We collect only the information we need to do our work. We use it to provide our services, run recruitment properly and respond to you. Candidate details are never sent to an employer without the candidate's permission. We do not sell personal information. We keep it only as long as needed, we protect it with sensible measures, and you can ask at any time what we hold and have it corrected or deleted.
Introduction
Hackles & Co is committed to handling personal information responsibly, transparently and in line with UK data protection law, including the UK GDPR and the Data Protection Act 2018.
Trust is central to how we work. Clients trust us with their business information, candidates trust us with their careers, and suppliers trust us with their commercial details. We take that seriously. We collect only the information we need, we use it only for the purposes we collected it for, we keep it secure with reasonable measures, and we do not keep it longer than necessary.
This policy describes how that works in practice. It covers website visitors, prospective and existing clients, job candidates, supplier contacts, business contacts and referral partners. By using our website or working with us, you are covered by this policy, and we encourage you to read it.
Who We Are
Hackles & Co helps small and growing businesses get practical business needs sorted through one clear route. We provide recruitment and staffing support, Business Presence Reviews and Business Essentials Reviews directly, and we help arrange specialist support, such as utilities, business insurance, HR, compliance, payroll-style support, PA and admin support, vehicle security and specialist commercial services, through third-party providers.
For the purposes of UK data protection law, Hackles & Co is the controller of the personal information described in this policy. That means we decide how and why that information is used, and we are responsible for looking after it.
Information We Collect
What we collect depends on who you are and how you interact with us. The categories below cover the typical information involved; in each case we aim to collect only what the purpose genuinely needs.
Website visitors and enquirers
Name, email address, phone number, the content of your enquiry, and technical information such as IP address and browser or device information collected when you visit the site.
Clients and prospective clients
Contact details, company information, information about your business relevant to the agreed work, project and engagement information, billing details, and service-related communications between us.
Job candidates
CVs, contact details, employment history, qualifications, salary expectations, notice periods, preferences, interview notes and feedback, right-to-work information, and our communications with you. Candidate information is covered in detail in Section 07.
Suppliers, partners and business contacts
Contact details, commercial information such as the services offered and terms discussed, records of introductions and outcomes, and our communications.
We do not deliberately collect special category information (such as health information) unless it is genuinely needed, for example where a candidate chooses to tell us something relevant to a role, and where we do hold it, we treat it with extra care.
How We Collect Information
Almost all the information we hold comes directly from you. We collect information through:
- Forms on our website
- Emails you send us
- Phone calls
- Meetings and conversations
- Candidate registrations and submissions
- Referrals and recommendations from others
- Direct conversations at events or in business settings
Where someone else gives us your details, for example a referral partner suggests we speak to you, or a candidate names you as a referee, we use those details only to make the relevant contact, and this policy applies from that point.
Why We Use Information
We use personal information for a small number of practical purposes:
- Providing our services, including recruitment and staffing support, Business Presence Reviews and Business Essentials Reviews.
- Recruitment activities, such as matching candidates to roles, arranging interviews and managing placements.
- Client communications, keeping you informed about work in progress and matters relevant to your engagement.
- Arranging specialist support, where you have asked us to help arrange support through a third-party provider.
- Responding to enquiries from the website, by email or by phone.
- Meeting legal obligations, such as tax, accounting and, where relevant, right-to-work requirements.
- Improving our services, by understanding how enquiries reach us and how our work is received.
We do not sell personal information, and we do not use it for automated decision-making that produces legal or similarly significant effects.
Lawful Basis for Processing
- Contract
- Where we use your information to provide services you have engaged us for, or to take steps you have asked for before an engagement, for example preparing a proposal. Most client work relies on this basis.
- Consent
- Where you have clearly agreed to something, most importantly a candidate agreeing that their details can be submitted to a particular employer. Consent can be withdrawn at any time.
- Legitimate interests
- Where using information is necessary for running our business in ways you would reasonably expect, for example keeping records of enquiries, maintaining supplier contacts, or following up after work is delivered. We balance our interests against your rights, and we do not rely on this basis where your interests outweigh ours.
- Legal obligation
- Where the law requires us to hold or share information, for example financial records for tax purposes or right-to-work checks in recruitment.
Candidate Information
If you register with us as a candidate, this section explains exactly how your information is handled.
Your consent comes first. When you register, you consent to us holding your details, CV and work history for the purpose of finding you suitable work.
Your details are only shared with your permission. We never send your CV or details to an employer without your agreement for that specific role. No exceptions, and no surprise submissions.
How we use your information. To assess your fit for roles, discuss opportunities with you, arrange interviews, pass on feedback, manage offers and placements, and meet legal requirements such as right-to-work checks.
How long we keep it. We typically keep candidate records for up to two years from our last meaningful contact with you, so we can consider you for future roles. Records connected to a placement are kept longer, in line with the retention periods in Section 10.
You can withdraw consent at any time. Contact us and we will stop putting you forward for roles and remove your details from our active records, subject only to anything we are legally required to keep, such as records relating to a completed placement.
Interview notes and feedback are recorded fairly and professionally, and you are welcome to ask what we hold about you at any time, as set out in Section 12.
Specialist Support Arrangements
Where you ask us to help arrange specialist support, for example utilities, business insurance, HR support or payroll-style support, we may need to share relevant information with the specialist provider so they can help you. We share only what is needed for the introduction or coordination, and only where we have an appropriate basis to do so: usually your agreement to the introduction, or the steps you have asked us to take.
Specialist providers are separate businesses. Once introduced, they handle your information under their own privacy policies and remain responsible for their own services and privacy practices. We choose providers we consider reputable, but we do not control them, and we encourage you to read their privacy information when engaging them.
Data Sharing
We share personal information only where there is a genuine purpose for doing so, and never by selling it. Depending on the situation, information may be shared with:
- Service providers
- Companies that support how we run, such as IT, email, document storage and accounting software providers, who process information on our behalf under appropriate protections.
- Recruitment clients
- Employers considering a candidate, with the candidate's permission for that role, as described in Section 07.
- Specialist providers
- Third-party providers we introduce or coordinate at your request, as described in Section 08.
- Professional advisers
- Our accountants, solicitors and insurers, where needed for the proper running of the business.
- Regulators and authorities
- Where we are required to share information by law, by a regulator such as the Information Commissioner's Office, or by a court.
We expect everyone we share information with to protect it appropriately, and we keep the information shared to what the purpose requires.
Data Retention
We keep personal information only as long as it is needed for the purpose it was collected for, or as long as the law requires. As a guide, our typical retention periods are:
| Information | Typical retention period |
|---|---|
| Website and general enquiries that do not become clients | Up to 12 months after our last contact |
| Client records and engagement files | Duration of the relationship, then up to 6 years after the engagement ends, in line with legal and accounting requirements |
| Candidate records (no placement made) | Up to 2 years from our last meaningful contact, unless consent is withdrawn earlier |
| Placement records | Up to 6 years after the placement, in line with contractual and legal requirements |
| Supplier and partner records | Duration of the relationship, then up to 6 years |
| Financial and tax records | At least 6 years, as required by law |
These are typical periods rather than fixed promises: actual periods may vary depending on legal, regulatory or operational requirements in a particular case. When information is no longer needed, it is deleted or securely destroyed.
Data Security
We take reasonable and proportionate measures to keep personal information secure. In practice this means information is stored in secure, access-controlled systems; access is limited to the people who need it for their work; devices and accounts are protected with appropriate controls; and everyone working in the business treats personal information as confidential.
We want to be honest rather than impressive on this subject: no organisation can promise that security incidents will never happen. What we commit to is taking sensible precautions, reviewing them as the business grows, and acting quickly and openly if something ever goes wrong, including notifying you and the Information Commissioner's Office where the law requires it.
Your Rights
UK data protection law gives you rights over your personal information. In plain English:
- Access
- You can ask for a copy of the personal information we hold about you.
- Correction
- You can ask us to correct information that is wrong or incomplete.
- Deletion
- You can ask us to delete your information where there is no good reason for us to keep it.
- Restriction
- You can ask us to pause our use of your information in certain situations, for example while a correction is checked.
- Objection
- You can object to our use of your information where we rely on legitimate interests, and we will stop unless there is a compelling reason to continue.
- Portability
- You can ask for information you provided to us in a format that can be passed to another organisation, where it was processed by consent or contract.
- Complaints
- You can complain to us at any time, and to the Information Commissioner's Office, as set out in Section 15.
To exercise any of these rights, contact us using the details in Section 16. We do not charge for reasonable requests, and we aim to respond within one month. We may need to confirm your identity before acting on a request, which protects your information rather than obstructs you.
Cookies
Our website uses cookies and similar technologies: small files that help the site work properly and help us understand how it is used. Some are essential for the site to function; others, such as analytics cookies, are used only with your consent where required. Full details of the cookies we use, what they do and how to manage them are set out in our separate Cookie Policy, available on our website. You can also control cookies through your browser settings at any time.
Third-Party Websites
Our website and communications may contain links to other websites, including those of specialist providers and partners. Those sites have their own privacy policies, and Hackles & Co is not responsible for their content or how they handle your information. We encourage you to read the privacy information of any site you visit.
Complaints
If you have a concern about how your information has been handled, please raise it with us first: we take privacy concerns seriously and will look into any issue properly and respond clearly. Contact us at contact@hackles.co.uk.
You also have the right to complain to the UK's data protection regulator, the Information Commissioner's Office (ICO), at any time. The ICO can be contacted through its website at ico.org.uk or by phone on 0303 123 1113. We would welcome the chance to address your concern first, but that choice is always yours.
Contact Us
Questions about this policy, or about how your information is handled, can be directed to:
Policy Updates
We review this policy regularly and update it when our services, systems or legal requirements change. The current version is always available on our website, and the version and date are shown in Section 18. Where a change significantly affects how your information is used, we will take reasonable steps to bring it to your attention.
Version Control
| Version | Date | Changes |
|---|---|---|
| 1.0 | June 2026 | First issue |
Related documents
- Cookie Policy: full details of the cookies used on our website and how to manage them.
- Terms of Business: the terms that apply to our services, provided with every engagement.