Privacy

Privacy Policy
Company or Controller	Thorpe Molloy McCulloch Recruitment Ltd Registered office: 38 Albyn Place, Aberdeen AB10 1YN Registered no: SC176282 T 01224 327 000
Company contact details:	Steve McCulloch Operations Director smcculloch@tmmrecruitment.com T 01224 327 000
Last updated:	6 August 2026

The Company is a recruitment business which provides work-finding services to its clients and work-seekers and other advisory services related to recruitment, including but not limited to market intelligence, psychometric assessment, salary benchmarking and market mapping.

This policy applies to the services provided by TMM Recruitment and TMM Executive (Thorpe Molloy McCulloch Recruitment Ltd).

The Company must process personal data (including special categories of personal data) so that it can provide these services – in doing so, the Company acts as a data controller.

Due to the nature of our business, we can also act as a processor on behalf of our clients. This means that when we are instructed by a client, we facilitate the processing of your personal data on behalf of that client. In this circumstance, the protections that apply to such personal data will be described in the individual privacy policies of those clients, and not in this policy. We encourage you to reach out to them directly and read their privacy policies if you want to learn more about the privacy and data practices of those clients.

You may give your personal details to Company directly, such as on a job application, registration form, job alert subscription, CV upload via our website, dealing with us in person, downloading our content and publications, visiting our office, submitting a request for action or we may collect them from another source such as a jobs board. The Company must have a legal basis for processing your personal data. For the purposes of providing you with work-finding services and/or information relating to roles relevant to you, we will only use your personal data in accordance with this privacy statement. We will comply with current data protection laws at all times.

1. Collection And Use Of Personal Data

a. Purpose of processing and legal basis

The Company will collect your personal data (which may include special categories of personal data) and will process your personal data for the purposes of providing you with work-finding services. This includes for example, contacting you about job opportunities, assessing your suitability for those opportunities, updating our databases, putting you forward for job opportunities, arranging payments to you and developing and managing our services and relationship with you and our clients.

If you have opted-in we may also send you marketing information and news via email/text. You can opt-out from receiving these at any time by clicking “unsubscribe” when you receive these communications from us.

Opting-out of receiving marketing communications does not opt you out of receiving important business communications relating to your current relationship with us such as service announcements.

On some occasions we may be required to use your data for the purpose of investigating, reporting and detecting crime and to comply with laws that apply to us. We may also use your information during internal audits to demonstrate our compliance with certain industry standards.

We must have a legal basis to process your personal data. The legal bases we rely upon to offer our work-finding services to you are:

• Your consent
• Where we have a legitimate interest
• To comply with a legal obligation that we have
• To fulfil a contractual obligation that we have with you

b. Legitimate Interest

This is where the Company has a legitimate reason to process your data provided it is reasonable and does not go against what you would reasonably expect from us in the interests of providing our services and nurturing long-lasting business relationships.

It is reasonable to conclude that processing personal data to provide work-finding services is in the legitimate interests of all parties involved – the recruiter, the work-seeker and the client.

Where the Company has relied on a legitimate interest to process your personal data our legitimate interests are as follows:

For work-seekers and candidates

• Manage our database and maintain work-seeker records up to date;
• Check the identity of work-seekers, their right to work, suitability for the role, qualifications and experience;
• Match your details against job vacancies appropriate for you and provide work-finding services to you;
• Answer your enquiries and questions, understand your needs and how they may be met;
• Contact you by post, email or telephone;
• Allow you to submit your CV, apply for specific jobs or to subscribe to our job alerts;
• Apply for jobs with our clients on your behalf and facilitate the recruitment process;
• Process financial transactions, pay and manage entitlement to certain statutory rights;
• Provide you with information about similar products / services to those that you will have used from us, the employment market, company news and marketing information;
• Conduct statistical analysis, comply with legal and regulatory obligations and pursue or defend a legal claim.
• Enhance and optimise business operations, which may include analysing your engagement with our services and website to develop, improve and provide our services.

For business contacts (prospective clients, clients, prospective suppliers and suppliers)

• Provide recruitment and/or related advisory services to the company you represent including billing and account management purposes;
• Facilitate the recruitment process for the company you represent;
• Fulfil our contractual obligations with the company you represent;
• Manage our database and maintain records up to date;
• Inform you about any relevant industry developments, events, promotions, company news and any other relevant information we consider may be of interest to you in regard to the employment market and similar products / services to those that you may have used from us;
• Respond to your enquiries or questions, understand your needs and how they may be met;
• Conduct statistical analysis, comply with legal and regulatory obligations and pursue or defend a legal claim.
• Enhance and optimise business operations, which may include analysing your engagement with our services and website to develop, improve and provide our services.

For website users

• Fulfil our obligations as a recruitment service provider;
• Respond to your enquiries, questions and requests for service;
• Send you communications where you have indicated you are happy to receive such information.
• Enhance and optimise business operations, which may include analysing your engagement with our website to develop, improve and provide our services.

For referees

• We will use your personal data solely for the purpose of conducting a reference check on a candidate.

c. Statutory/contractual requirement

The Company has certain legal and contractual requirements to collect personal data (e.g. to comply with the Conduct of Employment Agencies and Employment Businesses Regulations 2003, immigration and tax legislation, and in some circumstances safeguarding requirements). Our clients may require this personal data, and we may need your data to enter into a contract with you. If you do not give us the personal data we need to collect in order to comply with our statutory and legal requirements, we may not be able to continue to provide work-finding services to you.

d. Recipient/s of data

The Company will process your personal data and/or sensitive personal data with the following recipients:

• Prospective employers and clients (who we may introduce or supply you to);
• Your former employers who we may seek references from;
• Payroll service providers who manage payroll on our behalf or other payment intermediaries who we may introduce you to;
• Other recruitment agencies in the supply chain;
• Data processors of the Company;
• Auditors who are assessing the compliance and processes of the Company to ensure its adherence to all relevant legislation and good practice guidance;
• Third party service providers assisting with the management of our systems and processes and execution of our services eg IT, email marketing and CRM, pre-employment screening and background checking organisations;
• Your referees;
• Past employers and relevant education authorities;
• Government, law enforcement and other regulators eg HMRC;
• Insurers, legal advisers, social networks.

The Company will not provide any personal information to a client and/or third party (except as provided in this policy and our cookie policy ) unless you have given your consent.

2. Information to be provided when data collected not from the data subject

Categories of data: The Company has collected the following personal data on you:

Personal data:

• Name, address, mobile no., email, job title;
• National insurance no. ;
• Nationality (through right to work check);
• Date of birth;
• Experience, training and qualifications;
• CV.

Special categories of personal data:

• Health information including whether you have a disability;
• Criminal conviction(s).

Source of the personal data: The Company sourced your personal data/special categories of personal data:

• From jobs boards and networking sites such as LinkedIn;
• A former employer;
• A referee whose details you previously provided to us;
• Software providers who we use to support our services;
• Personal referral;
• Cookies.

3. Overseas Transfers

The Company may transfer the information you provide to us to countries outside the UK and/or the European Economic Area (‘EEA’) for the purposes of providing you with work-finding services. We will take steps to ensure adequate protections are in place to ensure the security of your information. The EEA comprises the EU member states plus Norway, Iceland and Liechtenstein.

4. Data Retention

Different laws may also require us to keep different data for different periods of time. For example, the Conduct of Employment Agencies and Employment Businesses Regulations 2003, require us to keep work-seeker records for at least one year from (a) the date of their creation or (b) after the date on which we last provide you with work-finding services. We are required to keep your records relating to the right to work in the UK 2 years after employment or the engagement has ended and working time records including your 48 hour opt out notice annual leave/holiday records 2 years from the time they were created.

We will only retain your personal data for as long as necessary to fulfil the purposes we collected it for or for as long as we have a valid purpose to do so, and in any case as permitted by applicable law, including to comply with any legal, accounting, auditing or reporting requirements.

We view our relationship with you as being one which is to support your career through numerous roles and assignments. Accordingly, we may retain your data for a period which is materially greater than simply one placement if we reasonably believe that we will continue to have an ongoing relationship with you.

We will appropriately and securely dispose of your personal data when it is no longer required. To determine the appropriate retention period for personal data, we will consider the following factors:

• amount and nature of the personal data;
• its sensitivity;
• the potential risk of harm from unauthorised use or disclosure of the personal data;
• the purposes for which we handle your personal data;
• whether we can achieve those purposes through other means; and
• applicable legal requirements.

When we act as a data processor to our clients, the data controllers, we will retain your personal data in accordance with the retention periods prescribed by our clients.

On our websites tmmrecruitment.com and tmmexecutive.com we do not retain website records for: Send Your CV, Submit A Vacancy, Apply Now, PPA Download or Professional, Personal and Academic Reference Requests and contact form enquiries.

Data Processing	Duration
Job Alert Emails	You can unsubscribe at any time using the link included in every job alert email. If you do not verify your job alert sign-up your data will be deleted 7 days after the verification email is issued. If you unsubscribe from job alert your data will be deleted immediately.
Registration Form	Records are deleted from our web hosting secure servers 7 calendar days after the completed registration form is submitted. The web records for generated but not accessed, or accessed and partially completed, will be deleted 7 days after the registration form link was generated.
Salary Guide Download	Personal data provided to access the Company's Northeast Salary Guide will be retained for two years, after which it will be securely deleted unless a longer retention period is required.

5. Your Rights

Please be aware that you have the following data protection rights:

• The right to be informed about the personal data the Company processes on you;
• The right of access to the personal data the Company processes on you;
• The right to rectification of your personal data;
• The right to erasure of your personal data in certain circumstances;
• The right to restrict processing of your personal data;
• The right to data portability in certain circumstances;
• The right to object to the processing of your personal data that was based on a public or legitimate interest;
• The right not to be subjected to automated decision making and profiling; and
• The right to withdraw consent at any time.

Where you have consented to the Company processing your personal / and sensitive personal data you have the right to withdraw that consent at any time by contacting Steve McCulloch, Operations Director on smcculloch@tmmrecruitment.com. Please note that if you withdraw your consent to further processing that does not affect any processing done prior to the withdrawal of that consent, or which is done according to another legal basis.

There may be circumstances where the Company will still need to process your data for legal or official reasons. Where this is the case, we will tell you and we will restrict the data to only what is necessary for those specific reasons.

If you believe that any of your data that the Company processes is incorrect or incomplete, please contact us using the details above and we will take reasonable steps to check its accuracy and correct it where necessary.

You can also contact us using the above details if you want us to restrict the type or amount of data we process for you, access your personal data or exercise any of the other rights listed above.

Where permitted by law, you may be charged a fee to access your personal data or to exercise any other privacy right that may apply to you. We will let you know if a fee applies to your request before we complete it.

6. Cookies

We may obtain data about you from cookies. These are small text files that are placed on your computer by websites that you visit. They are widely used to make websites work, or work more efficiently, as well as to provide information to the owners of the site. Cookies may also enable us to deliver more personalised content.

Our websites may include embedded content from other websites (eg Youtube videos). Embedded content behaves in the same way as if the visitor has visited the originator website. These websites may collect data about you, use cookies and monitor your interaction with that embedded content.

Most web browsers allow some control of most cookies through the browser settings. To find out more about cookies, please refer to our cookie policy . Please note that in a few cases some of our website features may not function if you remove cookies from your browser.

7. Login Files

We may use IP addresses to analyse trends, administer the site, track users’ movements, and to gather broad demographic information for aggregate use. IP addresses are not linked to personally identifiable information.

8. Links to external websites

The Company’s website may contain links to other external websites. Please be aware that the Company is not responsible for the privacy practices of such other sites. When you leave our site we encourage you to read the privacy statements of every website that collects personally identifiable information. This privacy statement applies solely to information collected by the Company’s websites.

9. Sale of business

If the Company’s business is sold or integrated with another business your details may be disclosed to our advisers and any prospective purchasers and their advisers and will be passed on to the new owners of the business. Where the sale of the business results in the transfer of your details to a different data controller we will notify you of this.

10. Sale of business

We take the security of your personal information seriously and implement appropriate technical and organisational measures to protect it against unauthorised access, loss, misuse, alteration, or disclosure.

Our website uses Secure Sockets Layer (SSL) / Transport Layer Security (TLS) encryption to protect information transmitted between your browser and our servers. When you access our website over HTTPS, data exchanged is encrypted to help prevent interception by third parties.

Only employees who need the information to perform a specific job (for example, consultants, our accounts clerk or a marketing assistant) are granted access to your information. We use appropriate security measures, which may include:

• Access controls and authentication.
• Regular software updates and security patches.
• Firewalls and system monitoring.
• Secure backup procedures where appropriate.

The Company uses all reasonable efforts to safeguard your personal information. However, you should be aware that no method of electronic transmission or storage is completely secure. Therefore, we cannot guarantee absolute security.

If you share a device with others, we recommend that you do not select the “remember my details” function when that option is offered.

If you believe you have identified a security issue with our website or have questions about the security at our website, you can email Steve McCulloch, Operations Director on smcculloch@tmmrecruitment.com .

11. Changes to this privacy statement

We will update this privacy statement from time to time. We will post any changes on the statement with revision dates.

12. Complaints or queries

If you wish to complain about this privacy notice or any of the procedures set out in it, please contact: Steve McCulloch, Operations Director on smcculloch@tmmrecruitment.com .

You also have the right to raise concerns with the Information Commissioner’s Office on 0303 123 1113 or at https://ico.org.uk/make-a-complaint/ , or any other relevant authority should your personal data be processed outside of the UK and you believe that your data protection rights have not been adhered to.