV, register or enquire about work; candidates identified through job boards, referrals, professional networks or other lawful sources; people interviewed, assessed or shortlisted; temporary workers and contractors whose placements we coordinate; and former candidates whose records remain relevant. A separate worker or employee privacy notice may provide additional detail on payroll, benefits, monitoring or workplace matters.

4. Recruitment Sectors

We recruit across Legal; Engineering & Manufacturing; IT & Technology; Security; Joinery & Woodworking; Finance & Professional Services; Renewable Energy; Warehousing & Logistics; Skilled Trades; Sales & Commercial; Driving & Transport; and Hospitality. The information required and checks undertaken depend on the vacancy, regulatory environment, contractual requirements and the individual's circumstances.

5. Information We May Collect

Identity and contact details: name, address, telephone number, email, and date of birth where necessary.

Professional details: CV, work history, job titles, qualifications, trade cards, licences, memberships, portfolios, references, work preferences, salary expectations, availability and interview notes.

Application and communications records: vacancies considered, interview arrangements, assessment outcomes, correspondence, feedback and records of our contact with you.

Eligibility and compliance: evidence of identity and right to work, immigration permission where relevant, National Insurance number when required, SIA licence, CSCS card, driving entitlements and role-specific certificates.

Assignment information: schedules, attendance, timesheets, assignment locations, performance or incident reports where relevant, pay or invoice information and contractual records.

Technical data: information submitted through online forms, relevant system logs and communications metadata. We do not require every category from every candidate, and we aim to collect information at the appropriate stage.

6. Sensitive Data and Criminal Offence Information

In some circumstances we may need health or disability information to arrange reasonable adjustments or assess role-specific legal requirements, or equality-monitoring information where voluntarily provided and lawfully handled. Such special category data requires an Article 6 lawful basis and a separate Article 9 condition under UK GDPR. Criminal offence and conviction information requires Article 6 and an applicable Article 10/DPA 2018 condition. Checks such as DBS screening or security vetting will be undertaken only where lawful, necessary and proportionate. Where required, we maintain an appropriate policy document and additional safeguards. We do not ask candidates to provide sensitive information through general enquiry forms unless specifically needed and a secure method is available.

7. Sources of Information

We obtain data directly from you through applications, registration forms, emails, calls, interviews and documents. We may also obtain relevant information from job boards, professional networking sites, referrals, publicly accessible professional profiles, referees, former employers, qualification and licence registers, screening providers and clients. If we obtain your details indirectly, we provide required privacy information within the applicable statutory period, generally no later than one month, at first communication, or before first disclosure, as applicable, subject to lawful exceptions. We do not assume that publicly accessible information is free of privacy obligations.

8. Recruitment Purposes

We use data to identify and contact candidates; assess experience and suitability; match people with vacancies; arrange interviews and assessments; verify qualifications and permissions; submit relevant profiles to employers; communicate outcomes; maintain recruitment records; manage complaints; and improve our recruitment services. We may also consider you for future suitable opportunities where we have an appropriate lawful basis and have given relevant information. We will not use candidate details for unrelated marketing merely because you applied for a role.

9. Temporary Work and Contractor Purposes

Where relevant, we use information to set up assignments, establish terms, provide required key information and assignment details, verify eligibility, administer rotas and timesheets, manage worker and client communications, process payments or invoices, meet tax and employment obligations, investigate workplace concerns and manage legal claims. Additional payroll or employee notices may apply depending on the engagement model.

10. Lawful Bases

Our lawful bases vary by activity. Legitimate interests may support proportionate candidate sourcing, assessment, matching, professional communications, record management and the defence of claims, following a balancing assessment. Contractual necessity may apply to steps you request before entering into a contract with us or administering a contract to which you are a party. Legal obligation may apply to right-to-work checks, tax and other statutory duties. Consent may be used for distinct activities where it is freely given and appropriate, such as some optional communications or specific disclosures. We do not generally treat consent as the default basis for ordinary recruitment. If special category or criminal offence data is processed, additional statutory conditions are required. You may request details of the basis used for a particular activity.

11. Candidate Screening and Vetting

Checks depend on the role and may include references, professional registrations, training records, identity, right to work, driving entitlements and security licensing. For security assignments, appropriate checks may include SIA licence validation and role-relevant screening aligned with applicable standards such as BS 7858 where required. We will tell you about relevant checks and avoid disproportionate or unlawful screening. Criminal record checks are conducted only where eligibility and legal conditions permit. Screening providers may act as processors or separate controllers depending on the service.

12. Right-to-Work and Identity Documents

We may need to inspect or retain evidence required to establish a statutory excuse or otherwise comply with applicable immigration law. We collect this at an appropriate stage and use secure channels wherever possible. Retention periods for right-to-work records may be prescribed by law and can differ from ordinary recruitment records. We will not retain copies longer than justified by the applicable requirements.

13. Sharing Information With Hiring Organisations

We may share relevant CV details, work experience, qualifications, availability and other suitability information with prospective employers or clients where lawful and appropriate. We aim to explain the opportunity and, where appropriate, identify the organisation before submitting identifiable details. Hiring organisations may become independent controllers and use the information for their own recruitment decisions under their own privacy notices. We do not sell CV databases for unrelated commercial resale. Information that is unnecessary or especially sensitive should not be routinely included in candidate profiles.

14. Other Recipients

We may disclose necessary information to recruitment management and IT providers, hosting services, secure document storage, payroll and accounting services, screening or qualification providers, professional advisers, insurers, regulators and public authorities, and relevant clients or assignment sites. We require suitable data processing agreements when a supplier acts as our processor and limit access to what is necessary. Disclosures may also occur when lawfully required or to establish, exercise or defend legal claims.

15. International Transfers

Some suppliers or service arrangements may involve access to personal data from outside the UK. Where restricted transfers occur, we use a valid UK transfer mechanism, such as adequacy regulations, an International Data Transfer Agreement, the UK Addendum to approved clauses or another lawful route, with any required risk assessment and safeguards. The specific countries and providers must be confirmed against our actual systems. You may contact us for information about relevant safeguards.

16. Retaining Candidates for Future Opportunities

We may wish to retain relevant professional information so we can contact you about future roles. This is not automatic permission for unrelated promotional marketing. We will use an appropriate lawful basis, explain the purpose and provide ways to update your preferences or object where applicable. We periodically review whether records remain useful and proportionate. If you ask not to be contacted, we may retain limited suppression information to respect that request.

17. Direct Marketing and Vacancy Alerts

Communications about particular applications and relevant recruitment administration are not necessarily direct marketing. Optional vacancy alerts, newsletters and promotional messages are assessed separately under UK GDPR and PECR. Where consent is required, we obtain it and provide a means to withdraw it. Where other rules permit marketing, we still identify an appropriate lawful basis and honour objections. You may email info@attop.co.uk to change your communication preferences.

18. Retention and Deletion

We retain personal data only for as long as needed for the stated purpose and any applicable legal, regulatory, tax, contractual or claims-related obligations. Different periods apply to unsuccessful applications, candidate databases, placement records, payroll, right-to-work evidence, security vetting, references and correspondence. We determine periods by necessity, statutory rules, limitation periods and risk; we review records and securely delete or anonymise them when no longer required. We do not promise one universal period for all recruitment data. Our detailed internal retention schedule should identify actual periods by record type and can be explained on request where appropriate.

19. Security and Confidentiality

We use risk-appropriate technical and organisational measures, which may include encrypted connections, access restrictions, authentication, secure storage, software maintenance, backups, staff confidentiality requirements, supplier oversight and incident procedures. Access to CVs, identity documents and vetting records is limited to authorised persons with a legitimate need. No transmission or storage method is completely risk-free. Please avoid sending highly sensitive documents through unprotected general-purpose forms unless requested and an appropriate channel has been provided.

20. Accuracy and Your Responsibilities

Please tell us when your contact details, qualifications, work eligibility, licence status or availability change. We take reasonable steps to keep information accurate and may seek confirmation of important details. Providing inaccurate or incomplete information can affect our ability to assess or administer an application, but we will not assume all inaccuracies are deliberate.

21. Automated Tools and Recruitment Decisions

We may use software to organise candidate records, search for relevant experience or support administrative shortlisting. If we introduce automated decision-making or profiling that has legal or similarly significant effects, we will assess and comply with the applicable UK GDPR rules and safeguards, including rights to information and challenge where required. This notice does not claim that any particular AI or automated scoring system is currently deployed.

22. Your Rights

Subject to applicable conditions and exemptions, you may have rights to be informed, access your personal data, rectify inaccuracies, request erasure, restrict processing, receive portable data where applicable, object to processing based on legitimate interests and object at any time to direct marketing. You may withdraw consent where processing relies on it, without affecting earlier lawful processing. Rights and safeguards also apply to certain automated decisions. Some information must be retained despite a deletion request where the law permits or requires this.

23. Making a Data Rights Request

Contact info@attop.co.uk and describe your request. We may verify your identity where reasonably necessary. We normally respond within one calendar month, subject to applicable extensions, pauses or exceptions under current law. Requests are generally free, although limited fees or refusal may be permitted for manifestly unfounded or excessive requests. You do not have to use a special form to exercise your rights.

24. Complaints and the ICO

If you have concerns, please contact info@attop.co.uk so we can investigate. You may also complain to the Information Commissioner’s Office (ICO) at www.ico.org.uk or telephone 0303 123 1113. You may have other legal remedies. We will not treat a candidate unfavourably merely for raising a legitimate privacy concern.

25. Data Breaches

We maintain arrangements to identify, assess, contain and investigate suspected personal data breaches. We report qualifying breaches to the ICO and notify affected individuals when the relevant legal thresholds are met. We also take steps to reduce the likelihood of recurrence.

26. Recruitment Fairness and Equal Opportunities

We aim to process candidate information fairly and avoid unjustified discrimination. Where equality monitoring information is collected, we will explain its purpose, limit access and separate it from selection decisions where appropriate. We consider reasonable adjustments and accessibility needs in a manner consistent with applicable law.

27. Children and Young Applicants

Most recruitment services are intended for adults. Where lawful opportunities involve younger applicants, we apply age-appropriate safeguards and collect only necessary information. Parents or guardians should contact us if they believe information has been submitted inappropriately.

28. Website Forms, Cookies and External Platforms

Candidate applications may be submitted through our website or third-party recruitment platforms. Our general Privacy Notice and Cookie Policy explain relevant website processing and cookie controls. Third-party job boards and professional networks may process your data independently under their own notices. Please review their privacy information where relevant.

29. Changes to This Notice

We may update this notice to reflect changes in our processing, systems, services, law or ICO guidance. The latest version will be available on our website. Where a change materially affects how we use your information, we will provide further notice where required. No effective date is stated in this document.

30. Contact Details

ATTOP GROUP LTD

Registered office: 65 Broadway, London, E15 4BQ, United Kingdom

Company number: 09943794

Website: www.attop.co.uk

Email: info@attop.co.uk

For candidate privacy questions, data rights requests, complaints or questions about recruitment data sharing, please contact us using the email above.