Privacy policy

Who we are

Sowers Recruitment (“we”, “us”) is a recruitment agency and employment business operating in the United Kingdom. We are the data controller for the personal data described in this policy.

What we collect

From candidates, we collect the information you give us and the information an employer needs in order to consider you:

• Identity and contact details — name, email, telephone number, and the area you are willing to work in
• Your CV and its contents — employment history, education, qualifications and professional registrations
• Application details — the roles you apply for, your availability, notice period and salary expectations
• Right to work documentation, which we are legally required to check and retain
• References from previous employers, obtained only with your knowledge
• Where a role requires it, criminal records information via a DBS check, and occupational health clearance

Some of this is special category data under UK GDPR — health information and criminal records information in particular. We only process it where a role legally requires it, under Article 9(2)(b) (employment law obligations) and Schedule 1 of the Data Protection Act 2018, and we hold an appropriate policy document covering that processing.

Why we process it, and our lawful basis

Who we share it with

• Prospective employers — only with your specific approval for that role, never speculatively
• Referees you have named, in order to obtain a reference
• The Disclosure and Barring Service, where a role requires a check
• Our suppliers, who process data on our behalf under written contracts and on our instructions only: Vercel (website hosting), Supabase (database and file storage, hosted in Ireland), Resend (email delivery) and Cloudflare (domain and network security)
• HMRC and other authorities where we are legally required to do so

We do not sell your data, and we do not share it with third parties for their own marketing. Where a supplier processes data outside the UK, we rely on the UK International Data Transfer Addendum or an adequacy decision.

How long we keep it

We hold candidate records for 24 months from your last meaningful contact with us, then delete them automatically. If we place you, we keep the records required by law — payroll and Conduct Regulations records for six years, and right to work documentation for two years after employment ends.

Your rights

Under UK GDPR you have the right to:

• Ask for a copy of the personal data we hold about you, free of charge, within one month
• Have inaccurate data corrected
• Have your data deleted — we action candidate deletion requests the same working day
• Object to processing based on legitimate interests, including all marketing
• Withdraw consent at any time, without it affecting any processing already carried out
• Ask us to restrict processing while a dispute is resolved
• Receive your data in a portable, machine-readable format

To exercise any of these, contact hello@sowersrecruitment.co.uk. If you are unhappy with how we have handled your data you can complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113 — though we would rather you told us first so we can put it right.

Security

Your data is encrypted in transit. CVs are held in private storage that is not reachable from the public internet — a consultant opens one through a link that expires after sixty seconds, and the file is never published at a guessable address. Our internal system sits behind a separate password and is available only to consultants working your search, on their own signed-in session. Records are deleted automatically at the end of the retention period described above rather than when somebody remembers.

We are a small team, which means access is genuinely limited rather than nominally limited. If a device is lost we revoke its session immediately, and no candidate data is stored on it. If a breach ever put your data at risk we would tell you, and the Information Commissioner's Office, within 72 hours of finding out.

Cookies

This website sets no advertising or tracking cookies. See our cookie policy for the detail.

Changes to this policy

We will update this page when our practices change, and the date at the top will tell you when it was last revised.