1. Who is responsible
Jamie John Nigel Henderson Jones, trading as Prime Pick Recruitment, is the controller. Business address: 34–35 Butcher Row, Shrewsbury, SY1 1UW. Email: enquiries@primepickrecruitment.co.uk.
2. What we collect
The first registration is deliberately short: name, contact details, current and target role, target compensation, location and mobility, availability, broad work-authorisation status and CV.
If we invite you to a qualification stage, we may ask for more evidence, preferences and the recruitment records required by law. That can include your address and, only if you are under 22, your date of birth. We do not ask for a photograph, passport, National Insurance number or sensitive personal information at initial registration.
3. What we do with it
We use your information to review your profile, assess whether a focused conversation is worthwhile, maintain recruitment records, consider suitable permanent opportunities, prepare an identity-protected Capability Card with your permission, keep the service secure and respond to your requests.
Our main legal bases are legitimate interests, steps taken at your request, legal obligations and legal claims. Optional role and market emails use separate permission where required. We do not sell candidate data.
4. Campaign measurement
We record a campaign label, channel, opportunity family and role, landing path, standard UTM labels and event time so we can understand which routes are useful. Names, contact details, CV text, IP addresses and device fingerprints are not stored in that campaign event. A browser-session flag avoids repeat counts and is not used for cross-site tracking.
5. How decisions are made
Every registration is reviewed by a person. The possible routes are Qualification-worthy, Potential, Needs information or Close. They are recruitment judgments about the information and market context available, not guarantees and not judgments of your worth. Automated scoring does not reject you, accept you for representation, disclose you to employers or submit you for a role. You can correct information or ask for the basis of an outcome through the privacy route.
6. Sharing and identity protection
We do not send your name, contact details, identifiable CV or current employer to an employer without separate permission. A Capability Card is normally pseudonymised personal data—not automatically anonymous—and may identify someone in a narrow market, so we also obtain permission before using one externally.
Service providers may support secure hosting, document storage, communications, verification and professional advice under appropriate contracts. Any overseas processing uses an applicable UK transfer safeguard.
7. Security and retention
CVs are held in private quarantine and are not rendered on the public site. The intake checks size and file signature and accepts PDF or DOCX only. Access, permissions and important changes are logged.
A registration closed before work-finding action is normally deleted 90 days after the Close decision. Needs-information records normally close after 30 days without the missing facts. Potential records are reviewed within 12 months; Qualification-worthy or active records may be kept up to 24 months from meaningful contact with a 12-month refresh. Where regulated agency action is taken, the applicable statutory record minimum is preserved. Superseded CVs normally delete after 90 days. Rights, complaints, security, tax, legal-claim and minimal suppression records follow their separate necessary periods.
8. Your choices and rights
You can ask for access, correction, deletion, restriction, objection, portability, withdrawal of optional marketing permission and human review, depending on the circumstances. You may withdraw from consideration at any time, although some records may still be retained where the law or a legal claim requires it.
9. Contact and complaints
Use the privacy email above or the privacy request form for access, correction, deletion, objection, adjustment or a data-protection complaint. Rights requests are normally answered without undue delay and within one month. Data-protection complaints are acknowledged within 30 days and investigated without undue delay. You may also complain to the Information Commissioner’s Office. Material changes receive a new version date.