Privacy Policy

1. Who we are and who this policy covers

Cathedral Appointments Ltd is the data controller for the personal data described in this policy. We are a recruitment agency based in Exeter, providing permanent and temporary recruitment services.

• Registered in England and Wales, company number 03619552
• Registered with the Information Commissioner's Office (ICO), registration number Z4564624
• Registered office: Broadwalk House, Southernhay West, Exeter, EX1 1TS

We process personal data in line with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations. We are a corporate member of the Recruitment and Employment Confederation.

This policy applies to:

• Candidates: anyone who applies for a role, registers with us, or whom we contact about a potential role
• Temporary workers: candidates employed by us to work on assignments with our clients
• Clients: contacts at organisations we recruit for or speak to about recruitment
• Referees: people who give a reference for a candidate
• Website users and subscribers: anyone who uses our website or receives our job alerts or market insight emails

We are not required to appoint a Data Protection Officer. Our Data Administrator is responsible for data protection and can be contacted using the details in section 7.

2. What we collect and where it comes from

Candidates: name, contact details, CV, career and education history, qualifications, the roles you are interested in, salary expectations, right to work documents, interview notes and feedback, references, and a record of the roles we have discussed with you or put you forward for.

Diversity data: we ask candidates to tell us about characteristics such as ethnicity, gender, disability and age. Answering is entirely optional. This information is held separately from your candidate record, used only in anonymised and aggregated form to monitor equality of opportunity, and never shared with clients.

Temporary workers: in addition to the above, the information needed to employ and pay you, such as National Insurance number, bank details, tax information and timesheets.

Clients: name, job title, organisation, contact details and notes of our discussions.

Referees: name, contact details, relationship to the candidate and the reference provided.

Website users: account login details, job alert preferences, and website usage data collected through cookies and analytics (see section 6).

We obtain candidate data from three sources only: applications to our advertised roles, job boards, and LinkedIn. Where we find you through a job board or LinkedIn, we record the source and send you a link to this policy when we first contact you. We do not use commercial databases or any other source. References are obtained from referees only with your consent.

3. How we use your data and why

We only use personal data where the law allows it. Below are the ways we use personal data and the lawful basis we rely on for each.

Legitimate interests (providing work-finding services to candidates and recruitment services to clients):

• holding your candidate record and matching you to suitable roles
• contacting you about roles that may suit you
• managing client relationships
• sending market insight emails, with an opt out in every email

Your consent:

• sharing your CV or details with a client (explicit consent, given for each specific role)
• contacting your referees
• diversity monitoring (explicit consent, together with the equality of opportunity condition in the Data Protection Act 2018)
• sending job alerts
• website analytics and non-essential cookies

Legal obligation:

• right to work checks and agency record keeping, including under the Conduct of Employment Agencies and Employment Businesses Regulations 2003
• tax and employment records for temporary workers

Contract:

• employing and paying temporary workers under their contract of employment

Candidate data is never shared with a client without your explicit consent. We do not send CVs speculatively, and we only put you forward for a role once you have agreed to it.

All decisions about candidates are made by our consultants. We do not use automated decision-making, scoring or profiling to decide whether a candidate is suitable for a role. We use AI tools to help with administrative tasks such as formatting CVs and drafting documents, always under the review of a member of our team.

4. Who we share data with

Clients receive a candidate's details only with that candidate's explicit consent for a specific role.

Service providers process data on our behalf, under contract, only on our instructions and not for their own purposes:

• Firefish: our applicant tracking system, holding candidate records and sending job alerts and email
• SourceWhale: candidate and client outreach emails
• Microsoft 365: email, documents and file storage
• Astria: payroll for temporary workers
• Anthropic (Claude): an AI assistant used for administrative tasks such as formatting CVs and drafting documents. We use Claude’s paid business plan, under which Anthropic processes data only on our behalf and does not use it to train its AI models.
• Google Analytics: website usage statistics

We may also disclose data where the law requires it, for example to HMRC or in response to a court order.

International transfers. Some of our service providers may store or process data outside the UK. Where they do, we make sure the data is protected by UK adequacy regulations or by the UK International Data Transfer Agreement or Addendum.  We do not work outsdie the UK and never share data with clients outside of the UK. 

5. How long we keep your data

We keep candidate data for 2 years from our last interaction with you, then archive it, then permanently delete it after a further 2 years.

• Candidate records (registration details, CVs, applications, consultant notes, interview feedback and references) are kept for 2 years from our last interaction with you. They are then archived: removed from active use and searches, and not used to contact you or put you forward for roles.
• Archived candidate records are permanently deleted after a further 2 years.
• Diversity data is kept for the same period as your candidate record and deleted with it.
• Temporary worker employment and payroll records are kept for the periods required by employment and tax law, then securely deleted.
• Client contact details and notes are kept for as long as we have a working relationship with your organisation, reviewed periodically, and deleted when no longer needed.
• Terms of business, invoices and placement records are kept for 6 years after the end of the financial year they relate to, then securely deleted.
• Job alert and marketing preferences are kept while you remain subscribed. If you opt out, we keep a record of that so we do not contact you again.

If you ask us to erase your data, we will delete it unless we must keep it by law. 

6. Emails, website, cookies and security

Job alerts are sent only if you sign up for them. Market insight emails are sent by our consultants to candidates and clients we work with. Every email includes an unsubscribe link, and you can also opt out by contacting us.

Website accounts. If you register on our website, we use your details to manage your account, your applications and your job alert preferences. You can update your details through your account or by contacting us.

Cookies and analytics. We use essential cookies to make the website work and, with your consent, analytics cookies (Google Analytics) to understand how the site is used. Analytics data is used in aggregate and is not used to identify you. You can change your choices at any time; see our cookie policy. You can opt out of Google Analytics at tools.google.com/dlpage/gaoptout.

Security. We limit access to personal data to staff who need it, and we use secure, access-controlled systems. If a data breach is likely to put your rights at risk, we will tell you and the ICO as the law requires.

Other people's information. If you give us details of someone else, such as a referee, please make sure they are happy for you to do so and point them to this policy.

7. Your rights, complaints and contact

You have the right to:

• ask for a copy of the personal data we hold about you
• ask us to correct data that is wrong or incomplete
• ask us to erase your data
• ask us to restrict how we use your data
• object to us using your data, including for marketing
• ask for data you gave us to be transferred to you or another organisation
• withdraw your consent at any time, where we rely on consent

To use any of these rights, contact our Data Administrator. We may ask you to confirm your identity. We will respond within one month, and aim to respond sooner.

If you are unhappy with how we have handled your data, please contact us first so we can put it right. You also have the right to complain to the Information Commissioner's Office at ico.org.uk/make-a-complaint or on 0303 123 1113.

Contact us

Data Administrator, Cathedral Appointments Ltd, Broadwalk House, Southernhay West, Exeter, EX1 1TS

Email: info@cathedralappointments.co.uk

Phone: 01392 575692

We review this policy regularly. It was last updated in October 2026.