Privacy Notice
Privacy Notice from Macmillan Davies
Last updated: September 2026
Introduction
At Macmillan Davies we take your privacy seriously and are committed to protecting the privacy of our candidates, clients and anyone who uses our services. This notice explains what personal data we collect, why we hold it, who we share it with, how long we keep it and what rights you have.
Who is responsible for your personal data?
Macmillan Davies Consulting Limited, a company registered in England and Wales (registration number 07769245) at 124 City Road, London, EC1V 2NX, is the data controller for the personal data described in this notice.
We are registered with the Information Commissioner's Office under registration number Z2953474.
We are an employment agency and employment business as defined in the Conduct of Employment Agencies and Employment Businesses Regulations 2003.
This notice is written to meet our obligations under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
The information we collect
If you are a candidate, the personal data we hold may include:
- Name, address, personal and work email addresses and telephone numbers
- CV, employment history, qualifications, professional memberships and references
- Identity and right to work documentation, and where a role requires it, criminal record check results
- Salary, rate and benefits information, and if we supply you as a worker, bank and payroll details
- Links to professional profiles in the public domain, for example LinkedIn
- Notes of our conversations with you, your career preferences and the roles you have been put forward for
If you are a client or business contact, we hold your name, job title, business contact details and records of our dealings with you.
We hold special category data only where it is necessary and lawful: health information where a reasonable adjustment is needed or where a role requires a fitness declaration, and equality monitoring information where you choose to give it. Criminal offence data is held only where a role requires a criminal record check. This data is held separately from your application, used only for the purpose it was given, and never used in a selection decision.
Information we obtain from other sources
Most of the data we hold comes directly from you, when you apply for a role, register with us, complete our registration form, attend an event, subscribe to our updates or contact us.
We also collect data from other sources: LinkedIn and other professional networks, job boards and CV libraries, your employer's website, referrals and recommendations, and public registers.
Where we obtain your data from a source other than you, we will tell you within one month, or at the point we first contact you if that is sooner, and give you this notice.
Why we hold your information, and our lawful basis
Under the UK GDPR we must have a lawful basis for each use of your personal data. Ours are set out below.
- Matching your skills to roles and putting you forward to clients. To provide our recruitment service to you and to our clients. Our lawful basis is legitimate interests, or contract where we supply you as a worker.
- Screening, right to work checks, references and criminal record checks. To meet our legal duties and our clients' requirements. Our lawful basis is legal obligation, and substantial public interest for criminal offence data.
- Paying workers we supply, and invoicing clients. To perform our contract with you and with our client. Our lawful basis is contract, and legal obligation for tax and payroll records.
- Sending you relevant roles, market insight, event invitations and newsletters. To keep you informed about opportunities and our services. Our lawful basis is consent, or legitimate interests for existing business contacts.
- Keeping records of our dealings, and managing complaints or disputes. To run our business and defend legal claims. Our lawful basis is legitimate interests.
- Equality monitoring. To check our processes are fair. Our lawful basis is explicit consent, which you may withdraw at any time.
Where we rely on legitimate interests, we have considered the impact on you and are satisfied our interest does not override your rights. You can object at any time and we will stop unless we have a compelling reason to continue.
Disclosure of your information
Your CV and related information are shared with prospective employers where you have agreed we may put you forward. If you are placed, we share what the client needs to complete the appointment or assignment.
We also use the following suppliers, who process data on our instructions under written agreements:
- Spott, our recruitment CRM, where candidate and client records are held
- Sonovate, for funding, invoicing and payment for the contractors we supply
- Timesheet Portal, for timesheet capture and approval on contingent assignments
- Personnel Checks, for right to work and criminal record checking
- Umbrella companies and payroll providers, where a worker is paid through one, for the purpose of paying them
- MailerLite, for email newsletters and event invitations
- Microsoft, for email, document storage and collaboration
- Xero, for accounting and payroll records
- Professional advisers, including accountants, auditors, insurers and lawyers, where needed
We share data with HMRC, regulators, law enforcement and other authorities where we are legally required to. We do not sell your data, and we do not share it for anyone else's marketing.
Where is your personal data stored?
Your data is held in the United Kingdom and the European Economic Area.
Where a supplier processes data outside the UK, we make the transfer only where an adequacy regulation applies, or under the ICO's International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, supported by a transfer risk assessment. We check these arrangements before a supplier is engaged.
Retention of your data
We keep personal data only as long as we need it. Because we support HR professionals across their careers, candidate records are often held for a number of years so that we can tell you about relevant roles. The periods we apply are:
- Candidate records, where you remain interested in opportunities: retained while the relationship is live and reviewed at least every five years, then deleted or pseudonymised if there has been no engagement
- Identity, right to work and screening documents for workers we supply: the assignment plus two years, then securely deleted
- Identity and screening documents for candidates who are not placed: six months from the end of the process, then securely deleted
- Placement, payroll and financial records: seven years, to meet tax and accounting requirements, then securely deleted
- Marketing preferences and suppression records: held indefinitely so that we do not contact you again in error
Pseudonymised data is created by replacing identifying fields with artificial identifiers, so that we can honour a suppression request without re-adding you to our database.
What are your rights?
You have the right to:
- ask what personal data we hold about you, and receive a copy
- have inaccurate data corrected
- ask us to delete your data, in some circumstances
- ask us to restrict how we use it, or object to our using it
- withdraw consent at any time, where we rely on consent
- receive certain data in a portable format
- object to direct marketing at any time, with no exceptions
To exercise any of these, email gdpr@mdhr.co.uk. We will respond within one month. We may ask you to confirm your identity first. There is no charge unless a request is manifestly unfounded or excessive.
We do not make decisions about you by automated means alone.
How do we protect your personal data?
We hold your data on password-protected systems with role-based access, multi-factor authentication and encryption in transit and at rest. Access is limited to the staff who need it.
All staff complete data protection awareness training at induction and annually thereafter, including how to recognise and report a personal data breach. We have a breach response procedure built around the 72-hour notification requirement.
No transmission over the internet is completely secure. If you send us information by email, please be aware of that risk.
Cookies
Our website uses cookies. Our Cookie Policy explains which cookies we use and how to manage them.
Complaints
If you have a concern about how we handle your data, please contact gdpr@mdhr.co.uk and we will look into it.
You also have the right to complain to the Information Commissioner's Office at ico.org.uk, or by calling 0303 123 1113.
Changes to our privacy notice
Macmillan Davies may update this notice. The date of the current version is shown at the top of this page, and we will set out any material change here. If you have questions about our privacy commitment, please email gdpr@mdhr.co.uk.
