MRJ Recruitment
Legal

GDPR Policy

Privacy Notice
Effective date: August 2026
Last updated: August 2026

PRIVACY NOTICE


MRJ Recruitment Ltd (MRJ) are committed to protecting and respecting your privacy.

Any personal data you provide to us, or that we collect about you, will be processed in accordance with applicable data protection legislation.

MRJ Recruitment Ltd processes personal data in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, the Data (Use and Access) Act 2025 and other applicable data protection legislation.

We are committed to protecting your privacy, handling your personal information responsibly and being transparent about how we collect, use, store and share your data. This Privacy Notice explains what personal information we collect, why we collect it, how we use it, the lawful basis for processing it, and the rights you have in relation to your personal data.

Please read this Privacy Notice carefully to understand how your information is managed. If you have any questions about this notice, how we process your personal data, or wish to raise a complaint about how we have handled your personal information, please contact our Data Protection Representative using the details provided below.

We will acknowledge your complaint within 30 days and respond without undue delay.

Our Data Protection contact is Grant Spencer, who can be contacted regarding any questions about how we process personal data at DPO@mrjrecruitment.com

Who we are and what we do
MRJ Recruitment Ltd operates as both a recruitment agency and employment business as regulated under the Employment Agencies Act 1973 and the Conduct of Employment Agencies and Employment Businesses Regulations 2003.

We collect the personal data of the following types of people to allow us to undertake our business:

  • Prospective and placed candidates for permanent or temporary roles
  • Prospective and live client contacts
  • Supplier contacts to support our services
  • Employees, consultants, temporary workers

We collect information about you to carry out our core business and ancillary activities.

1. Information You Provide to Us or We Collect About You

We collect personal information that you voluntarily provide when you interact with MRJ Recruitment Ltd. This may include information submitted when you complete forms on our website (www.mrjrecruitment.com), register with us, upload your CV, apply for a vacancy, attend one of our events, subscribe to our communications, complete a survey, contact us by telephone or email, or otherwise engage with our services.

The personal information we collect may include your name, postal address, personal and business email addresses, telephone number, employment history, qualifications, references, right to work documentation, financial information where relevant, curriculum vitae (CV), photograph (where provided), salary expectations, and links to publicly available professional profiles, including LinkedIn, X (formerly Twitter), business Facebook pages, GitHub, personal websites or other relevant professional platforms. Where we contact individuals using publicly available professional information, we will ensure that our approach is relevant, proportionate and connected to the individual's professional experience or career interests.

Your personal data is stored securely within our internal systems and recruitment technology platforms, including SourceWhale, a recruitment engagement platform used to support candidate relationship management and communications. These providers act as data processors on our behalf and are required to process personal data securely and only in accordance with our instructions and applicable data protection legislation. Access to your personal data is restricted to authorised MRJ Recruitment employees and trusted service providers who require access to perform their duties. All individuals processing personal data on our behalf are subject to appropriate confidentiality obligations and process personal information in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

Where appropriate, and only where there is a lawful basis to do so, we may share your personal information with prospective employers or clients for the purposes of introducing you for employment opportunities or arranging interviews. We will not submit your personal details to a client without first discussing the opportunity with you and obtaining your agreement to represent you for that specific role.

We may also disclose your personal information where required by law, where necessary to comply with a legal or regulatory obligation, to establish, exercise or defend legal claims, to protect the rights, property or safety of MRJ Recruitment Ltd, our clients, candidates or others, or as part of a business sale, merger, acquisition or corporate restructuring. In such circumstances, any disclosure will be made in accordance with applicable data protection legislation.

2. Which Personal Data MRJ Collects

MRJ Recruitment Ltd only collects personal data that is relevant to providing recruitment services and matching candidates with suitable career opportunities. Depending on your relationship with us, we may collect the following categories of personal information:

  • Full name
  • Postal address
  • Date of birth (where relevant)
  • Personal and business email addresses
  • Telephone and mobile numbers
  • Personal website, portfolio or online profile (where applicable)
  • Publicly available professional profiles, including LinkedIn, X (formerly Twitter), GitHub or similar platforms
  • Curriculum Vitae (CV) or employment history
  • Skills, qualifications and professional experience
  • Career preferences, including preferred roles, locations and working arrangements
  • Current employer and employment status
  • Current salary, remuneration package and salary expectations
  • Notice period and availability
  • Right to work documentation (such as a passport, visa or other evidence of your eligibility to work), where required
  • References, qualifications, certifications or other documentation relevant to the recruitment process
  • Any other information you choose to provide to us in connection with your application or career search.

Additional information collected for contractors and temporary workers

Depending on the services we provide, including contractor recruitment, temporary worker placements or engagement through a limited company, we may also collect:

  • Bank account details and payment information required to process payments
  • National Insurance number and tax-related information where required
  • Limited company details, including company name, registration details, registered address, VAT information and other relevant company documentation
  • Confirmation of IR35 status and supporting documentation where applicable
  • Payslips, invoices or payment records where required to verify employment history, remuneration or contractual arrangements
  • Right to work documentation and compliance information
  • Insurance documentation, certifications or other compliance records relevant to the engagement

This information is collected where necessary to administer contractor engagements, process payments, meet contractual obligations, comply with tax and employment legislation, and satisfy client or regulatory compliance requirements.

3. How MRJ Collects Personal Data

MRJ Recruitment Ltd collects personal data through a variety of channels in the course of providing recruitment services. This may include when:

  • You apply for a vacancy through www.mrjrecruitment.com or via external job boards such as LinkedIn, Indeed, CWJobs or other recruitment platforms.
  • You upload your CV or register your details on our website.
  • You complete a contact form, subscribe to our communications or otherwise contact us directly.
  • You provide your details to one of our Recruitment Consultants by telephone, email, at an event or through networking activities.
  • One of our Recruitment Consultants identifies your profile on publicly available professional networking sites or recruitment databases to which you have subscribed and contacts you regarding relevant career opportunities.
  • We receive your details through a referral from a client, business contact or another trusted third party.
  • You engage with MRJ through industry events, webinars, social media or other professional activities.

When we receive your information, it is securely recorded within our recruitment systems, including SourceWhale, and reviewed by our Recruitment Consultants to assess suitable employment opportunities.

Where appropriate, we may discuss relevant vacancies with you and, with your agreement, introduce your details to prospective employers. We will not submit your personal information to a client without first discussing the opportunity with you and obtaining your agreement to proceed with that specific opportunity.

Where we obtain your personal data from a source other than directly from you, we will provide you with the information required under the UK General Data Protection Regulation (UK GDPR), including the source of your personal data, within the timeframes required by applicable law.

4. Why We Hold Your Data and Our Lawful Basis for Processing

MRJ Recruitment Ltd collects and processes personal data to deliver our recruitment services, support our clients and candidates, and fulfil our legal and regulatory obligations. Depending on the circumstances, we process your personal data under one or more of the lawful bases set out in the UK General Data Protection Regulation (UK GDPR).

We may use your personal data for the following purposes:

  • Identifying and introducing you to suitable employment opportunities with prospective employers or clients.
  • Assessing your skills, qualifications and experience against current and future vacancies.
  • Maintaining your candidate profile and keeping you informed about relevant job opportunities.
  • Communicating with you throughout the recruitment process.
  • Managing our relationship with clients and candidates.
  • Improving our recruitment services, website and candidate experience.
  • Verifying your identity and your right to work in the United Kingdom, where required by law or as part of the recruitment process.
  • Meeting our legal, regulatory and contractual obligations.

Where a client requires additional documentation, such as references, qualifications or right to work documentation, we will discuss this with you before sharing any relevant information. We will only share personal information that is necessary for the recruitment process and where there is an appropriate lawful basis for doing so.

The lawful bases we rely on may include:

  • Legitimate Interests – to provide recruitment services, introduce candidates to suitable employers, and maintain relationships with candidates and clients.
  • Contract – where processing is necessary to take steps at your request before entering into an employment contract or to fulfil contractual obligations.
  • Legal Obligation – where we are required to process personal data to comply with applicable laws, including right to work and employment-related obligations.
  • Consent – where required by law, for example where you have chosen to receive certain marketing communications or where we request your consent for a specific processing activity.

5. Special Category Data

·       In some circumstances, MRJ Recruitment Ltd may process special category personal data, such as information relating to health, disability or diversity information, where you voluntarily provide this information or where it is necessary to support an inclusive recruitment process.

·       We will only process special category data where we have a lawful basis to do so and appropriate safeguards are in place. Providing this information is optional unless required by law.

6. Who We Share Your Data With  

MRJ Recruitment Ltd may share your personal information with trusted third parties where necessary to provide recruitment services, fulfil contractual obligations or comply with legal requirements.

This may include:

Prospective employers and clients

  • Where you have agreed to be represented for a specific opportunity, we may share relevant information with prospective employers to support your application.

Recruitment technology and service providers

  • We use trusted technology providers to support our recruitment activities, including candidate relationship management, communication and recruitment workflow systems. These providers process personal data on our behalf and are contractually required to protect your information in accordance with applicable data protection legislation.
  • Contractor and compliance service providers
    Where required for contractor engagements, we may share relevant information with payroll providers, accountancy providers, compliance partners, umbrella companies or other service providers involved in administering contractor placements and ensuring legal and contractual compliance.

Professional advisors and legal authorities

  • Where necessary, we may share information with professional advisors, regulators, government bodies or law enforcement agencies where required by law or to protect our legal rights.

We only share personal information that is necessary, relevant and proportionate for the purpose it was collected.

7. International Transfers

Some of our trusted service providers may process personal data outside the United Kingdom. Where this occurs, MRJ Recruitment Ltd ensures that appropriate safeguards are in place to protect your personal information, including UK adequacy regulations, International Data Transfer Agreements (IDTAs), or other lawful transfer mechanisms approved under applicable data protection legislation.

8. Legitimate Interests and Data Retention

As a specialist recruitment business, MRJ Recruitment Ltd primarily relies on legitimate interests as the lawful basis for processing personal data relating to candidates, clients and business contacts, where those interests are not overridden by your rights and freedoms.

Before relying on legitimate interests, we carry out an assessment to ensure that our processing is necessary, proportionate and does not have an unfair impact on your privacy.

We maintain candidate records to:

  • Match candidates with current and future employment opportunities.
  • Maintain accurate and up-to-date recruitment records.
  • Communicate with candidates regarding relevant vacancies and career opportunities.
  • Provide recruitment services to our clients.
  • Manage and improve our recruitment processes and business operations.

Where appropriate, we will discuss specific opportunities with you before introducing your details to a prospective employer. We only share personal information that is necessary for the recruitment process and only where there is an appropriate lawful basis for doing so.

We review candidate records regularly and retain personal data only for as long as it is necessary for the purposes for which it was collected, or to comply with legal, regulatory or contractual obligations. Unless a longer retention period is required by law, candidate records that have been inactive for an extended period will be reviewed and securely deleted or anonymised in accordance with our data retention policy.

9. Marketing Communications and Your Choices

If we have not had meaningful contact with you for an extended period, we will review your personal data in accordance with our data retention policy. Where appropriate We may contact you regarding relevant career opportunities where we have a lawful basis to do so, such as legitimate interests. Where required by law, we will obtain your consent before sending marketing communications.

Where we rely on your consent to send marketing communications, you may withdraw that consent at any time. You can do this by clicking the unsubscribe link included in our marketing emails or by contacting us at DPO@mrjrecruitment.com.

Withdrawing your consent for marketing communications will not affect the lawfulness of any processing carried out before your consent was withdrawn, nor will it affect processing that we undertake under another lawful basis, such as legitimate interests, legal obligation or contract.

You also have the right to request that we restrict the processing of your personal data or erase your personal data in accordance with your rights under the UK General Data Protection Regulation (UK GDPR). We will respond to such requests without undue delay and, in most cases, within one calendar month of receiving your request.

We comply with applicable electronic marketing laws, including the Privacy and Electronic Communications Regulations (PECR), when sending marketing communications electronically.

10. Retention of Placement Records

If you are successfully placed with one of our clients, MRJ Recruitment Ltd will retain relevant records relating to your placement for as long as is necessary to comply with our legal, regulatory and contractual obligations.

In most cases, records relating to permanent placements are retained for a minimum of six years following the completion of the placement. This enables us to:

  • Comply with tax, accounting and other statutory obligations.
  • Maintain accurate business and financial records.
  • Respond to audits or regulatory enquiries.
  • Establish, exercise or defend legal claims where necessary.
  • Fulfil our contractual obligations to clients and candidates.

Where legislation requires us to retain certain information for longer than six years, or where there is an ongoing legal or regulatory reason to do so, we will retain the relevant records for the required period. Once the applicable retention period has expired, personal data will be securely deleted or anonymised in accordance with our data retention policy.

11. How Long We Keep Your Personal Data

MRJ Recruitment Ltd retains personal data only for as long as is necessary to fulfil the purposes for which it was collected, to provide our recruitment services, and to comply with our legal, regulatory and contractual obligations.

Where you are actively seeking employment through MRJ or are engaged with one of our Recruitment Consultants, we will retain your personal data to support your job search and keep you informed of relevant career opportunities.

Candidate records are generally reviewed after three years of inactivity. Where there has been no meaningful engagement with you during this period, we will assess whether your personal data remains necessary and either securely delete, anonymise or retain it where there is a lawful reason to do so.

You may request that we erase your personal data at any time. We will consider all such requests in accordance with the UK General Data Protection Regulation (UK GDPR) and any other applicable legal or regulatory obligations. Please note that, in certain circumstances, we may be required to retain specific information where we have a legal obligation or another lawful basis for doing so.

Different retention periods may apply where:

  • You have entered into a separate agreement with MRJ Recruitment Ltd that is covered by a different Privacy Notice (for example, contractors or temporary workers).
  • We are required by law to retain certain records for a longer period, including records relating to completed placements, taxation, accounting, regulatory compliance or the establishment, exercise or defence of legal claims.

Once the applicable retention period has expired and there is no lawful reason to continue processing your personal data, it will be securely deleted or anonymised.

12. How We Keep Your Data Secure

MRJ Recruitment Ltd takes the security of your personal information seriously and has appropriate technical and organisational measures in place to protect your data against accidental loss, unauthorised access, alteration, disclosure or misuse.

We use secure recruitment technology platforms, internal systems and processes designed to protect the confidentiality and integrity of personal information. Access to candidate and client data is restricted to authorised MRJ employees and trusted service providers who require access to perform their role.

All individuals who process personal data on behalf of MRJ are required to maintain confidentiality and handle information in accordance with applicable data protection legislation.

While we take reasonable steps to protect your personal information, no method of electronic storage or transmission can be guaranteed to be completely secure. We regularly review our security measures to ensure they remain appropriate and effective.

In the unlikely event of a personal data breach, MRJ Recruitment Ltd will assess the risk and take appropriate action, including notifying affected individuals and the Information Commissioner's Office where required by law.

13. Your Rights Under UK GDPR

Under the UK General Data Protection Regulation (UK GDPR), you have a number of rights regarding the personal data that MRJ Recruitment Ltd holds about you.

These rights include:

  • The right to access – You have the right to request a copy of the personal data we hold about you and to receive information about how we process it.
  • The right to rectification – You may ask us to correct or update any personal information that is inaccurate or incomplete. We encourage you to keep your contact details and employment information up to date while you are registered with MRJ.
  • The right to erasure – In certain circumstances, you may request that we delete your personal data where there is no lawful reason for us to continue processing it. Please note that we may be required to retain certain information to comply with legal, regulatory or contractual obligations.
  • The right to restrict processing – You may request that we temporarily restrict the processing of your personal data while we verify its accuracy or consider an objection you have raised.
  • The right to object – You have the right to object to the processing of your personal data where we rely on legitimate interests as our lawful basis. You also have the absolute right to object to the processing of your personal data for direct marketing purposes.
  • The right to data portability – Where applicable, you may request that we provide your personal data in a structured, commonly used and machine-readable format, or transfer it directly to another organisation where technically feasible.
  • The right to withdraw consent – Where we rely on your consent to process your personal data, you may withdraw that consent at any time. This will not affect the lawfulness of any processing carried out before your consent was withdrawn.

To exercise any of these rights, please contact us at DPO@mrjrecruitment.com.

We will respond to your request without undue delay and, in most cases, within one calendar month of receiving it. In certain circumstances, where requests are particularly complex or numerous, this period may be extended by up to a further two months. If this is the case, we will inform you of the extension and explain the reasons for it.

If we are unable to comply with your request because it is manifestly unfounded or excessive, we will explain our decision and inform you of your right to lodge a complaint with the Information Commissioner's Office (ICO) or seek a judicial remedy.

14. Automated Decision-Making and Profiling

MRJ Recruitment Ltd may use recruitment technology, including automated tools and AI-assisted functionality, to support our recruitment activities. These technologies may help us organise and search candidate information, identify potentially relevant skills or experience, and support our Recruitment Consultants in matching candidates with suitable opportunities.

These tools are used to assist our Recruitment Consultants and do not replace human judgment. MRJ does not currently make decisions about an individual's suitability for a role based solely on automated processing where those decisions produce legal or similarly significant effects.

Our Recruitment Consultants remain involved in reviewing candidate information, assessing suitability and making decisions throughout the recruitment process.

If our use of automated decision-making, profiling or AI changes, we will review our data protection obligations and update this Privacy Notice where required.

15. Complaints

If you have any concerns about how MRJ Recruitment Ltd collects, uses or protects your personal data, we would welcome the opportunity to address those concerns in the first instance. Please contact us at DPO@mrjrecruitment.com and we will do our best to resolve the matter promptly.

You also have the right to lodge a complaint with the Information Commissioner's Office (ICO), the UK's independent authority for data protection and privacy matters.

Further information about the ICO and how to make a complaint can be found on the ICO website:

https://ico.org.uk/make-a-complaint/

Nothing in this Privacy Notice affects your right to seek a remedy through the courts where permitted by applicable law.

16. Cookies

Our website uses cookies and similar technologies to improve functionality, analyse website performance and enhance user experience. Where required, we will request your consent before placing non-essential cookies on your device.

Further information can be found in our Cookie Policy.

 

17. Changes to This Privacy Notice

We may update this Privacy Notice from time to time to reflect changes to our business, our services, our use of personal data or changes in applicable data protection legislation.

Any updates will be published on our website, and where changes are significant and may affect your rights or how we process your personal data, we may notify you directly by email or through another appropriate communication method.

We encourage you to review this Privacy Notice periodically to stay informed about how we protect and process your personal information.