Privacy Notice

ATTOP GROUP LIMITED

1. Introduction

Attop Group Limited (“Attop Group”, “we”, “us” or “our”) is committed to protecting the privacy, confidentiality and security of personal information entrusted to us.

This Privacy Notice explains how we collect, use, disclose, retain and protect personal data in connection with our recruitment, staffing, employment, business development and website activities.

It applies to visitors to www.attop.co.uk, candidates, job applicants, temporary workers, contractors, employees, employer representatives, clients, suppliers and other individuals with whom we interact.

We process personal information in accordance with applicable UK data protection legislation, including the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, the Privacy and Electronic Communications Regulations 2003 (PECR), and relevant amendments introduced by the Data (Use and Access) Act 2025.

We aim to ensure that personal information is handled lawfully, fairly, transparently, securely and only for legitimate purposes.

2. Who We Are

Legal Company Name: ATTOP GROUP LTD

Company Registration Number: 09943794

Registered Office Address:

65 Broadway

London

E15 4BQ

United Kingdom

Website: www.attop.co.uk

Email: info@attop.co.uk

Attop Group Limited is a recruitment and staffing business operating across the United Kingdom.

For most of our recruitment, candidate management and business administration activities, we act as a data controller under UK GDPR because we determine why and how personal information is processed.

In some circumstances, prospective employers, clients and other organisations may act as separate controllers or joint controllers, depending on the nature of the processing arrangement.

All privacy enquiries and requests relating to personal information may be directed to info@attop.co.uk.

3. Scope of This Privacy Notice

This notice applies to personal information we process about:

• Website visitors and individuals submitting online enquiries.
• Candidates registering with Attop Group.
• Applicants seeking permanent, temporary or contract employment.
• Temporary workers, contractors and agency personnel.
• Security officers and other personnel seeking assignments.
• Current and former employees, where applicable.
• Employers, recruitment clients and their representatives.
• Business partners, suppliers and professional contacts.
• Individuals whose professional information we obtain through lawful recruitment and business development activities.

This notice applies to information collected through our website, email, telephone, online recruitment platforms, professional networking services, applications, interviews, referrals and other business communications.

Additional privacy information may be provided where a particular activity requires more detailed explanation.

4. Recruitment and Staffing Sectors

Attop Group provides recruitment and staffing services across the following sectors:

1. Legal Recruitment
2. Engineering & Manufacturing Recruitment
3. IT & Technology Recruitment
4. Security Recruitment & Staffing
5. Joinery & Woodworking Recruitment
6. Finance & Professional Services Recruitment
7. Renewable Energy Recruitment
8. Warehousing & Logistics Recruitment
9. Skilled Trades Recruitment
10. Sales & Commercial Recruitment
11. Driving & Transport Recruitment
12. Hospitality Recruitment

Our services may include permanent recruitment, temporary staffing, contract recruitment, candidate sourcing, screening, workforce coordination and placement management.

The personal information required will depend on the position, industry, client requirements and applicable legal obligations.

5. Personal Information We Collect

We may collect the following categories of personal information, where relevant.

Personal and Contact Information

• Full name and preferred name.
• Residential or correspondence address.
• Email address and telephone number.
• Date of birth where necessary.
• Identification information where justified.

Recruitment and Professional Information

• CVs and covering letters.
• Employment history and previous job titles.
• Professional qualifications and certifications.
• Education, skills and training.
• Professional licences and memberships.
• References and referee information.
• Portfolios and examples of previous work.
• Interview records and recruitment assessments.
• Availability, work preferences and salary expectations.
• Details of previous applications and assignments.

Employment and Compliance Information

Where necessary, we may collect:

• Right-to-work documentation.
• Passport or other identification details.
• National Insurance information.
• Relevant immigration and work authorisation details.
• CSCS cards and construction qualifications.
• SIA licence details.
• Driving licence and professional driving entitlements.
• Training certificates.
• Employment verification records.
• Relevant security screening information.
• Other documents necessary for lawful recruitment or assignment management.

We aim to collect sensitive documents only when necessary and at the appropriate stage of the recruitment process.

Financial and Payroll Information

Where required for employment, payroll, contractor payments or business administration, we may collect bank details, payment information, tax information, invoices and relevant financial records.

Business Contact Information

For employers, clients and suppliers, we may collect names, job titles, business contact details, staffing requirements, correspondence and contractual information.

Website and Technical Information

We may collect IP addresses, browser information, device details, website usage data, referral information, cookie preferences and security-related technical records.

6. Special Category and Criminal Offence Information

Certain recruitment activities may involve information requiring additional legal protection.

This may include health or disability information, reasonable adjustment requirements and certain equal opportunities information.

We process special category information only where an appropriate lawful basis under Article 6 UK GDPR and an additional condition under Article 9 apply.

Where criminal offence information is processed, we ensure that the requirements of Article 10 UK GDPR and the Data Protection Act 2018 are satisfied.

This may be relevant to regulated roles, security positions or other assignments requiring legally justified screening.

We will not request unnecessary sensitive information or undertake disproportionate background checks.

Access to sensitive information is restricted to authorised personnel with a legitimate need to process it.

7. How We Collect Information

We may obtain personal information:

• Directly from individuals through forms, applications and correspondence.
• Through CV submissions and candidate registrations.
• From employers and recruitment clients.
• From professional references and verification providers.
• From recruitment websites and job boards.
• From professional networking platforms.
• From publicly available professional or business information.
• Through lawful referrals.
• Through website technologies and analytics tools.

Where we obtain personal information indirectly, we provide the required privacy information within the applicable legal timeframe unless a lawful exception applies.

8. How We Use Personal Information

We use personal information for the following purposes.

Recruitment and Placement

To register candidates, assess suitability, match individuals with vacancies, arrange interviews, communicate about applications and facilitate employment placements.

Temporary Staffing and Assignment Management

To coordinate assignments, manage availability, maintain timesheets, administer payment arrangements and communicate with workers and clients.

Employer Services

To respond to recruitment enquiries, understand staffing requirements, prepare proposals, manage contracts and deliver recruitment services.

Compliance and Verification

To verify relevant qualifications, professional licences, right-to-work eligibility and other legally justified requirements.

Business Administration

To maintain records, respond to correspondence, process invoices, manage professional relationships, improve services and protect our business.

Marketing and Business Development

To communicate about relevant recruitment services, business opportunities and vacancies where legally permitted.

Legal and Regulatory Obligations

To comply with applicable employment, tax, immigration, regulatory and data protection requirements, and to establish, exercise or defend legal claims.

We do not process personal information for incompatible purposes without an appropriate lawful basis and any additional notice required by law.

9. Our Lawful Bases for Processing

We rely on the lawful basis appropriate to each processing activity.

These may include:

Contractual necessity: Where processing is necessary to perform a contract with an individual or take requested steps before entering into one.

Legal obligation: Where processing is required to comply with applicable legislation.

Legitimate interests: Where processing is necessary for our legitimate business interests or those of a third party, provided these are not overridden by individuals' rights and freedoms.

Consent: Where individuals freely agree to a specific processing purpose, including certain marketing or non-essential tracking activities.

Other lawful bases: Where another basis applies in limited circumstances, such as protecting vital interests.

Our principal activities and anticipated lawful bases include:

Activity — Lawful basis

General website enquiries — Legitimate interests or contractual necessity

Candidate sourcing and recruitment matching — Legitimate interests or contractual necessity, depending on circumstances

Temporary assignment administration — Contractual necessity, legitimate interests or legal obligation

Right-to-work checks — Legal obligation

Payroll and tax records — Contractual necessity and legal obligation

Employer relationship management — Contractual necessity or legitimate interests

Website security — Legitimate interests or legal obligation

Electronic marketing — Consent or legitimate interests where appropriate, subject to PECR

Non-essential advertising tracking — Consent

Additional conditions apply where special category or criminal offence information is processed.

Where consent is used, it may be withdrawn at any time without affecting earlier lawful processing.

10. Candidate Registration and Job Applications

When you register with Attop Group or apply for employment, we use your information to evaluate suitability for relevant positions.

We may review your CV, qualifications, experience, employment preferences, availability and relevant compliance information.

We may contact you about applications, interviews, suitable vacancies, required documents and assignment opportunities.

Submitting an application does not guarantee an interview, employment offer or placement.

Where we retain candidate information for future opportunities, we will identify an appropriate lawful basis and explain the relevant processing.

We aim to ensure that recruitment information is accurate, relevant and not excessive.

11. Sharing Candidate Information With Employers

As part of our recruitment services, we may share relevant candidate information with prospective employers and recruitment clients.

This may include CVs, employment history, qualifications, professional skills, availability and other information necessary to assess suitability.

We will share information only where an appropriate lawful basis and legitimate recruitment purpose exist.

Where appropriate, we will inform candidates before submitting identifiable details to a prospective employer.

Employers receiving candidate information may act as independent data controllers and have their own privacy obligations.

We do not sell candidate CVs or personal information to unrelated organisations for commercial resale.

12. Recruitment Screening and Verification

Depending on the position, recruitment screening may include:

• Identity verification.
• Right-to-work checks.
• Qualification and licence verification.
• Employment references.
• Relevant professional registration checks.
• Role-specific competency assessments.
• Security screening where justified.
• Criminal record checks where legally permitted.

Checks will be proportionate to the role and conducted under an appropriate lawful basis.

Where third-party screening providers are involved, we will assess the relevant data protection responsibilities and safeguards.

13. Security Recruitment and Vetting

Certain security assignments may require additional checks because of regulatory obligations, contractual requirements or the nature of the work.

These may include SIA licence verification, relevant training records, employment history, identity checks and appropriate security screening.

Where applicable, screening may be aligned with recognised industry standards, including BS 7858.

Any criminal offence information will be processed only where legally permitted and with appropriate safeguards.

Vetting information will be accessible only to authorised individuals with a legitimate operational need.

14. Temporary Workers and Contractors

Where individuals undertake assignments through Attop Group, we may process information relating to:

• Assignment details and work locations.
• Availability and shift schedules.
• Attendance and timesheets.
• Training and competency records.
• Pay and invoicing arrangements.
• Contractual information.
• Relevant health and safety requirements.
• Compliance records.
• Assignment-related communications.

Necessary information may be shared with the client organisation receiving the services.

We will limit such sharing to information reasonably required for the relevant assignment.

15. Employers and Business Clients

Where you represent an employer or business organisation, we may use your professional contact information to respond to staffing enquiries, manage recruitment requirements, provide quotations, deliver services and maintain commercial relationships.

We may also communicate about relevant recruitment services where permitted by UK GDPR and PECR.

Business contact information will not be treated as exempt from data protection requirements merely because it relates to professional activities.

16. Business Development and Public Information

We may identify prospective business clients using legitimate commercial research, including company websites, professional directories, recruitment advertisements, public business registers and professional networking platforms.

We will only process personal contact information where there is an appropriate lawful basis.

We will comply with applicable electronic marketing rules and respect objections to direct marketing.

Information being publicly available does not remove our obligations under data protection legislation.

17. Marketing Communications

We may send information about recruitment services, relevant vacancies or business opportunities where permitted by law.

Where consent is required, we will obtain valid consent.

Where marketing is permitted on another lawful basis, we will ensure that applicable PECR requirements are satisfied.

You may object to direct marketing at any time.

To opt out, contact:

info@attop.co.uk

Where applicable, marketing communications will include an unsubscribe or opt-out facility.

We will maintain appropriate records to ensure marketing objections are respected.

18. Website Cookies and Similar Technologies

Our website may use cookies and related technologies for functionality, security, analytics and advertising.

Cookies are small files or technologies used to store or access information on a visitor's device.

The categories of cookies used may include:

Strictly Necessary Cookies: Support essential website functions and security.

Functional Cookies: Remember preferences or support optional website functionality.

Analytics Cookies: Help measure website usage and improve performance.

Advertising Cookies: Support advertising measurement, campaign analysis or relevant marketing activities.

Where consent is required under PECR, we will obtain it before activating the relevant technology.

Certain limited uses may qualify for statutory exceptions where all applicable legal conditions are met.

Visitors may manage relevant preferences through the website's Cookie Settings facility.

Further information about actual cookies, providers, purposes and durations will be provided in our Cookie Policy.

19. Analytics and Advertising

We may use third-party analytics or advertising technologies to understand website performance and assess marketing effectiveness.

These may include services provided by Google, Meta, LinkedIn, Nextdoor or other platforms, where installed.

We will assess applicable consent requirements and data protection responsibilities before activating such technologies.

We will take appropriate steps to prevent sensitive recruitment information, uploaded CVs and confidential documents from being unnecessarily disclosed to advertising providers.

20. Sharing Information With Third Parties

Where necessary and lawful, personal information may be shared with:

• Prospective employers and recruitment clients.
• Organisations receiving temporary workers.
• Payroll and accounting providers.
• IT, hosting and software providers.
• Recruitment management system providers.
• Identity and qualification verification services.
• Relevant screening and compliance providers.
• Professional advisers.
• Regulators and public authorities.
• Law enforcement bodies where legally required or justified.
• Other service providers necessary for our operations.

We share only information relevant to the legitimate purpose.

Where a provider acts as our processor, we require appropriate contractual safeguards.

Where information is disclosed to an independent controller, that organisation has its own responsibilities under data protection law.

21. International Data Transfers

Some technology providers or business activities may involve personal information being transferred outside the United Kingdom.

Where this occurs, we will comply with applicable UK international transfer requirements.

Depending on the destination and circumstances, safeguards may include UK adequacy regulations, approved international data transfer agreements, the UK Addendum to relevant contractual clauses or another lawful mechanism.

Where required, we will assess transfer risks and implement appropriate protections.

Individuals may contact us for further information about applicable safeguards.

22. Information Security

We take appropriate technical and organisational measures to protect personal information against unauthorised access, loss, alteration, disclosure and destruction.

Depending on the processing activity, these measures may include:

• Secure website connections.
• Restricted system access.
• Appropriate authentication.
• Secure document storage.
• Confidentiality requirements.
• System maintenance and updates.
• Backup and recovery procedures.
• Secure handling of recruitment records.
• Incident response arrangements.

Security measures are reviewed according to the nature, sensitivity and risks of the information processed.

No electronic system can be guaranteed to be completely secure.

23. Data Retention

We retain personal information only for as long as necessary for the relevant purposes, including applicable legal, contractual and operational requirements.

Retention periods differ according to the type of information.

General enquiries: Retained for the period reasonably necessary to respond and manage any resulting relationship or dispute.

Candidate applications and CVs: Retained for relevant recruitment purposes and any justified period for future opportunities, compliance or legal claims.

Temporary worker records: Retained according to applicable employment, contractual, tax and legal requirements.

Right-to-work and vetting information: Retained according to the applicable legal requirements and justified operational needs.

Employer records: Retained for relevant business and contractual purposes and any additional period required by law.

Marketing information: Retained while the relevant lawful purpose continues, subject to withdrawal of consent, objections and suppression requirements.

Website information: Retained according to the relevant purpose, technical configuration and applicable cookie requirements.

We consider the nature of the information, legal requirements, business necessity, potential claims and risks when determining retention periods.

When information is no longer required, it will be securely deleted, anonymised or otherwise disposed of according to our retention procedures.

24. Your Data Protection Rights

Subject to applicable conditions and exemptions, you may have the following rights under UK data protection law:

Right to be informed: To understand how your information is processed.

Right of access: To request a copy of personal information held about you.

Right to rectification: To request correction of inaccurate or incomplete information.

Right to erasure: To request deletion in circumstances where the law provides this right.

Right to restrict processing: To request restrictions on certain uses of your information.

Right to data portability: To receive certain information in a structured, commonly used and machine-readable format where applicable.

Right to object: To object to certain processing activities, including processing based on legitimate interests.

Right to object to direct marketing: To stop the use of your personal information for direct marketing at any time.

Rights relating to automated decision-making: To receive applicable information and safeguards where relevant automated decisions have legal or similarly significant effects.

Right to withdraw consent: To withdraw consent where processing relies on it.

These rights are not all absolute, and certain legal exceptions may apply.

25. Exercising Your Rights

To exercise your data protection rights, please contact:

Email: info@attop.co.uk

Subject: Data Protection Request

We may request information reasonably necessary to verify your identity.

We will respond within the applicable legal timeframe, generally one calendar month, subject to lawful extensions, clarification provisions and exceptions.

We will not normally charge a fee, although the law permits fees or refusal in limited circumstances.

26. Automated Decision-Making and Profiling

Recruitment technology may be used to organise applications, search candidate records or assist with administrative assessments.

Where such tools are used, we will assess their fairness, accuracy, necessity and potential impact on individuals.

We will comply with applicable UK GDPR requirements and safeguards concerning automated decision-making, including relevant provisions amended by the Data (Use and Access) Act 2025.

Where additional information is legally required, we will provide it.

27. Accuracy of Personal Information

We take reasonable steps to maintain accurate and up-to-date personal information.

Candidates, workers and business contacts are encouraged to notify us when their details change.

Requests for corrections may be sent to info@attop.co.uk.

28. Children's Privacy

Our recruitment and staffing services are primarily intended for individuals seeking employment and organisations requiring workforce solutions.

We do not knowingly collect children's personal information unnecessarily.

Where information relating to individuals under 18 is processed, we will apply the protections and lawful requirements appropriate to the circumstances.

29. Third-Party Websites

Our website may contain links to external websites, including job boards, professional networking services and other business platforms.

These organisations may operate under their own privacy notices and data protection arrangements.

We encourage visitors to review the privacy policies of third-party websites before submitting personal information.

30. Personal Data Breaches

We maintain procedures for identifying, investigating and responding to suspected personal data breaches.

Where required by law, we will notify the Information Commissioner's Office and affected individuals within the applicable statutory timeframes.

We will take appropriate measures to contain incidents, mitigate risks and reduce the likelihood of recurrence.

31. Privacy Complaints

We take privacy concerns seriously.

If you believe your personal information has been handled improperly, please contact us at:

info@attop.co.uk

We will review your concern and respond in accordance with applicable legal requirements.

You also have the right to complain to the Information Commissioner's Office.

Information Commissioner's Office (ICO)

Website: www.ico.org.uk

Telephone: 0303 123 1113

We welcome the opportunity to address concerns directly.

32. Changes to This Privacy Notice

We may update this Privacy Notice to reflect changes in legislation, ICO guidance, technology, business operations or our processing activities.

The latest version will be available on our website.

Where changes materially affect how personal information is processed, we will provide additional information where required by law.

33. Contact Us

For any questions regarding this Privacy Notice, data protection, privacy rights or the handling of personal information, please contact:

ATTOP GROUP LIMITED

Registered Office:

65 Broadway

London

E15 4BQ

United Kingdom

Company Registration Number: 09943794

Email: info@attop.co.uk

Website: www.attop.co.uk

Attop Group Limited is committed to handling personal information responsibly, protecting individual privacy and maintaining the confidence of our candidates, employees, contractors, employers, clients and website visitors.

Attop Group Limited — Recruitment, Staffing and Workforce Solutions Across the United Kingdom.