Data & privacy policy

Last updated: October 2026

About this policy

This policy explains how Nicholson Glover Associates Ltd collects, uses and protects your personal data, and the rights you have over it.

It applies to personal data about candidates, prospective candidates, contractors, clients, prospective clients, business contacts and visitors to our website.

We handle personal data in line with UK data protection law, which is the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations (PECR).

When we talk about "processing" data, we mean anything we do with it, including collecting, storing, updating, sharing or deleting it.

Who we are

Nicholson Glover Associates Ltd is the data controller responsible for your personal data. That means we decide how and why it's used.

Our registered office is Unit 2, The Village, Guards Avenue, Caterham on the Hill, Surrey, CR3 5XL.

If you have any questions about this policy or how we use your data, contact our Data Protection Officer:

• Email: DPO@nicholsonglover.co.uk
• Phone: +44 207 223 1440
• Post: Data Protection Officer, at the address above

What personal data we collect

Depending on how we work with you, we may collect:

• Assessment results (for example, cognitive, numeracy or psychometric tests)
• Bank details (for contractors supplied through Nicholson Glover)
• Call recordings and notes from our conversations with you
• Contact details (email address, phone number)
• Education details
• Employment history
• Identification (passport, National Insurance number)
• Interview notes
• Location and salary details
• Name and job title

We only collect what we need to deliver our service to you.

Where we get your data

We collect personal data:

• Directly from you. For example, when you email us, speak to us on the phone or apply for a role.
• From publicly available sources. For example, job boards such as Indeed, and professional networking sites such as LinkedIn.
• From other people. For example, through referrals, or from clients we're working with.
• From our website. Through cookies (see below).

How and why we use your data

We use your personal data to:

• understand your needs and find roles that suit you
• introduce you to clients and manage recruitment processes
• keep accurate records of our conversations with you, including through call recording
• prepare summaries for clients and match you to roles, sometimes with the help of AI tools
• train our team and check the quality of our service
• pay contractors and meet our legal and tax obligations
• send you relevant updates about our services
• run our business, including HR, finance and record keeping
• improve our website

If you choose not to share certain information with us, we may not be able to provide our service.

Our lawful bases

The law says we need a valid reason, called a lawful basis, to use your personal data. We rely on:

• Legitimate interests. Most of our recruitment work is based on our legitimate interests in running an effective recruitment service. This includes finding and contacting candidates and clients, introducing candidates to clients, call recording and our use of AI tools. We only rely on this where our interests are balanced against your rights and what you'd reasonably expect.
• Contract. Where we need your data to enter into or carry out a contract with you, for example if you're a contractor supplied through us.
• Legal obligation. Where the law requires us to keep or share information, for example for tax purposes or right to work checks.
• Consent. Where the law requires it, for example for some types of electronic marketing and non-essential cookies.

Special category data

Some types of information get extra protection under data protection law. This includes information about health, disability, racial or ethnic origin, religious beliefs, sexual orientation and other protected characteristics.

We only collect or use this information where it's necessary and we have an appropriate legal basis. For example, we may use health or disability information you give us so we can arrange adjustments during a recruitment process, or in connection with a contractor engagement.

If we ask for information for diversity monitoring or equal opportunities purposes, we'll explain why and how it will be used. Providing it is always optional.

Our use of AI tools

Our consultants use AI tools to help with some of the work involved in representing you. We use them to:

• tidy up notes from our conversations with you
• turn your information into clear, concise summaries for clients
• help us match your experience and what you're looking for in your next role against the roles we're working on

A consultant always decides whether to put you forward for a role. AI tools don't make decisions about whether you're put forward, rejected or hired.

Nothing AI-generated is sent to a client until your consultant has reviewed it and checked it's accurate. No decision about you is made solely by automated means. If the way we use AI changes, we'll update this policy before we start.

We only use AI tools we've approved for business use, through business accounts that Nicholson Glover controls. The AI tools we currently use are Claude, provided by Anthropic, and the AI features built into SourceWhale, our recruitment database. Our team can't use personal AI accounts or unapproved tools with your information. We only share the information a tool needs for the task in hand, not your full record.

Call recording

We record some phone calls with candidates and clients. We do this so we can:

• keep an accurate record of what you tell us about your experience, what you're looking for and the roles we discuss
• check the quality of the service we give you
• train our consultants

We'll always tell you if a call is being recorded. Our booking links say calls may be recorded, and your consultant will confirm it at the start of the call. If you'd rather not be recorded, just say so and we won't record the call.

Recordings are stored securely in SourceWhale. Only a small number of people at Nicholson Glover can access them. They can be played back, but they can't be downloaded or exported.

Who we share your data with

We won't send your details to a client without talking to you about the role first and getting your go-ahead.

We also use trusted suppliers to help us run our business, such as our recruitment database, AI tools, job boards, IT and cloud storage providers. They can only use your data to provide services to us, and we have agreements in place requiring them to protect it.

We may also share data where the law requires it, for example with HMRC or other regulators.

We will never sell or lease your personal data.

International transfers

Some of our suppliers store or process data outside the UK, including in the US. When personal data is transferred outside the UK, we use a transfer mechanism and safeguards required by UK data protection law. Depending on the country and supplier, this may be a UK adequacy decision (where the UK government has confirmed the country protects data to an equivalent standard) or contractual safeguards approved under UK law.

You can contact us for more information about the safeguards we use.

Cookies

Cookies are small files stored on your device that help websites work. We use essential cookies to make our website function, and, with your consent, analytics cookies to understand how people use it so we can improve it.

You can choose which non-essential cookies to accept through the cookie banner on our site. Our [cookie policy] lists the cookies we use, what they do and how long they last.

How we protect your data

We take data security seriously. To protect your information, we use:

• encryption
• firewalls and up-to-date antivirus and malware protection
• strong authentication controls
• pseudonymisation
• restricted access to our systems

Our website may link to other websites. Once you leave our site, their privacy policies apply, not ours.

How long we keep your data

We only keep your personal data for as long as we need it. How long that is depends on what the data is and why we're using it. For example:

• We keep certain records for set periods required by law. This includes financial records, such as invoices and payments, which we keep for 6 years under UK tax rules, and records about the people and businesses we work with, which employment agency regulations require us to keep for at least 1 year.
• We keep call recordings only for as long as we need them to check our notes, review the quality of our service and train our team.
• We may keep any of your data for longer if it's relevant to a complaint or legal claim.

After that, we delete or anonymise your data. We can give you more information about our retention periods on request.

Your data protection rights

You have the right to:

• access the personal data we hold about you
• correct information that's wrong or incomplete (rectification)
• delete your data (erasure)
• restrict how we use your data
• object to us using your data on the basis of our legitimate interests, including call recording and our use of AI tools
• transfer your data to you or another organisation (data portability)
• withdraw consent at any time, where we rely on it

These rights apply in certain circumstances and are subject to legal exceptions, so we may not always be able to do everything you ask. If we can't, we'll explain why.

If you ask us to delete or restrict your data, we may not be able to keep providing our recruitment services to you.

Asking for a copy of your data

You can ask for a copy of the personal data we hold about you. This is called a subject access request. We'll also tell you what we use it for, who we've shared it with, where we got it from and how long we plan to keep it.

It's free. We'll normally respond within one month. In some cases, where the law allows, we may extend this by up to a further two months. If we need to, we'll tell you why.

How to make a request

To use any of these rights, email our Data Protection Officer at DPO@nicholsonglover.co.uk, or contact us using any of the details in "Who we are".

Direct marketing

You can stop marketing from us at any time, using the unsubscribe link in our emails or by contacting us. You have an absolute right to object to us using your data for direct marketing, and we'll stop as soon as you tell us.

Where the law requires it, we'll get your consent before sending you electronic marketing.

How to make a complaint

If you're unhappy with how we've handled your data, please tell us as soon as possible using the contact details in "Who we are". We take complaints seriously and follow a formal complaint handling policy, which we can send you on request.

If you're not satisfied with our response, you can complain to the Information Commissioner's Office (ICO), the UK's data protection regulator, at ico.org.uk.

Changes to this policy

We may update this policy to reflect changes in the law or in how we work. If we make significant changes, we'll make sure you're told clearly.