Privacy Policy
1. Introduction and Controller
Cavendish House Recruitment LLP and Cavendish House Operations LLP (“Cavendish Maine”, “we”, “us”, “our”) are committed to protecting your personal data and to being transparent about how we collect and use it under the UK GDPR and the Data Protection Act 2018. This notice explains how we process data about candidates, clients, suppliers, and other contacts. The person responsible for data protection is Nick Hester, Managing Partner. He can be contacted using gdpr@cavendishmaine.com
2. Categories of Personal Data We Collect
We collect personal data directly from you (e.g. CVs, application forms, email, phone) and from third parties or publicly available sources. Categories include:
• Identity & contact information (name, address, email, phone);
• Professional information (employment history, qualifications, skills);
• Publicly available professional profiles, including LinkedIn and other online sources;
• Technical and website usage data (cookies).
LinkedIn and Public Profile Data We may collect or process professional data that you make publicly available on LinkedIn or other online platforms as part of our recruitment services. This includes information such as your current and past roles, skills, education, and professional interests. We rely on our legitimate business interests to use this publicly available data to match candidates with suitable opportunities and to contact you about relevant roles — in line with what you would reasonably expect when you publish professional information for networking and recruitment purposes. We do not access LinkedIn through automated scraping tools or violate LinkedIn’s terms of service. (See Lawful Bases below.)
3. How and why we use your data
We use personal data to:
• Register and manage candidates, clients, and suppliers.
• Assess candidate suitability and match candidates with job opportunities.
• Communicate with you about roles, services, or requests.
• Provide recruitment services and fulfil contractual obligations.
• Comply with legal and regulatory requirements.
4. Lawful Bases for Processing
We process personal data under the following lawful bases:
• Legitimate interests: to operate our recruitment business, including sourcing, assessing, and introducing candidates to clients; maintaining a relevant talent pool; and improving our services where these interests do not override your rights. This includes processing professional data from LinkedIn and other public sources.
• Performance of a contract: where you enter into a service engagement with us.
• Legal obligation: for compliance with applicable laws and regulatory requirements.
• Consent: where explicitly required (e.g. some pre-employment checks).
5. Sharing Your Data
We share personal data with:
• Clients and their agents to consider candidates for suitable roles (with your consent where required);
• Service providers and processors (e.g. IT, background checks) subject to contractual security safeguards;
• Authorities where required by law.
6. Retention
We retain personal data only for as long as necessary for legitimate business purposes or to meet legal requirements.
7. Your Rights
Under UK GDPR, you have rights including:
• Access to your data;
• Correction of inaccurate data;
• Erasure (where there is no overriding legitimate basis to retain);
• Restriction or objection to processing (including processing based on legitimate interests);
• Data portability.
To exercise your rights or object to processing (including LinkedIn/public profile processing), contact gdpr@cavendishmaine.com. You can also complain to the UK Information Commissioner’s Office.
8. Cookies and Website Tracking
We will take all steps reasonably necessary to ensure that your information is treated securely and in accordance with this Privacy Notice.
9. Changes to this Policy
We may update this policy, with the latest version posted on our website.
10. Contact
Questions, comments, and requests regarding this Privacy Notice are welcomed and should be addressed to gdpr@cavendishmaine.com