Candidate Privacy Notice

1. Who We Are

Illuminex Ltd, trading as Illuminex Consultancy, is a recruitment and executive-search business providing work-finding services to clients and candidates.

For the purposes of applicable UK data protection law, Illuminex Ltd is the controller of the personal information described in this notice.

Company Name: Illuminex Ltd
Trading Name: Illuminex Consultancy
Company Number: 16961631
Registered Office: First Floor, Embsay Mill, Embsay, Skipton, North Yorkshire, BD23 6QR
Email: hello@illuminex.co.uk
ICO Registration Number: ZC161884

2. Scope of This Notice

This notice applies when we are helping you find work, considering you for an opportunity, managing an application, maintaining a professional relationship with you, or identifying you as a potential candidate through a lawful source.

It should be read alongside our general Privacy Policy and Cookie Policy. Where this notice provides more specific information about candidate and recruitment processing, this notice takes priority for that processing.

3. Our Privacy Commitment

We are committed to processing personal information lawfully, fairly and transparently under the UK General Data Protection Regulation, the Data Protection Act 2018, the Data (Use and Access) Act 2025 and other applicable UK legislation.

We collect only information that is reasonably relevant to our recruitment and work-finding services. We do not sell candidate information.

4. Personal Information We May Collect

Depending on the services involved, we may collect:

• your name, address, email address and telephone number;
• your CV, employment history, education, qualifications, skills, experience and professional memberships;
• your current and expected remuneration, notice period, availability, location and work preferences;
• application history, interview information, assessment information, client feedback and communications with us;
• identity, right-to-work, eligibility, reference and suitability information;
• information provided by clients, referees, former employers, job boards, professional networks and screening providers;
• account, login, communication and preference information generated through our website, candidate portal or recruitment systems;
• technical information such as IP address, browser, device and security information where relevant to the use and protection of our online services;
• information required to comply with legal, regulatory, contractual or professional obligations.

5. Special Category and Criminal-Offence Information

Where it is relevant and lawful, we may process special category personal information, such as information about health, disability, racial or ethnic origin, religious or philosophical beliefs, trade-union membership, sexual orientation or other diversity information.

We may process criminal-conviction or offence information only where it is necessary and lawful, including where a role is subject to appropriate vetting or safeguarding requirements.

We identify an Article 6 lawful basis and, where required, an additional Article 9 condition or a condition under Schedule 1 of the Data Protection Act 2018 before carrying out this processing. We maintain additional safeguards and documentation where the law requires them.

6. How We Obtain Your Information

We may obtain information:

• directly from you when you register, apply for a role, upload a CV, update your profile or contact us;
• from job boards, recruitment platforms, professional networking services and publicly available professional or corporate sources;
• through referrals, recommendations or talent-search activity;
• from clients, former employers, referees, qualification bodies and screening or verification providers;
• from your interaction with our website, candidate portal, communications and recruitment services.

Where we obtain your information from another source, we will provide or make available the relevant privacy information within the period required by law, unless a lawful exemption applies.

7. Why We Use Your Information

We may use candidate information to:

• create, maintain and update your candidate profile;
• provide recruitment, executive-search and work-finding services;
• assess your experience, suitability, availability and preferences;
• contact you about potentially relevant opportunities;
• process and manage job applications;
• discuss opportunities with you and, where agreed, introduce you to clients;
• arrange interviews, obtain feedback and communicate decisions;
• verify identity, right to work, qualifications, references or other suitability information where necessary;
• maintain accurate recruitment, compliance and communication records;
• respond to enquiries, rights requests, complaints and legal claims;
• protect our systems and prevent or investigate fraud, misuse, spam, abuse or unlawful activity;
• comply with legal, regulatory, contractual and professional obligations;
• improve our recruitment services, systems and candidate experience.

8. Our Lawful Bases

Contract or steps before entering a contract

We may process information where this is necessary to provide services you have requested, manage an application or take steps connected with a potential engagement.

Legitimate interests

We may process information where this is necessary for our legitimate interests in operating a recruitment business, maintaining candidate relationships, matching candidates with appropriate opportunities, administering and protecting our systems, managing our business and improving our services. We consider and balance those interests against your rights and reasonable expectations.

Legal obligation

We may process information where necessary to comply with employment-agency, immigration, tax, equality, safeguarding, regulatory or other legal obligations.

Consent

We rely on consent where you are given a genuine and optional choice, such as certain email or SMS communications, or where explicit consent is an appropriate condition for particular special category information. You may withdraw consent at any time. Withdrawal does not affect processing already carried out lawfully, and we may continue processing where another lawful basis applies.

9. Candidate Introductions and Client Sharing

We will not send your CV or disclose your identity to a client for a specific opportunity without first discussing that opportunity with you and obtaining your agreement, unless disclosure is required by law.

We may use limited or anonymised information when discussing general market availability, provided that it does not identify you.

10. Information Required by Law or Contract

Certain information may be required by law, by a client requirement, by contract, or in order to enter into a contract. This may include identity, right-to-work, suitability, qualification, experience, reference or safeguarding information.

Where required information is not provided or cannot be verified, we may be unable to introduce you to a client, progress an application or provide a particular work-finding service.

11. Job Alerts, Industry News and Service Messages

You may separately choose to receive industry news, recruitment updates or alerts about potentially relevant roles by email or SMS. These choices are optional and are not required in order to register, apply for a role or receive our core recruitment services.

You may withdraw consent or opt out at any time by using any unsubscribe facility provided, updating available preferences or contacting us at hello@illuminex.co.uk.

We may still send service messages that are reasonably necessary to manage your registration, application, candidate account or an active recruitment process.

12. Who We May Share Information With

Where necessary and lawful, we may share information with:

• prospective employers and clients in connection with agreed opportunities;
• referees, former employers, qualification bodies and professional-registration bodies;
• identity, right-to-work, background, reference or suitability-checking providers;
• recruitment CRM and applicant-tracking system providers;
• website, cloud-hosting, email, communications, document-storage, analytics, IT-support and cybersecurity providers;
• professional advisers including accountants, auditors, insurers and solicitors;
• regulators, government bodies, courts, law-enforcement organisations and public authorities where required;
• another organisation involved in a merger, acquisition, restructuring or transfer of business, subject to appropriate confidentiality and data-protection safeguards.

We share only information that is reasonably necessary for the relevant purpose. We do not sell candidate information.

13. International Transfers

Some service providers, clients or systems may process or permit access to personal information from outside the United Kingdom.

Where this amounts to a restricted international transfer, we will use an appropriate lawful mechanism, which may include UK adequacy regulations, the UK International Data Transfer Agreement, the UK Addendum to approved contractual clauses or another permitted safeguard. Where required, we will assess the protection available and apply additional safeguards.

14. Where Candidate Information Is Stored and Protected

Candidate information held within our recruitment CRM is hosted using Microsoft Azure infrastructure in European data centres.

The recruitment system uses safeguards including encryption at rest, secure HTTPS transport over public networks, access controls, restricted administrative access, monitoring and backup arrangements.

We also apply appropriate organisational measures, including restricted user permissions, account security, confidentiality requirements and proportionate internal controls. No online or information storage system can be guaranteed to be completely secure, but we take reasonable steps designed to protect personal information against loss, misuse, unauthorised access, alteration and disclosure.

15. How Long We Keep Information

We retain personal information only for as long as it is reasonably necessary for the purposes described in this notice.

The appropriate retention period will depend on factors including whether we are actively providing recruitment or work-finding services to you, the date of our last meaningful contact or recruitment activity, whether your information remains accurate and relevant, the nature of any application or engagement, and applicable legal, regulatory, contractual, insurance or professional requirements.

Relevant work-seeker records required under the Conduct of Employment Agencies and Employment Businesses Regulations 2003 will be retained for at least the applicable statutory minimum period. Certain placement, financial, tax, compliance, complaint and legal-claim records may need to be retained for longer where required or permitted by law.

We periodically review inactive candidate records. Where information is no longer needed for a genuine recruitment, legal or compliance purpose, it will be deleted, anonymised or otherwise placed beyond normal operational use.

A candidate record may be retained for longer where we continue to have an active professional relationship with you, are providing ongoing work-finding services, or have another lawful and documented reason for retaining it. You may contact us at any time to ask us to review the information we hold about you.

16. Automated Decision-Making

We do not currently make recruitment decisions about candidates solely through automated processing where the decision would have a legal or similarly significant effect.

We may use technology to support searching, matching, administration or analysis, but material recruitment decisions involve human consideration. We will update this notice and provide any additional information required by law before introducing significant solely automated decision-making.

17. Your Data Protection Rights

Depending on the circumstances and the lawful basis being used, you may have the right to:

• be informed about how your personal information is collected and used;
• request access to your personal information;
• request correction of inaccurate or incomplete information;
• request erasure in certain circumstances;
• request restriction of processing;
• receive certain information in a portable format in applicable circumstances;
• object to processing based on legitimate interests;
• object to direct marketing at any time;
• withdraw consent at any time;
• request information about applicable safeguards for international transfers;
• raise a complaint about how your personal information has been handled.

You have an absolute right to object to direct marketing.

To exercise a right, email hello@illuminex.co.uk. We may need to verify your identity before responding. Some rights are subject to legal conditions and exemptions.

18. Data Protection Complaints

You can make a data protection complaint by emailing hello@illuminex.co.uk. Please explain what has happened and provide any information reasonably needed to investigate the complaint.

We will:

• acknowledge receipt within 30 days;
• take appropriate steps to investigate and respond without undue delay;
• keep you informed where appropriate; and
• communicate the outcome of our investigation without undue delay.

You may also complain to the Information Commissioner's Office.

ICO Helpline: 0303 123 1113
ICO Website: Make a complaint to the ICO

19. Changes to This Notice

We may update this notice to reflect changes in law, our services, our suppliers or the way we process personal information. Where a change materially affects how we use candidate information, we will take reasonable steps to bring it to your attention before beginning the new processing. The latest version will remain available on this page.