Privacy Policy

Privacy Policy for Carrot Recruitment

We are a recruitment business (company number 5959235) and we provide work-finding services to our clients and work-seekers. As a company, in order to provide these services, we must process personal data (including sensitive personal data). In doing so, the company acts as a data controller.

You may give your personal details to the company directly, such as on an application or registration form or via our website. Or we may collect data from another source, such as a job board onto which you have uploaded your CV. The company must have a legal basis for processing your personal data. For the purposes of providing you with work-finding services and/or information relating to roles relevant to you, we will only use your personal data in accordance with this privacy statement. At all times we will strive to comply with current data protection laws.

What information might we collect?

Typically, most of your personal data will come to us in the form of your CV, which will include but is not limited to your name, contact details (such as phone numbers, e-mail addresses and home address) plus details of your current salary and package. Occasionally we may be provided with sensitive personal information such as ethnicity, date of birth or even information regarding criminal convictions. We have processes in place to limit our use and disclosure of such sensitive data, other than where permitted by law.

We will normally receive your CV electronically via email or via an application to a job advertised on our website or a third-party job board. As our relationship with you progresses, we will likely obtain further personal information about you, which could come directly from you or may be obtained from third parties, such as organisations to whom we have provided your CV to and who have engaged with you as part of a job application (e.g., our clients or other recruitment agencies along the chain).

You are welcome to unsubscribe from our mailing lists at any time by using this form. If you wish for your data to be permanently removed from our database please email enquiries@carrotpharma.co.uk

How we use your personal information?

The following is a list of ways in which we might process your personal information:

To provide our recruitment services to you; To communicate and maintain our business relationship with you, where you are a client, candidate or user of our website; To enable you to submit your CV for general applications, to apply for specific jobs or to subscribe to our newsletters or job alerts; To match your details and requirement with job vacancies. This will help us in finding a position that is most suitable for you and to send your personal information to clients in order to apply for jobs; To notify you about future job opportunities (based on your requirements) other than the specific role for which you have contacted us; To answer your enquiries effectively; To advise you of news, industry updates, events, promotions and competitions, reports and other information. Before we do so, you will be given an option to opt-out of such communications and an option to unsubscribe will also be provided with each communication; To fulfil contractual obligations with our clients; To provide regulatory or law enforcement agencies with personal information, if ever requested to do so;

What legal basis do we have for processing your personal information?

We must have a legal basis to process your personal data. In line with GDPR the legal bases we rely upon to offer our work-finding services to you are:

Contractual – we may need certain data to enter into a contract with you in order to effectively provide a service to you;
Compliance – certain legal obligations may require us to process certain personal data. We may be obliged by law to disclose your personal data to a regulatory body or law enforcement agency;
Legitimate interests - either we, or a third party, may need to process your personal data for the purposes of our legitimate interests, provided we have established that those interests are not overridden by your rights and freedoms, including your right to have your personal data protected.
Consent – in some circumstances, we may ask for your consent to process your personal data in a particular way.

Legitimate interests

In order for us at Carrot to carry out work on your behalf in an effective manner, it is reasonable for us to need to store certain elements of your personal data. As a Recruitment Consultancy who submit candidates to permanent and contract assignments, the exchange of candidate and client data is essential.

Having a database of candidates and clients with certain elements of personal data is needed to support individual career aspirations and to fulfil client’s resourcing requirements. We also feel it’s reasonable for us to hold data on prospective candidates and clients in order for us to grow our business.

If you are looking for new employment or have uploaded your CV or similar information to a job board or professional networking site, we’d reasonably assume that you are happy for us to collect this data and to contact you to support you in that objective. Prior to us sending any of your data to our clients or any other trusted party, we will first seek your consent.

Potential employers may want to confirm your qualifications or references at some point in the process, so again we feel it is necessary for us to hold your data to fulfil these obligations and to help you land that dream job. Providing you with tailored job alerts also requires us to process your data to ensure the content is appropriate to your needs. And we may also need to use your data for internal administrative activities, like payroll and invoicing.

Who might we share your data with?

In order to fulfil our obligations and provide a service to you, we will share your personal information with other trusted parties. The following is a list of some possible recipients whom the company may process your personal data with:

Clients (whom we may introduce or supply you to)
Former employers whom we may seek references from (with your prior permission)
Payroll service providers who manage payroll on our behalf or other payment intermediaries whom we may introduce you to (such as umbrella companies)
Other recruitment agencies in the supply chain

Overseas transfers

The company may transfer your data to countries outside the European Economic Area (‘EEA’) for the purpose of providing you with work-finding services. We will take steps to ensure adequate protections are in place to ensure the security of your information. The EEA comprises the EU member states plus Norway, Iceland and Liechtenstein.

Data Retention

Any personal data held is stored on our secure recruitment database which is password protected and accessible only by our professional and qualified consultants for the purposes of finding you work finding services or supporting our clients to identify suitable applicants for the vacancies which we are supporting them with. We also have a confidential waste facility in place to safely discard any printed CVs we are working with.

The Company will retain your personal data only for as long as is necessary for the purpose we collect it. Different laws may also require us to keep different data for different periods of time. For example, the Conduct of Employment Agencies and Employment Businesses Regulations 2003, require us to keep work-seeker records for at least one year from (a) the date of their creation or (b) after the date on which we last provide you with work-finding services.

We must also keep your payroll records, holiday pay, sick pay and pensions auto-enrolment records for as long as is legally required by HMRC and associated national minimum wage, social security and tax legislation. This is currently 3 to 6 years.

We typically support candidates throughout their careers and so may often hold their data for lengthy periods. We do, however, proactively communicate with everyone whom we hold data for once per year to remind them of our privacy policy, remind them of their data rights and ensure they are still happy for us to continue to hold their data.

Our process for confirming you have permitted us to store your data

At the outset of our relationship we will send you an email requesting your permission to store your data on our system.
Once consent is obtained you may then receive occasional communication from us in the form of mailers or job alerts, but each time you will have the option to unsubscribe from similar future communications.
Once per year we communicate our privacy policy to all whom we store data for, reminding them of their data rights and giving them the opportunity to change their consent or update their details.
If we receive a request from you to remove all your data, our procedure is to ‘retain & restrict’ which means that everything apart from your name and an internal identification number is removed completely. We retain the name so that we can indicate to our team that you do not wish data to be stored or to be contacted. If we were to remove the name too, then there is a good chance one of our team will contact you through another means and will not know of your preference not to be contacted.

Your rights

Please be aware that you have the following data protection rights. You have the right:

to be informed about the personal data the company processes on you;
of access to the personal data the company processes on you;
to rectification of your personal data;
to erasure of your personal data in certain circumstances;
to restrict processing of your personal data;
to data portability in certain circumstances;
to object to the processing of your personal data that was based on a public or legitimate interest;
not to be subjected to automated decision making and profiling; and
to withdraw consent at any time.

Where you have consented to the company processing your personal data, you have the right to withdraw that consent at any time by contacting us via enquiries@carrotpharma.co.uk. Please note that if you withdraw your consent to further processing, that will not affect any processing done prior to the withdrawal of that consent, or which is done according to another legal basis.

There may be circumstances where the company will still need to process your data for legal or official reasons. Where this is the case, we will tell you and we will restrict the data to only what is necessary for those specific reasons.

If you believe that any of your data that the company processes is incorrect or incomplete, please contact us using the email address above and we will take reasonable steps to check its accuracy and correct it where necessary. You can also contact us using the above details if you want us to restrict the type or amount of data that we process for you, access your personal data or exercise any of the other rights listed above.

Cookies

We may obtain data about you from cookies. These are small text files that are placed on your computer by websites that you visit. They are widely used in order to make websites work, or work more efficiently, as well as to provide information to the owners of the site. Cookies also enable us to deliver more personalised content.

How we use cookies:

Google Analytics

We use Google Analytics to analyse our website. This uses a small cookie that allows the site owner to check which pages are the most popular on the site and so provide more site content that is popular to users. It contains no personal or private data at all and is used on millions of websites worldwide.

If you wish to opt-out of Google Analytics data collection you can do so by using the Google Analytics Opt-out Browser Add-on.

HotJar

We use Hotjar in order to better understand our users’ needs and to optimize this service and experience. Hotjar is a technology service that helps us better understand our users’ experience (e.g. how much time they spend on which pages, which links they choose to click, what users do and don’t like, etc.) and this enables us to build and maintain our service with user feedback. Hotjar uses cookies and other technologies to collect data on our users’ behavior and their devices. This includes a device's IP address (processed during your session and stored in a de-identified form), device screen size, device type (unique device identifiers), browser information, geographic location (country only), and the preferred language used to display our website. Hotjar stores this information on our behalf in a pseudonymized user profile. Hotjar is contractually forbidden to sell any of the data collected on our behalf.

For further details, please see the ‘about Hotjar’ section of Hotjar’s support site.

To learn more about cookies, you may wish to visit: www.allaboutcookies.org, www.youronlinechoices.eu or www.google.com/policies/technologies/cookies/

Most web browsers allow some control of most cookies through the browser settings. Please note that in a few cases some of our website features may not function if you remove cookies from your browser.

Log files

We use IP addresses to analyse trends, administer the site, track users’ movements, and to gather broad demographic information for aggregate use. IP addresses are not linked to personally identifiable information.

Links to external websites

The Company’s website may contain links to other external websites. Please be aware that the Company is not responsible for the privacy practices of such other sites. When you leave our site, we encourage you to read the privacy statements of each and every website that collects personally identifiable information. This privacy statement applies solely to information collected by our Company website.

Sale of business

If the Company’s business is sold or integrated with another business your details may be disclosed to our advisers and any prospective purchasers and their advisers and will be passed on to the new owners of the business.

Data security

The Company takes every precaution to protect our users’ information. Only employees who need the information to perform a specific job (for example, consultants, our accounts clerk or a marketing assistant) are granted access to your information via our password protected recruitment database.

The Company uses all reasonable efforts to safeguard your personal information. However, you should be aware that the use of email/ the Internet is not entirely secure and for this reason the Company cannot guarantee the security or integrity of any personal information which is transferred from you or to you via email/ the Internet.

If you share a device with others, we recommend that you do not select the “remember my details” function when that option is offered.

Changes to this privacy statement

We will update this privacy statement from time to time. We will post any changes on the statement with revision dates. If we make any material changes, we will notify you.

Complaints or queries

If you wish to complain about this privacy notice or any of the procedures set out in it, please write to us via enquiries@carrotpharma.co.uk

You also have the right to raise concerns with Information Commissioner’s Office on 0303 123 1113 or at https://ico.org.uk/concerns/, or any other relevant supervisory authority should your personal data be processed outside of the UK, if you believe that your data protection rights have not been adhered to.