Introduction

Optima Site Solutions (“we”, “us”, “our”) is a recruitment agency providing temporary, contract and permanent staffing services. We take the privacy and security of personal data seriously and are committed to complying with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 (DPA 2018), and guidance issued by the Information Commissioner’s Office (ICO).

This policy explains what personal data we collect, why we collect it, how we use it, who we share it with, and the rights available to you. It applies to:

• Candidates and work-seekers registered with us, or who apply for a role through us
• Contract and temporary workers we place with clients, including those engaged via umbrella or payroll companies
• Client contacts at organisations who hire through us (“end hirers”)
• Referees and emergency contacts provided by candidates
• Visitors to our website (see Section 15)

Who We Are

Optima Site Solutions is the data controller for the personal data described in this policy. Registered company name: Optima Site Solutions Ltd

Trading as: Optima Site Solutions Ltd Company number: 04236274

Registered office: Unit 5 Kingsway Business Park, Oldfield Road, Hampton, Middlesex, TW12 2HD ICO registration number: Z9861145

Data protection contact: James Cranston, Data Protection Officer — [email protected]

If you have any questions about this policy or how we handle your data, please contact us using the details above.

Scope of This Policy

As a recruitment agency, we act as data controller for the personal data of candidates and client contacts. Where we introduce a candidate to an end hirer, or where a worker is paid via a payroll or umbrella company, each organisation in that chain may also be an independent data controller for the data it holds. This policy explains our part of that chain. We encourage candidates to also review the privacy notices of any umbrella or payroll company, or end hirer, they are engaged by.

Personal Data We Collect:

Data We Collect From Candidates and Workers

• Identity and contact details (name, address, phone, email, date of birth)
• CV, employment history, qualifications, training records and skills
• Right to work documentation (passport, visa, share code, immigration status)
• National Insurance number, tax code and bank details (for payroll purposes)
• Referee details and references obtained
• Interview notes and assessment or test results
• Salary, day rate or contract rate expectations and history
• Availability and preferences (location, sector, working pattern)
• Communications between you and us (calls, emails, texts, portal messages)
• Where relevant to a role: driving licence details, professional body memberships, and security clearance status

Special Category Data

Where relevant to a role and permitted by law, we may also process:

• Criminal conviction and offence data, including DBS (Disclosure and Barring Service) check results, where a role requires vetting (for example, regulated activity with children or vulnerable adults, or client-mandated screening)
• Health information, where relevant to a reasonable adjustment request, occupational health referral, or role-specific fitness-to-work requirement
• Equality monitoring data (for example, ethnicity, disability, sexual orientation, religion), provided voluntarily and used only in anonymised or aggregated form for diversity monitoring unless you tell us otherwise
• Trade union membership, only if you disclose this to us directly (for example, in relation to a grievance or workplace matter)
• We only collect special category data where it is necessary and lawful to do so, and we apply extra safeguards to this data (see Sections 6.1, 7 and 10).

Data We Collect From Clients (End Hirers)

• Business contact details of individuals at client organisations (name, job title, work email, phone number)
• Role requirements, job specifications and feedback on candidates
• Contractual and commercial information relating to our services

How We Collect Your Data

• Directly from you — application forms, CV submission, registration calls, interviews, our website or careers portal
• From job boards and sourcing platforms (for example, Indeed, LinkedIn, Reed) where you have made your profile or CV available
• From referrals — colleagues, referees, other candidates
• From publicly available sources, such as professional networking sites or published company information
• From third parties involved in vetting — DBS, reference-checking services, credit reference agencies, occupational health providers — where you have consented or a role requires it
• From umbrella or payroll companies and end hirers, where necessary to administer a placement

Why We Process Your Data and Our Legal Basis

We rely on the following legal bases under Article 6 UK GDPR:

Special Category and Criminal Records Data

Where we process criminal records or special category data, we rely on one or more of the following conditions under Article 9 UK GDPR and Schedule 1 of the DPA 2018:

• Employment, social security and social protection (Schedule 1, Part 1)
• Substantial public interest conditions — for example, preventing or detecting unlawful acts, or safeguarding of children and vulnerable individuals (Schedule 1, Part 2)
• Your explicit consent, where no other condition applies
• Where we rely on a Schedule 1 condition, we maintain an appropriate policy document setting out our retention and deletion practices for this data, as required by the DPA 2018.

Criminal Record (DBS) Checks

Where a role requires it, we carry out or facilitate Disclosure and Barring Service (DBS) checks, or equivalent checks in Scotland (Disclosure Scotland) or Northern Ireland (AccessNI), as part of our vetting process. We:

• Only request the level of check (Basic, Standard or Enhanced) that is appropriate and proportionate to the role
• Handle DBS certificate data in line with the DBS Code of Practice
• Restrict access to DBS results to staff who need it to make a recruitment decision
• Do not retain DBS certificates for longer than necessary, and do not store scanned copies beyond the period recommended by the DBS Code of Practice, retaining only the outcome or reference where necessary (see Section 11)
• Will discuss the content of any check with you before making a decision that may affect your engagement, where relevant

Who We Share Your Data With

We share personal data with the following categories of recipients, only where necessary:

• End hirers (clients): your CV, application and relevant vetting outcomes are shared with prospective and confirmed end hirers so they can assess your suitability for a role and, where placed, manage your assignment.
• Umbrella companies and payroll providers: where you are engaged via an umbrella company, or we operate PAYE payroll on your behalf, we share the data necessary to process your pay, tax and pension contributions (for example, name, NI number, bank details, hours worked).
• DBS and background screening providers: where vetting is required, we share relevant identity and application data with our DBS umbrella body or screening provider.
• Reference providers: we may contact referees you have nominated to verify your employment history and suitability.
• Job boards and sourcing platforms: where you apply through, or we advertise via, third-party job boards, limited data may be shared to manage applications.
• IT, CRM and cloud service providers: we use third-party customer relationship management (CRM) and back-office systems to store and manage candidate, worker and client data on our behalf, currently Firefish (candidate and client CRM), Seven20 (recruitment back-office and pay & bill), and Timesheet Portal (timesheet management). These providers act as data processors under contract and are only permitted to process data on our instructions.
• Professional advisors and regulators: solicitors, auditors, insurers, and regulatory or law enforcement bodies, where required by law or to protect our legitimate interests.
• Prospective buyers of the business: in the event of a sale, merger or restructuring of Optima Site Solutions, data may be transferred as part of that transaction, subject to appropriate confidentiality safeguards.
• We do not sell personal data to third parties.

International Data Transfers

At present, Optima Site Solutions does not store or transfer personal data outside the UK or European Economic Area (EEA). All of our systems, including our CRM, are hosted within the UK/EEA.

If this changes — for example, if we adopt a new supplier that stores data outside the UK/EEA — we will only transfer data where an adequate level of protection is in place, such as:

• A UK adequacy regulation covering the destination country, or
• Appropriate safeguards, such as the UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses
• We will update this policy to reflect any such change before it takes effect.

How We Store and Protect Your Data

We store personal data primarily in our CRM system and take appropriate technical and organisational measures to protect it, including:

• Access controls and role-based permissions, so only staff who need data to do their job can access it
• Encryption of data in transit and, where supported by our systems, at rest
• Confidentiality agreements and data protection training for staff
• Contracts with all processors (including our CRM and IT providers) requiring them to meet UK GDPR security standards
• Regular review of access rights and removal of access when no longer needed
• Restricted, time-limited access to special category and criminal records data (see Sections 6.1 and 7)
• We maintain a data breach response procedure and will notify the ICO within 72 hours of becoming aware of a breach likely to result in a risk to individuals’ rights and freedoms, and will notify affected individuals directly where required by law.

How Long We Keep Your Data

Retention periods reflect statutory limitation periods (for example, under the Limitation Act 1980) and sector guidance, including the Conduct of Employment Agencies and Employment Businesses Regulations 2003. Data is securely deleted or anonymised once no longer needed.

Your Rights

Under UK GDPR, you have the right to:

• Be informed about how we use your data (this policy)
• Access a copy of the personal data we hold about you
• Rectification of inaccurate or incomplete data
• Erasure of your data in certain circumstances (the “right to be forgotten”)
• Restrict processing in certain circumstances
• Data portability, where processing is based on consent or contract and carried out by automated means
• Object to processing based on legitimate interests, and to direct marketing at any time
• Not be subject to solely automated decision-making with legal or similarly significant effect (see Section 13)
• Withdraw consent at any time, where processing is based on consent, without affecting the lawfulness of processing before withdrawal
• To exercise any of these rights, contact James Cranston, our Data Protection Officer, at [email protected]. We will respond within one month, as required by law, and will not normally charge a fee.

Automated Decision-Making

We do not currently use fully automated decision-making (without human involvement) to make decisions about candidates that have a legal or similarly significant effect, such as automatically rejecting an application without human review. If this changes, we will update this policy and explain the logic involved and your rights in relation to it.

Marketing Communications

We may contact you by email, phone or text about job opportunities and our services, relying on our legitimate interests as a recruitment business, or the “soft opt-in” exemption under the Privacy and Electronic Communications Regulations (PECR) where you have previously engaged with us. You can opt out of marketing communications at any time by

clicking “unsubscribe” on any marketing email, or by contacting us at [email protected].

Opting out of marketing will not affect our ability to contact you about an active application or assignment.

Our Website and Cookies

If you visit our website, we may use cookies and similar technologies to operate the site and understand how it is used. Where cookies are not strictly necessary, we will ask for your consent in line with PECR before setting them.

How to Complain

If you have concerns about how we handle your personal data, please contact James Cranston, our Data Protection Officer, at [email protected] so we can try to resolve the issue.

You also have the right to complain to the Information Commissioner’s Office (ICO):

Website: ico.org.uk/make-a-complaint

Helpline: 0303 123 1113

Address: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

Changes to This Policy

We may update this policy from time to time to reflect changes in our practices or legal requirements. The current version will always be available on request from James Cranston at [email protected], or at www.optimasitesolutions.com, and dated below.

Contact Us

Optima Site Solutions Ltd

Unit 5 Kingsway Business Park, Oldfield Road, Hampton, Middlesex, TW12 2HD [email protected]

0208 783 9222