Privacy Policy
Last updated: 5 June 2026
1. Introduction
Cedar Stone Recruitment Limited is committed to protecting your privacy and personal data. This Privacy Policy explains how we collect, use, store, disclose and protect personal data when you use our website, contact us, apply for roles, engage with our recruitment services, or work with us as a client, supplier or business contact.
We process personal data in accordance with the UK General Data Protection Regulation, the Data Protection Act 2018, the Privacy and Electronic Communications Regulations, the Data (Use and Access) Act 2025, and other applicable data protection and privacy laws.
For the purposes of data protection law, Cedar Stone Recruitment Limited is usually the controller of the personal data described in this Privacy Policy. This means we decide how and why your personal data is used.
2. Who we are and how to contact us
Organisation: Cedar Stone Recruitment Limited
Address: Fennels Lodge, St. Peters Close, High Wycombe, England, HP11 1JT
Email: legal@cedarstonerec.com
Telephone: 020 4600 7766
If you have any questions about this Privacy Policy, how we use your personal data, or how to exercise your data protection rights, please contact us using the details above.
3. Personal data we collect
We may collect and use different types of personal data depending on your relationship with us.
If you are a candidate, applicant, contractor, temporary worker or prospective candidate, we may collect:
- name, address, email address and telephone number;
- CV, employment history and education history;
- skills, qualifications, training, certifications and experience;
- job preferences, location preferences, availability and notice period;
- salary expectations, current remuneration and benefits information;
- interview notes, assessment information and feedback;
- references and referee contact details;
- right to work documentation and related compliance information;
- identity information where required for recruitment, compliance or placement purposes;
- information you provide in communications with us; and
- call recordings where you speak with us by telephone.
If you are a client, employer, supplier, referee or business contact, we may collect:
- name, job title and business contact details;
- company name, address and website;
- job descriptions, vacancy information and hiring requirements;
- candidate feedback and recruitment process information;
- contract, billing and payment information;
- communications with us; and
- call recordings where you speak with us by telephone.
When you use our website, we may collect:
- IP address;
- browser type and version;
- device information;
- operating system;
- pages visited and website interactions;
- cookie and similar technology information; and
- website analytics data.
4. How we collect personal data
We may collect personal data:
- directly from you when you contact us, send us your CV, apply for a role, complete a form, attend an interview, speak with us by telephone or otherwise communicate with us;
- from employers, clients, hiring managers, referees or other professional contacts;
- from job boards, professional networking sites, publicly available sources and recruitment platforms;
- from background, compliance or right to work checking providers where applicable;
- automatically through our website using cookies and similar technologies; and
- from our internal recruitment systems, CRM systems and call recording systems.
5. How we use personal data and our lawful bases
We only use personal data where we have a lawful basis to do so. Depending on the circumstances, we may rely on one or more of the following lawful bases:
- Consent — for example, where you consent to certain marketing communications or optional cookies.
- Contract or steps before entering into a contract — for example, where we provide recruitment services to you or take steps in connection with a potential placement.
- Legal obligation — for example, where we need to comply with right to work, tax, accounting, regulatory or other legal requirements.
- Legitimate interests — for example, to operate our recruitment business, introduce candidates to suitable roles, manage client relationships, improve our services, maintain business records, protect our legal rights and prevent fraud.
- Recognised legitimate interests — where applicable and permitted by law.
- Legal claims — where processing is necessary to establish, exercise or defend legal claims.
Where we rely on ordinary legitimate interests, we consider whether our interests are overridden by your rights and freedoms. Where we rely on a recognised legitimate interest, we will only do so where the relevant legal conditions are met. The DUAA introduced a recognised legitimate interests framework and also clarifies that subject access request searches need only be reasonable and proportionate.
We may use personal data for the following purposes:
| Purpose | Examples | Likely lawful basis |
|---|---|---|
| Recruitment services | Matching candidates with roles, presenting candidates to employers, arranging interviews, obtaining feedback and managing offers | Legitimate interests; contract/pre-contract steps |
| Candidate management | Keeping candidate records, discussing opportunities, maintaining availability and preference information | Legitimate interests; consent where required |
| Client services | Managing vacancies, candidate submissions, recruitment process feedback and client communications | Contract; legitimate interests |
| Right to work and compliance | Checking eligibility to work and meeting legal or regulatory obligations | Legal obligation; legitimate interests |
| Communication | Responding to enquiries, sending service updates and managing relationships | Legitimate interests; contract |
| Call recording | Training, quality assurance, compliance, dispute resolution and record keeping | Legitimate interests; legal obligation where applicable |
| Marketing | Sending job alerts, industry updates or service information | Consent or legitimate interests, depending on the communication and applicable law |
| Website operation | Running, securing and improving our website | Legitimate interests; consent for non-essential cookies |
| Legal and business protection | Preventing fraud, handling complaints, resolving disputes and protecting legal rights | Legitimate interests; legal claims; legal obligation |
6. Recruitment services
We use candidate personal data to assess suitability for roles, discuss opportunities, introduce candidates to potential employers, arrange interviews, obtain feedback, manage offers and support the recruitment process.
We may share relevant candidate information with clients and prospective employers where this is necessary for recruitment purposes. We will only share information that is relevant to the role or recruitment process.
If you provide us with referee details, you should ensure that the referee is aware that their details may be provided to us and used for reference purposes.
7. Call recording
All telephone calls made to or from our business may be automatically recorded.
We record calls to:
- ensure the quality of our services;
- train and support our staff;
- keep an accurate record of discussions with candidates, clients and suppliers;
- help resolve queries, complaints or disputes; and
- comply with legal or regulatory obligations.
Call recordings are treated as personal data under data protection law. We store them securely and restrict access to authorised personnel only.
Recordings are used only for the purposes described in this Privacy Policy and are not shared with third parties unless required by law, necessary to protect our legal rights, necessary for the recruitment services we provide, or where you have given consent.
Call recordings are retained for 12 months from the date of the call, unless we need to keep them for longer to resolve a dispute, comply with legal obligations, investigate a complaint, or establish, exercise or defend legal claims.
If you have concerns about call recording, please tell us before or during the call so that we can discuss alternative ways to communicate.
8. Cookies and similar technologies
Our website may use cookies, pixels, tags, local storage and similar technologies to operate the website, remember your preferences, analyse website usage and, where applicable, support marketing.
Some cookies are necessary for the website to function and do not require consent. We will ask for your consent before using non-essential cookies, including analytics, advertising or tracking cookies, unless an exemption applies under applicable law.
You can manage your cookie preferences through our cookie banner or your browser settings.
For more information, please see our Cookie Policy: Cookie Policy – Cedar Stone Recruitment
9. Marketing communications
We may send you relevant job alerts, recruitment updates, industry insights or information about our services.
Where required by law, we will only send marketing communications with your consent. You can opt out of marketing communications at any time by using the unsubscribe link in our emails or by contacting us.
Even if you opt out of marketing, we may still contact you about active recruitment processes, service matters, legal notices or other non-marketing communications.
10. Who we share personal data with
We may share personal data with:
- employers, clients and hiring organisations;
- candidates, where relevant to recruitment processes;
- referees;
- background, screening, compliance or right to work checking providers;
- payroll, umbrella or contractor management providers, where relevant;
- recruitment technology providers, CRM providers and IT service providers;
- website hosting, analytics and cookie management providers;
- professional advisers, including lawyers, accountants and insurers;
- regulators, public authorities and law enforcement agencies;
- courts, tribunals or dispute resolution bodies; and
- potential buyers, investors or advisers in connection with a business sale, merger, restructuring or investment.
We require service providers who process personal data for us to use appropriate security measures and to process personal data only in accordance with our instructions and applicable law.
11. International transfers
Some of our service providers or technology platforms may process personal data outside the United Kingdom.
Where personal data is transferred outside the UK, we will ensure that appropriate safeguards are in place. These may include adequacy regulations, the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, standard contractual clauses, or another approved transfer mechanism.
12. How long we keep personal data
We keep personal data only for as long as necessary for the purposes for which it was collected, including for recruitment, business, legal, accounting, reporting and compliance purposes.
Retention periods may vary depending on the type of data, the purpose of processing, legal requirements and whether we need to retain data in connection with a complaint, dispute or legal claim.
| Data category | Retention approach |
|---|---|
| Candidate records | Retained while we provide recruitment services and for a reasonable period afterwards so we can contact you about suitable roles, unless you ask us to delete your data and we are not required to keep it. |
| Client and business contact records | Retained for the duration of the business relationship and for a reasonable period afterwards for contract, legal, accounting and relationship management purposes. |
| Right to work and compliance | Retained only for as long as needed to evidence compliance with legal obligations. |
| Call recordings | Retained for 12 months, unless needed for longer for disputes, complaints, legal obligations or legal claims. |
| Marketing records | Retained until you opt out or withdraw consent, unless we need to keep a suppression record to respect your preferences. |
| Website analytics and cookie data | Retained in accordance with our Cookie Policy, cookie banner settings or analytics provider settings. |
| Complaints and rights request records | Retained for a reasonable period to evidence how the matter was handled and to comply with legal and accountability obligations. |
13. Security
We use appropriate technical and organisational measures to protect personal data against unauthorised access, loss, misuse, alteration or disclosure.
These measures may include access controls, secure systems, password protection, staff training, data minimisation, secure storage, audit trails and supplier due diligence.
However, no website, email system or electronic transmission is completely secure. You should take care when sending sensitive information to us electronically.
14. Automated decision-making and recruitment technology
We may use recruitment technology to help organise applications, manage our recruitment pipeline, identify relevant skills, search candidate records, match candidates to vacancies or support shortlisting.
We do not make decisions that have a legal or similarly significant effect on you based solely on automated processing unless we tell you this and appropriate safeguards apply.
Where required by law, you may ask for human review, express your point of view and contest a decision.
15. Your data protection rights
Depending on the circumstances, you may have the following rights under data protection law:
- the right of access to your personal data;
- the right to rectification of inaccurate or incomplete personal data;
- the right to erasure of your personal data;
- the right to restrict processing;
- the right to data portability;
- the right to object to processing;
- the right to withdraw consent where processing is based on consent; and
- rights relating to automated decision-making.
You also have the right to request a copy of personal data we hold about you. When responding to a subject access request, we will carry out reasonable and proportionate searches for your personal data. If your request is unclear, we may ask you to clarify what information you are seeking where permitted by law. The ICO’s DUAA summary confirms that organisations only have to carry out reasonable and proportionate searches when dealing with requests from people for their information.
To exercise your rights, please contact us using the details in section 2.
We may need to verify your identity before responding to a request. We will respond within the timeframe required by law.
16. Data protection complaints
If you have a concern about how we collect, use, disclose, retain or otherwise process your personal data, you can raise a data protection complaint with us by contacting:
Email: legal@cedarstonerec.com
Address: Fennels Lodge, St. Peters Close, High Wycombe, England, HP11 1JT
Telephone: 020 4600 7766
Please include your name, contact details, a description of your concern, and any relevant reference numbers or correspondence. You do not need to use legal terminology or refer to data protection law for us to treat your concern as a data protection complaint.
We will acknowledge your complaint promptly, investigate it fairly, and aim to provide a substantive response within one month. If the matter is complex or we need more time, we will explain this to you.
We will keep records of complaints, investigation steps, outcomes and any remedial action taken.
If you are dissatisfied with our response, you have the right to complain to the Information Commissioner’s Office. From 19 June 2026, the DUAA introduces new statutory rules requiring controllers to operate a data protection complaints process, and privacy notices should explain how individuals can complain.
17. Complaining to the Information Commissioner’s Office
You can contact the Information Commissioner’s Office if you are unhappy with how we have handled your personal data or responded to your complaint.
ICO website: ico.org.uk
ICO telephone: 0303 123 1113
ICO address: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
We would encourage you to contact us first so that we have the opportunity to investigate and respond to your concerns.
18. Changes to this Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in our services, legal requirements, regulatory guidance or how we process personal data.
The latest version will be published on our website and will show the date it was last updated.