How we look after your personal data

1. Who we are

Hurren & Hope is the trading name of Hurren & Hope Holdings Ltd, a company registered in England and Wales (company number 09613334). Our registered office is Suite 5, 5th Floor, City Reach, 5 Greenwich View Place, London E14 9NN, United Kingdom.

We are the controller of the personal data described in this policy, and we are registered with the Information Commissioner's Office (ICO) under registration number ZB095116.

For anything to do with your personal data, contact us at [email protected], by phone on 020 3833 0334, or by post to the address above.

We work with companies and candidates in the United Kingdom and the United States. This policy is written to meet UK data protection law (the UK GDPR, the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations), and it applies to everyone whose data we hold, wherever they are.

2. What we collect

If you're a candidate or contractor, we may hold:

• your name, email address, phone number, location and LinkedIn profile;
• your CV, work history, skills, qualifications and the kind of role you want;
• salary or day rate expectations, notice period and availability;
• notes of our conversations with you, and feedback from interviews;
• if you work with us as a contractor: your limited company details, bank details for payment, insurance certificates and the records of your right to work check;
• anything else you choose to tell us.

A right to work check involves identity documents (such as your passport or share code result). Our checks are carried out through a certified identity service provider. We keep the outcome and the evidence the law requires, and we delete dates of birth and share codes from our own records once the check is recorded.

We don't ask for special category data (such as health, ethnicity or religion) as part of our recruitment process. If you choose to tell us about a disability so that we can arrange adjustments for an interview, we use it only for that purpose.

If you're a client or a prospective client, we hold your name, job title, company, work email, phone number and notes of our dealings with you.

If you use this website, we receive what you type into our forms (for example your name, email, message, the role you're hiring for, or how you heard about us), and basic technical information such as your IP address and browser type.

3. Where it comes from

• From you, when you apply for a role, send us your CV, fill in a form on this website, email or call us, or join our talent network.
• From public professional sources, such as LinkedIn and job boards, where you've made your profile available to recruiters.
• From referrals, when someone who knows you recommends you to us, including through our Grow the Network programme.
• From clients, who give us feedback on candidates they've interviewed.
• From business data providers and public registers, such as Companies House, and professional contact databases we use to find the right people at companies who may want our services.

If we collect your details from someone other than you, we'll tell you who we are and point you to this policy within a month, or when we first contact you, whichever is sooner.

4. How we use it, and our lawful basis

We will always talk to you before we send your CV or details to a client about a specific role. Where we rely on legitimate interests, we have balanced our interests against yours, and you can object at any time.

We don't make decisions about you that are based solely on automated processing and that have a legal or similarly significant effect on you. A person at Hurren & Hope always decides who we put forward for a role.

5. Who we share it with

• Clients, when we introduce you for a role, after we've talked to you about it.
• Candidates, who receive the name of the client and details of the role when we discuss it with them.
• Our service providers, who process data for us under contract and only on our instructions. They include our recruitment database (Recruitly), email and calendar (Microsoft 365), website hosting and security (Kinsta and Cloudflare), workflow automation (n8n), email newsletters (MailPoet), electronic signatures (SignNow), right to work checks (InfoVetted and its certified identity service provider), website analytics (Google Analytics) and accounting (Xero).
• Partners who deliver work with us, such as a consultancy running a project that includes contractors we supply, where you've agreed to be put forward.
• Professional advisers, such as our accountants, lawyers and insurers.
• Authorities, such as HMRC, the Home Office or the police, where the law requires it.
• A buyer of our business, if we ever sell or merge it, under the same protections.

We never sell your personal data.

6. International transfers

We recruit for companies in New York and San Francisco as well as the UK, and some of our service providers store or process data outside the UK, including in the United States and the European Union. When your data leaves the UK, we make sure it's protected by one of the safeguards UK law requires: a UK adequacy decision (including the UK Extension to the EU-US Data Privacy Framework for certified US companies), or the ICO's International Data Transfer Agreement or Addendum. You can ask us for details.

7. How long we keep it

• Candidates: for as long as we're in touch, and up to two years after our last meaningful contact with you. We'll check in with you before then if we'd like to keep your details for longer.
• Contractors: for the length of each assignment and two years after it ends, and longer where tax or employment business rules require it (usually six years for financial records).
• Right to work records: for the period the Home Office requires, which is the length of the engagement and two years after it ends.
• Clients and business contacts: for as long as we have a business relationship, and up to two years after our last contact. Financial records are kept for six years.
• Newsletter and job alert subscribers: until you unsubscribe. Unconfirmed sign-ups are deleted.
• Website enquiries: for up to two years, unless they lead to a working relationship.

8. Your rights

You have the right to:

• access the personal data we hold about you and receive a copy;
• correct anything that's wrong or incomplete;
• delete your data, where we no longer have a good reason to keep it;
• restrict how we use it while a concern is looked into;
• object to our use of it based on legitimate interests, and to direct marketing at any time;
• move data you gave us to another organisation, where the law allows;
• withdraw consent where we rely on it, for example by unsubscribing from a newsletter.

To use any of these rights, email [email protected]. It's free, and we'll reply within one month. We may need to confirm who you are before we act on a request.

9. Newsletters, job alerts and marketing

Our city newsletters and job alerts use double opt-in: you'll get an email asking you to confirm before anything is sent. Every email has a one-click unsubscribe link.

If you work at a business, we may contact you about our recruitment services at your work email address because we think they'll be relevant to you. You can tell us to stop at any time by replying to the email or writing to [email protected], and we'll add you to our suppression list so you're not contacted again.

10. Cookies and similar technologies

This website uses a small number of cookies and similar technologies:

We use analytics cookies only to collect statistics that help us improve this website, as UK law now allows without a consent banner. You can object at any time, free of charge: use the switch below and we'll stop loading Google Analytics in this browser.

You can also block or delete cookies in your browser settings. Strictly necessary cookies can't be switched off, because the site needs them to work securely.

11. Security

We protect your data with access controls, encrypted connections and carefully chosen providers. Our contractor onboarding portal is invitation-only. No system is perfectly secure, so if we ever have a breach that puts you at risk, we'll tell you and the ICO as the law requires.

12. Complaints

If you're unhappy with how we've handled your personal data, please tell us first at [email protected] with "Data protection complaint" in the subject line. We'll acknowledge your complaint within 30 days, look into it, and tell you what we've done without undue delay.

You also have the right to complain to the Information Commissioner's Office at ico.org.uk/make-a-complaint or on 0303 123 1113.

13. Changes to this policy

We review this policy at least once a year and whenever the way we use personal data changes. The date at the top shows when it was last updated. If a change affects you significantly, we'll let you know.