Privacy Notice | Gresham Hunt

Who we are

This notice explains how Gresham Hunt Ltd ("Gresham Hunt", "we", "us") collects and uses personal data about candidates, client contacts and visitors to our website, and the rights you have.

Gresham Hunt is a recruitment business. For the purposes of UK data protection law (the UK GDPR, the Data Protection Act 2018 and the Data (Use and Access) Act 2025), we are the controller of the personal data described in this notice.

Company: Gresham Hunt Ltd, registered in England and Wales, company number 10170284
Registered office: 33 Cannon Street, London EC4M 5SB
ICO registration number: ZB300827
Data protection contact: Mark McLoughlin or Tamsin Robinson, GDPR@greshamhunt.com, 0203 854 3640

If you have any questions about this notice or how we handle your data, please contact us using the details above.

The data we collect and where it comes from

Candidates

We may collect your name, contact details, address, CV, employment history, education and qualifications, skills, current and expected salary, notice period, right to work, job preferences, willingness to relocate, references, and notes from our conversations and interviews with you.

Client contacts

We may collect your name, job title, employer, work contact details and records of our dealings with you.

Website visitors

We collect technical information such as your IP address and browsing activity through cookies.

Special category data

We only collect sensitive information, such as health or diversity information, where you choose to give it to us, where it is needed to make reasonable adjustments, or where the law requires it. Where we collect diversity data for monitoring, providing it is voluntary.

We collect this data:

directly from you, when you apply for a role, register with us, send us your CV, or speak to one of our consultants
from job boards when you respond to an advert we have placed
from publicly available professional sources, such as LinkedIn, company websites and online CV databases
from referees, and from people who recommend you to us
from our clients, for example interview feedback

If we obtain your data from a source other than you, we will tell you within one month and send you a link to this notice.

How we use your data and our lawful basis

We only use your personal data where the law allows us to. You do not have to consent to this notice to use our website or apply for a role.

What we do

Lawful basis

Assess your suitability for roles, match you to opportunities and support your job search

Legitimate interests (providing recruitment services), or steps at your request before entering a contract

Contact you about roles that may interest you

Legitimate interests; you can ask us to stop at any time

Send your CV or details to a client for a specific role

Your agreement for that role, obtained before we send it

Find candidates using public professional sources, such as LinkedIn

Legitimate interests

Carry out right-to-work and reference checks

Legal obligation and legitimate interests

Manage our relationships with clients

Legitimate interests, and to perform our contract

Send marketing emails or newsletters

Consent (for individuals), or legitimate interests (for business contacts); you can unsubscribe at any time

Keep records for tax, accounting and legal purposes

Legal obligation

Use special category data

Your explicit consent, or employment and social security law

Where we rely on legitimate interests, we have balanced our interests against your rights. You can ask us for details of that assessment.

We do not make decisions about you based solely on automated processing.

Who we share your data with

We never sell your personal data. We will not send your CV or details to a client without first agreeing it with you for that specific role.

We may share your data with:

clients, for roles you have agreed to be put forward for
companies in our group, where they help us provide our services
referees and background-check providers, when you are progressing towards an offer
our service providers, who process data on our behalf under contract, including our website platform (Webflow), our recruitment database Bullhorn, our email and IT provider (Microsoft 365), and our phone system 8x8
professional advisers, regulators, law enforcement or courts, where the law requires it

International transfers

Some of our service providers may store data outside the UK. When they do, we make sure it is protected by a UK adequacy decision or by approved contract terms, such as the UK International Data Transfer Agreement.

If we put you forward for a role outside the UK, we will only share your data with that client with your agreement.

How long we keep your data

We keep personal data only for as long as we need it.

Data

How long we keep it

Candidate records

2 years from our last meaningful contact with you, then deleted or anonymised. Before deleting your record, we may contact you to ask whether you want us to keep it.

Candidates we place in a role

6 years after the placement, for contractual, tax and legal purposes

Client contact records

3 years from our last contact

Marketing lists

Until you unsubscribe

Financial and accounting records

6 years, as required by law

Many candidates come back to us years later. If you would like us to keep your details for longer, just tell us.

Your rights

You have the right to:

ask for a copy of the personal data we hold about you
ask us to correct data that is inaccurate or incomplete
ask us to delete your data
ask us to restrict how we use your data
object to our use of your data where we rely on legitimate interests, and to object to direct marketing at any time
ask us to transfer data you gave us to another organisation
withdraw your consent at any time, where we rely on consent

To use any of these rights, contact us using the details in "Who we are". We will respond within one month. We may need to confirm your identity first. Some rights do not apply in every situation, and if that is the case we will explain why.

Complaints

If you are unhappy with how we have handled your personal data, please complain to us first by emailing GDPR@greshamhunt.com. We will acknowledge your complaint within 30 days, look into it, keep you updated and tell you the outcome without undue delay.

If you are not satisfied with our response, you have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk/make-a-complaint or on 0303 123 1113.

Changes to this notice

We review this notice regularly. Any changes will be posted on this page, and where they are significant we will let you know by email.