This Privacy Policy explains how WOODHOUSE & DEPENDENT Ltd processes personal data in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and the Data (Use and Access) Act 2025 (DUAA). It applies to all individuals whose data we process, including Candidates, Clients, Temporary Workers, Suppliers, Website Users, and others we interact with.

We are committed to protecting your privacy and ensuring your personal data is handled securely and lawfully.

• Identification & Contact: Name, date of birth, gender, address, email, phone number
• Employment & Education: CV, work history, qualifications, salary expectations
• Legal & Compliance: National Insurance number, immigration status, criminal convictions (if required), driving licence
• Sensitive Data (where necessary and with your consent): Health/disability information, diversity data
• Emergency & Reference Contacts
• Website Usage Data: Collected via cookies (see Cookie Policy)

• Directly from you (e.g. job applications, contact forms)
• Via third parties (e.g. job boards, referrals)
• From clients or suppliers during service delivery
• Automatically via cookies and analytics tools on our website

• To match you with suitable job opportunities (permanent or temporary)
• To communicate with you about roles, updates, or services
• To fulfil contractual obligations with clients and suppliers
• To comply with legal obligations (e.g. right to work checks)
• To improve our services and website functionality

We rely on the following lawful bases under UK GDPR:

• Consent – e.g. when you ask us to keep your CV on file
• Contractual necessity – e.g. when we place you in a role
• Legal obligation – e.g. for tax or right-to-work checks
• Legitimate interests – e.g. to match candidates with roles, improve services

Under the DUAA 2025, we may also rely on Recognised Legitimate Interests, such as safeguarding or fraud prevention, which do not require a full balancing test.

We only share your data:

• With vetted clients, and only with your explicit permission
• With suppliers or partners as needed to deliver services
• With authorities if legally required (e.g. HMRC, law enforcement)

We do not sell your data.

We retain your data only as long as necessary for the purposes outlined above. You may request deletion at any time, subject to legal or contractual obligations.

We use secure systems, encryption, and access controls to protect your data from unauthorized access, loss, or misuse.

You have the right to:

• Access your data
• Request correction or deletion
• Object to or restrict processing
• Data portability
• Withdraw consent at any time

To exercise your rights, email: MM@woodhouseindependent.com with proof of identity.

If you have concerns about how we handle your data, you can contact the Information Commissioner's Office (ICO) at ico.org.uk.