Privacy Policy
At Vastmet Recruitment, we take your personal information seriously. This policy sets out how we collect, use, manage, and safeguard candidate and employer data across the UK in compliance with UK GDPR and data protection regulations.
Changes and Updates to This Privacy Policy
VASTMET Recruitment routinely reviews this Privacy Policy to ensure continued compliance with UK data protection laws, evolving recruitment sector standards, and new technological advancements.
We maintain an archive of previous versions for compliance and audit integrity. The table below highlights recent updates:
Updated candidate verification guidelines and streamlined employer compliance checks.
Refined retention schedules for candidate CV submissions across all UK recruitment sectors.
Full structural review aligning all procedures with refreshed UK GDPR standards.
Have questions about policy revisions?
Our Data Protection Officer is available to provide previous copies or clarifications.
Company Overview & Data Protection
VASTMET Recruitment is a specialist permanent recruitment consultancy serving employers and professionals throughout the UK. As a dedicated data controller, we uphold stringent compliance standards to safeguard candidate careers and client hiring information.
Responsible recruitment built on trusted relationships
Our core business focus is securing high-caliber permanent appointments that drive businesses forward. We operate with complete transparency, maintaining rigorous data management standards across every interaction with candidates and hiring partners.
Data Controller Standards
Lawful Basis for Processing
Legitimate interest and direct consent applied strictly within permanent talent matching.
Zero Third-Party Marketing Sales
We never monetize, sell, or disclose personal recruitment data to third-party marketing services.
Secure UK & EEA Data Storage
High-grade technical and organizational safeguards protecting candidate contact and employment history.
Clear Candidate Rights
Full access, correction, transfer, and removal rights handled promptly by our compliance team.
Our Legal Bases for Processing Data
Under the UK General Data Protection Regulation (UK GDPR) Article 6, VASTMET Recruitment relies on specific lawful grounds to process candidate and client personal data responsibly throughout the recruitment lifecycle.
We process personal and professional data to fulfill direct contractual terms, execute service agreements, and take steps at your request prior to entering into a placement contract.
Applied Activities
- Assessing suitability for registered vacancies
- Submitting agreed candidate profiles to prospective employers
- Arranging interviews, client onboarding, and contract drafting
- Verifying right-to-work and required trade certifications
We process information to introduce qualified candidates to relevant open roles across our UK sectors, provided your individual privacy rights and freedoms are not overridden.
Applied Activities
- Reviewing publicly available professional profiles (e.g. LinkedIn)
- Maintaining up-to-date industry talent pools and salary data
- Matching relevant skillsets with newly registered client briefs
- Ensuring network security, fraud prevention, and audit logging
Where specific processing requires explicit permission, we request clear, informed consent. You retain full control and can withdraw consent at any time.
Applied Activities
- Receiving tailored sector newsletters and market insight reports
- Subscribing to automated job alerts for specific job categories
- Processing sensitive personal data where strictly necessary by law
- One-click preference management and instant unsubscribe options
Data Protection Standards & Governance
How we enforce accountability and security across all sector placements.
Data Minimisation
We only collect data strictly necessary to facilitate placements and verify professional credentials.
Retention Schedules
Personal data is securely retained only for as long as active placement or statutory HMRC requirements demand.
Candidate Rights
You hold direct rights to access, rectify, restrict, or request erasure of your data under UK GDPR.
Why and How We Process Your Data
VASTMET Recruitment processes personal information strictly for legitimate recruitment services, regulatory compliance, and employment facilitation across the UK. Here is how your data is used at each step of the recruitment lifecycle.
You hold the right to request human intervention, express your point of view, or contest any automated filtering by contacting our compliance team.
External Links Disclaimer
Please understand how our privacy practices apply when navigating between VASTMET Recruitment systems and independent third-party services.
Data Protection & Rights Inquiries
VASTMET Recruitment processes personal data for candidates and employers across the UK in full compliance with the UK GDPR and Data Protection Act 2018. To submit a statutory privacy request or lodge a query, contact our designated team below.
No automated contact forms are used for privacy requests to protect sensitive personal identification.
What you can request
Subject Access Requests (SAR)
Request a copy of the personal information and recruitment records we hold about you.
Correction & Rectification
Update out-of-date CVs, contact details, or rectify inaccurate candidate records.
Data Erasure & Right to Be Forgotten
Ask us to remove your candidate profile and personal data from our active placement systems.
Marketing & Processing Objections
Opt out of recruitment alert communications or restrict specific processing activities.
How to submit your request
Send your inquiry via email
Write to info@vastmet.co.uk using the subject line 'Data Protection Request'.
Provide identity verification
Include your full legal name, current contact details, and any previous emails used with VASTMET.
Receive official response
Under UK GDPR regulations, our team reviews and responds to valid requests within one calendar month.
Data Retention & Candidate Rights
VASTMET Recruitment retains candidate records and client information solely for legitimate recruitment purposes, regulatory compliance, and verified mutual interest.
Duration of Active Engagement
Up to 24 Months Post-Engagement
Up to 6 Years (Statutory)
How to Request Deletion or Erasure
You retain complete authority over your personal information. If you no longer wish for VASTMET Recruitment to hold your CV or profile, you may submit a formal deletion request at any point without fees or hassle.
Right to Erasure (Be Forgotten)
You can request complete deletion of your CV, contact details, and application history at any time when no legal retention obligation applies.
Right to Access & Rectification
Request a full copy of the data we hold or request corrections to your employment history, certifications, or salary expectations.
Right to Restrict Processing
Instruct us to pause submitting your profile to employers while maintaining your file in an inactive, non-searchable state.
Security Measures Protecting Your Personal Data
At VASTMET Recruitment, safeguarding candidate records and employer information is integral to our operations. We maintain strict technical, administrative, and physical controls to prevent unauthorized access, loss, or disclosure.
Rigorous Data Governance Across Every Placement
Whether you submit your CV for a vacancy or partner with us to recruit specialized talent, your data is processed solely for lawful recruitment activities under UK GDPR principles.
Have a Data Request or Question?
Contact our Data Compliance team for Subject Access Requests or policy enquiries.
Personal Information We Collect
As a specialist UK recruitment agency connecting talent with employers across key sectors, VASTMET Recruitment collects and processes specific personal data necessary to evaluate, place, and manage candidates effectively.
Specific Items Collected:
Full name, home address, personal email address, telephone numbers, date of birth, emergency contact info.
Specific Items Collected:
Candidate CVs, cover letters, application forms, employment history, qualifications, certifications, portfolio links.
Specific Items Collected:
Consultant interview notes, technical competency feedback, screening questionnaires, candidate reference checks.
Specific Items Collected:
Current salary, expected rate or compensation, notice period, immediate availability, preferred working hours/shifts.
Specific Items Collected:
Target commute radius, willingness to relocate, UK region preferences, remote or hybrid working arrangements.
Specific Items Collected:
Right to work in the UK verification, national insurance number, industry licences (e.g. CSCS, SMSTS, IOSH), background checks.
How We Handle Your Information
Strict Purpose Limitation
Data is used strictly to provide UK staffing, recruitment, and placement services.
Accuracy & Updates
You may request an update or correction to your career profile at any stage.
Defined Retention Periods
Records are securely archived or deleted in accordance with UK statutory compliance.
Have questions regarding your stored records?
Under UK GDPR and the Data Protection Act 2018, you have the right to request access, rectification, or erasure of your recruitment file at any time.
International Data Transfers & Global Safeguards
VASTMET Recruitment primarily stores and processes candidate and employer data within the United Kingdom. Where services require cross-border data flows, we enforce rigorous legal and technical safeguards to ensure uninterrupted data protection.
Requires no supplementary transfer authorization. All processing continues under equivalent legal standards.
Includes binding commitments on data subject rights, legal recourse, and lawful processing limitations.
Ensures technical safeguards like end-to-end encryption neutralize foreign jurisdictional risks.
Technical & Organizational Safeguards
Measures applied to maintain data integrity across international endpoints
End-to-End Encryption
All candidate and client records transferred across borders are encrypted in transit (TLS 1.3) and at rest (AES-256).
Vetted Cloud Infrastructure
Recruitment CRM and verification platforms are hosted in certified ISO 27001 / SOC 2 data centres with restricted regional failovers.
Role-Based Access Controls
Strict least-privilege permissions and multi-factor authentication prevent unauthorized third-party cross-border access.
Regular Processor Audits
Annual reviews and compliance checks across all international vendors, assessment partners, and technical service providers.
Your Statutory Rights Under UK GDPR
VASTMET Recruitment is committed to transparency and the ethical handling of your personal data. Below is a plain-language summary of your legal rights and how to exercise them.
You have the right to request a copy of the personal data we hold about you, along with information about how we process and share it.
We provide your full candidate file, submission records, and interview notes free of charge.
If your contact details, work history, qualifications, or certifications are inaccurate or incomplete, you can ask us to update them promptly.
Immediate correction and notification to any employers who received the previous details.
You can request the deletion of your personal data where there is no compelling or statutory reason for its continued processing by our agency.
Complete removal of your CV, contact records, and profiles from our active database.
You have the right to block or suppress further processing of your data while an accuracy dispute or legal objection is being resolved.
We retain your record securely in a restricted state without sharing it with hiring employers.
You can obtain and reuse your personal data across different services in a structured, commonly used, and machine-readable format.
Export of your application records, skill matrix, and basic details in CSV/JSON format.
You can object at any time to your data being used for direct job marketing alerts, sector insights, or processing based on legitimate interests.
Immediate opt-out from automated emails, SMS notifications, and marketing communications.
You have the right not to be subject to a decision based solely on automated processing or AI screening that significantly affects your candidacy.
Every job match, CV shortlisting, and hiring recommendation is verified by a human consultant.
How to Exercise Your Rights
We never charge fees for standard data requests and aim to resolve all statutory inquiries within one calendar month.
Submit Your Request
Email our designated Data Protection Officer stating the specific right you wish to exercise.
Identity Verification
We confirm your identity to safeguard your confidential recruitment records from unauthorized access.
Action & Confirmation
We fulfill your request within 30 days and provide clear written confirmation of the actions taken.
Contact Data Protection Officer
Have a question or wish to submit a Subject Access Request? Contact our compliance desk directly.
How We Introduce You to Potential Employers
Your career data is handled with complete discretion. Here is how your CV is managed, shared, and protected throughout our recruitment process.
You retain complete control over where your CV is sent
We believe in ethical recruitment. You are never committed to a client submission without your explicit approval, and you have the statutory and procedural right to object to specific employer introductions at any time.
Frequently Asked Questions
Clear answers regarding your representation and data handling
Ready to take the next step in your career?
Speak with a VASTMET recruitment specialist or register your CV today with confidence.
How and when we collect your information
VASTMET Recruitment collects information through structured, lawful channels to match skilled candidates with UK employers and ensure full employment compliance.
Collection Methods
The primary touchpoints through which recruitment data is received.
Includes CV uploads, contact details, right-to-work declarations, and career preferences.
Includes correspondence with consultants, interview availability, and salary expectations.
Includes employment histories, sector certifications, and tailored cover letters.
Includes competency assessments, technical evaluations, and placement preferences.
Includes identity verification documents, national insurance numbers, and banking details.
Data Sources
Who supplies the information we hold and process.
Candidates
Job Seekers & Contractors
Direct applications, resume submissions, and qualification records provided by professionals seeking permanent or contract roles across the UK.
Employers
Hiring Clients & Organisations
Job specifications, company hiring guidelines, decision-maker contact details, and commercial terms provided by client organisations.
Recruitment Partners
Screening & Verification Bodies
Reference checks, accredited certification bodies, background screening verification, and professional industry registers.
Collection Timeframes
When personal data is requested throughout the recruitment lifecycle.
Initial Engagement
Basic contact details, current role, target sector, and CV are collected when you first connect with our consultants.
Shortlisting & Interview
Interview notes, salary expectations, role preferences, and detailed work histories are gathered as you progress.
Offer & Placement
Compliance checks, right-to-work validation, professional references, and payment information are collected before day one.
Ongoing Support
Performance feedback, timesheets, and role extension discussions are documented during active placements.
Data Complaints & Escalation Procedure
VASTMET Recruitment is committed to processing all personal data transparently, lawfully, and securely. If you have concerns about how your data is collected, stored, or processed, you have the right to raise a formal grievance.
Internal Complaints Process
We aim to resolve all personal data issues swiftly through our internal team.
Send full details of your complaint regarding how your personal information has been handled directly to our Data Protection Compliance Team.
Our compliance officers will review our processing logs, recruitment records, and communication histories to investigate the issue thoroughly.
You will receive a comprehensive written response detailing our findings, any corrective measures taken, and remedies applied.
Contact the Data Protection Officer
Send your complaint with your full name and candidate/client reference.
Independent Escalation to the ICO
UK data protection supervisory authority
If you are unsatisfied with our response, or if you believe VASTMET Recruitment is not processing your personal data in accordance with the UK General Data Protection Regulation (UK GDPR) and Data Protection Act 2018, you have the statutory right to lodge a complaint directly with the Information Commissioner's Office (ICO).
The ICO is the UK's independent authority set up to uphold information rights in the public interest, promoting openness by public bodies and data privacy for individuals.
Complaints FAQ
Common questions regarding data dispute procedures
Candidate Data Sharing Disclosure
VASTMET Recruitment is dedicated to protecting your professional privacy. Here is an open explanation of exactly when, how, and why your information is shared during the UK recruitment process.
How Your Data Moves Through The Placement Process
Clear rules govern each stage from initial registration to interview scheduling and offer management.
No CV or personal details are shared with any employer without your explicit prior permission and discussion.
Before submitting your profile for any vacancy, our recruitment specialists contact you directly to discuss the role, employer identity, compensation package, and working terms. Your data remains confidential until you confirm your interest.
Only relevant qualification, employment history, and career details are supplied to hiring managers.
We provide vetted prospective employers with a formatted candidate profile. Sensitive identifiers are kept secure and shared strictly on a need-to-know basis to evaluate your suitability for the specific open vacancy.
All partner employers sign binding confidentiality and data protection agreements under UK GDPR.
Employers receiving your profile are legally restricted from distributing, retaining, or re-purposing your CV for unapproved roles, third parties, or outside agencies without formal authorization.
Clear data lifecycle schedules with immediate removal upon candidate request.
If a placement does not proceed, employer clients are mandated to securely delete candidate CVs according to UK data privacy standards. You retain full rights to request updates or permanent erasure at any time.
Strict Data Restrictions
Bound by UK Employment Regulations
When candidate details are shared with verified employers for active hiring processes, strict contractual boundaries apply automatically:
- 1Single Vacancy Limitation:
Employers are prohibited from using your data for vacancies other than the role explicitly discussed without fresh consent.
- 2No Sub-licensing or Distribution:
Client companies cannot forward your profile to sister entities, subsidiaries, or external suppliers without direct notification.
- 3Confidential Interview Records:
Interview notes and assessment scores are maintained securely and disclosed back to you as constructive feedback upon request.
Statutory & Legal Disclosures
Mandatory exceptions under UK law
In rare instances, VASTMET Recruitment may be legally compelled to disclose candidate records to competent authorities without prior notice:
Statutory & Regulatory Obligations
Compliance with HMRC reporting, Employment Agencies Act 1973, Conduct of Employment Agencies Regulations, and right-to-work verification under UK immigration laws.
Law Enforcement & Court Orders
Formal requests from UK police forces, courts of competent jurisdiction, or regulatory bodies investigating statutory offences or preventing fraud.
Health, Safety & Compliance Audits
Mandatory qualification verification, industry standard vetting (e.g., CSCS, safety certifications), or public health reporting when legally mandated for site access.
Candidate Data Protection Questions
Have specific data requests or privacy questions?
Our compliance officer is ready to assist you with Subject Access Requests (SAR), consent revocations, or employer disclosure audits.
Specialist permanent recruitment across Construction & Built Environment, Engineering & Manufacturing, and Training & Education throughout the UK.
Candidates & Employers
Candidates
Employers
Quick Navigation
Get in Touch
Have a vacancy to discuss or looking for your next opportunity? Get in touch: info@vastmet.co.uk