Privacy Policy
Our commitment
Wilkinson & Associates Ltd ("W&A", "we", "us" or "our") is committed to protecting personal information and explaining clearly how it is used.
This notice applies to candidates, temporary workers, contractors, client and supplier contacts, referees, employees and other individuals who interact with W&A.
Legal framework We process personal information under the UK GDPR, Data Protection Act 2018, Privacy and Electronic Communications Regulations 2003 (PECR), and amendments made by the Data (Use and Access) Act 2025.
1. Who we are
W&A is a recruitment agency and employment business providing permanent, fixed-term, temporary and contract recruitment services. W&A is the data controller for the processing described in this notice.
Wilkinson & Associates
50 Melville Street
Edinburgh
EH3 7HF
Tel: 0131 225 8030
Email: enquiries@wilkinsonandassociates.co.uk
Data protection contact: Michele Boyton, Operations Director
2. Information we collect
Depending on our relationship with you, we may collect:
- identity and contact details;
- CV, employment history, skills, qualifications and professional memberships;
- salary, remuneration, availability and employment preferences;
- application, interview, assignment and placement information;
- references, right-to-work and compliance documentation;
- financial and payment information where required;
- communications with W&A and information from professional profiles; and
- information needed to meet legal, regulatory or contractual obligations.
Where necessary and permitted by law, we may process health, disability, equality and diversity information, and criminal conviction or offence information. Special category information is processed only where an Article 9 UK GDPR condition applies and, where required, a Schedule 1 Data Protection Act 2018 condition is met. Criminal offence information is processed only where authorised by law, with an appropriate policy document and safeguards where required.
3. How we obtain information
We obtain information directly from individuals and from sources such as LinkedIn, job boards, CV databases, professional or corporate websites, clients, referees, recommendations and screening providers.
Where we obtain information from another source, we provide privacy information within a reasonable period and no later than one month, or sooner if we first contact you or disclose the information, unless a legal exemption applies.
4. Why we use information and our lawful bases
Recruitment and contracts
To identify and assess candidates, manage applications, placements and assignments, administer contracts and payments, and provide requested services. We rely on contract, steps requested before contract, and legitimate interests as appropriate.
Legal and compliance obligations
To complete right-to-work, tax, employment, screening and regulatory requirements. We rely on legal obligation and, where relevant, additional conditions for sensitive information.
Business relationships and security
To maintain candidate, client and supplier relationships, keep accurate records, prevent fraud, protect systems and establish or defend legal claims. We generally rely on legitimate interests or legal obligation.
Consent
We use consent only where it is the appropriate basis. Consent may be withdrawn at any time without affecting earlier lawful processing.
Where we rely on legitimate interests, we identify the purpose, demonstrate necessity and balance the processing against the individual’s rights and reasonable expectations. We retain a Legitimate Interests Assessment where appropriate.
5. Sharing information
Where necessary, we may share information with:
- clients and prospective employers;
- recruitment technology, CRM, IT and cloud providers;
- payroll, payment, screening, compliance and right-to-work providers;
- job boards and recruitment platforms;
- insurers, accountants, legal advisers and other professional advisers;
- regulators, government bodies and law-enforcement authorities where required; and
- a prospective buyer or adviser in a legitimate sale, restructuring or acquisition.
Processors acting for W&A must be bound by appropriate contracts and security obligations. W&A does not sell personal information.
6. International transfers
Some providers may process information outside the United Kingdom. Where this is a restricted transfer, W&A uses an appropriate transfer mechanism, such as UK adequacy regulations, the UK International Data Transfer Agreement or UK Addendum, together with the applicable data protection test or transfer risk assessment where required.
7. Retention
We retain personal information only for as long as needed for the purpose, relationship and applicable legal, regulatory, contractual and claims requirements. Personal information that is no longer required is securely deleted or anonymised under W&A’s Data Retention Policy. A legal hold, complaint, investigation or claim may require relevant information to be kept for longer.
8. Security
- W&A uses appropriate technical and organisational measures to protect confidentiality, integrity and availability.
- Access is restricted to authorised people with a business need.
- W&A’s Information Security Policy, Cyber Security Plan and supplier controls govern storage, access, sharing, recovery and incident response.
9. Recruitment technology and automated decisions
W&A may use technology to assist with searching, matching and administering candidate information. W&A does not currently make decisions producing legal or similarly significant effects based solely on automated processing. A person remains involved in recruitment and placement decisions. If this changes, W&A will provide the required information, challenge route and human-intervention safeguards before the processing begins.
10. Marketing and cookies
W&A may send relevant recruitment, employment opportunity and business communications where permitted by UK data protection law and PECR. Depending on the recipient and communication, W&A may rely on consent, the PECR soft opt-in or legitimate interests. Every electronic marketing message provides a clear way to opt out.
Our website may use cookies and similar technologies. Essential technologies operate where necessary. Non-essential cookies are used only after the required consent, and visitors can manage preferences through the website cookie controls. Detailed information should be provided in W&A’s Cookie Notice.
11. Your rights
Depending on the circumstances, you may have the right to:
- access personal information and receive a copy;
- correct inaccurate or incomplete information;
- request deletion where there is no lawful reason to continue processing;
- request restriction of processing;
- object to processing, including direct marketing;
- receive certain information in a portable format;
- withdraw consent where consent is the basis; and
- request safeguards, challenge and human involvement for applicable automated decisions.
Rights are not absolute and legal exemptions may apply. We may verify identity before acting on a request. Requests should be sent to enquiries@wilkinsonandassociates.co.uk.
12. Data protection complaints
Concerns and complaints should be sent electronically to enquiries@wilkinsonandassociates.co.uk or addressed to Michele Boyton, Operations Director, at the contact details above. W&A will acknowledge a data protection complaint within 30 days, investigate it appropriately and communicate the outcome without undue delay, including any relevant review or appeal route.
You may also complain to the Information Commissioner’s Office. Information is available at ico.org.uk/concerns/.
13. Changes and contact
We review this notice regularly and update it before beginning a materially new use of personal information. The latest version will be published on our website and significant changes will be brought to affected individuals’ attention where appropriate.
Questions, rights requests and complaints should be addressed to:
Michele Boyton, Operations Director
50 Melville Street
Edinburgh
EH3 7HF
Tel: 0131 225 8030
Email: enquiries@wilkinsonandassociates.co.uk