Articles

GDPR Privacy Notice

Last updated: May 2026

Picture More Limited is committed to protecting your privacy and handling personal data responsibly, lawfully and transparently.

This privacy notice explains how we collect, use, store and share personal data in connection with our recruitment services, business operations and website enquiries.

Picture More Limited is a company incorporated in England and Wales with company number 06656925. Our registered office is Marine House, 151 Western Road, Haywards Heath, RH16 3LH.

Our Information Commissioner’s Office registration reference is Z1982742.

For the purposes of data protection law, Picture More Limited acts as a data controller in relation to the personal data we process as a recruitment business.

We are not required to appoint a formal Data Protection Officer, but we have a privacy contact for data protection queries.

You can contact us about this notice or about your personal data at:

Email: matthew.pike@picturemore.co.uk
Post: Picture More Limited, Marine House, 151 Western Road, Haywards Heath, RH16 3LH

1. Who this notice applies to

This notice applies to personal data we process about:

• candidates and work-seekers;
• contractors, consultants and temporary workers;
• client contacts, hiring managers and other business contacts;
• referees, emergency contacts and other individuals whose details may be provided to us;
• users of our website or people who contact us with enquiries;
• suppliers and professional contacts.

2. What personal data we collect

Depending on our relationship with you, we may collect and process some or all of the following:

• name, address, email address, phone number and other contact details;
• CV, employment history, job titles, skills, qualifications and education;
• professional memberships, accreditations and certifications;
• salary, rate expectations, notice period, availability and work preferences;
• interview notes, screening notes, call notes, assessment results and related communications;
• right-to-work, visa or immigration status information where relevant, including information confirming eligibility to work, share code details, check outcomes or related communications;
• copies of passport, driving licence or other identity documentation where required for a specific recruitment, onboarding, compliance or contractual process;
• references and referee details;
• information about roles you have applied for, been submitted for, interviewed for or been placed into;
• contractor engagement information, including timesheets, payroll, payment and tax information where relevant;
• client contact information, including job title, employer, business contact details and recruitment requirements;
• website enquiry information;
• marketing preferences and communication history.

We do not routinely collect or retain copies of identity documents unless they are required for a specific recruitment, onboarding, compliance or contractual purpose. Where right-to-work checks are relevant, we will usually use share codes or other appropriate verification routes rather than retaining copies of identity documents wherever possible.

If you send identity documents to us by email, they may be retained within our email systems and CRM as part of the communication record, unless deleted or otherwise managed in line with our data protection procedures.

In many cases, formal identity, background or pre-employment checks are handled directly by the client or by a specialist screening provider.

We may also process limited special category data where relevant, such as health or disability information for reasonable adjustments, diversity monitoring information, or other sensitive data you choose to provide. We will only process this where permitted by law.

3. Where we get personal data from

We may collect personal data:

• directly from you;
• from your CV, application, email, LinkedIn profile, interview or other communications with us;
• from job boards, CV databases and professional networking platforms where you have made your details available;
• from referrals or recommendations;
• from clients, hiring managers and interviewers;
• from publicly available professional or company information;
• from screening, compliance, payroll or background check providers where relevant;
• from our recruitment CRM, email systems and business records.

Where we receive personal data about you from a third party, we will provide privacy information in line with our legal obligations.

4. Why we use personal data and our lawful bases

We process personal data for the following purposes:

We rely on legitimate interests for many of our core recruitment activities. This is because recruitment depends on identifying, assessing, contacting and maintaining relationships with candidates and client contacts over time. We consider this to be a legitimate business interest, provided that we use personal data in a way that is proportionate, relevant and reasonably expected in the context of recruitment.

Maintaining a recruitment database allows us to consider candidates for current and future opportunities, avoid repeatedly asking for the same information, keep accurate records of previous conversations and submissions, and provide a better service to both candidates and clients.

Our legitimate interests include:

• introducing suitable candidates to clients;
• helping individuals find work;
• maintaining candidate and client relationships;
• keeping accurate recruitment records;
• managing client terms, candidate ownership, submissions and disputes;
• protecting our legal and commercial position;
• improving our services.

Where we rely on legitimate interests, we consider the impact on individuals and their rights. You have the right to object to processing based on legitimate interests in certain circumstances.

5. Special category data and criminal offence data

We do not usually need to process special category data or criminal offence data as part of our standard recruitment services.

Special category data includes information about health, disability, racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic or biometric data, sex life or sexual orientation.

We may process limited special category data where it is relevant to the recruitment process, for example where you tell us about a health condition, disability or adjustment requirement so that we or a client can make appropriate arrangements during the recruitment process.

We may also process information you voluntarily provide to us where you believe it may be relevant to pre-employment screening or background checks. In most cases, formal background checks, criminal record checks, financial checks or other pre-employment screening are carried out directly by the client or by a specialist third-party screening provider appointed by the client.

Where we do process special category or criminal offence data, we will only do so where permitted by law. This may include where processing is necessary for employment-related purposes, to comply with legal obligations, to establish, exercise or defend legal claims, where there is a substantial public interest condition, or where you have given explicit consent and consent is the appropriate basis.

6. Who we share personal data with

We may share relevant personal data with:

• clients and prospective employers for recruitment purposes;
• hiring managers, interviewers and client recruitment teams;
• payroll, umbrella, accountancy or payment providers where relevant to contractor engagements;
• background screening, reference checking or compliance providers where required;
• HMRC, regulators, courts, law enforcement or other authorities where legally required;
• professional advisers, insurers and auditors;
• technology providers who support our recruitment and business systems;
• providers of AI-assisted tools where used to support recruitment activity;

For client submissions, we only share candidate information where there is a relevant recruitment purpose. We do not sell personal data and we do not share personal data with third parties for their own marketing purposes.

7. Our key technology providers

We use trusted third-party systems to help us provide recruitment services and manage our business. Our key technology providers include:

We may also use other technology, communication, hosting, website, compliance, payroll, accounting, AI-assisted or professional service providers where necessary for our business operations. Details of relevant providers are available on request where appropriate.

Our technology providers are required to process personal data securely and only for the purposes for which we use their services.

8. International transfers

Some of our technology providers, group companies, hosting providers, AI-assisted tool providers or support teams may process or access personal data from outside the UK or European Economic Area.

This may include, depending on the systems used and the relevant provider arrangements, countries such as the United States and other locations from which technology support, hosting, development or AI-assisted services are provided.

Where personal data is transferred internationally, we will ensure that appropriate safeguards are in place, such as:

• an adequacy decision;
• the UK International Data Transfer Agreement;
• the UK Addendum to the EU Standard Contractual Clauses;

9. How long we keep personal data

We do not apply a single fixed retention period to all recruitment records. How long we keep personal data depends on factors including:

• the nature of our relationship with you;
• the type of data we hold;
• whether we are actively providing, or may reasonably provide, recruitment or work-finding services;
• whether there has been meaningful contact, engagement or recruitment activity;
• the relevance of your experience to the markets, clients and roles we support;
• the need to maintain accurate records of previous conversations, submissions, introductions, interviews, offers and placements;
• legal and regulatory requirements;
• client terms and candidate ownership periods;
• potential disputes;

As a recruitment business, our ability to provide a proper service to candidates and clients depends on maintaining an accurate and relevant database of candidates, client contacts, vacancies, communications and recruitment history. Candidate and client records may therefore be retained for as long as we have a genuine recruitment, relationship management, legal or business reason to retain them.

We may delete, archive or anonymise records where they are no longer required or where the information no longer appears relevant to the services we provide. You can ask us to delete your personal data at any time, and we will consider that request in accordance with applicable data protection law.

In some circumstances, we may need to retain certain information, for example to comply with legal obligations, maintain suppression records, evidence consent or opt-outs, resolve disputes, enforce client terms, or defend legal claims.

Certain records must be retained for minimum legal periods. For example, the Conduct of Employment Agencies and Employment Businesses Regulations 2003 require employment businesses to keep certain work-seeker records for at least one year from the date of their creation or from the date on which work-finding services last took place. Payroll, tax, accounting and contractor records may be kept for longer where required by law.

10. Security

We take appropriate technical and organisational measures to protect personal data against unauthorised access, loss, misuse, alteration or disclosure.

These measures may include access controls, password protection, role-based permissions, staff training, secure cloud services, confidentiality obligations, backups and appropriate supplier due diligence.

11. Marketing communications

We may contact business contacts and candidates with relevant information about our services, vacancies, market updates, events or industry content.

We comply with applicable data protection law and the Privacy and Electronic Communications Regulations when sending electronic marketing communications.

You can opt out of marketing communications at any time by contacting matthew.pike@picturemore.co.uk or using any unsubscribe option provided.

We will not send electronic marketing where we do not have a lawful basis to do so.

12. Recruitment technology and AI-assisted tools

We may use recruitment technology, search tools and AI-assisted tools to help us organise information, draft communications, analyse job requirements, review CVs, improve searches, summarise information or identify potentially relevant candidates.

This may include the use of general-purpose AI tools where appropriate. Candidate CVs, role information, recruitment notes or related communications may be used with such tools where this supports our recruitment activity.

Where we use AI-assisted tools, we aim to use personal data in a proportionate way, avoid inputting information that is unnecessary for the task, and apply human review before taking action.

We do not make recruitment decisions based solely on automated processing where that decision would have a legal or similarly significant effect on you. Recruitment decisions involve human review and judgement.

13. Your rights

Depending on the circumstances, you may have the following rights:

• the right to be informed about how we use your personal data;
• the right of access to your personal data;
• the right to rectification of inaccurate or incomplete data;
• the right to erasure in certain circumstances;
• the right to restrict processing in certain circumstances;
• the right to data portability in certain circumstances;
• the right to object to processing based on legitimate interests or direct marketing;
• the right not to be subject to solely automated decision-making with legal or similarly significant effects;
• the right to withdraw consent where we rely on consent.

Withdrawing consent does not affect the lawfulness of processing carried out before consent was withdrawn.

To exercise your rights, please contact matthew.pike@picturemore.co.uk.

We may need to verify your identity before responding to a request.

We will usually respond to data protection rights requests within one month. Where a request is complex or where we receive multiple requests, we may extend this period by up to two further months where permitted by law.

14. Complaints

Please contact us first if you have any concerns about how we handle your personal data.

Email: matthew.pike@picturemore.co.uk
Post: Picture More Limited, Marine House, 151 Western Road, Haywards Heath, RH16 3LH

You also have the right to complain to the Information Commissioner’s Office:

Website: https://ico.org.uk/concerns/
Telephone: 0303 123 1113

15. Website and cookies

Our website may contain links to third-party websites. We are not responsible for the privacy practices of those websites.

We use a separate cookie notice to explain how cookies and similar technologies are used on our website. https://www.picturemore.co.uk/terms/cookie-policy

16. Updates to this notice

We may update this privacy notice from time to time. The latest version will be published on our website. Where changes are significant, we may take additional steps to bring them to your attention.