Privacy Notice

Last updated: November 2026

We respect your privacy and are committed to protecting your personal data. This notice explains how Ripple Recruitment Ltd collects, uses, shares, and protects personal data, and outlines your statutory rights under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. It covers personal data collected directly from you, provided to us by you, or obtained from third-party sources.

Please read this notice carefully to understand our practices regarding your personal data.

Scope of This Notice

This notice applies to:

  • Candidates: Individuals who apply for roles, register with us, send us a CV, or whom we identify and approach as potential candidates for career opportunities.
  • Business Contacts and Prospective Clients: Individuals at clients, prospective client companies, suppliers, and business partners with whom we engage for commercial operations and business development.
  • Website Visitors: Anyone accessing www.ripplerecruit.co.uk, signing up for content, or submitting web contact forms.

Who We Are

Ripple Recruitment Ltd is the data controller responsible for your personal data.

  • Registered Address: c/o Radford & Sergeant Ltd, Quatro House, Lyon Way, Camberley, Surrey, England, GU16 7ER.
  • Company Registration / ICO Reference: Registered with the Information Commissioner's Office (ICO) under registration number ZA813279.
  • Website: www.ripplerecruit.co.uk.

What We Do

We operate as an employment agency (introducing permanent candidates to clients) and an employment business (engaging contractors/temporary personnel), as defined under the Employment Agencies and Employment Businesses Regulations 2003. We also provide recruitment outsourcing, talent consulting, and advisory support.

Information We Collect

We collect and process personal data across different stages of our recruitment and business relationship:

Information You Provide Directly to Us

Information you provide by completing forms on our website, sending your CV, communicating by phone or email, or engaging through professional messaging platforms:

  • Contact details: Full name, residential address, personal and corporate email addresses, and phone numbers.
  • Career and work history: CVs, resumes, employment history, qualifications, accreditations, portfolio links, and compensation expectations.
  • Compliance and identity documentation: Proof of identity, passport/visa details, references, and documentation verifying your statutory right to work in the UK.
  • Financial details: Bank and payment details (strictly where required for processing direct placement fees or contractor invoicing).
  • Call and meeting records: Audio recordings, video recordings, AI-generated transcripts, and summary notes captured during telephone consultations, screening calls, or video meetings.
  • Professional profiles: Links to publicly available professional profiles (e.g., LinkedIn).

Information We Obtain from Third-Party Sources

To identify talent and business development opportunities, we gather professional information from external sources:

  • Publicly accessible platforms, including professional networking sites, corporate websites, industry directories, and public profiles.
  • Third-party talent sourcing, B2B data enrichment, and verification platforms that compile and verify publicly accessible corporate and career details.
  • Professional references provided by you to confirm employment history and credentials.

Information We Collect Automatically

When you interact with our website, we automatically collect technical data (e.g., IP addresses, browser types, interaction data, and pages visited) via cookies and server logs.

Special Category (Sensitive) Data

We do not solicit, collect, or store "special category data" (such as information concerning your health or medical conditions, racial or ethnic origin, religious beliefs, trade union membership, or sexual orientation). We also do not conduct criminal conviction or DBS checks.

The only exception occurs if you voluntarily choose to inform us of a health condition, disability, or neurodivergent requirement to request reasonable adjustments for an interview or recruitment process. Where you share this information:

  • Purpose: We use it exclusively to communicate and arrange your requested adjustments with prospective employer clients.
  • Lawful Basis: Your explicit consent (UK GDPR Article 9(2)(a)), which you grant by choosing to disclose the details so we can assist with accommodations. You may withdraw this consent at any time.
  • Handling: We handle this information strictly on an ad-hoc, confidential basis for the specific application or interview. We do not index, tag, or retain health information as part of your general searchable profile on our recruitment database.

Purposes of Processing and Lawful Bases

Under the UK GDPR, we process personal data under the following legal grounds:

Sourcing and Talent Identification

  • Activity: Identifying potential candidates for career openings via professional platforms, corporate directories, and B2B sourcing and data enrichment tools.
  • Categories of Data: Name, job title, public career history, business or professional contact details.
  • Lawful Basis: Legitimate Interests (UK GDPR Article 6(1)(f)). Our legitimate commercial interest in identifying qualified professionals for current and upcoming client vacancies.

Recruitment and Candidate Management

  • Activity: Assessing CVs, evaluating skills, recording notes, matching profiles against job descriptions, and managing interview stages.
  • Categories of Data: Contact information, CV details, employment history, recruiter notes, and interview feedback.
  • Lawful Basis: Legitimate Interests (UK GDPR Article 6(1)(f)). Serving candidates' career aspirations and fulfilling client resourcing assignments.

Call Recording, Transcription, and Note-Taking

  • Activity: Recording and automatically transcribing phone and video calls to capture accurate recruitment requirements, assess candidate suitability, compile interview notes, and log records in our CRM.
  • Categories of Data: Voice recordings, video footage, transcripts, and AI-generated call summaries.
  • Lawful Basis: Legitimate Interests (UK GDPR Article 6(1)(f)) for standard note-taking, service quality, and maintaining accurate client and candidate records.

Candidate Introduction to Clients

  • Activity: Presenting candidate profiles, qualifications, and CVs to prospective employers.
  • Categories of Data: Full CV, candidate summary profile, qualifications, and portfolio.
  • Lawful Basis: Legitimate Interests (UK GDPR Article 6(1)(f)), alongside candidate agreement pursuant to recruitment industry regulations.

Direct B2B Outreach and Introductions

  • Activity: Sending tailored, 1-to-1 communications to prospective clients and candidate prospects regarding targeted opportunities.
  • Categories of Data: Professional contact details and career history.
  • Lawful Basis: Legitimate Interests (UK GDPR Article 6(1)(f)) (and compliance with the Privacy and Electronic Communications Regulations (PECR) for corporate B2B communications).

Contractual Arrangements and Placements

  • Activity: Managing terms of business, placement contracts, supplier agreements, and billing.
  • Categories of Data: Identity data, billing contact details, company information, bank and financial details.
  • Lawful Basis: Performance of a Contract (UK GDPR Article 6(1)(b)). Entering into or fulfilling placement and service agreements.

Legal and Regulatory Compliance

  • Activity: Retaining statutory records, verifying Right to Work in the UK, adhering to HMRC reporting, and managing disputes.
  • Categories of Data: Identification, Right to Work documentation, statutory placement records, and invoicing.
  • Lawful Basis: Legal Obligation (UK GDPR Article 6(1)(c)). Complying with immigration legislation, tax laws, and the Conduct of Employment Agencies and Employment Businesses Regulations 2003.

Our Legitimate Interests

Our primary commercial purpose is connecting professional candidates with organisations looking for talent. In pursuit of this, our legitimate interests include:

  • Maintaining an active, qualified database of talent and client contacts across our specialist industry sectors.
  • Conducting targeted, 1-to-1 professional outreach to introduce career opportunities or recruitment solutions.
  • Utilising modern workflow tools, including semantic search, CV parsing, and AI matching assistants, to efficiently index candidate skills and match requirements.
  • Maintaining operational records to protect Ripple Recruitment Ltd against potential legal, contractual, or commercial claims.

Where we rely on Legitimate Interests, we conduct a balancing assessment to ensure our commercial interests do not override your fundamental rights, freedoms, or privacy expectations. You have the right to object to this processing on grounds relating to your particular situation, and an absolute right to object to direct marketing at any time.

Artificial Intelligence (AI) and Automated Processing

We use modern recruitment software, including embedded features inside our Customer Relationship Management (CRM) system and standalone productivity tools, to streamline administrative and analytical workflows:

How We Use AI

  • CV Parsing and Data Structuring: Converting unstructured CV documents into organized, searchable database records (e.g., extracting skills, job titles, education, and dates).
  • CV Screening: Reviewing CVs against role requirements to produce preliminary matching notes that assist our recruiters in evaluating applications.
  • Semantic Search and Candidate Matching: Assisting our recruiters in querying our database to identify relevant candidates using skills, locations, and experience criteria.
  • Audio Transcription and Call Summarisation: Transcribing spoken telephone and video conversations into written notes and generating concise interview or client brief summaries for our database.
  • Profile Formatting and Summaries: Drafting internal profile summaries and highlighting key candidate competencies for presentation to clients.
  • CRM Data Enrichment: Categorising, tagging, and verifying professional contact data.

Safeguards and Meaningful Human Oversight

  • No Solely Automated Decision-Making: We do not conduct solely automated decision-making or automated profiling that produces legal or similarly significant effects under UK GDPR Article 22. AI tools operate strictly as decision-support systems for our recruiters.
  • Recruiter Review: Every shortlisting decision, client submission, interview selection, or rejection is evaluated, confirmed, and executed by a human recruiter. AI scores or matches do not automatically reject or advance any individual.
  • No Public Model Training: We confirm that candidate CVs, call transcripts, personal details, and confidential application materials processed through our systems are not used by us or our software vendors to train, fine-tune, or develop public foundational AI models.

Sourced Data and Targeted Outreach

We balance inbound applications with proactive outbound talent identification. Where we identify you as a potential candidate or business contact through third-party sourcing and enrichment platforms:

  • Data Categories: We collect your name, current job title, employer, professional contact information, public profile links, and summary career experience.
  • Contact Methods: We contact you on a targeted, 1-to-1 basis via professional networking platforms, phone, or direct corporate/professional email. We do not send mass, unsolicited marketing campaigns via automated bulk-email dispatch platforms.
  • Notification Window: We will provide you with this privacy notice and inform you of the nature of the source of your data upon our initial communication, or within one month of collecting the data at the latest, as required by UK GDPR Article 14. You may also ask us at any time for the specific source of your data.
  • Independent Platforms: Sourcing platforms operate their own independent databases as separate data controllers. Once your data is imported into our recruitment database, Ripple Recruitment Ltd becomes the data controller of our specific copy.
  • Opt-Out and Suppression: You can decline future contact at any time. When you opt out, we retain your basic identifier on an internal suppression list to ensure we do not inadvertently contact or re-source you in the future.

Cookies and Analytics

Our website uses cookies and related technologies to ensure site functionality, collect aggregate traffic analytics, and remember user preferences:

  • Strictly Necessary Cookies: Essential for the website to load and function securely. These cannot be switched off in our systems.
  • Analytical / Performance Cookies: Activated only if you provide your consent via our website cookie banner. These cookies allow us to count site visits and track page engagement anonymously so we can improve platform performance.

For detailed lists of the specific cookies used, their providers, and expiry periods, please review our standalone Cookie Policy at https://ripplerecruit.co.uk/cookie-policy/. You can adjust or withdraw cookie consent at any time via the cookie settings banner or footer link on our site.

Data Sharing and Third-Party Disclosures

We share personal data only where necessary to operate our recruitment business and fulfil our service obligations:

  • Clients and Prospective Employers: Sharing CVs, work experience, qualification confirmations, and interview notes to introduce candidates for roles.
  • Technology and Software Providers: Trusted software providers acting as data processors under binding contractual agreements, including:
    • Our core recruitment CRM and database platforms.
    • Talent sourcing, candidate search, and data enrichment providers.
    • Call recording, transcription, and meeting summarisation software providers.
    • Cloud file hosting, office productivity software, and business email infrastructure.
    • Standalone productivity and AI support tools used for CV formatting, indexing, and administrative assistance.
  • Professional Advisors: Accountants, legal counsel, compliance auditors, and insurers, strictly to the extent required for professional governance.
  • Corporate Transactions: If Ripple Recruitment Ltd undergoes a corporate sale, merger, or asset reorganization, customer and candidate databases may be disclosed to the prospective buyer or transferred as a commercial asset under strict confidentiality.
  • Legal Disclosures: Where required by law, regulation, court order, or government enforcement bodies (e.g., HMRC, ICO).

International Data Transfers

Our operations, cloud providers, and technology vendors are distributed across the UK, the European Economic Area (EEA), and the United States.

Where personal data is transferred or hosted outside the UK:

  • Adequacy Regulations: We rely on UK adequacy regulations confirming that the destination country or territory ensures an adequate level of data protection (e.g., transfers to the EEA).
  • UK-US Data Privacy Framework: For transfers to US-based technology platforms, we rely on the vendor's certification under the UK Extension to the EU–US Data Privacy Framework where available.
  • Appropriate Contractual Safeguards: Where a vendor is located outside an adequate jurisdiction or is not certified under an applicable framework, we implement appropriate contractual safeguards approved by the UK Government, including the UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses (SCCs).

You can contact us at contact@ripplerecruit.co.uk if you require further details regarding transfer mechanisms implemented for specific software platforms.

Data Security

We apply appropriate technical, administrative, and physical safeguards to prevent unauthorized access, accidental loss, disclosure, or alteration of personal data:

  • Multi-factor authentication (MFA) and granular role-based access restrictions across all CRM, email, and cloud storage systems.
  • Industry-standard encryption for data in transit (TLS/SSL) and data stored at rest.
  • Internal operational procedures regarding data handling, call recording notifications, and confidential communications.

While we take rigorous measures to safeguard data, no internet transmission is completely impervious to interception; any transmission across public networks is undertaken at your own risk.

Data Retention Schedules

We do not retain personal data indefinitely. We adhere to defined retention windows based on our operational needs, statutory obligations, and the nature of our engagement:

  • Unplaced Active Candidates (Talent Pool): Retained for 3 years from the date of initial registration or our last meaningful contact (whichever is later). Prior to the expiration of this 3-year period, we review the record and seek updated CV details or securely archive/delete the profile.
  • Placed Candidates and Financial Records: Retained for 7 years following the end of the financial year in which the placement or engagement completed. This retention period satisfies our statutory accounting obligations under HMRC guidelines and aligns with statutory limitation periods for contractual claims.
  • Sourced Prospects (No Response): Professional contact data sourced from external platforms (such as professional networking sites or B2B data enrichment tools) where no positive engagement, application, or response is received will be deleted or moved to a permanent suppression list within 12 months of initial contact.
  • Statutory Agency Records: Records required to demonstrate compliance under Regulation 29 of the Conduct of Employment Agencies and Employment Businesses Regulations 2003 are retained for a minimum of 1 year from the date of creation or the date on which services were last provided.
  • Suppression Records: Where you object to processing or request to opt out of communications, we retain minimal identity details (e.g., name and email address) on a permanent suppression list to prevent future re-sourcing or accidental contact.

Your Legal Rights

Under the UK GDPR and the Data Protection Act 2018, you have statutory rights regarding your personal data:

  • Right of Access (Subject Access Request): You have the right to request a copy of the personal information we hold about you and verify the lawfulness of processing.
  • Right to Rectification: You may request that incomplete or inaccurate data we hold about you be updated or corrected.
  • Right to Erasure ("Right to be Forgotten"): You can request the deletion of your personal data where there is no ongoing legal basis or statutory requirement for us to retain it.
  • Right to Object: You have the absolute right to object at any time to the processing of your personal data for direct marketing purposes. You also hold the right to object to processing carried out under our Legitimate Interests on grounds relating to your particular situation.
  • Right to Restrict Processing: You can ask us to suspend the processing of your data (for example, while its accuracy is contested).
  • Right to Data Portability: Where processing is carried out by automated means and based on your consent or the performance of a contract, you have the right to receive your personal data in a structured, commonly used, machine-readable format.
  • Right to Withdraw Consent: Where we rely explicitly on consent to process your data (such as for voluntary interview adjustment disclosures or optional non-essential website cookies), you may withdraw that consent at any time.

How to Exercise Your Rights

  • No Fee: Exercising your statutory rights is free of charge.
  • Response Timeframe: We respond to verified Subject Access Requests and statutory rights claims within one calendar month. If your request is particularly complex or numerous, we may extend this period by up to two additional months, and we will notify you of any extension within the initial month.
  • Submissions: To submit a request, email contact@ripplerecruit.co.uk or write to our registered office address.

Regulatory Complaints

You have the right to lodge a complaint at any time with the UK supervisory authority for data protection:

Information Commissioner's Office (ICO)

Website: https://ico.org.uk/make-a-complaint/

We would appreciate the opportunity to resolve any concerns or queries with you directly prior to an approach to the ICO, so please contact our Managing Director in the first instance.

External Links

Our website may contain links to external third-party websites, plug-ins, and job boards. Clicking those links may allow third parties to collect or share data about you. We do not control these third-party platforms and are not responsible for their individual privacy standards, policies, or operations. We recommend reviewing the privacy notices of any external site you visit.

Updates to This Privacy Notice

We review and update this notice periodically to reflect operational, technology, or legal changes. Any amendments will be published on this page with an updated revision date. Where modifications substantially impact how we process existing data, we will provide appropriate notice via direct email communication.

Contact Information

For any questions, Subject Access Requests, or queries regarding this privacy notice and our data handling practices, please contact:

David Ellery, Managing Director

Ripple Recruitment Ltd

c/o Radford & Sergeant Ltd, Quatro House, Lyon Way, Camberley, Surrey, England, GU16 7ER

Email: contact@ripplerecruit.co.uk