Privacy & Data Protection Notice

PRIVACY & DATA PROTECTION NOTICE
Contract Labour Solutions Ltd — Notice to candidates, workers, contractors, clients and website visitors

Contract Labour Solutions Ltd ("CLS", "we", "us") is committed to protecting the privacy and personal data of every individual who interacts with us. This notice explains what personal data we collect, why we collect it, how we use it, who we share it with and how long we keep it. It also explains your rights and how to contact us.

We process personal data in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and the Data (Use and Access) Act 2025, together with the Privacy and Electronic Communications Regulations 2003 (PECR) and other applicable UK data protection legislation (the "Data Protection Laws").

This notice applies to candidates, workers and contractors engaged through CLS, our clients and their representatives, individuals who contact us, and visitors to our website. If you have any questions about how your personal data is handled, please contact the Data Protection Lead using the details at the end of this notice.

1. Who we are

CLS is a UK recruitment business providing temporary and permanent placements across construction, civil engineering, healthcare, industrial and logistics sectors. To match candidates with suitable work, manage assignments, pay workers and meet our legal obligations, we collect and process personal data as part of our day-to-day operations.

For most of the personal data we hold, CLS is the data controller. This means we are responsible for deciding what data we collect about you and how it is used. Where we process data on behalf of a client (for example, when a client instructs us to process worker data on their behalf during an assignment), we may act as a data processor.

2. Our Data Protection Lead

CLS is not required to appoint a statutory Data Protection Officer under the UK GDPR. We have instead appointed a Data Protection Lead who is the senior person responsible for our compliance with the Data Protection Laws and the day-to-day handling of data protection queries.

Our Data Protection Lead is Stewart Olsen, Managing Director. Any query or request relating to data protection, including a request to exercise any of the rights set out in this notice, should be addressed in writing to him using the contact details at the end of this notice.

CLS is registered as a data controller with the Information Commissioner’s Office (ICO) under registration reference ZA398315. Our company registration number is 09201504, registered in England and Wales.

3. What personal data we collect

The personal data we collect depends on your relationship with us. The categories below are not exhaustive, but cover the main types of information we hold.

Identification & contact	Full name, date of birth, gender, home address, email address, telephone number, National Insurance number, photograph (where required for site passes or carded trades).
Right to work & identity	Passport, visa, biometric residence permit, share code, driving licence, utility bills and other documents used to evidence identity and right to work in the UK.
Work history & skills	CV, employment history, references, training records, qualifications, certifications, ticketed trade cards (e.g. CSCS, CPCS, NPORS), competence assessments and licences.
Healthcare workers	For workers placed in healthcare settings: DBS check results, NMC or other regulatory body registration, occupational health clearance, immunisation records, fit-to-work declarations.
Assignment & engagement	Client details, assignment details, hours worked, timesheets, performance feedback, incident and accident reports, disciplinary records.
Payroll & financial	Bank account details for payment, tax code, pension auto-enrolment status, deductions, holiday pay accruals, statutory sick pay, P45/P60 data, CIS verification details where applicable.
Equality monitoring	Where you choose to provide it: ethnicity, religion, disability and other special category data used for equality monitoring purposes only.
Emergency contact	The name, relationship and contact details of a person you ask us to contact in an emergency.
Communications	Records of correspondence, telephone calls, emails, text messages and any other contact between you and CLS.
Website & technical	IP address, browser type, device information, pages visited and similar technical data collected when you use our website.

4. Where we obtain your data from

Most of the personal data we hold has been provided to us directly by you — for example, when you register with us, send us your CV, complete a compliance pack, or correspond with us.

We may also receive personal data about you from:

Job boards and online platforms where you have made your CV or profile available.
Recruitment partners or sister agencies who refer candidates to us with your consent.
Your previous or current employers, when we request work references.
The Disclosure and Barring Service (DBS) and other professional or regulatory bodies, where a check is required for the role.
Occupational health providers commissioned to assess fitness to work.
Our clients, including timesheet approvals, performance feedback and any incident or conduct reports relating to your assignment.
Publicly available sources such as LinkedIn or professional registers, where relevant to your suitability for work.

5. How we use your data and our lawful bases

Under the Data Protection Laws, we must have a lawful basis for each way we use your personal data. The table below sets out the main ways in which we use personal data and the lawful basis we rely on for each.

Purpose	What this involves	Lawful basis
Registration & matching	Holding your CV and details so we can match you to suitable assignments and roles.	Legitimate interests (Art. 6(1)(f)) — our interest in running a recruitment business and your interest in finding work.
Placing you on assignment	Putting forward your details to a client, arranging interviews, agreeing terms and engaging you for work.	Contract (Art. 6(1)(b)) — to take steps before entering into, and to perform, your contract with us.
Right to work checks	Verifying you have the right to work in the UK and keeping evidence for the statutory period.	Legal obligation (Art. 6(1)(c)) — Immigration, Asylum and Nationality Act 2006 and related guidance.
Payroll, tax & deductions	Paying you, deducting PAYE/NI, reporting to HMRC under RTI, operating CIS where applicable, and administering pension auto-enrolment.	Legal obligation (Art. 6(1)(c)) — tax, NI, pensions and CIS legislation.
Healthcare worker compliance	DBS checks, occupational health, fit-to-work, professional registration, immunisation and other healthcare clearance.	Legal obligation and Art. 9(2)(b) / 9(2)(h) — employment law and health/social care, with Sch.1 DPA 2018 conditions.
Conduct Regulations records	Keeping records required under the Conduct of Employment Agencies and Employment Businesses Regulations 2003.	Legal obligation (Art. 6(1)(c)).
AWR equal treatment	Recording comparator information to comply with the Agency Workers Regulations 2010.	Legal obligation (Art. 6(1)(c)).
Health & safety	Recording accidents, near-misses, RIDDOR-reportable incidents and site safety information.	Legal obligation (Art. 6(1)(c)) and our and your legitimate interests in safe working.
Managing assignments	Day-to-day administration of your assignment, including timesheets, performance, conduct and feedback.	Contract and legitimate interests.
Job alerts & opportunities	Sending you details of roles that match your registered skills, sector or location.	Legitimate interests, or consent where required by PECR for electronic marketing.
Equality monitoring	Anonymised analysis of recruitment outcomes to support equal opportunities.	Substantial public interest (Sch.1 Part 2 DPA 2018) where special category data is involved.
Complaints & disputes	Handling complaints, grievances, regulatory queries and any legal claims.	Legitimate interests and, where applicable, legal obligation.
Fraud prevention	Checking the integrity of timesheets, identity documents and assignment records.	Legitimate interests and legal obligation.

CLS does not use your personal data for unsolicited third-party marketing, and we do not sell your personal data under any circumstances. Where we rely on consent (for example, for certain electronic job alerts), you have the right to withdraw that consent at any time — see section 9.

6. Who we share your data with

We share personal data only where it is necessary for the purposes set out above, and only with recipients who are required to keep it secure and use it for limited purposes. The main categories of recipient are:

Clients, end-users and hirers to whom we introduce or supply you for work.
HMRC, the Pensions Regulator, the Information Commissioner’s Office, the Disclosure and Barring Service and other regulatory or government bodies where we are required to share data.
Payroll providers, accounting software providers and back-office support partners that process data on our behalf as our data processors.
Umbrella companies where you elect to be paid through one, in which case the umbrella company becomes a separate data controller.
Occupational health providers, DBS check providers, training providers and other compliance partners.
Pension scheme administrators, where required for auto-enrolment.
Insurers, brokers and legal advisers, where required to handle a claim or dispute.
Banks and other financial institutions, in order to pay you and to detect fraud.
Auditors and other professional advisers under a duty of confidentiality.
Other parties where required by law, by a court order or in response to a formal request from a regulator or law enforcement body.

Where a third party acts as our data processor, we put in place a written contract that imposes data protection obligations on them in line with the Data Protection Laws.

7. International transfers

CLS is based in the UK and the great majority of the personal data we hold is processed within the UK. Some of our software providers (for example, our email, cloud storage and back-office providers) may store or process data on servers located in the European Economic Area (EEA) or in countries that have been the subject of UK adequacy regulations.

Where personal data is transferred outside the UK, we will only do so where one of the following safeguards is in place: a UK adequacy decision, the UK International Data Transfer Agreement (IDTA), the UK Addendum to the EU Standard Contractual Clauses, or another mechanism permitted under the Data Protection Laws.

8. How long we keep your data

We only keep personal data for as long as we need it for the purposes we collected it for, or for as long as we are required to keep it by law. Our main retention periods are set out below. A more detailed Retention Schedule is available from the Data Protection Lead on request.

Candidate records (no engagement)	Up to 2 years from your last contact with us, unless you ask us to delete your data sooner.
Engaged worker records	For the duration of your engagement and for at least 6 years after your last assignment ends, in line with limitation periods for contract and tax claims.
Right to work check evidence	For the duration of your engagement and for 2 years after it ends, as required by Home Office guidance.
Payroll and tax records	For at least 6 years following the end of the tax year to which the records relate (HMRC requirement).
CIS records	For at least 3 years after the end of the tax year to which they relate.
Conduct Regulations records	At least 1 year from the end of an assignment, in line with the Conduct of Employment Agencies and Employment Businesses Regulations 2003.
AWR comparator records	At least 3 years from the date of creation.
Health & safety / accident records	At least 3 years from the date of the incident (longer for certain exposures).
DBS check evidence	Generally no longer than 6 months after the recruitment decision, in line with the DBS Code of Practice.
Occupational health records	For the duration of the engagement and for an appropriate period afterwards, in line with the provider’s retention guidance.
Website analytics & cookies	Up to 26 months for analytics; session cookies are deleted when you close your browser.

Where we no longer need your data we will securely delete it, or anonymise it so that it can no longer be linked to you.

9. Your rights

Under the Data Protection Laws you have the following rights in relation to the personal data we hold about you:

Right of access — to ask for a copy of your personal data and certain information about how we use it (a "subject access request").
Right to rectification — to ask us to correct inaccurate or incomplete personal data.
Right to erasure — to ask us to delete your personal data in certain circumstances (sometimes called the "right to be forgotten").
Right to restrict processing — to ask us to stop using your data while a query or dispute is being resolved.
Right to object — to object to our use of your data where we are relying on legitimate interests, and to object at any time to use of your data for direct marketing.
Right to data portability — to ask us to send certain data you have provided to us, in a structured electronic format, to you or to another organisation.
Right to withdraw consent — where we rely on your consent for a particular use of your data, you can withdraw it at any time. Withdrawing consent does not affect any processing that has already taken place.
Rights in relation to automated decision-making — you have the right not to be subject to a solely automated decision that produces a legal or similarly significant effect on you, unless an exception applies.

CLS does not make any solely automated decisions about candidates or workers that have a legal or similarly significant effect. Where any element of automation is used in matching candidates to roles, a member of our team always reviews the outcome before any decision affecting you is taken.

To exercise any of these rights, please contact our Data Protection Lead in writing. We will normally respond within one calendar month. We may extend this period by up to two further months for complex or numerous requests, in which case we will tell you within the first month.

10. How to complain

If you are unhappy with the way we have handled your personal data, please raise it with our Data Protection Lead in the first instance. Under section 164A of the Data Protection Act 2018 (introduced by the Data (Use and Access) Act 2025) you have a statutory right to complain directly to CLS, and we will acknowledge your complaint and respond as quickly as we reasonably can.

You also have the right to lodge a complaint with the Information Commissioner’s Office at any time:

Telephone: 0303 123 1113
Online: https://ico.org.uk/make-a-complaint/
Post: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF

If you choose not to provide personal data

Some of the personal data we ask for is required by law or is necessary for us to register you, pay you or place you on assignment. If you do not provide it, we may not be able to put you forward for work, pay you, or fulfil our legal obligations as a recruitment business.

11. Website and cookies

Information you submit through our website — such as your name, email address, telephone number and IP address — is transmitted over a secure connection and held in secure systems. It is used to respond to your enquiry, register you, or pre-populate your application, and is retained in line with the retention periods above.

Our website uses cookies and similar technologies. A separate Cookie Notice on our website sets out the categories of cookies we use, what each does, and how to manage your preferences. You can change your cookie preferences at any time through your browser settings or via the cookie banner on our website.

12. Changes to this notice

We keep this notice under regular review. We will update it whenever there is a material change to the way we handle personal data or to the Data Protection Laws. The latest version is always available on our website and on request from the Data Protection Lead.

Version 2.0 | Effective date: 9 June 2026 | Approved by Stewart Olsen, Managing Director and Data Protection Lead | Supersedes the Privacy & Data Protection Notice dated 29 July 2025.

Contact — Data Protection
Stewart Olsen, Data Protection Lead
Tel: 01302 244 486 | Email: info@cls.ltd
Contract Labour Solutions Ltd | Company No. 09201504 | ICO Registration: ZA398315