Version 1.0 | Effective date: 21 September 2026
1. Who we are
Northline is a recruitment business operating through the website https://northlinerecruitment.com/. In this notice, “Northline”, “we”, “us” and “our” mean Northline Recruitment Ltd, trading as Northline. We are the controller of the personal data described in this notice.
Privacy contact: info@northlinerecruitment.com.
This notice explains how we collect, use, disclose and retain personal data about candidates, prospective candidates, client and prospective-client contacts, referees, website users, suppliers and other business contacts.
2. The information we collect
Candidates and prospective candidates
identity and contact details, including name, address, email address and telephone number;
account and login details for the candidate portal;
CV and career information, including qualifications, skills, training, employment history, job preferences, salary or rate expectations, availability and right-to-work information;
job applications, supporting statements, screening answers, interview notes, communications and feedback;
information supplied when we verify identity, qualifications, employment history, references or suitability for a role;
information about reasonable adjustments or other needs relevant to the recruitment process; and
where necessary and lawful, special category data or criminal-offence data, as described below.
Clients, employers and business contacts
name, role, organisation, work contact details and account details;
vacancy details, hiring requirements, communications, meeting notes and commercial relationship information;
employer-portal submissions and job adverts awaiting review, approved, rejected or deleted; and
billing, contractual and transaction records where relevant.
Website and technical information
information entered in our candidate and employer portals;
basic technical and security records such as IP address, device/browser information, login records and server logs; and
essential cookie or session information required for the website, portals, security and account authentication to operate.
Please do not provide personal data about another person unless you are authorised to do so and they have been given appropriate privacy information.
3. How we collect information
We collect personal data directly from you when you create an account, upload a CV, apply for a job, submit a vacancy, complete a form, contact us or communicate with us. We may also obtain information from:
publicly available professional sources, such as company websites and professional networking platforms;
job boards or other recruitment platforms where you have made your details available to recruiters;
referees, former employers, education providers and qualification bodies, with appropriate authority;
clients and candidates during a recruitment process; and
service providers that support our website, email, hosting, IT security and business administration.
If we obtain your personal data from another source, we will provide privacy information within the period required by law, unless an exception applies.
4. How our website and portals operate
Candidate portal
Candidates can create and manage an account, upload a CV and apply for advertised vacancies. Applications and uploaded CVs are received by Northline first and are accessible through Northline’s restricted admin portal. Employers cannot search or browse the candidate database through the website. Candidates can request deletion of their account and CV by contacting Northline at info@northlinerecruitment.com, subject to the limited retention described in section 11.
You can also submit your CV, contact details and an optional cover letter using the Candidates page without creating an account. Direct submissions are available only to authorised Northline administrators and are not automatically added to an account with the same email address. Account holders can update their profile and replace or remove documents in their portal.
Employer portal
Employers can create an account and submit vacancy information. A submitted vacancy is not published automatically. Northline manually reviews it and may approve, reject, edit in consultation with the employer, or delete it. Information within an unpublished submission is not visible to candidates. Once approved, the job information intended for publication becomes visible on the website; employers should therefore avoid including unnecessary personal data in job descriptions.
Employers can access only their own vacancies and supporting documents. Editing a published vacancy takes it offline until Northline approves it again. Uploaded job specifications remain private to the submitting employer and Northline administrators.
CV submission and applications
Applications come to Northline first. Employers do not receive portal access to CVs. Before sending an identifiable CV to an employer, Northline will discuss the specific opportunity with the candidate and obtain the candidate’s agreement. We then send the CV separately, normally by email, to the relevant employer contact. Once an employer receives a CV, that employer will usually process it as an independent controller under its own privacy notice.
Admin access and decisions
Northline’s recruitment review and decisions are performed manually by the owner/operator. We do not use automated decision-making, artificial intelligence, automated scoring or profiling to rank or reject candidates. Website, hosting or IT providers may nevertheless have limited technical access where needed to host, secure, maintain or troubleshoot the service, under appropriate contractual and confidentiality controls.
5. Why we use personal data and our lawful bases
| Purpose | Personal data | Lawful basis |
|---|---|---|
| Provide candidate accounts, receive applications and deliver recruitment services requested by candidates | Account, contact, CV, application and communication data | Contract or steps at your request before entering a contract; legitimate interests where appropriate |
| Identify and contact suitable candidates and maintain a candidate database | Contact, CV, career preferences and recruitment records | Legitimate interests in operating a recruitment service |
| Discuss a role and submit an agreed CV to an employer | CV, contact and relevant suitability information | Legitimate interests in matching candidates with roles; steps at the candidate’s request. We also seek the candidate’s agreement before each identifiable submission |
| Provide employer accounts, review vacancies and manage client relationships | Business contact, account, vacancy and communication data | Contract or steps before a contract; legitimate interests |
| Verify information, obtain references and carry out permitted pre-employment checks | Identity, qualifications, employment, reference and checking data | Legal obligation, contract steps or legitimate interests, depending on the check |
| Operate, secure and troubleshoot the website and portals | Account, login, device, IP, security and server-log data | Legitimate interests in providing a secure service; legal obligation where applicable |
| Maintain business, tax, legal and complaint records | Relevant contact, recruitment, transaction and correspondence data | Legal obligation and legitimate interests in establishing, exercising or defending legal claims |
| Send service messages and communications about active recruitment | Name, contact and recruitment data | Contract steps or legitimate interests; these are not general direct marketing |
Where we rely on legitimate interests, we consider whether the use is necessary and balanced against your rights and reasonable expectations. You may object to processing based on legitimate interests; see section 13.
We may send relevant business-to-business communications to prospective client contacts about Northline’s recruitment services where permitted by applicable data-protection and electronic-marketing laws. We normally rely on legitimate interests when contacting relevant representatives of corporate organisations using their business contact details. We do not use candidate details for general promotional marketing. Anyone may object to direct marketing at any time by contacting us or replying to the communication. We will stop the marketing and may retain minimal information on a suppression record to ensure that the request continues to be respected.
6. Providing your information
You are not generally required by law to provide personal data to Northline. However, certain information is necessary for us to create and manage accounts, process job applications, assess suitability for opportunities, submit agreed candidate information to employers and provide services to clients. If you do not provide the information reasonably required, we may be unable to process an application, consider you for a role or provide the requested recruitment service.
7. Special category and criminal-offence data
Recruitment information may reveal special category data, for example health or disability information, racial or ethnic origin, religious or philosophical beliefs, trade-union membership or sexual orientation. We ask you not to include such information unless it is relevant and necessary.
Where we process special category data, we require both an Article 6 lawful basis and an additional legal condition. Depending on the circumstances, this may include employment and social-protection law obligations, establishing or defending legal claims, substantial public interest under applicable UK law, or explicit consent where that is genuinely appropriate. Health or disability information may be used to arrange reasonable adjustments or meet legal obligations.
We will only process criminal-offence data when authorised by UK law and where necessary for a particular role or legal requirement. Any criminal-record check will be handled in accordance with applicable law and relevant safeguards. We will tell the candidate about the check and its basis where required.
8. Who we share personal data with
We may share relevant personal data with:
an employer or prospective employer after discussing the specific opportunity with the candidate and obtaining agreement to submit the candidate;
referees, former employers, qualification bodies, screening providers or other parties involved in authorised checks;
website developers, hosting providers, email providers, cloud-storage, IT-support, cybersecurity and other suppliers acting for us;
professional advisers, insurers, auditors and accountants where necessary;
courts, regulators, law-enforcement bodies, public authorities or other parties where required by law or necessary to protect rights; and
a purchaser, investor or successor if our business or assets are sold, reorganised or transferred, subject to appropriate safeguards.
We share only the information reasonably required for the relevant purpose. We do not sell personal data. We do not give employers access to browse the candidate portal or candidate database.
9. Service providers and controller responsibilities
Suppliers that host, maintain or support our website and systems may process personal data on our behalf as processors. We require processors to act only on documented instructions, keep data secure, preserve confidentiality and assist with data-protection obligations. Some recipients, including prospective employers, may act as independent controllers and are responsible for their own use of the information.
10. International transfers
Some service providers or recipients may store or access personal data outside the United Kingdom. Before making a restricted transfer, we will use a lawful transfer mechanism where required, such as UK adequacy regulations, the UK International Data Transfer Agreement or UK Addendum, and will carry out any required risk assessment and apply supplementary safeguards. You may contact us for more information about the safeguards relevant to your data.
11. How long we keep information
| Record | Normal approach |
|---|---|
| Candidate account, CV and general candidate record | Reviewed and normally retained for up to 24 months after the last meaningful contact or recruitment activity, then deleted or anonymised unless there is a reason to retain it longer. We may contact the candidate to update the record. |
| Application and submission records | Kept for the recruitment process and then for a proportionate period needed for follow-up, compliance, complaints and legal claims; the exact period will depend on the circumstances. |
| Employer accounts, vacancy submissions and client records | Kept while the relationship or account is active and afterwards for contractual, tax, complaint and legal-claims requirements. |
| Technical and security logs | Kept for a limited period appropriate to security, troubleshooting and legal requirements. |
| Suppression or objection record | Minimal information may be kept for as long as needed to respect the request and demonstrate compliance. |
| Legal, tax or dispute records | Kept for the period required by law or needed to establish, exercise or defend legal claims. |
When a candidate or employer requests account deletion, Northline will delete the account and associated personal data to be removed from active systems, unless limited information must be retained to manage an active recruitment process, comply with a legal obligation, resolve a dispute or demonstrate compliance. Information may remain temporarily in secure backups until it is deleted or overwritten under the applicable backup cycle.
We consider the amount, nature and sensitivity of the data, the risk of harm, the purpose of processing and legal requirements when setting retention periods.
12. Security
We use proportionate technical and organisational measures designed to protect personal data against unauthorised access, alteration, disclosure, loss or destruction. These include access restrictions, account authentication, appropriate supplier controls, system maintenance and secure business practices. No internet or email transmission is completely secure, so candidates should avoid sending unnecessary sensitive information by ordinary email.
The website uses HTTPS, one-way password hashing and role-based access controls. CVs and supporting documents are stored outside the public website and downloads require authorised access. Website hosting is provided by Hostinger.
If a personal-data breach occurs, we will assess it and notify the Information Commissioner’s Office and affected individuals where the law requires.
13. Your data-protection rights
Depending on the circumstances, you may have the right to:
be informed about how your personal data is used;
request access to your personal data and a copy of it;
ask us to correct inaccurate or incomplete data;
ask us to erase personal data in certain circumstances;
ask us to restrict processing in certain circumstances;
object to processing based on legitimate interests and object at any time to direct marketing;
receive certain data in a structured, commonly used and machine-readable format and transmit it to another organisation;
withdraw consent at any time where consent is the basis used, without affecting earlier lawful processing; and
not be subject to a decision based solely on automated processing that has legal or similarly significant effects. Northline does not currently make such decisions.
Rights are not absolute and exemptions may apply. We may ask for information to verify identity. We normally respond within one month, although the law permits an extension in certain cases. We will not usually charge a fee, but the law allows a reasonable fee or refusal for requests that are manifestly unfounded or excessive.
To exercise a right, contact info@northlinerecruitment.com.
14. Cookies
The website uses the first-party northline_session cookie for secure login, session management and form protection. It expires when the browser session ends; server-side sessions time out after one hour of inactivity. We do not currently use analytics, advertising or behavioural-tracking cookies. See our Cookie Information page for details. If this changes, we will update that information and obtain consent before setting non-essential cookies where required.
15. Children
Our recruitment services and portals are not directed at children under 16. If we become aware that we have collected a child’s personal data without an appropriate basis, we will take steps to delete it. Anyone under 16 should not create an account or submit personal data through the website.
16. Complaints
Please contact us first at info@northlinerecruitment.com if you have a concern, so that we can try to resolve it.
You also have the right to complain to the Information Commissioner’s Office (ICO), the UK supervisory authority. Current contact details are available at ico.org.uk/make-a-complaint/ or by telephone on 0303 123 1113.
17. Changes to this notice
We may update this notice to reflect changes to our services, suppliers, technology or legal obligations. The current version will be published on our website with its effective date. Where a change materially affects how we use personal data, we will take reasonable steps to bring it to the attention of affected individuals.