Compliance and governance
Everything a regulator, a client's procurement team or a curious candidate would otherwise have to ask for. Our registrations and the honest state of each one, every document we publish with its version and review date, the retention periods read straight from the software that enforces them, and the exact words anybody agreed to.
Nothing here is a claim we cannot show you. Where something is not done yet, this page says so.
1. Who we are, and where we are registered
| Register | Number | State | Detail |
|---|---|---|---|
| Companies House | 17414012 | registered | HIRINGUK LTD, incorporated in England and Wales, registered office 270 Slade Road, Birmingham, England, B23 7LX. |
| Information Commissioner's Office | not yet | in progress | Applied on C2038392, 20 September 2026. The reference is issued a few days later and appears here, in the privacy notice, in the footer and on every PDF the moment it is saved. An application number is not a registration and is not shown as one. |
| HM Revenue and Customs, VAT | not yet | not registered | Not registered, so no VAT is added to any price. Every figure on this site is the figure you pay. |
| Employment agency conduct | not yet | not trading | This site is a job board: it sells advertising, and an employer receives applications sent to their own advert. It does not yet operate as an employment agency or employment business, so the Conduct Regulations 2003 do not yet apply to it. When that changes, this line changes with it and the documents that go with it appear below. |
| Gangmaster's licence (Fair Work Agency) | not yet | not required | A licence is required to supply labour into agriculture, horticulture, shellfish and the food and drink processing attached to them. We supply no labour at all, so none is required. If we ever go into those sectors the licence comes before the first placement, not after. The scheme did not go anywhere when the Gangmasters and Labour Abuse Authority was dissolved on 7 April 2026: the Fair Work Agency issues and enforces the licences now. |
The badges, and what each one actually is
If you arrived here from a search for one of these names, read the third column before anything else. WE HOLD NONE OF THEM. They are listed because a buyer deserves a straight answer about each one and because the list itself is worth understanding, not because we are hoping to be found under somebody else's badge. If this page ever reads as though we are claiming any of them, that is a fault and we want to be told.
Every agency footer in this trade carries a row of these. They are worth understanding rather than collecting, so here is the list with what each one really means and where we stand on it. A membership you pay for is not an inspection you passed. Everything on this list except the first is voluntary and most of it is a subscription. We hold none of them, we have said so rather than leaving the question open, and when we join one it will appear here with the date and the reference. What actually binds us is the law in the table above, and that binds us today.
| Name | What it is | Us | What it means |
|---|---|---|---|
| Gangmaster's licence | Statutory licence, Fair Work Agency | not required | The only one on this list with the force of law behind it. Required to supply labour into agriculture, horticulture, shellfish and the food and drink processing attached to them, and supplying without one is a CRIMINAL OFFENCE rather than a fine. We supply into none of those sectors, so none is required, and the day that changes the licence comes before the first placement. The Fair Work Agency took the scheme over from the Gangmasters and Labour Abuse Authority on 7 April 2026. |
| REC corporate membership | Trade association, NOT a regulator | not a member | Worth saying plainly because it is widely misdescribed, including on an agency page we read this week which calls it the body that regulates recruitment companies. IT DOES NOT. Recruitment is regulated by the Employment Agencies Act 1973 and the Conduct Regulations 2003, enforced by the Fair Work Agency, and that binds us whether we join anything or not. The REC is a membership you pay for, with a code of practice and a complaints route attached, and buyers respect it. It is not permission to trade. |
| Association of Labour Providers | Trade association for labour suppliers | not a member | The one most specific to this trade: it exists for businesses supplying temporary labour into food, agriculture and logistics. If the agency arm ever goes near licensable work, this is the first door to knock on rather than the general ones. |
| ISO 9001:2015 | Management standard, certified by an accredited body | not certified | It says a business has written down how it works and can show it follows what it wrote. That is genuinely useful and it is NOT a statement that the service is good. A certificate proves the process is documented and audited, not that the right person turned up at six in the morning. |
| Stronger Together | Training and resources programme on modern slavery | not a partner | A paid business partnership with training materials and toolkits, at tiers. Buyers in food and logistics ask for it. It is a commitment to use the resources rather than a finding that anybody's supply chain was clean. |
| Sedex | Membership platform for sharing ethical audit data | not a member | Being a member means having somewhere to publish audit results. The audit itself, usually SMETA, is a separate exercise that is separately paid for. A Sedex logo on a footer does not by itself mean anybody has been audited. |
| Logistics UK | Trade association | not a member | Formerly the Freight Transport Association, renamed on 27 July 2020. Still listed as the FTA on agency sites six years later, which is the same fault as naming a dissolved regulator and just as easy to make. |
| Cyber Essentials | Government backed certification, self assessed and verified | not certified | The cheapest thing on this list and the most relevant to a site that holds CVs. It covers five basic technical controls and is the one public sector buyers ask about first. Worth doing before any of the trade memberships, because it is about whether the data is safe rather than about who we have paid to be associated with. |
| RTITB and similar forklift accreditation | Accrediting body for training providers | not applicable to us | It accredits the people who deliver forklift training and the certificates they issue. It does not issue anybody a licence, because there is no such thing as a forklift licence. We neither train nor certify, so this is on the list only because clients ask and the answer should be a fact rather than a shrug. |
The documents we do not publish, and the size at which we would have to
None of these is required of us today and none of them is being avoided. A client questionnaire will ask for several of them, and the answer we want to give is not a bare no: it is no, here is the threshold, here is the law that sets it, and here is what we already do anyway. The day one of these thresholds is crossed, the document appears here with a date on it, and this row moves up into the table above.
| Document | Required at | Which law | Where we stand |
|---|---|---|---|
| Modern slavery statement | Turnover of £36 million or more | Modern Slavery Act 2015, section 54 | We publish one anyway, and have from the start. It is well under the threshold and it is the one document on this list where the work is worth doing long before the law asks. |
| Tax strategy | Turnover above £200 million, or a balance sheet above £2 billion | Finance Act 2016, Schedule 19 | Published annually and free to read online. We are nowhere near it and will say so rather than produce a page that imitates one. |
| Gender pay gap report | 250 or more employees | Equality Act 2010 (Gender Pay Gap Information) Regulations 2017 | There is one person here. A gender pay gap figure calculated over one employee is not a statistic, it is an arithmetic accident. |
| Payment practices report | Two of three: turnover £36 million, balance sheet £18 million, 250 employees | Reporting on Payment Practices and Performance Regulations 2017 | Twice a year, showing how long a business actually takes to pay its suppliers. Worth knowing about as a BUYER even when you do not have to file one: it is public, and it is the fastest way to find out whether a client pays on time. |
| Carbon reduction plan | Bidding for central government contracts above £5 million a year | Procurement Policy Note 006, formerly PPN 06/21 | A PASS OR FAIL GATE rather than a scored criterion: a bidder without a compliant plan is excluded before anybody reads the rest. If we ever go after public sector work this is the first thing to build, and it cannot be done in the week of the bid. |
| Streamlined energy and carbon reporting | Large company thresholds in the Companies Act | Companies (Directors' Report) and Limited Liability Partnerships Regulations 2018 | Energy use and emissions inside the annual accounts. Same answer: not yet, and we will not pretend to measure something we have not measured. |
Data protection contact: Grigore Octavian Pupazan, Data Protection Lead, dpo@hiringuk.co.uk. The role is deliberately called Lead and not Officer, and the privacy notice explains why in full.
2. How long we keep things
These numbers are read from the constants the deletion sweep uses. They cannot drift away from what the software does, because they are what the software does. The sweep runs when the site starts and every six hours after that.
| What | How long | What happens |
|---|---|---|
| An application, and the CV attached to it | 365 days (1 year) | Deleted with its file. The employer's own copy is theirs to keep or delete as an independent controller, and our terms give them three months. |
| A candidate account with no activity | 183 days | We email a keep or erase link at 150 days. Using it starts the period again. |
| A CV kept on file at the candidate's request | 365 days (1 year) | We ask at 305 days whether to keep it. Silence means it is erased, file and all. |
| An anonymous card on the available now list | 365 days (1 year) | The card is the same record as the CV on file, so it cannot outlive it. |
| An advert somebody removed | 90 days | Recoverable until then, then erased for good with its applications. |
| A message, an enquiry or a call back request | 365 days (1 year) | A telephone number given to arrange one call is used for that call and nothing else. |
| The audit log of what staff did | 730 days (2 years) | Who did what, to which record, with the old and the new value. Reading it is itself recorded. |
| A data protection request | 30 days | Not a retention period: the time the law allows us to answer, counted and shown as a due date in the panel. |
Deletion is enforced by the software on a schedule, not by anybody remembering. Every erasure is written into a retention log with what went and when.
3. The exact words people agreed to
The question at an inspection is never whether somebody consented. It is what the box actually said. So the sentence itself is stored with every consent, with its version, the page it was given on, the date and the address it came from. Here are the three that exist, in full.
Keeping a CV on file (v1, 28 August 2026)
Keep my CV and details on file at HIRINGUK LTD so the HIRING UK team can contact me about other jobs, including roles HIRINGUK LTD recruits for as an employment agency or employment business. I understand my CV is not shared with any other employer or sold to anybody, that only the HIRING UK team can see it, that it is erased after twelve months unless I confirm again, and that I can withdraw at any time with one click.
An anonymous card on the available now list (v1, 6 September 2026)
Show an anonymous summary of me on the HIRING UK website so employers can ask about me. I understand it shows my trade, the area I can work in, my years of experience, my tickets and when I am available, and that it never shows my name, my contact details, my CV or the companies I have worked for. Nobody sees who I am unless I say yes to a specific job first. I can take it down at any time with one click.
Job alerts by email (v1, 5 September 2026)
Yes, email me jobs matching this search. At most one email a week. I am asking for these emails of my own choice, and I understand every email has a one click unsubscribe link that stops them immediately.
3a. Record of processing activities
Article 30 of the UK GDPR asks for a record of what we process and why. Most organisations keep one in a spreadsheet and it drifts. Ours is written into the software and reads its retention figures from the same constants the deletion sweep uses, so it cannot describe a system that no longer exists.
| Why we process it | Whose | What | Lawful basis | Who else sees it | How long |
|---|---|---|---|---|---|
| Advertising a vacancy for an employer | The employer's own contact, not a candidate | Name, work email, telephone, company details, the advert itself | Contract, Article 6(1)(b). Performing the advertising contract they bought. | Nobody. The advert is public because that is its purpose. | While the account is open, then 12 months. Invoices 7 years, which is tax law and not our choice. |
| Passing an application to the employer who advertised | Candidates | Name, email, telephone, covering message, the CV file itself | Contract and pre contractual steps, Article 6(1)(b). The candidate asks us to send it to that employer. | That one employer, and nobody else. Never sold, never shared with a second advertiser, never searchable. | 365 days, then the row and the file are deleted together. |
| A candidate account, to track applications and manage data | Candidates | Name, email, password hash, saved jobs, applications | Contract, Article 6(1)(b). | Nobody. | 183 days of inactivity, with a keep or erase link emailed at 150 days. |
| Keeping a CV on file for roles we recruit for ourselves | Candidates who asked us to | Name, contact details, the CV, the sector and area they want | Consent, Article 6(1)(a), given by a separate tick that is never pre ticked. The exact wording is stored with the record. | Nobody. No employer can search it and there is no public route to it. | 365 days from the last confirmation, with an email at 305 days asking whether to keep it. Silence erases it. |
| Publishing an anonymous card so employers can enquire | Candidates on file who asked for one | Trade, sector, area, years, tickets, availability and a description they wrote. No name, no initials, no contact details, no employers. | Consent, Article 6(1)(a), separate again from the consent to hold the CV. | The card is public. The person behind it is disclosed to nobody until they say yes to a named employer and role. | It is the same record as the CV on file, so it cannot outlive it. |
| Job alerts by email | Anybody who asked for them | Email address, the search they saved | Consent, Article 6(1)(a), with a second tick confirming it is their own choice. | Nobody. | Until they stop them. Stopping switches off every alert on the address and adds it to the do not email list. |
| Answering messages, call backs and enquiries | Whoever wrote or rang | Name, contact details, what they asked | Legitimate interests, Article 6(1)(f). Somebody who asks us a question expects an answer. | Nobody. | 365 days. |
| Deciding who to approach about advertising or recruitment, and approaching them | Named people at businesses, never candidates. A person is here because of the job they do, not because of anything about them. | Name where a published one exists, job title, work telephone, work email, the company, and a note of where each of those came from. | Legitimate interests, Article 6(1)(f). Offering a business service to a business that appears to need it. The balancing test is written down and kept. | Nobody at all. It is not sold, not swapped, and not used for anything except deciding whether to write to that one company. | Until they ask us to stop, or twelve months after the last approach with no reply, whichever comes first. A company that never answers is not a prospect, it is an address we are wasting. |
| Employing people, and placing workers on our payroll | Our own staff, and temporary workers we pay directly | Name, address, date of birth, National Insurance number, bank details, right to work evidence, next of kin, timesheets, pay and tax records, absence and any disciplinary record | Contract, Article 6(1)(b), for pay and terms. Legal obligation, Article 6(1)(c), for PAYE, right to work and working time records. Where a fit note or an adjustment is involved that is health data, and the Article 9 condition is 9(2)(b), employment law, read with Schedule 1 Part 1 of the Data Protection Act 2018. | HM Revenue and Customs, the pension provider once auto-enrolment starts, and the hirer only to the extent they need it to run a shift safely. Never the bank details, never the date of birth. | Pay and tax records six years after the tax year they relate to, which is HMRC and not our choice. Right to work evidence two years after the work ends. Everything else twelve months after the last assignment. |
| Logging which employer opened which CV | Employers, and by implication the candidate whose CV was opened | Employer account, application reference, date and time | Legitimate interests, Article 6(1)(f). The interest is the CANDIDATE'S: it is how we can answer "who has seen my CV" truthfully, and how an employer who downloads CVs they never intended to consider can be found. | Nobody. Shown to the candidate about their own application on request. | With the application, so it goes when the application goes. |
| Refer a friend | The person referring, and THE PERSON BEING REFERRED, who did not give us their details themselves | Name and contact details of both | Legitimate interests, Article 6(1)(f), and only for a first approach that says plainly who passed the details on and offers an immediate way out. | Nobody. | Until the reward is settled or refused, then twelve months. |
| Meeting our own legal duties | Everybody | Consent records with their wording, the audit log, the breach register, the retention log, the do not email list | Legal obligation, Article 6(1)(c), and our own legitimate interest in being able to prove what we did. | The Information Commissioner, if asked. | Audit log 730 days. The do not email entry is kept even after an erasure, because deleting it would make an erased person contactable again. |
Safeguards, purpose by purpose: Advertising a vacancy for an employer: Signed sessions, per account isolation checked on every request, no third party scripts. · Passing an application to the employer who advertised: Files stored outside the public web root under unguessable names, every download by an employer logged and answerable to the candidate. · A candidate account, to track applications and manage data: PBKDF2-SHA256 at 200,000 iterations. Nobody here can read a password, including the director. · Keeping a CV on file for roles we recruit for ourselves: Withdrawal in one click from any email, which erases the record and the file the same moment. · Publishing an anonymous card so employers can enquire: Built from an allow list of nine fields. Wording containing a name, contact details or special category data is refused, and a person here reads every card before it is published. · Job alerts by email: One click unsubscribe in the body and in the List-Unsubscribe header, and a suppression list checked inside the function that sends. · Answering messages, call backs and enquiries: A telephone number given to arrange one call is used for that call and is never added to a list. · Deciding who to approach about advertising or recruitment, and approaching them: Every approach carries who we are with a company number, where we got the address, and one line on how to stop. An address we cannot classify as a business address is not approached at all: the test fails closed. Telephone numbers are screened before anybody rings, because PECR applies to a business line as well. · Employing people, and placing workers on our payroll: Held apart from candidate data, reachable only by the owner, and never on the same screen as an employer account. · Logging which employer opened which CV: Written on every download, not sampled. Cannot be switched off from the admin screen. · Refer a friend: ARTICLE 14 APPLIES HERE AND NOWHERE ELSE ON THIS LIST, because the data came from somebody other than the person it is about. They are told within one month, at the latest in the first message, where we got their details and how to have them erased. A referral that arrives without the referrer confirming they had permission to pass them on is not contacted at all. · Meeting our own legal duties: Reading the audit log is itself recorded.
4. What we do, in practice
Things that happen automatically
- Deletion on a schedule, with a log of what went.
- A reminder before a consent expires, so nobody is erased by surprise or kept without asking.
- Every CV an employer opens is recorded, and a candidate can ask us who has seen theirs.
- A do not email list, checked inside the one function that sends. It survives an erasure, because deleting it would make an erased person contactable again.
- A subject access request produces everything held about a person in one action, and erasure removes it, files included, in one more.
- An audit log of what staff did, with the old value and the new one. Reading it is itself recorded.
- A breach register, kept whatever the size of the incident, as Article 33(5) requires.
Things we deliberately do not do
- No searchable CV database, and no access to one sold to anybody.
- No candidate data sold, rented or shared. A CV goes to the employer whose advert it answered.
- No third party advertising or analytics scripts, so no tracking cookies to consent to.
- No automated decision making. No algorithm scores, ranks or rejects an application.
- No date of birth, national insurance number, home address or bank details asked of a candidate, because we never need them.
- No charge to a work seeker, ever, for anything.
- No special category data invited. We ask candidates to leave health, ethnicity and similar out of a CV.
5. Every document we publish
Each one carries a version, a date and, where it promises a review, the date that review is due. Every one is downloadable as a PDF for a supplier file.
| Document | Version | Updated | Review due | |
|---|---|---|---|---|
| Privacy notice (UK GDPR) What personal data we hold, why, how long for and your rights. |
2.4 | 11 September 2026 | not yet | |
| Drugs and alcohol policy The morning after, medicines from a pharmacy, testing and consent, and what happens if somebody is not fit to work. |
1.1 | 18 September 2026 | not yet | |
| Speaking up: whistleblowing policy How to report wrongdoing, the law that protects you, and the regulators you may go to without asking us. |
1.1 | 18 September 2026 | not yet | |
| Cookie policy Every cookie this site can set, and how to refuse them. |
1.3 | 1 September 2026 | not yet | |
| Candidate data policy Who sees your CV, how long we keep it and how to have it removed. |
2.1 | 28 August 2026 | not yet | |
| Website terms of use The rules for using the site, for everybody. |
1.6 | 11 September 2026 | not yet | |
| Employer terms of business Advertising contract terms: prices, payment, cancellation and liability. |
1.8 | 9 September 2026 | not yet | |
| Service agreement (customer contract) The full contract between HIRING UK and the customer, ready to file or countersign. |
1.2 | 28 August 2026 | not yet | |
| Acceptable use and advert rules What may and may not be advertised or uploaded. |
1.2 | 28 August 2026 | not yet | |
| Equality and diversity policy Our commitment under the Equality Act 2010. |
2.0 | 28 August 2026 | 28 August 2027 | |
| Harassment and bullying policy What harassment is in law, what we do about it on a client's site, and who to go to when the complaint is about us. |
not yet | not yet | not yet | |
| Accessibility statement The standard we build to and how to report a barrier. |
1.1 | 28 August 2026 | 28 August 2027 | |
| Modern slavery statement Our position on forced labour and unlawful fees. |
1.1 | 28 August 2026 | 28 August 2027 | |
| Complaints procedure How to complain and what happens next. |
1.2 | 28 August 2026 | not yet | |
| Disclaimer What we are responsible for, what we are not, and what to check yourself. |
1.0 | 28 August 2026 | not yet | |
| Referral programme terms Who can take part, what counts as a valid referral, the reward and the limits. |
1.0 | 1 September 2026 | not yet | |
| Anti-bribery and anti-corruption policy Our position under the Bribery Act 2010, what it means in recruitment, and how to report a concern. |
1.1 | 28 August 2026 | 28 August 2027 |
All of them in one file: the downloads page.
6. Security
Encryption in transit and at rest, passwords stored only as salted PBKDF2-SHA256 hashes at 200,000 iterations, CV files outside the public web root under unguessable names, access on the principle of least privilege checked on every request rather than trusted from a link, and an admin area that refuses to open until its starter password has been changed. The full list of technical and organisational measures, which is what Article 32 asks for, is section 8 of the privacy notice.
7. Asking us for something
A copy of your data, or erasure
Free, no reason needed, answered inside one month and usually within days. The form, or dpo@hiringuk.co.uk.
A complaint
A person reads it and replies. How it works and what happens next. You can also complain to the ICO at any time, and we will not think less of you for it.
A supplier questionnaire
Send it. Most of the answers are on this page, and we will fill in the rest and sign it. Or ask us to ring you.
Why this page is public
Most companies keep this in a folder and produce it when somebody official asks. We would rather publish it. A promise that anybody can check on a Tuesday afternoon is worth more than one that has to be requested, and a page like this is hard to keep if you are not actually doing the work.
This page is published so that a candidate, a client or an inspector can see what we do without asking us first. The law behind it is free to read and we say where to read it, which is a different thing from handing over the work of applying it. Somebody starting out should not have to pay a membership to find out what the rules are, and they should not expect somebody else to have done the thinking for them either.
We have gone further and written the guides out in full, free, with links to the actual legislation so you can check us rather than trust us: running a recruitment agency legally.