Version 1.1 | 10 August 2026 | CareerPath Recruitment Ltd

CareerPath acts as an employment agency and data controller for its

recruitment activities

We use personal information to provide work-finding and recruitment services

We will not submit your CV or identifying profile to a specific client for a

specific opportunity without your authorisation

We do not make solely automated decisions about candidates that produce legal

or similarly significant effects

You can contact us at info@careerpathrecruitment.co.uk or 0330 223 8201 about

your personal information

Background

CareerPath Recruitment Ltd (“CareerPath”, “we”, “us” or “the Company”) is a recruitment business which provides work-finding services to clients and work-seekers. CareerPath acts as an employment agency when introducing candidates for permanent or fixed-term roles where the candidate is engaged directly by the client. To provide these services, we process personal data and, where necessary and lawful, special category personal data or criminal offence data. For the recruitment activities described in this notice, CareerPath generally acts as a data controller. You may give us personal information directly, for example through our website, a vacancy application, Talent Network sign-up, registration, CV, employer enquiry form, email, telephone call or other communication. We may also obtain information from sources such as job boards, professional networking platforms, referrals, clients, company websites and publicly available professional sources where it is lawful and appropriate to do so. We will use personal data only where we have an appropriate lawful basis and in accordance with this Privacy Notice and applicable data protection law.

1. Information About Us

Company: CareerPath Recruitment Ltd Company number: 17351767 Registered office: 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ Website: careerpathrecruitment.co.uk Data Protection Lead: Director, CareerPath Recruitment Ltd Email: info@careerpathrecruitment.co.uk Telephone: 0330 223 8201 Postal address for data protection enquiries: CareerPath Recruitment Ltd, 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ

2. What Does This Notice Cover?

This Privacy Notice explains how CareerPath collects, uses, stores, shares and protects personal data in connection with its recruitment and work- finding services. It also explains your rights under data protection law and how to contact us or raise a concern. This notice is intended for candidates and prospective candidates, including people who join the CareerPath Talent Network. It also applies, where relevant, to referees, client and prospective-client contacts, hiring managers and other individuals whose personal data we process in connection with recruitment, relationship management and business development.

3. What Is Personal Data?

Personal data is information relating to an identified or identifiable individual. It includes obvious information such as a name, email address and telephone number, but can also include identification numbers, online identifiers, employment information and other information which identifies or can reasonably be linked to an individual. Certain types of information receive additional protection. “Special category” data can include information about health, racial or ethnic origin, religious or philosophical beliefs, trade union membership, genetics, biometrics used for identification, sex life or sexual orientation. Criminal offence data is also subject to additional legal safeguards.

4. What Are My Rights?

Subject to the conditions and exemptions in applicable law, you have the following rights in relation to your personal data: The right to be informed about how your personal data is collected and used. The right of access to personal data we hold about you. The right to have inaccurate personal data corrected and incomplete data completed. The right to request erasure of personal data in certain circumstances. The right to request restriction of processing in certain circumstances. The right to object to processing in certain circumstances, including direct marketing. The right to withdraw consent at any time where consent is the lawful basis for processing. Withdrawal does not affect the lawfulness of processing carried out before withdrawal. The right to data portability in circumstances where the legal requirements for that right are met. Rights relating to solely automated decision-making and profiling where applicable. CareerPath does not currently use solely automated decision-making about candidates that produces legal effects or similarly significant effects. Technology may be used to assist administrative, search, matching or recruitment activity, but material decisions about candidate representation or submission are subject to human involvement. It is important that the information we hold about you is accurate and up to date. Please tell us if your personal information changes while we retain it. You may exercise your rights by contacting us using the details in section 11. We may need to verify your identity before acting on a request. Rights are not absolute, and in some circumstances the law allows or requires us to retain or continue processing information. You also have the right to complain to the Information Commissioner’s Office (ICO). We would welcome the opportunity to address your concern first, but you are not required to contact us before approaching the ICO.

5. What Personal Data Do We Collect and How?

Depending on your relationship with CareerPath and the roles for which you are considered, we may collect and hold some or all of the following information. We aim to collect only information that is relevant and reasonably necessary for recruitment and compliance purposes.

Identity and contact

Examples

Name, title, address where required, email address and telephone number.

Typical sources

You; applications; registration forms; communications; job boards or professional platforms.

Career and work information

Examples

CV, employment history, job titles, experience, skills, availability, salary expectations, location preferences and other work preferences.

Typical sources

You; your CV; applications; interviews; professional profiles; job boards.

Qualifications and professional information

Examples

Education, training, qualifications, licences, registrations, memberships and other role-related credentials.

Typical sources

You; your CV; relevant professional or awarding bodies where appropriate.

Recruitment records

Examples

Vacancies considered, applications, authorisations to represent you, client submissions, interview arrangements, feedback, offers, remuneration and start-date information.

Typical sources

You; CareerPath records; clients; recruitment communications.

Right-to-work and suitability information

Examples

Nationality or immigration/right-to-work information where necessary, identity evidence, references and other information required to establish suitability for a role.

Typical sources

You; referees; clients; relevant official or professional sources where lawful.

Special category information

Examples

Only where necessary and lawful, for example health or disability information relevant to reasonable adjustments, or equality information where collected for a lawful purpose.

Typical sources

Normally you; occasionally a client or other lawful source where appropriate.

Criminal offence information

Examples

Only where a role and the law justify its collection, such as information connected with an appropriate criminal-record or safeguarding check.

Typical sources

You or an authorised checking/safeguarding process where lawful.

Technical and communications information

Examples

Email correspondence, telephone notes, CRM records, website enquiry information and limited technical information generated through use of our systems or website.

Typical sources

You; our communications, CRM, website and service providers.

Referee and third-party information

Examples

Names, roles and contact details of referees or other recruitment contacts provided in connection with your application.

Typical sources

You; the relevant individual; client or professional sources where appropriate.

You are not generally obliged to provide personal data to CareerPath. However, if you do not provide information that is reasonably required to assess or progress your application, provide work-finding services, verify suitability, or meet a legal obligation, we may be unable to provide some or all of our services or progress you for a particular role.

6. How Do We Use My Personal Data?

CareerPath processes personal data to provide and manage recruitment and work-finding services. This may include: registering and communicating with candidates and prospective candidates; maintaining the CareerPath Talent Network and keeping member profiles in our approved recruitment/CRM system so that we can search, match and contact members about suitable current and future vacancies; understanding your experience, preferences, availability and career interests; identifying and discussing potentially relevant vacancies; assessing suitability for particular opportunities; obtaining your authorisation to represent you for a specific opportunity; submitting your CV or candidate profile to a client after appropriate authorisation; arranging interviews, communicating feedback and facilitating offers; checking qualifications, references, right-to-work or other suitability information where appropriate and lawful; maintaining recruitment, client, compliance and audit records; managing our relationship with candidates and clients, improving our services and administering our business; maintaining relationships with clients, former clients, prospective corporate clients, hiring managers and other professional contacts, including proportionate business-development activity; establishing, exercising or defending legal rights and responding to lawful requests from regulators, courts, public authorities or law-enforcement bodies where required or permitted by law; and preventing or detecting fraud, misuse, unlawful activity or security incidents where necessary and lawful.

7. What Lawful Bases Do We Rely On?

The lawful basis depends on the particular processing activity. CareerPath may rely on one or more of the following bases: Legitimate interests – where processing is necessary for our legitimate interests or those of a third party and those interests are not overridden by your interests, rights and freedoms. This may include operating a recruitment business, maintaining candidate and Talent Network records, identifying suitable opportunities, managing client and prospective-client relationships, proportionate B2B business development, maintaining security and establishing or defending legal rights. We will apply the legitimate- interests test where required. Talent Network membership – where you actively ask to join the CareerPath Talent Network, we will record that choice and use your profile for ongoing future-vacancy matching and contact. Depending on the processing activity, CareerPath may rely on legitimate interests and/or consent. Where we specifically rely on consent, you may withdraw it at any time. Leaving the Talent Network stops future Talent Network processing, subject to records CareerPath is legally entitled or required to retain. Consent – where we ask for and obtain your consent for a particular use. Where consent is relied upon, you may withdraw it at any time. Legal obligation – where processing is necessary to comply with a legal obligation that applies to CareerPath, including obligations arising under recruitment, employment agency, data protection or other applicable law. Contract – in limited circumstances, where processing is necessary to take steps at your request before entering into a contract with you or to perform a contract with you. Your authorisation for CareerPath to submit your CV or identifying profile to a specific client for a specific opportunity is an operational instruction to represent you. It is separate from the question of which lawful basis under data protection law applies to the underlying processing. Where we process special category personal data, we will also identify an appropriate condition under Article 9 UK GDPR and, where required, Schedule 1 of the Data Protection Act 2018. This may include explicit consent where appropriate, employment and social protection law obligations or rights, legal claims, or another condition permitted by law. Where we process criminal offence data, we will do so only where Article 10 UK GDPR and the Data Protection Act 2018 permit it and where any required policy document or additional safeguard is in place. We will use personal data for the purposes for which it was collected. If we need to use it for another purpose, we will consider whether that purpose is compatible with the original purpose and, where required, provide further information or identify another lawful basis.

8. How Long Will We Keep My Personal Data?

CareerPath keeps personal data only for as long as reasonably necessary for the purposes for which it was collected, including ongoing Talent Network membership, recruitment, client relationship management, legal, regulatory, accounting, dispute and record-keeping requirements. Retention is reviewed periodically under our Data Retention Policy. The Conduct of Employment Agencies and Employment Businesses Regulations 2003 require specified work-seeker and recruitment records to be kept for prescribed periods. Relevant work-seeker records are generally retained for at least one year from the later applicable point required by those Regulations, including the date the record was created or the date on which CareerPath last provided work-finding services, as applicable. For ordinary candidate records outside the Talent Network, CareerPath generally applies a retention period of up to two years after the last meaningful recruitment activity, subject to statutory minimums and any longer period justified for legal or evidential purposes. For a person who actively joins the CareerPath Talent Network, the core candidate profile may be retained for the duration of that membership so CareerPath can consider and contact the member about suitable future vacancies. Talent Network records are reviewed periodically for accuracy, relevance and continued necessity; members may leave the Talent Network or ask us to stop this processing at any time. We may retain limited information afterwards where required or permitted by law, including recruitment records, legal- claims evidence and suppression records. Company information that does not identify a living individual is not personal data under UK GDPR. Where we hold personal data about client, former-client or prospective-client contacts, we may retain it while the business relationship or legitimate business-development purpose remains active and for an appropriate period afterwards. Contract, placement, invoice and regulatory records may be retained for longer where required for legal, tax, accounting or claims purposes. Marketing objections and opt- outs may be kept on a minimal suppression list so that we can respect them. Information collected for a particular check or purpose may be retained for a different period where the law, the nature of the information or the purpose requires it. When information is no longer required, we will delete it, anonymise it, or otherwise dispose of it securely in accordance with our retention arrangements. Where CareerPath carries out B2B marketing, UK GDPR applies to named business contacts. PECR rules depend on the communication method and whether the recipient is a corporate subscriber or an individual subscriber such as a sole trader or certain partnerships. We will provide required opt- outs, respect objections to direct marketing and maintain proportionate suppression records.

9. How and Where Do We Store or Transfer Personal Data?

Personal data may be stored in CareerPath’s recruitment and customer relationship management systems, email and communications systems, secure cloud storage, website systems and other business records used to provide and administer our services. CareerPath uses third-party technology and service providers. As a result, some personal data may be processed or accessed outside the United Kingdom. Where personal data is transferred internationally, we will use a lawful transfer mechanism and appropriate safeguards as required by UK data protection law. Depending on the destination and circumstances, these may include UK adequacy regulations, the UK International Data Transfer Agreement, the UK Addendum to approved EU Standard Contractual Clauses, or another legally permitted safeguard. We take reasonable and proportionate technical and organisational measures to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access. Measures include access controls, use of reputable business systems and service providers, password and account-security controls, confidentiality requirements, appropriate backups and procedures for responding to suspected personal data breaches. No system can be guaranteed to be completely secure. If a personal data breach occurs, CareerPath will assess it and notify affected individuals and/or the ICO where the law requires us to do so.

10. Do We Share My Personal Data?

We may share personal data where it is necessary and lawful for recruitment, administration, compliance or legal purposes. Recipients may include: clients and prospective employers, but CareerPath will not submit your CV or identifying candidate profile to a specific client for a specific opportunity without your authorisation; referees and former employers where reference checking is appropriate and lawful; professional, qualification, licensing, screening or safeguarding bodies where a relevant check is necessary and lawful; technology, CRM, website, communications, cloud, IT support and other service providers acting for or supporting CareerPath; professional advisers such as accountants, insurers, legal advisers or auditors where necessary; government departments, regulators, courts, law-enforcement bodies or other public authorities where disclosure is required or permitted by law; and a purchaser, investor or successor organisation in connection with a genuine corporate transaction, subject to appropriate confidentiality and data-protection safeguards. We do not sell candidate personal data. Where a service provider processes personal data on our behalf, we will put appropriate contractual and security arrangements in place as required by law. Where another organisation determines its own purposes and means of processing, it may act as an independent controller and will be responsible for its own data- protection obligations.

11. How Can I Access My Personal Data or Contact CareerPath?

You can ask us whether we hold personal data about you and request a copy of that information. This is commonly known as a subject access request. We will carry out reasonable and proportionate searches for personal data covered by a valid request and respond within the period required by data protection law. There is normally no charge for exercising your data-protection rights. The law may permit a reasonable fee or allow us to refuse to act where a request is manifestly unfounded or excessive. We may ask for information reasonably necessary to confirm your identity or clarify the scope of your request. To exercise a data-protection right, ask a question or make a complaint about our handling of personal data, contact: Data Protection Lead CareerPath Recruitment Ltd Email: info@careerpathrecruitment.co.uk Telephone: 0330 223 8201 Postal address: 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ You can also complain to the Information Commissioner’s Office. Current contact and complaint information is available from the ICO.

12. Changes to This Privacy Notice

We may update this Privacy Notice from time to time, for example if the law, regulatory guidance, our services, systems or business practices change. The current version will be made available through the CareerPath Recruitment website and may also be provided directly where appropriate. This Privacy Notice was last updated on 10 August 2026.