Golden One Recruitment
Legal

GDPR Policy

Last updated: July 2026

1. Overview

Golden One Recruitment Ltd is committed to full compliance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. This policy sets out our approach to data protection and the rights of individuals whose personal data we process.

This policy applies to all personal data processed by Golden One Recruitment, whether held electronically or in paper form.

2. Data Protection Principles

We adhere to the following data protection principles under UK GDPR. Personal data must be:

  • Processed lawfully, fairly and transparently — we always have a lawful basis for processing and are transparent about how we use data.
  • Collected for specified, explicit and legitimate purposes — we only collect data for defined purposes and do not use it in ways incompatible with those purposes.
  • Adequate, relevant and limited to what is necessary — we only collect the data we actually need.
  • Accurate and kept up to date — we take reasonable steps to ensure data is accurate.
  • Kept for no longer than necessary — we have clear retention schedules and delete data when it is no longer needed.
  • Processed securely — we implement appropriate technical and organisational security measures.

3. Lawful Bases for Processing

We rely on the following lawful bases for processing personal data:

  • Contract: Processing necessary to perform or prepare a contract.
  • Legal obligation: Processing required to comply with a legal obligation (e.g. right to work checks, tax obligations).
  • Legitimate interests: Processing for our legitimate business interests, balanced against individuals' rights.
  • Consent: Where individuals have given clear, informed consent (e.g. marketing emails, job alerts).

4. Individual Rights

Under UK GDPR, individuals have the following rights:

  • Right of access: Request a copy of the personal data we hold about you (Subject Access Request).
  • Right to rectification: Request correction of inaccurate or incomplete data.
  • Right to erasure: Request deletion of your data where there is no compelling reason for us to continue processing it.
  • Right to restriction: Request that we restrict processing of your data in certain circumstances.
  • Right to data portability: Receive your data in a structured, commonly used format.
  • Right to object: Object to processing based on legitimate interests or for direct marketing.
  • Rights related to automated decision-making: Not to be subject to solely automated decisions that have a significant effect on you.

To exercise any of these rights, please contact us at [email protected]. We will respond within one calendar month.

5. Data Retention

We retain personal data only for as long as necessary for the purposes for which it was collected:

  • Candidate data: Up to 2 years from last contact, unless you request earlier deletion.
  • Client data: 6 years from the end of the business relationship (for legal and accounting purposes).
  • Website enquiry data: Up to 2 years.
  • Financial records: 7 years (HMRC requirement).

6. Data Security

We implement appropriate technical and organisational measures to protect personal data, including:

  • Secure, encrypted storage of digital data.
  • Access controls limiting data access to authorised personnel only.
  • Regular staff training on data protection.
  • Procedures for detecting, reporting and investigating data breaches.

7. Data Breaches

In the event of a personal data breach that is likely to result in a risk to individuals' rights and freedoms, we will notify the Information Commissioner's Office (ICO) within 72 hours of becoming aware of the breach, and affected individuals without undue delay where the breach is likely to result in a high risk to their rights.

8. International Transfers

We do not routinely transfer personal data outside the UK or EEA. Where any such transfer is necessary, we ensure appropriate safeguards are in place, such as standard contractual clauses approved by the ICO.

9. Complaints

If you are unhappy with how we have handled your personal data, you have the right to lodge a complaint with the Information Commissioner's Office (ICO):

We would, however, appreciate the opportunity to address your concerns before you contact the ICO. Please contact us first at [email protected].

10. Contact Us

For any data protection queries, please contact us at [email protected] or visit our Contact page.