UK GDPR, DPA 2018 & PECR Compliant

Privacy & Cookies Policy

Aaron Wallis Recruitment and Training Limited prioritises your personal privacy and ensures that all personal data is handled securely, fairly, and transparently in full accordance with UK data protection legislation.

Data Controller: Aaron Wallis Recruitment & Training Ltd

Company Registration: 06356563 (England & Wales)

Last Reviewed: September 2026 (Version 3.1)

Notice Scope: Website Visitors, Clients & Work-Seekers

This policy sets out how we collect, store, and process personal data gathered via our website, digital assessments, direct enquiries, and commercial client engagements. If you register as an active candidate seeking work-finding services, please also review our supplemental Candidate Privacy Notice for in-depth information regarding client representations, candidate screening, and recruitment matchmaking.

1 Who We Are & Data Protection Contact

Aaron Wallis Recruitment and Training Limited (“Aaron Wallis”, “we”, “us”, or “our”) acts as a Data Controller under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018 (DPA 2018). We operate as both an employment agency (introducing permanent candidates to prospective employers) and an employment business (supplying contractor and temporary personnel).

Registered & Head Office

Aaron Wallis Recruitment and Training Limited

22 Walker Avenue, Stratford Business Village, Wolverton Mill, Milton Keynes, MK12 5TW, United Kingdom

Company No: 06356563 | VAT No: GB 918 1077 27

Data Protection Lead

Robert Scott, Managing Director

Designated Privacy Contact & Data Protection Lead

Address: 22 Walker Avenue, Wolverton Mill, Milton Keynes, MK12 5TW

Email: rob.scott@aaronwallis.co.uk

Telephone: 01908 061400

2 Scope & Clarification on Consent

This Privacy Policy is an informative transparency disclosure. In strict adherence to regulatory guidance from the Information Commissioner’s Office (ICO), browsing or navigating this website does not constitute “deemed acceptance” of this policy. Under the UK GDPR, consent must be freely given, specific, informed, and unambiguous. We do not presume consent through passive website usage.

This policy governs the processing of personal data relating to:

Visitors browsing www.aaronwallis.co.uk;
Individuals submitting direct enquiries regarding recruitment assignments, market remuneration benchmarks, or career advice;
Employer contacts, corporate clients, hiring authorities, and commercial suppliers;
Candidates who submit CVs, register for job alerts, or complete Sales Personality Assessments (SPA).

3 Lawful Bases for Processing (Article 6 UK GDPR)

We process personal data only when a verified lawful basis applies under Article 6(1) of the UK GDPR. We do not conflate or retrospectively interchange legal bases.

Processing Activity	Data Types Handled	Article 6 Lawful Basis	Legitimate Interest (where applicable)
Website Navigation & Infrastructure Security	IP address, browser type, device operating system, network logs	Legitimate Interests (Art 6(1)(f))	Securing digital infrastructure, monitoring malicious traffic, and maintaining platform resilience.
Website Analytics & Performance Cookies	Client IDs, pages viewed, dwell time, referral journeys, interactions	Consent (Art 6(1)(a) & PECR)	Not applicable (collected solely through affirmative opt-in via our cookie banner).
Inbound Enquiries & Customer Support	Name, business email, contact telephone, company, enquiry narrative	Contract / Pre-contractual (Art 6(1)(b))	Responding to customer enquiries and providing preliminary service details.
Work-Finding Services (Candidates)	CVs, career history, qualifications, interview feedback, SPA reports	Legitimate Interests (Art 6(1)(f)) & Contract (Art 6(1)(b))	Matching candidate profiles with prospective client vacancies and facilitating interviews.
Statutory Recruitment Record-Keeping	Proof of identity, right-to-work documentation, interview schedules	Legal Obligation (Art 6(1)(c))	Compliance with Regulation 29 of the Conduct of Employment Agencies Regulations 2003.
Client Invoicing & Financial Accounting	Corporate contact, accounts address, VAT details, payment records	Legal Obligation (Art 6(1)(c))	Compliance with HMRC statutory rules and the Companies Act 2006.
B2B Commercial Outreach & Market Surveys	Business email, job title, corporate telephone, company name	Legitimate Interests (Art 6(1)(f))	Informing commercial clients of market trends, candidate availability, and salary surveys.

4 Special Category Data & Criminal Offence Data

Under Article 9 of the UK GDPR, data relating to racial or ethnic origin, physical or mental health conditions, trade union membership, or religious beliefs requires a heightened level of protection (“special category data”). Data relating to criminal convictions and offences is subject to a distinct, separate regime under Article 10 UK GDPR and Schedule 1, Part 3 of the Data Protection Act 2018.

Our Article 9 Processing Gateways (Special Category Data):

Employment, Social Security, and Social Protection Law (Article 9(2)(b) & DPA 2018 Schedule 1, Part 1): Used where we verify statutory right-to-work credentials or ensure reasonable workplace adjustments are facilitated during candidate interview procedures.
Explicit Consent (Article 9(2)(a)): Where you voluntarily disclose health, disability, or accessibility requirements and request tailored interview assistance, we obtain your explicit, documented consent before sharing this information with a prospective hirer.
Legal Claims or Judicial Acts (Article 9(2)(f)): Retained strictly where essential for establishing, exercising, or defending legal claims.

Our Article 10 Processing Gateway (Criminal Offence Data):

Employment vetting checks required by law or mandated by a prospective employer/regulator (DPA 2018, Schedule 1, Part 3): We process criminal conviction or Disclosure and Barring Service (DBS) vetting data only where a role formally requires such checks by law or regulatory requirement (e.g. roles in financial services, legal, healthcare, or safeguarding). This data is processed strictly when authorised, evaluated individually, kept confidential, and retained only for as long as necessary to fulfil the vetting assessment.

5 Data Sharing & Third-Party Processors

We never sell, rent, or trade personal data. We disclose information solely to vetted processors and partners under written Data Processing Agreements compliant with Article 28 of the UK GDPR:

Prospective Employers & Clients

Candidate profiles and CVs are presented to prospective hirers only following direct discussion and the candidate’s confirmation.

Recruitment CRM Infrastructure

Our cloud-hosted recruitment platform (JobAdder) stores candidate and client records securely under strict confidentiality obligations.

Cloud Infrastructure & Business Systems

Enterprise cloud services (Google Workspace), hosting servers, encrypted backups, and accredited external IT support.

Regulators & Professional Bodies

HMRC, the Department for Business and Trade (Employment Agency Standards Inspectorate), and professional advisers where required by statute.

6 International Data Transfers & Adequacy

Our primary data stores are hosted within the United Kingdom and the European Economic Area (EEA). Certain third-party software providers maintain data storage or technical support infrastructure outside these territories.

Whenever data is transferred across borders, we implement safeguards compliant with Chapter V of the UK GDPR:

UK Adequacy Regulations: Transfers to countries formally recognised by the UK Government as providing an adequate standard of data protection.
UK International Data Transfer Agreement (IDTA) / UK Addendum: For transfers to jurisdictions without an adequacy decision, standard contractual safeguards are enforced to protect individual rights.
UK Extension to the EU-US Data Privacy Framework: Where US service providers are certified under the UK-US Data Bridge, transfers proceed under approved privacy principles.

7 Data Retention & Disposal Schedules

We retain personal data only for as long as is necessary to satisfy our recruitment purposes, or to comply with statutory legal, taxation, and regulatory reporting requirements.

Data Category	Retention Period	Statutory Basis / Retention Justification
Work-Seeker Records (Unplaced)	12 months from the date work-finding services were last provided	Regulation 29 of the Conduct of Employment Agencies and Employment Businesses Regulations 2003.
Candidate Profiles & CV Database	2 years following last meaningful contact (subject to re-engagement or an erasure request)	Legitimate interest in ongoing professional placement matchmaking; dormant profiles are systematically reviewed and removed.
Placed Candidates & Commercial Invoices	6 years plus current financial year	Section 388 of the Companies Act 2006, Taxes Management Act 1970, and VAT accounting regulations.
General Website Contact Submissions	12 months from resolution of enquiry	Managing correspondence history and customer service continuity.
Analytics Telemetry & Server Logs	Up to 14 months (Google Analytics standard retention)	Security monitoring and website optimisation; aggregated metrics thereafter.

8 Cookies & Tracking Technologies

Our website uses cookies and similar digital technologies in full accordance with PECR and UK GDPR requirements.

1. Strictly Necessary Cookies (Always Active)

Essential for page navigation, session management, and recording your cookie consent preferences. These cannot be disabled through our consent banner under Regulation 6 of PECR.

2. Performance & Analytical Cookies (Optional)

Help us understand how visitors interact with our website, which sales career resources are most visited, and site loading speeds. Placed solely upon your prior affirmative consent.

3. Advertising & Social Media Cookies (Optional)

Track cross-site activity to display tailored Aaron Wallis career vacancies across networks including LinkedIn and Google. Disabled by default.

Manage Your Cookie Preferences

You may update your consent at any time through our preference manager or your browser controls.

9 Your Rights & Automated Decisions / Profiling

Automated Tools & Profiling (Sales Aptitude Assessments)

Where we use automated tools or psychometric evaluations (such as the Sales Personality Assessment — SPA) to assist in appraising candidate suitability for sales vacancies, these assessments are used solely to inform — not replace — human judgement.

In compliance with Article 22 of the UK GDPR, you will never be subject to a decision based solely on automated processing or profiling that produces legal or similarly significant effects concerning you without the opportunity for human review. Candidates may request human intervention, express their viewpoint, or contest any assessment evaluation by writing to our Data Protection Lead.

Under Chapter III of the UK GDPR, you have the following enforceable statutory rights:

Right of Access (SAR)

Request confirmation of data processing and obtain a free copy of your personal data records.

Right to Rectification

Request immediate correction of inaccurate or incomplete personal data records.

Right to Erasure (“Right to be Forgotten”)

Request deletion where records are no longer required for recruitment or statutory record-keeping.

Right to Restrict Processing

Limit processing activities while disputes concerning accuracy or legitimate interests are resolved.

Right to Data Portability

Obtain digital records you have provided in a structured, commonly used, machine-readable format.

Right to Object & Withdraw Consent

Object at any time to direct marketing, or withdraw previously given consent without penalty.

* Statutory notice: Specific exemptions apply (such as when records must be maintained under Regulation 29 of the Conduct of Employment Agencies Regulations 2003 or HMRC fiscal rules). We will advise you in writing if a statutory exemption applies to your request.

10 Information Security & Contact Details

We maintain robust physical, electronic, and managerial protections (including SSL/TLS encryption, multi-factor authentication, perimeter firewalls, and role-based permissions) to prevent unauthorised access, loss, or disclosure.

If you have questions regarding this policy, wish to exercise any statutory rights, or wish to raise a complaint, please contact our Data Protection Lead in the first instance. You also have the right to lodge a complaint directly with the UK supervisory authority:

Aaron Wallis Data Protection Contact