Privacy Policy

Privacy Notice

Company Name: Identifi Global Resources Limited (the Company)
Contact details: Data Protection Officer (DPO)

DPO@identifiglobal.com
Document DP5B Privacy Notice (Personal data obtained from a 3rd party and/or direct consent)
Topic: Data protection
Date: 8th December 2025
Version: 3.1

 

Identifi Global, part of the Issured Limited Group (referred to as “the Company”, “we”, “us”, “our”) may obtain data from you either through a 3rd party or directly. Information obtained through a third-party source could be data taken from LinkedIn, a job board, a recruitment platform or a referral. The categories of data we receive may include name, contact details, CV, public profile link, role history and other recruitment-related information. As we did not obtain this personal data directly from you, we will provide you with the information required by Article 14 of the UK GDPR (including the source of the data, the categories of personal data, the purposes of processing, the lawful basis relied on, recipients, any envisaged international transfers and safeguards, retention period, and your rights) within one month of obtaining the data or, if earlier, at first contact with you. If the source is publicly accessible, we will tell you which source. If you object to our processing or want us to stop using the data, contact our DPO at DPO@identifiglobal.com (or reply to the contact email you receive) and we will explain your options and respond promptly.

When you provide personal data directly to Us (for example by completing an application form, uploading your CV, registering on our website or emailing us), we will give you the information required by Article 13 of the UK GDPR at the time of collection. That information will explain the purposes for which we will use your data, the lawful bases we rely on (for example contract/steps prior to contract, legitimate interests, legal obligations or consent where applicable), the recipients or categories of recipients, any intended international transfers and safeguards, the retention periods (or criteria used to determine them), and your data subject rights and contact details for our DPO. If you choose not to provide required information (for example right-to-work evidence), we will explain the likely consequences (such as being unable to progress your application or place you in a role).

1.     Relationship with Issured Limited

Identifi Global is a wholly owned subsidiary of Issured Limited. Although we share group ownership, we remain an independent data controller responsible for our own processing activities.

1.1.  Data sharing within the Issured Group

Identifi Global may share limited personal data with Issured Limited only where necessary, lawful, and proportionate, such as:

  • Supporting group-level administrative or financial processes.
  • Fulfilling contractual obligations.
  • Ensuring compliance or audit requirements.
  • Coordinating service delivery where joint operations exist.

Data sharing within the group is always:

  • Governed by contractual safeguards.
  • Limited to compatible purposes.
  • Based on a valid lawful basis (typically legitimate interests, contractual necessity, or legal obligation).

Identifi Global Resources Limited does not share personal data with Issured Limited for unrelated marketing, business development or profiling unless explicit consent has been provided or another lawful basis applies.

2.     Collection and use of personal data

2.1.  Purpose of processing and legal basis

We process personal data to provide recruitment and placement services, which includes candidate sourcing, shortlisting, submitting CVs to clients (with your consent where required), conducting interviews and carrying out pre-employment checks. Our typical lawful bases for collection of data falls under Article 6 of UK GDPR and include:

  • Article 1 (a) - Consent - where explicitly requested (e.g., marketing, or processing special category data where no other condition applies). For special category data we will also identify an Article 9 condition and obtain explicit consent where required.
  • Article 1 (b) - Contractual necessity / steps prior to contract— where processing is needed to consider or perform a placement
  • Article 1(c) - Legal obligation— for right-to-work, tax, DBS and payroll obligations.
  • Article 1 (f) - Legitimate interests— for candidate sourcing, profiling for role matches and contacting candidates (we document a Legitimate Interests Assessment).

2.2.  Categories of data

We shall process categories of data, which include:

  • Identity & contact details.
  • CV/employment history.
  • Right-to-work and ID checks.
  • Payroll and tax information (if placed);
  • Background check/DBS data where required.
  • Special category data when provided (health, ethnicity, etc. — processed only where lawful).

2.3.  Legitimate interest

Where we rely on a legitimate interest to process your personal data, we will:

  • Carry out a Legitimate Interest Assessment (LIA), ensuring purpose, necessity and balance testing are all carried out.

Typical legitimate interests include:

  • Candidate sourcing,
  • Maintaining candidate pipelines
  • Contact candidates about suitable roles

You have the right to object to processing based on legitimate interests; we will consider and respond to such objections.

2.4.  Recipient/s of data

We will process your personal data and/or sensitive personal data with the following recipients:

  • End clients / hiring organisations — we will notify you and obtain your permission before submitting your details to a client for a specific role, unless submission is necessary to take steps at your request prior to entering a contract
  • Background-check providers
  • Payroll processors
  • IT/cloud service providers and other processors under contract
  • UK/EEA - If we transfer data outside the UK/EEA we will use lawful transfer mechanisms (UK adequacy, standard contractual clauses or other safeguards). (See section 2).

2.5.  Data Sharing Between Identifi Global and Issured Limited

As part of the Issured Group, Identifi Global Resources Limited may share data with Issured Limited only when:

  • Required to fulfil a contract.
  • Necessary for regulatory, audit or compliance purposes.
  • Supporting coordinated service delivery.

Each organisation acts as an independent data controller unless otherwise stated. Data is never shared for incompatible purposes or for marketing without a lawful basis.

2.6.  Statutory / contractual Requirements

Some information we request is required by law or by our clients in order to consider you for certain roles (for example right-to-work evidence or DBS information). If you do not provide required information, we may be unable to:

  • Consider or progress your application for certain roles.
  • Enter into a contract of employment or engagement on your behalf; or
  • Determine your suitability for specific positions.

Where processing is a statutory or contractual requirement, we will make this clear at the point of collection and explain the consequences of not providing the data

3.     International transfers

We may transfer your personal data to countries outside the UK (and formerly the EEA) where necessary for our services. Where transfers occur, we will ensure appropriate safeguards are in place, for example:

  • Transfer to countries with an adequacy decision (as recognised by the UK Government),
  • Use of UK/UK-adopted Standard Contractual Clauses (SCCs) or other approved contractual safeguards, or
  • Explicit informed consent from you for the transfer where no other safeguard is available.

We will ensure recipients apply adequate security measures and limit use to the specified purposes. You can request details of the safeguards we use for any international transfers by contacting our DPO at DPO@identifiglobal.com

4.     Data retention

We retain personal data only as long as necessary for the purposes for which it was collected and as required by law. We maintain a retention schedule mapping data category to retention periods and secure disposal methods.

Typical retention periods:

Description Retention Period
Unsuccessful candidate applications/CVs: 6–12 months (commonly 12 months where required by Conduct Regulations and for candidate pipelines)
Records required by the Conduct Regulations Minimum 1 year from creation or last provision of services.
Payroll, PAYE and tax records: Retained per HMRC guidance (commonly 3–6 years depending on record type).
Right-to-work documents: Retained for the duration of engagement and for 2 years after employment ends (Home Office guidance).
DBS/criminal conviction data and special category data Retained only as necessary and protected; delete securely when no longer required.

Table 1 – Data Retention Periods

When processing is based on consent we will retain data in line with the consented period; when consent expires, we will cease processing unless another lawful basis applies. We will securely delete or anonymise data when retention lapses.

5.     Your rights

You have the following rights under the UK GDPR (subject to statutory limitations):

  • Right to be informed — about what we process and why.
  • Right of access — obtain a copy of your personal data (subject access request).
  • Right to rectification — correct inaccurate or incomplete data.
  • Right to erasure — in certain circumstances (right to be forgotten).
  • Right to restrict processing — in certain circumstances.
  • Right to data portability — where processing is based on consent or contract and data is provided in a structured, commonly used format.
  • Right to object — including to processing based on legitimate interests or for direct marketing.
  • Rights related to automated decision-making and profiling — including the right to human intervention where decisions have legal or similarly significant effects.
  • Right to withdraw consent at any time where processing is based on consent.

To exercise your rights contact, see complaints and queries section below.

6.     Automated decision-making

We do not use automated decision-making, including profiling. If we do decide to use automated decision-making that produces legal or similarly significant effects, we will provide you with meaningful information about the logic involved, the significance and envisaged consequences, and your rights (including the right to request human intervention and to contest decisions).

7.     Source of the personal data

We may obtain your personal data directly from you or from third party sources. Examples of third-party sources include:

  • LinkedIn,
  • job boards,
  • recruitment platforms
  • referrals

Where we did not obtain the data directly from you, we will tell you the source (if publicly available) and provide Article 14 information within one month or at first contact. We will record the source and date obtained in our candidate records.

8.     Complaints or queries

For queries or complaints contact Identifi Global’s DPO, DPO@identifiglobal.com  in the first instance. You also have the right to raise a concern or complaint with the Information Commissioner’s Office (ICO) — helpline 0303 123 1113 or https://ico.org.uk/make-a-complaint/. If your personal data is processed outside the UK, you may also contact the relevant supervisory authority in that jurisdiction.