Privacy Notice.

This Privacy Notice explains what personal data we collect, why we collect it, how we use it, who we may share it with, how long we keep it, and what rights you have in relation to it.

This notice is written to comply with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, the Privacy and Electronic Communications Regulations 2003 (PECR), and other applicable data protection legislation.

This notice does not cover how personal data is used by an organisation that employs you or hires your services, an organisation you are introduced to through us, or any umbrella company or personal service company involved in supplying your services through us. In those cases, the relevant organisation's own privacy notice will apply.

Our services are not directed at children and we do not knowingly collect personal data relating to anyone under 18.

Who we are

Creation Recruitment Limited is the data controller for personal data collected and processed under this Privacy Notice.

What personal information we collect

If you are a candidate looking for a role

We may identify potential candidates through LinkedIn, job boards, referrals, public professional profiles, or our existing network. However, we do not collect or store personal data about you unless we have a lawful basis to do so and a genuine reason to engage with you in the context of our recruitment services.

This may include situations where you have contacted us directly, responded to a role we have advertised, replied to a message from one of our team, been introduced to us through our network, or asked us to keep in touch about future opportunities.

In those circumstances, we will typically collect:

• Name, address, phone number and email address
• Current and previous employment details, including job title and employer
• Professional certifications relevant to the roles you are seeking
• Education and qualifications
• Professional skills
• Salary or day rate expectations
• Right-to-work status and citizenship
• Information included in your CV, portfolio, application or professional profile
• Relevant information from publicly available professional profiles or job boards, where you have made this available
• References from previous employers or professional contacts
• Email communications and attachments, such as CVs, portfolios and supporting documents

We will only collect copies of passports, visas, share codes or other right-to-work documentation where required, usually when you are being placed in a role. We do not routinely collect health data, diversity data or criminal record information. We do not collect or hold DBS information.

If you are placed in a contract or consultancy role through us

If you secure a contract or consultancy assignment through us, we may also collect contract, assignment, timesheet and rate information, details of your limited company, personal service company or umbrella company, invoices and payment information, bank details where required to process payment, and information needed to administer the contract and comply with legal, tax and accounting obligations.

If you are a client looking to hire

We collect your work contact details and enough context about your organisation and hiring requirements to provide our recruitment services. This may include name, job title, work address, phone number and email address, details of your recruitment requirements, details of your organisation, team structure and hiring plans, feedback you share with us regarding candidates, and communications between you and Creation Recruitment.

If you are providing a reference

We collect your basic work contact details so we can contact you in your capacity as a referee. This may include name, job title, work address, email address and telephone number.

How we collect your information

We collect personal information through:

• Direct contact from you by phone, email, video call or in person
• Your response to a role we have advertised on a job board, LinkedIn or another platform
• A reply to a message or InMail from one of our team
• An introduction through our network
• Your use of our website
• Documents you provide to us, such as CVs, portfolios, transcripts, invoices or contracts
• Information you make publicly available on professional platforms, where relevant to recruitment

We also collect limited technical data when you browse our website, using cookies and similar technologies. See Section 9 for details.

How we use your information and our lawful basis

Candidates

We use candidate information to understand your skills, experience, interests and career plans, match you to relevant opportunities, contact you about roles we believe may interest you, provide recruitment-related advice and support, discuss specific opportunities with you, submit your CV or profile to client organisations (but only with your specific prior agreement), manage interview processes and client feedback, keep in touch where you have asked to remain in our network, send salary benchmarking reports or newsletters where you have opted in, verify your right to work where required, and comply with legal and regulatory obligations.

Our lawful basis for this processing is usually:

We will never submit your CV, profile or personal details to a client without your specific prior agreement for that opportunity.

Contractors and consultants

Where you work through us on a contract or consultancy basis, we use your information to administer the contract or assignment, manage timesheets, invoicing and payment, comply with legal, tax and regulatory obligations, and maintain appropriate business records. Our lawful basis is usually Article 6(1)(b) (contractual necessity), Article 6(1)(c) (legal obligation), and Article 6(1)(f) (legitimate interests).

Clients

We use client contact information to provide recruitment services, discuss hiring requirements, introduce relevant candidates where agreed, manage business relationships, and comply with legal and regulatory obligations. Our lawful basis is usually Article 6(1)(b) and Article 6(1)(f) UK GDPR.

Referees

We use referee information to contact you about a candidate who has named you as a referee, and to record and share reference information where appropriate. Our lawful basis is Article 6(1)(f) UK GDPR.

Use of AI and similar tools

We may use secure AI tools or CRM-based automation features to help with administrative tasks, such as summarising CVs, interview notes, transcripts, or other candidate or client information. Where we do this, we use tools that operate within appropriate security and confidentiality controls.

No decisions about candidates are made by AI. We do not use AI to automatically reject candidates, rank candidates, shortlist candidates, or decide whether someone is suitable for a role. Any AI-generated output is reviewed by a member of our team before it is used. All candidate-related decisions are made by people at Creation Recruitment.

We aim to use AI tools responsibly and only where appropriate. We do not knowingly use tools that train public models on our confidential candidate, client or business data.

How long we keep your information

We retain personal data only for as long as necessary for the purpose for which it was collected, or as required by law.

Candidates in our network

Many of the candidates we work with are senior professionals who may remain in a role for several years before considering another move. Where you have asked to remain in our network, or where we have an ongoing professional relationship with you, we may retain your details so we can keep in touch about relevant opportunities. We review candidate records at least annually. You can ask us to remove your details from our active candidate network at any time, unless we need to retain them for legal or compliance reasons.

Candidates considered for a specific role

If you apply for, or are considered for, a specific role but are not placed, we will usually retain basic contact and role-related information for up to two years, unless you ask us to delete it sooner or we have a legal reason to retain it for longer.

Placed candidates and contractors

Where you are placed in a permanent, contract or consultancy role, we may retain relevant placement, contract, payment, accounting and compliance records for up to seven years, in line with our legal and regulatory obligations.

Client and referee data

We retain client contact data for the duration of our business relationship and for a reasonable period afterwards. We retain referee data only for as long as necessary to complete the relevant reference check and maintain appropriate recruitment records.

We will delete your information sooner than these periods if you ask us to and there is no legal or legitimate business reason to retain it.

Who we share your information with

We share personal information only where necessary and appropriate. This may include sharing information:

• With client organisations, but only where a candidate has given specific prior agreement for their details to be submitted for a particular opportunity
• With umbrella companies or personal service companies, where relevant to a contract or consultancy assignment
• With Recruitment Process Outsourcers or Managed Service Providers engaged by our clients, where relevant to a recruitment process and with the candidate's knowledge
• With third-party service providers who support our operations, such as IT providers, CRM providers, Microsoft 365, Adobe Acrobat Sign, and payment processors
• With professional advisers, such as accountants, lawyers or insurers, where necessary
• Where required by law, court order, regulation, or to establish, exercise or defend legal claims

We do not sell personal data. We do not share your personal data with third parties for their own marketing purposes.

International transfers

Some of the software providers we use may process personal data outside the United Kingdom. Where this happens, we will only use providers where appropriate safeguards are in place, such as a UK adequacy regulation, an International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, or another legally recognised transfer mechanism.

We use a customer relationship management system, Microsoft 365, Adobe Acrobat Sign and other secure business systems to manage candidate records, client data and business operations.

Cookies and website tracking

Our website uses cookies and similar technologies. Some cookies are strictly necessary for the website to work properly and do not require your consent. We may also use analytics cookies to understand how visitors use our website and to improve the site. Analytics cookies will only be used where you have given your consent.

When you first visit our website, you will be given the option to accept, reject or manage non-essential cookies. You can change your cookie preferences at any time.

We do not currently use advertising pixels, remarketing cookies or similar tracking technologies. If this changes, we will update this Privacy Notice and our cookie notice accordingly.

Security

We take reasonable and appropriate technical and organisational measures to protect personal information from loss, misuse, unauthorised access, alteration or disclosure. These include secure business systems, access controls, password protection, multi-factor authentication where appropriate, appropriate supplier checks, staff awareness and internal procedures, and processes for identifying and responding to suspected data breaches.

If you suspect any misuse, loss or unauthorised access to your information, please contact us immediately at info@creationrecruitment.co.uk.

Your rights

Under UK data protection law, you have the following rights in relation to your personal data:

• Right of access — you can request a copy of the personal information we hold about you
• Right to rectification — you can ask us to correct inaccurate or incomplete information
• Right to erasure — you can ask us to delete your information where there is no good reason for us to continue holding it
• Right to object — you can object to processing based on legitimate interests
• Right to restriction — you can ask us to suspend processing of your information in certain circumstances
• Right to portability — where processing is based on consent or contract and carried out by automated means, you can ask us to provide your data in a structured, commonly used format
• Right to withdraw consent — where processing is based on consent, you can withdraw it at any time

We do not make decisions about candidates using solely automated processing. We will not charge a fee to action any of these requests unless the request is manifestly unfounded or excessive. We aim to respond within one month.

To exercise your rights, contact us at info@creationrecruitment.co.uk.

How to make a complaint

If you have a concern about how we have handled your personal data, please contact us so we can investigate and respond.

If you remain dissatisfied after raising your complaint with us, you have the right to escalate your complaint to the Information Commissioner's Office (ICO), the UK's data protection regulator.

Changes to this Privacy Notice

We review this Privacy Notice at least annually and whenever our processing activities materially change. Any updates will be posted on our website. If changes are significant, we will take reasonable steps to bring them to your attention.

It is important that the personal information we hold about you is accurate. Please let us know if your details change at any point during our relationship with you.

Creation Recruitment Limited  |  Company No. 05933384  |  June 2026