Privacy Notice

Cirrus Selection Limited (“Cirrus Selection”, “we”, “us”, “our”) is committed to protecting and respecting your privacy. This notice explains what personal data we collect, why we collect it, how we use and protect it, and the rights you have. Please read it together with our Terms of Use.

We process personal data in line with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations 2003 (PECR), each as amended by the Data (Use and Access) Act 2025.

Who we are

The data controller is Cirrus Selection Limited, a company registered in England and Wales (company number 10748288), whose registered office is 82 Westbrook End, Newton Longville, Buckinghamshire, MK17 0DF. We are registered with the Information Commission (known as the ICO) under registration number ZA251298.

We are not required to appoint a Data Protection Officer. David Cox, Managing Director, is responsible for data protection at Cirrus Selection. You can contact him at enquiries@cirrusselection.co.uk, by phone on 01908 764363, or by post at the address above.

What we do

We are an employment agency and employment business as defined in the Conduct of Employment Agencies and Employment Businesses Regulations 2003. We introduce candidates to clients for permanent, contract and temporary roles, and we offer related services such as interview coaching through Cirrus Elevate. To do this, we hold personal data about:

• prospective and placed candidates;
• prospective and current client contacts;
• supplier and partner contacts;
• people who contact us or use our website.

The personal data we collect

Depending on how you deal with us, we may collect:

• Identity and contact details, such as your name, address, email address and phone number.
• Career information, such as your CV, employment history, qualifications, skills, salary and benefits, notice period, references, and links to professional profiles such as LinkedIn.
• Eligibility and compliance information, such as evidence of your right to work in the UK, your nationality and residency history, and any UK security clearance you hold or are eligible for, where this is relevant to a role.
• Recruitment records, such as notes of our conversations, the roles we discuss with you, interview feedback and offers.
• Business contact details for client and supplier contacts, such as job title, employer and work contact details.
• Website and technical data, such as information you submit through our forms, and limited technical data collected by cookies (see Cookies below).

More sensitive information

We do not ask for special category data (for example, information about your health, ethnicity or religion) unless it is needed. Where it is, for example to arrange reasonable adjustments for an interview, or where a client asks for equal opportunities monitoring, we will only use it with your explicit consent or where the law otherwise permits. We do not carry out criminal record checks. Security vetting is carried out by the employer and the relevant government bodies, not by us.

Where we get your personal data

Most of the information we hold is provided by you, for example when you send us your CV, register through our jobs pages, complete a form on our website, or speak to us by phone or email.

We also collect information from other sources, such as LinkedIn and other professional networking sites, job boards and CV databases, company websites, business cards, and recommendations from people who know you. Where we keep your data, or contact you about a role, we will tell you where we got it and send you this notice when we first contact you, and in any case within one month. Where we review a CV or profile from a job board or CV database and do not keep it or contact you, we will not usually be able to tell you individually, so this notice explains how we handle that data.

How we use your personal data and our lawful bases

We use your personal data to:

• find, assess and introduce suitable candidates for our clients’ vacancies;
• tell candidates about roles that match their experience and aspirations;
• arrange interviews, manage offers and support people through onboarding;
• provide interview coaching and career support;
• manage our relationships with clients and suppliers, including invoicing;
• keep you informed about our services and relevant market insight;
• run, secure and improve our website;
• meet our legal and regulatory obligations.

We rely on the following lawful bases:

• Legitimate interests. Most of our processing is necessary for our legitimate interests in running a specialist recruitment business: building and maintaining a database of candidates and client contacts, matching candidates to roles, and developing our business. We have weighed these interests against your rights and freedoms, and you can object at any time (see Your rights).
• Contract. Where we are entering into, or performing, a contract with you or your organisation, such as terms of business, a placement, or a coaching booking.
• Legal obligation. Where we must process data to comply with the law, for example checking right to work, keeping the records required by the Conduct Regulations, and meeting tax and accounting requirements.
• Consent. Where we ask for your consent for a specific purpose, for example to use special category data. Where we rely on consent, you can withdraw it at any time.

We will always agree with you before we send your CV or details to a client for a specific role.

Automated decisions and AI tools

We do not make decisions about you based solely on automated processing. We use technology, including AI tools provided by third parties, to help our team search our database, review and summarise CVs, compare candidates’ skills and experience with the roles we are recruiting for, score or flag possible matches, and prepare interview materials. This helps us find suitable roles for registered candidates faster and more consistently. These tools support our team and do not replace it. A member of our team reviews the results before we contact you, put you forward to a client, or decide not to progress your details.

You can ask us not to use AI tools to review your details, ask for a person to review any decision about you, or object to this use at any time, by emailing enquiries@cirrusselection.co.uk.

Who we share your personal data with

We share personal data only where we need to, with:

• Clients, to introduce candidates and arrange interviews and placements, once the candidate has agreed;
• Candidates, to arrange interviews and engagements with client contacts;
• Referees, to obtain references you have agreed to;
• Service providers who process data on our behalf, including our recruitment database and jobs platform provider (Firefish Software), our website host (Wix), our email and document storage provider (Microsoft 365), our website analytics provider (Google), and AI and other software providers. They may only use your data to provide services to us, under contracts that require them to keep it secure;
• Professional advisers, such as our accountants, lawyers and insurers;
• Authorities and regulators, such as HMRC or the police, where we are legally required to do so, or to protect the rights, property or safety of Cirrus Selection, our clients or others;
• A buyer or successor, if we sell, transfer or merge all or part of our business.

We do not sell your personal data.

International transfers

Most of the personal data we hold is stored in the UK or the European Economic Area. Some of our service providers may process data in other countries, such as the United States. Where personal data is transferred outside the UK, we make sure it is protected, for example by transferring it to a country the UK considers to have adequate data protection laws (including under the UK–US Data Bridge), or by using the International Data Transfer Agreement or Addendum approved for use in the UK. Please contact us if you would like more information.

How we keep your personal data secure

We use appropriate technical and organisational measures to protect your personal data, including access controls, encrypted connections and reputable, secure service providers. Our website uses HTTPS encryption. If you have a password for our jobs platform, you are responsible for keeping it confidential.

No transmission over the internet is completely secure, but once we receive your information we take reasonable steps to prevent unauthorised access, loss or misuse.

How long we keep your personal data

We keep personal data only for as long as we need it. For candidates and client contacts, this is typically three years from our last meaningful contact with you, after which we delete or anonymise your data unless we have a reason to keep it, for example if you are actively working with us.

Some records are kept for set periods by law, for example records required under the Conduct Regulations (at least one year) and financial records for tax purposes (six years). When deciding how long to keep data, we consider:

• the type of data and why we hold it;
• whether it is still accurate and up to date;
• our legal obligations;
• whether an interview or placement has been arranged; and
• our knowledge of how long careers in our sectors typically take to develop.

If you ask us to delete your data, we may keep a minimal record (for example, your name and email address) so that we do not add you to our database again by mistake.

We aim to keep your data accurate. Before introducing you to a client we check our information is up to date, and you can tell us about changes at any time.

Your rights

You have the right to:

• Access the personal data we hold about you and receive a copy;
• Rectification, to have inaccurate or incomplete data corrected;
• Erasure, to ask us to delete your data where there is no good reason for us to keep it;
• Restriction, to ask us to pause using your data, for example while its accuracy is checked;
• Object to our use of your data where we rely on legitimate interests, and to object at any time to direct marketing;
• Data portability, to receive data you have given us in a commonly used format, or have it sent to another organisation, where technically feasible;
• Withdraw consent at any time, where we rely on consent;
• Complain to us, and to the Information Commission (see below).

To exercise any of these rights, email enquiries@cirrusselection.co.uk. There is usually no charge. We may need to confirm your identity before responding, and we will respond within one month of receiving your request (or of receiving anything we reasonably need to confirm your identity or understand your request). For complex or multiple requests, we may extend this by up to two further months and will tell you if we do. For access requests, we will carry out reasonable and proportionate searches for your information.

Marketing

We may send you information about relevant roles, candidates, market insight or our services. Where the law requires your consent for this, we will ask for it. You can opt out at any time by using the unsubscribe link in our emails or by contacting us.

Cookies

Our website is hosted on Wix, which sets a small number of cookies that are strictly necessary for the site to work securely and reliably. These do not need your consent.

With your consent, we also use Google Analytics, provided by Google, to understand how visitors find and use our site, for example which pages are visited and for how long. Google Analytics sets cookies (named _ga and _ga_ followed by an ID) that last for up to two years. We use this information in aggregate to improve the site, not to identify you. Google may process this data in the United States (see International transfers).

We also set a cookie called cs_cookie_consent to remember your cookie choice for 12 months. It is shared with our jobs pages on jobs.cirrusselection.co.uk so you are not asked twice, and it is strictly necessary, so it does not need consent.

When you first visit our site, a banner asks whether you accept analytics cookies. Google Analytics only runs if you click Accept. You can change your choice at any time using the Cookie settings link at the bottom of every page, or block or delete cookies through your browser settings. We do not use advertising cookies.

Our jobs and candidate registration pages are provided by our recruitment software provider and have their own cookie settings.

Other websites

Our website links to other sites, including our jobs pages, the Cirrus Elevate booking site and LinkedIn. These sites have their own privacy notices, and we are not responsible for how they handle your data. Please check their notices before you submit any personal data.

Complaints

If you are unhappy with how we have handled your personal data, please tell us first so we can put it right. You can complain by email to enquiries@cirrusselection.co.uk, using the enquiry form on our contact page (please mention that it is a data protection complaint), by phone or by post. We will acknowledge your complaint within 30 days, investigate it without undue delay, keep you informed of progress, and tell you the outcome.

If you are not satisfied with our response, you have the right to complain to the UK regulator, the Information Commission (known as the ICO), at ico.org.uk/make-a-complaint or on 0303 123 1113.

Changes to this notice

We review this notice regularly. Any changes will be posted on this page and, where appropriate, we will tell you by email. This notice was last updated on 3 November 2026.

Contact us

Questions, comments and requests about this notice are welcome. Please contact enquiries@cirrusselection.co.uk.