Privacy Policy

Last updated: 29 September 2025 – updated to reflect the Data (Use and Access) Act 2025

Carrington West Limited (“Carrington West”, “we”, “our”, “us”) is committed to protecting the privacy and security of your personal data. This Privacy Policy explains how we collect, use, disclose and safeguard your information when you interact with us, in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and other applicable privacy laws.

If you have any questions about this notice or how we process your personal data, please contact us at: privacy@carringtonwest.com or contact Ella Razzell – Ella.Razzell@carringtonwest.com | 023 9387 6006.

1. Who we are

Carrington West is an award-winning recruitment company, founded in 2011, providing technical talent across multiple UK industries including highways, transport & infrastructure, town planning, property, water & environmental, nuclear, buildings & architecture, and rail.

We act as a data controller when handling your personal data for recruitment, business operations, and website interactions.

We comply with the Conduct of Employment Agencies and Employment Businesses Regulations 2003, immigration and tax legislation, and safeguarding requirements.

2. What personal data we collect

We may collect and process the following categories of personal data:

•Candidates: Name, contact details, CVs, employment history, qualifications, right-to-work documentation, salary expectations, interview notes, reference details, National Insurance number, nationality, proof of address, driving licence details, and date of birth.

•Sensitive personal data: Health information (including disabilities), ethnicity, and criminal conviction data where legally required.

•Clients: Contact details, job role, company information, and communications.

•Suppliers/partners: Business contact details, bank details for payments, and contractual information.

•Website users: Technical data (IP address, browser type, device identifiers), cookies, and online behaviour when using our website.

•Other data: Any personal information you voluntarily provide when contacting us.

We may also collect your data from job boards, LinkedIn, former employers, referees, and software providers we use to support our services.

3. How we use your personal data

We process your data only when we have a lawful basis to do so, including:

•Recruitment services: Matching candidates with job opportunities, processing job applications, and communicating with you.

•Client and supplier management: Maintaining business relationships, fulfilling contractual obligations, and providing recruitment services.

•Legal compliance: Verifying identity, right-to-work checks, safeguarding obligations, and record-keeping.

•Website operations: Improving functionality, security monitoring (including Cyber Essentials), and analysing site performance.

•Marketing (where permitted): Sending you recruitment news, job alerts, or business updates, always with the option to opt out. If you have opted in, we may send you marketing information and news by email or text. You can opt out at any time by clicking unsubscribe.

4. Legal bases for processing

We rely on one or more of the following legal bases under UK GDPR and the Data (Use and Access) Act 2025 when processing personal data:

•Performance of a contract or taking steps prior to entering into a contract.

•Compliance with legal obligations, including employment, tax, and safeguarding requirements.

•Legitimate interests, such as providing recruitment services, maintaining business operations, improving service delivery, and utilising AI technologies (including Carv) where appropriate safeguards and human oversight are in place.

•Consent, where required, for example in relation to certain marketing communications.

5. How we share your personal data

We may share your information with:

•Prospective employers, clients, and candidates (with your knowledge).

•Service providers such as IT, payroll, compliance, and database providers.

•Regulatory bodies, auditors, and government authorities where legally required.

•Professional advisers (legal, financial, insurance). We do not sell your personal data.

6. International transfers

Where personal data is transferred outside the UK/EEA, we ensure appropriate safeguards are in place (e.g., UK-approved Standard Contractual Clauses or adequacy decisions).

7. Data retention

We will keep your data only for as long as necessary to fulfil the purposes we collected it for, including legal, regulatory, and reporting requirements.

• Candidate data: up to 3 years after last contact (unless required longer by law or consent is renewed).

• Client and supplier data: up to 7 years after contract end (to comply with accounting and legal requirements).

• Marketing data: until you withdraw consent or unsubscribe.

• Additional retention: Work-seeker records are kept for at least one year from the date of creation or after we last provide work-finding services. Payroll and compliance records (e.g., holiday pay, HMRC) are retained for 3–6 years.

8. Your rights

You have the following rights under UK GDPR:

• Right to be informed – about how we use your data.

• Right of access – request a copy of your personal data.

• Right to rectification – correct inaccurate or incomplete data.

• Right to erasure – request deletion of your data (where applicable).

• Right to restrict processing – limit how your data is used.

• Right to data portability – obtain and reuse your data.

• Right to object – to processing based on legitimate interests or direct marketing.

• Rights related to automated decision-making and profiling.

To exercise these rights, please contact us at: privacy@carringtonwest.com.

You also have the right to lodge a complaint with the Information Commissioner’s Office (ICO) at www.ico.org.uk or call 0303 123 1113.You can also raise complaints internally with Ella Razzell at Ella.Razzell@carringtonwest.com before contacting the ICO.

9. Data security

We take appropriate technical and organisational measures to safeguard your personal data against loss, misuse, unauthorised access, disclosure, alteration, and destruction.

• We are accredited with ISO 9001:2015, ISO 14001:2015, ISO 27001:2013, and hold Cyber Essentials certification.

• Access to personal data is restricted to authorised personnel only.

10. Cookies

Our website uses cookies and similar technologies to improve user experience, monitor traffic, and ensure security. For full details, please see our Cookie Policy.

11. Changes to this Privacy Policy

We may update this Privacy Policy from time to time. Any changes will be posted on this page with a revised “last updated” date. This policy was updated in September 2025 to reflect the introduction of the Data (Use and Access) Act 2025, including changes relating to automated decision-making, subject access requests, cookies, international transfers, and complaints procedures.

12. Data (Use and Access) Act 2025

On 20 August 2025, key provisions of the Data (Use and Access) Act 2025 (DUUUA) came into force. This legislation amends but does not replace existing UK data protection laws. Key changes relevant to recruitment businesses include:

• Automated decision-making: widening the lawful reasons for using personal data to make automated decisions (including AI), provided appropriate safeguards are in place.

• Subject access requests (SARs): clarifies that businesses only need to carry out reasonable and proportionate searches when individuals request access to their data.

• Cookies: certain cookies can be set without consent, such as those used for statistical purposes or improving website functionality.

• Simplified wording: clarifies existing provisions, including confirming that direct marketing may be a legitimate interest, and rephrases the rules for international transfers of personal data.

• Complaints handling: introduces a legal requirement for businesses to provide an accessible complaints process for concerns about misuse of personal data. Businesses must acknowledge complaints within 30 days and respond without undue delay.

Carrington West has updated its Privacy Policy and complaints procedures to reflect these changes.

13 . Use of Artificial Intelligence (AI) and Call Recording

Carrington West utilises artificial intelligence (AI) solutions, including Carv, to enhance recruitment and business operations. This may involve the recording and analysis of Teams meetings and telephone calls to ensure accurate record-keeping, improve service delivery, and support recruitment processes. The use of AI is undertaken strictly in accordance with applicable data protection legislation, including the UK GDPR, the Data Protection Act 2018, and the Data (Use and Access) Act 2025. Appropriate safeguards are implemented to protect individuals’ rights and freedoms, including human oversight of automated decision-making, data minimisation, security measures, and restricted access protocols. Our use of AI technologies is subject to ongoing review to ensure transparency, fairness, and continued compliance with legal and regulatory requirements.

14. Contact us

If you have any questions or concerns about this Privacy Policy or how we handle your personal data, please contact us:

• Email: privacy@carringtonwest.com

• Contact person: Ella Razzell – Ella.Razzell@carringtonwest.com | 023 9387 6006