We have created he following policy in a user-friendly format and language to aid the understanding of our service and systems to our end users. It draws reference and is also binding to all of our policies and terms:
The UK General Data Protection Regulation (UK GDPR), together with the Data Protection Act 2018, provides the main legal framework for protecting personal information in the UK. These laws give individuals rights over their personal data and place obligations on organisations that collect, use, store or share it.
Graduate Recruitment Bureau Ltd, also referred to as GRB, operates under the following trading names:
Graduate Recruitment Bureau Ltd is registered with the Information Commissioner’s Office under registration number Z7502403.
We take data privacy seriously and process personal information in accordance with applicable UK data protection legislation. We use appropriate technical and organisational measures to protect personal information and do not sell work-seeker or client personal data.
We process and store the personal data of the work-seekers and individual client contacts that opt-in or request the use of our services by agreeing to our Privacy Policy or Terms of Business. We hold and store this personal data on individuals so we can efficiently retrieve it at the appropriate time to provide the work-finding and employee-finding services you request. This storage and access requirement comes in the following but not exclusive forms of:
Our recruitment service for graduates, students and employers consists of, but not exclusively:
So that we can accurately carry out our recruitment service, we collect the following compulsory and optional information:
Compulsory:
Non-Compulsory:
While using our website we also collect and store other data while you use our website for the features to work and to better improve our services. We also store unobtrusive cookies in your browser that allows our website to function correctly. These cookies are typically set when you submit a form, login or interact with the site by doing something that goes beyond clicking on simple links. Please view our Website Usage and Cookie Privacy Policy for more information.
Information Obtained from Third Party Recruitment Sources
We may obtain candidate information from third party sources including job boards, CV databases, professional networking sites, and recruitment platforms. Where we identify a CV that appears to belong to you, for example by matching identifiers such as name, email address, or phone number, we may add that CV to your profile within our recruitment system in order to support job applications and candidate matching.
We process this information under our legitimate interests in providing recruitment services and connecting candidates with relevant opportunities. If you believe information has been added to your profile incorrectly, you may request that it is corrected or removed at any time.
By creating an account you agree that we may match your profile with CVs from job boards or CV databases that we subscribe to.
Call Recording
If you are in communication with any member of staff at GRB via telephone, we may store the call as a recording for training or reference.
We provide email and SMS updates to keep interested visitors to our website informed of developments and events related to job opportunities and workshops. In order to receive these updates you must provide us with your name, email address and mobile number. This information will be held in complete confidence, and will NOT be sold, traded or otherwise revealed to a third party. You will be given the option to remove your name from our email and SMS/RCS and WhatsApp lists at the bottom of each message. Users are required to comply with the terms of use and notification services, hereby accepting the terms and agreeing to send and receive messaging via email, RCS, WhatsApp, phone calls or SMSes facilitated via GRB. Message and data rates may apply and message frequency varies.
Emails sent by GRB may contain technologies that allow us to understand how recipients interact with our communications. This may include information such as whether an email has been opened and whether links within the email have been clicked. We use this information to measure the effectiveness of our communications, understand engagement and improve the relevance of the information and opportunities we send. Where required by applicable law, we will provide appropriate information and obtain any necessary consent before using email tracking technologies.
When you register with GRB you will be provided with our Privacy Notice explaining how we process your personal data. This will outline the following important GDPR compliance factors as to what we do with your data:
Please preview the full Privacy Notice you will receive when registering here – GDPR Privacy Notice
Your personal data is stored within secure UK or EU based infrastructure. Where data is processed outside the UK or EU, appropriate safeguards such as Standard Contractual Clauses will be used. Your information may be stored in one or more of the following systems either temporarily or until your account is deleted:
Details of the principal service providers we use are available in our GDPR Privacy Notice.
GRB lawfully process their data in a fair and transparent manner and we do not discriminate by gender, ethnicity or any other protected characteristic or social background. The data collected is exclusively for legitimate work-finding purposes and limited to only what is necessary in relation to it.
Every reasonable step is taken to keep data accurate and up to date, including by the use of email requests or in some cases telephone calls, to ensure that any personal data stored is valid and still relevant to the purposes of which it was collected. GRB do not intend to keep data for longer than is necessary to the services we offer in student, graduate and experienced recruitment. We retain personal information in accordance with our retention policy, taking account of the purposes for which it is used and any legal or regulatory requirements. Further details are provided in our GDPR Privacy Notice.
We ensure that appropriate security of personal data is in place to protect against unauthorised or unlawful access, accidental loss and destruction or damage. We do so by using, amongst others, the following technical, cyber security and organisational measures:
GRB only process your personal data where it has a legal basis for doing so that is with the requirements of the service we offer. Before transferring personal data to any third party (such as past, current or prospective employers, suppliers, customers and clients, intermediaries such as our sister companies, persons making an enquiry or complaint and any other third party (such as software solutions providers and back office support)), we will ensure that we have an appropriate lawful basis before processing or sharing personal information.
GRB take every possible step to implement measures and procedures that protect your privacy and we ensure that data protection is integral to all processing activities. This includes implementing measures such as:
Anonymisation (of data) is a type of information sanitisation whose intent is privacy protection. It is the process of either encrypting or removing personally identifiable information from data sets, so that the people whom the data describe remain anonymous.
It is important that you know exactly what data is being collected and what it is used for. GRB ensure that whenever personal data is collected the individual is clearly notified as to what is going to happen with the data. You will be given at least one of the following notices and will be required to confirm with us that you accept before we process and store your information for our services:
All new user registrations will receive an email containing our terms of consent depending on how their data was acquired and guidelines on our data policy. This will normally arrive in the welcome email.
GRB does not intend to further process personal data for any purpose other than that for which the data was initially collected. If this should change in the future for a reason that would benefit the users of GRB’s service, then full consent will be requested from the affected individuals before they carry out any further processing.
We process the majority of our data internally, but additionally GRB use third-party data processors who meet GDPR requirements when necessary. For physical registrations that are collected at events, GRB use a third-party data entry company. The companies and their GDPR statements with details of how they process data on behalf of GRB are available by request.
We use approved business artificial intelligence and automated processing tools to support the administration and delivery of our recruitment services and to make our registration and application processes quicker and easier to use.
These tools may process information contained in CVs, application documents, forms and correspondence to identify, organise, analyse and structure information relevant to our recruitment services. This may help us create and maintain candidate profiles, populate information within our systems, reduce the need for users to enter the same information manually and support candidate and vacancy matching.
We also use approved business AI tools to assist authorised members of staff with analysis, administration, software development and preparing communications.
The services we use are operated within controlled business environments. Information submitted through these services is not used to train or improve the providers’ underlying artificial intelligence models by default.
Artificial intelligence and automated tools assist with processing and administration but do not make final recruitment or employment decisions. Decisions about a candidate’s suitability for an opportunity involve appropriate human review. Candidates can ask us to correct any inaccurate information held about them.
If we hold any of your personal data then you or a representative of your behalf can request a copy from GRB. A full copy of your data will be supplied in a Microsoft Excel file within one month. GRB would also be happy to assist if you would like to rectify any inaccurate or incomplete personal data. See Making Requests at the end of this document.
GRB strongly believe in your right to be forgotten. This is both good for the autonomy and respect of our users, and business efficiency. This is at the core of GRB’s values as a company and GDPR.
If you would like your personal data removed then please email your request to GRB (See Making Requests at the end of this document) with confirmation that you would like to be removed entirely, or whether you are happy to remain as a user that does not get contacted in the future (for a specified period or otherwise). You can also achieve this yourself by editing your settings, deactivating for a period or fully deactivating.
If you ask us to remove your personal information, we will delete or irreversibly anonymise it where appropriate, subject to any legal, regulatory or legitimate retention requirements. If you have given prior consent for your information to be passed on to a recruiter or another third party then we will attempt to reach out and request they follow the same procedure however we can’t enforce or follow-up to prove action from them. This initial process will be completed within one month of the request made.
Please note that you will be able to re-submit your data again in the future should you wish to. It is also possible to be re-registered via another route that you may not be aware of such as opting-in while registering with one of our partners. As we will not keep a record of people we have removed, we can’t avoid this, so you may be contacted again.
Employment businesses such as GRB must keep records that are sufficient to show that we have complied with the legal Acts and the Conduct Regulations of our industry. This includes a regulation that requires us to retain work-seeker and client records for at least one year following the date we last provided services. What this means is that if you request to be deleted, certain information will be stored in a separate location for a year before we can completely delete it.
You have the right to ask us to stop using your data if you know it to be inaccurate, unlawful or against legitimate interest where the grounds of use override those of yours. In these cases GRB will revert to the anonymisation of your data once you agree. Please see Making Requests at the end of this document.
You have the right to a copy of your data, and where feasible, GRB will send your personal data to a named third party on the individual’s request. We supply your data in Microsoft Excel format which is considered as a good choice for data portability. We can also supply it in other formats on request. Please see Making Requests at the end of this document.
You have the right to object to your personal data being used or profiled by GRB if you feel it’s of public or legitimate interest. You can also object to your personal data being used for direct marketing. Once we receive a request we shall cease using your data, unless we have legitimate grounds to continue which take precedence over your interests, rights and freedoms or for the establishment, exercise or defence of legal claims. To cease using your data we will revert to full anonymisation of your record in all our systems. Please see Making Requests at the end of this document.
GRB will act upon any requests relating to your personal data within one month. This includes personal data requests, requests relating to rectification, erasure, restriction, data portability or objection or automated decision making processes or profiling. We may extend this period for two further months where necessary, when taking into account the complexity and the number of requests. These timeframes meet the GDPR standards.
Requests are normally free of charge. However, where requests are manifestly unfounded or excessive, particularly due to their repetitive nature, GRB may either refuse to act on the request or charge a reasonable administrative fee.
In the unlikely event of a data breach, GRB will take steps to contain and recover the breach. If a personal data breach is likely to result in a risk to the rights and freedoms of any individual, GRB will notify the ICO. If a personal data breach presents a high risk to the rights and freedoms of any individual then GRB will tell all affected individuals without undue delay. If a personal data breach happens outside of the UK, GRB shall alert the relevant supervisory authority for data breaches in the affected jurisdiction.
Please email your request to GRB providing the following information:
What action you would like to take:
For identification:
You must make your request from the registered email on your account. In the cases where we can’t identify you with certainty we may ask for further identification such as photographic ID.
Please send the above information from your registered email to [email protected]
