Privacy Policy



Company Name : Charles McKenzie Associates (CMA)

Company Contact details : Kelly Reynolds, [email protected]

Document Name : Privacy Notice (including for use on the company website)

Topic : GDPR/ Data protection

Date : May 2018


Who we are and what we do

Charles McKenzie (CMA) is a recruitment agency and recruitment business, as defined in the Employment Agencies and Employment Business Regulations 2003. We must process the personal data of the following types of people to allow us to undertake our business:

  • Prospective and placed candidates for permanent or temporary roles;
  • Prospective and live client contacts;
  • Supplier contacts to support our services, such as our IT consultants;
  • Emploeyees, temporary workers.

In doing so, CMA acts as a ‘data controller’. The purpose of this privacy policy is to explain what we do with the information we hold about you.

You may give your personal details to CMA directly, such as on an application or registration form or via our website, or we may collect them from another source such as a jobs board, Totaljobs Recruiter and Linkedin.. The Company must have a legal basis for processing your personal data.

For the purposes of providing you with work-finding services and/or information relating to roles relevant to you, we will only use your personal data in accordance with this privacy statement. At all times we will comply with current data protection laws.


Some of the information we hold about you comes directly from you, for example when you complete our registration form or submit your CV, and from correspondence with you over the phone and by email. We obtain references from your previous employers with your consent.

CMA may also source your personal data from the publicly accessible sources, such as major jobs boards, Totaljobs Recruiter and LinkedIn.

Categories of Data

Personal data:

  • Name, address, mobile no., email
  • National insurance no.
  • Nationality (through right to work check)
  • Previous places of employment

Sensitive personal data:

  • Photo identification
  • Criminal convictions

Purpose of processing and legal basis

CMA will collect your personal data (which may include sensitive personal data) and will process your personal data for the purposes of providing you with work-finding services. This includes, for example, contacting you about job opportunities, assessing your suitability for those opportunities, updating our databases, putting you forward for job opportunities, arranging payments to you and developing and managing our services and relationship with you and our clients.

You can opt-out from receiving these at any time by emailing Kelly Reynolds at [email protected].

In some cases we may be required to use your data for the purpose of investigating, reporting and detecting crime, and also to comply with laws that apply to us. We may also use your information during the course of internal audits to demonstrate our compliance with certain industry standards.

We must have a legal basis to process your personal data. The legal bases we rely upon to offer our work-finding services to you are:

  • Your consent, where required;
  • Where we have a legitimate interest;
  • To comply with a legal obligation that we have;
  • To fulfil a contractual obligation that we have with you.

Legitimate Interests in collecting and retaining your personal data

As a recruitment business and recruitment agency, we introduce candidates to clients for permanent employment, temporary worker placements or independent professional contracts. The exchange of personal data of our candidates and our client contacts is a fundamental, essential part of this process. In order to support our candidates’ career aspirations and our clients’ resourcing needs we require a database of candidate and client personal data containing historical information as well as current resourcing requirements. To maintain, expand and develop our business, we need to record the personal data of prospective candidates and client contacts. We process this data for the following legitimate purposes:

  • Managing our database and keeping work-seeker records up to date;
  • Providing work-finding services to you and our clients;
  • Contacting you to seek your consent where we need it.


Should we want or need to rely on consent to lawfully process your data we will request your consent orally, by email or by an online process for the specific activity we require your consent for. We will record your response on our system. Where consent is the lawful basis for our processing, you have the right to withdraw your consent to this particular processing at any time.

Statutory/Contractual Requirement

CMA has certain legal and contractual requirements to collect personal data (e.g. to comply with the Conduct of Employment Agencies and Employment Businesses Regulations 2003, immigration and tax legislation, and in some circumstances safeguarding requirements.) Our clients may also require this personal data, and/or we may need your data to enter into a contract with you. If you do not give us personal data we need to collect we may not be able to continue to provide work-finding services to you.

Data Sharing

CMA will share your personal data and/or sensitive personal data with the following recipients, for the legitimate purpose of carrying out our business as a recruitment agency:

  • Clients (whom we may introduce or supply you to);
  • Former employers, from whom we may request references;
  • Payroll service providers who manage payroll on our behalf, or other payment intermediaries whom we may introduce you to.

CMA will never sell or pass your details to any third party.


CMA will retain your personal data only for as long as is necessary for the purpose for which we collect it. Different laws may also require us to keep different data for different periods of time. For example, the Conduct of Employment Agencies and Employment Businesses Regulations 2003, require us to keep work-seeker records for at least one year from (a) the date of their creation or (b) after the date on which we last provide you with work-finding services.

We must also keep your payroll records, holiday pay, sick pay and pensions auto-enrolment records for as long as is legally required by HMRC and associated national minimum wage, social security and tax legislation. This is currently 3 to 6 years.

Where CMA has obtained your consent to process your personal/sensitive personal data, we will do so in line with our retention policy. Upon expiry of that period CMA will seek further consent from you. Where consent is not granted, CMA  will cease to process your personal data/sensitive personal data.


Please be aware that you have the following data protection rights:

  • The right to be informed about the personal data the Company processes on you;
  • The right of access to the personal data the Company processes on you;
  • The right to rectification of your personal data;
  • The right to erasure of your personal data in certain circumstances;
  • The right to restrict processing of your personal data;
  • The right to data portability in certain circumstances;
  • The right to object to the processing of your personal data that was based on a public or legitimate interest;
  • The right not to be subjected to automated decision making and profiling; and
  • The right to withdraw consent at any time.


For more information on these rights, please refer to the Information Commissioner’s Office (ICO) website –

Where you have consented to CMA processing your personal/sensitive personal data, you have the right to withdraw that consent at any time by contacting Kelly Reynolds at [email protected] Please note that if you withdraw your consent to further processing, that withdrawal does not affect any processing done prior to the withdrawal of that consent, or which is done according to another legal basis.

There may be circumstances where CMA will still need to process your data for legal or official reasons. Where this is the case, we will tell you and we will restrict the data to only what is necessary for those specific reasons.

If you believe that any of your data that CMA processes is incorrect or incomplete, please contact us using the details above and we will take reasonable steps to check its accuracy and correct it where necessary.

You can also contact us using the above details if you want us to restrict the type or amount of data we process for you, access your personal data or exercise any of the other rights listed above.


If CMA’s business is sold or integrated with another business your details may be disclosed to our advisers and any prospective purchasers and their advisers and will be passed on to the new owners of the business.


CMA takes every precaution to protect our users’ information. In addition we do not store any financial or critical information about individuals or companies. All details provided are stored on a secure remote server that is monitored. Only employees who need the information to perform a specific job (for example, consultants, our accounts clerk or a marketing assistant) are granted access to your information.

CMA uses all reasonable efforts to safeguard your personal information. However, you should be aware that the use of email/ the Internet is not entirely secure and for this reason CMA cannot guarantee the security or integrity of any personal information which is transferred from you or to you via email/ the Internet.

If you share a device with others we recommend that you do not select the “remember my details” function when that option is offered.

If you have any questions about the security at our company, you can email Kelly Reynolds at [email protected]


We will update this privacy statement from time to time. We will post any changes on the statement with revision dates. If we make any material changes, we will notify you.


If you wish to complain about this privacy notice or any of the procedures set out in it please contact: Kelly Reynolds at [email protected].

You also have the right to raise concerns with Information Commissioner’s Office on 0303 123 1113 or at, or any other relevant supervisory authority should your personal data be processed outside of the UK, if you believe that your data protection rights have not been adhered to.