Privacy Policy

Introduction

CMA Financial Recruitment Ltd (“CMA”) and any associated trading names understand the importance of protecting the personal data of our candidates and clients. This Privacy Notice explains in detail the types of personal data we may collect about you when you interact with us. It also explains how we’ll store and handle that data and keep it safe. We know that there’s a lot of information here, but we want you to be fully informed about your rights and understand how CMA uses your data.

With this in mind, CMA adheres to the following Privacy Notice. English law and jurisdiction apply with respect to the content of this notice and the information contained. In particular, CMA recognises and addresses its obligations under the UK General Data Protection Regulation, the Data Protection Act 2018, including section 164A of the Data Protection Act 2018 in relation to data protection complaints, and any applicable statutory or regulatory provisions in force from time to time relating to the protection and transfer of personal data.

Data Controller

Under the UK General Data Protection Regulation (‘UK GDPR’), data controllers are defined as the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data. Based on this definition, CMA will act as the Data Controller with regards to both candidate and client data collected by CMA when providing services in the UK.

Explaining the legal basis we rely on

The law on data protection sets out a number of different reasons for which a company may collect and process your personal data, including:

Contractual obligations

In certain circumstances, we may need your personal data to comply with our contractual obligations.

For example, if you are offered a role via CMA, we may collect your contact details and pass them to our client to enable you to receive a formal offer letter and/or proposed contract of employment.

Consent

In specific situations, we may collect and process your data with your consent. At the point of registration CMA may ask to retain and use candidate personal data on the basis of consent and in compliance with the UK GDPR.

For example, when you agree that CMA can pass your details to a client for a role in which you are interested in relation to CMA providing you with work finding services.

When collecting your personal data, we’ll always make clear to you which data is necessary in connection with providing you with work finding services.

Legal compliance

If the law requires us to, we may need to collect, process and store your data.

For example, if you undertake a temporary assignment via CMA, HMRC request specific personal data relating to payroll for RTI reporting purposes and our pension provider requests specific personal data for compliance with auto enrolment legislation.

Legitimate interest

In specific situations, we may require your data to pursue our legitimate interests in a way which might reasonably be expected as part of running our business, and which does not materially impact your rights, freedom or interests.

For example, we may use your email address details to send you direct marketing information, telling you about products and services that we think might interest you.

How and when CMA collect information

Information is collected via our website and third-party sources such as independent external job boards and social media platforms. Information is also voluntarily provided to us by candidates and clients when creating an account or registering for our services. Personal information relating to an individual is collected during candidate registration interviews, telephone calls, email correspondence and reference checks. Client information is also collected during meetings, telephone calls and events CMA attend or host. The legal basis for this processing is our legitimate interest as a business to offer work finding and/or recruitment services.

CMA collect information from all users of CMA’s services, whether this is via our website, in person or via an affiliated partner. CMA collect candidate data required to carry out work finding services. This includes but is not limited to: name, address, date of birth, employment history, right to work, membership details and references. CMA also collect client data required to carry out recruitment services. This includes but is not limited to: name, company address, company phone number, company email and job role.

In addition to the information provided CMA collect and check data from third parties such as companies house and accredited bodies.

CMA never knowingly collect more personal data than is strictly necessary to perform our tasks in providing work finding and/or recruitment services.

Information created when you use our services

If you are a client, CMA will collect details about the company. This includes but is not limited to: company registration details, structure, contact information and role details.

If you are a candidate (job seeker) CMA will collect personal data. This includes but is not limited to: name, address, date of birth, employment history, right to work, qualification membership details, and references.

CMA may associate your name with another person via our refer a friend scheme, to ensure you receive the due recognition.

Use of Cookies

The CMA website www.cmarecruitment.co.uk (the “Site”) uses cookies. Cookies are small data files which the Site places on your computer or handheld device. This is normal practice for websites. Cookies are essential to help us provide a high-quality website. By collecting information through cookies and other automated means on our Site, we learn how to best tailor the Site to our visitors.

The Cookies that we use and why: We use third party cookies to analyse your visiting patterns on our Site and other trends and statistics regarding your use of our Site and the sites from which you visited us (referrers). These cookies are set by Google Analytics. Using these cookies helps us deliver the best web experience for you, and to understand what our readers are looking at so that we can produce more of the

right kind of content. We do not use cookies to track your Internet browsing activities before or after you visit the Site. Our use is subject to Google’s current cookie policy, which you can find at:

http://www.google.com/analytics/learn/privacy.html

Consent to use Cookies

Where cookies or similar technologies require consent, CMA will seek your consent before using them. You can manage or disable cookies through your browser settings or any cookie preference tools made available on our website. Disabling certain cookies may affect how the Site functions.

If you have a concern or complaint about our use of cookies, trackers, analytics technologies or marketing consents, you may raise this through CMA’s data protection complaints process using the contact details set out in this Privacy Notice.

How and why do we use your personal data

Candidates

CMA do not sell or share your personal information to third parties for third party direct marketing purposes. CMA will use your information to deliver personalised work finding services and optimise your CMA experience. Data will be collated onto our internal systems, and all paper documents will be securely stored on each site. CMA will use information collected to:

Source and match roles and companies to your requirements
Submit your CV and any other relevant information to clients in the process of providing work finding services
Communicate with candidates regarding your job search via email, phone, text message or post
Update candidates on events and announcements which may be of interest in relation to CMA providing current or future work finding services
Undertake research and analysis to enhance CMA’s work finding services
Process payroll and comply with Auto Enrolment and HMRC requirements
Meet our Health & Safety obligations as per UK statute

Clients

Client data is obtained, kept and used on the basis of legitimate interest and in compliance with the UK GDPR. CMA does not sell or share your information to third parties for third party direct marketing purposes. Data will be collated onto our internal systems, and all paper documents will be securely stored on each site. CMA will use information collected to:

Discuss present and future organisational recruitment requirements
Allow CMA to compare CMA candidates with organisational vacancy requirements
Provide candidate CVs and any other relevant candidate information
Update clients on events and announcements which may be interest in relation to CMA supporting current or future organisational recruitment strategy
Manage processes throughout the recruitment cycle including but not limited to: interviews, feedback, offers and timesheet authorisation.
Process credit checks and raise invoices for services provided
Undertake research and analysis to enhance CMA’s recruitment services
Recommend service partners, where agreed details will be passed onto our selected partners

Other processing activities

In addition to the specific purposes for which we may process your personal data set out above, we may also process any personal data where such processing is necessary for compliance with a legal obligation to which we are subject, such as the Conduct Regulations 2003, or in order to protect your vital interests or the vital interests of another natural person.

Data Sharing & Disclosure

Except as set out herein and where required or permitted by law or a court of competent jurisdiction, CMA will not reveal any personal data about you to any third party.

Information will be shared internally within the CMA team to provide work finding, recruitment and payroll services. CMA will only share information with third parties when required as part of our work finding or recruitment services. CMA may check information collected with third parties or with other information held by CMA. Candidate’s personal data will only be shared with CMA clients who have a legitimate interest and only then with the candidate’s permission.

Your data may be disclosed to any person, firm or company to whom we sell the whole or a substantial part of our business or to whom we may transfer any part of our rights or obligations. We may also disclose your

information where necessary to enforce our Terms of Business or other agreements or if necessary to prevent, detect or prosecute illegal or suspected illegal activities or to prevent other damage in response to a legal action against CMA.

How do we protect your information?

Your personal data security is our highest priority. CMA have taken steps to protect your information by limiting the access to our network and locations where your data is stored. Our team only access data which is required to complete their job function. Our IT systems are ISO 27001 accredited. These are provided, monitored and supported by Enhanced. Enhanced regularly monitor our system for possible vulnerabilities and attacks and carry out penetration testing to identify ways to further strengthen security. We secure access to all transactional areas of our websites using ‘https’ technology. Further information on the security features of our system is available on request. Access to your personal data is password-protected. Although we do our best to protect the information you share via the internet, anything you submit via the internet is done so at your own risk. We know how much data security matters to all our customers. With this in mind we will treat your data with the utmost care and take all appropriate steps to protect it.

Information retention & deletion

Client and Candidate Data

Whenever we collect or process your personal data, we’ll only keep it for as long as is necessary for the purpose for which it was collected.

During our marketing activities, CMA log who, when and where our mailers have been opened and viewed.

CMA also obtain data from publicly available sources, financial service providers, governing bodies and referees. CMA may combine information collected from these sources with information already in its possession.

Our data is stored on external servers, which are monitored and protected 24hrs a day. All personal information is stored on servers located in the UK.

CMA may retain your personal data where such retention is necessary for compliance with a legal obligation to which we are subject, or in order to protect your vital interests or the vital interests of another natural person.

Candidate Data

During the time you are registered as active with CMA we will log calls, emails, meetings, texts, events and any other relevant information on our secure internal database. At this time no option exists for third party access. If a decision is made to change this aspect of the database, then we will notify you first. While all reasonable security measures have been implemented, CMA are unable to accept responsibility for intrusion by third parties acting illegally.

CMA will retain your information whilst you are active, unless you request deletion of your account or information, and for a period of no more than 6 years if you have completed temporary assignments via CMA as required by law and in accordance with UK statute.

If your work finding search is no longer active and you have not undertaken temporary assignments via CMA, your information will be stored for five years following the date of our last contact or dealing with you, on the basis of legitimate business interest and in compliance with the UK GDPR. At the end of that retention period, we’ll contact you to ask whether you’d like CMA to retain, store and process your data. Unless you reply to say ‘yes’, your data will either be deleted completely or anonymised, for example by aggregation with other data so that it can be used in a non-identifiable way for statistical analysis and business planning. However, some of your data may still exist within our systems. For our purposes, this data will be put beyond use, meaning that while it still exists on a system, it cannot be readily accessed by operational systems, processes or employees.

Client Data*

Client data including but not limited to company information, credit checks and key contact details.

After the five-year period, key contacts who have not been contacted within this period will be deleted. If after this process has been undertaken, the client record has no key contacts, then the company will be deleted from our system. However, some of your data may still exist within our systems. For our purposes, this data will be put beyond use, meaning that while it still exists on a system, it cannot be readily accessed by operational systems, processes or employees.

*Any clients who have actively conducted transactions with CMA within the five-year period will have their company information retained on our system.

Data processing of minors

We do not offer work finding services to anyone under the age of 18. Therefore, no data will be held on individuals under this age.

What are your rights over your personal data

You have the following rights in relation to your personal data:

Access to the personal data we hold about you, free of charge in most cases
The correction of your personal data when incorrect, out of date or incomplete.
That we stop using your personal data for direct marketing
That we stop any consent-based processing after you withdraw that consent
To be forgotten from our databases and systems
A copy of our Right to Be Forgotten policy
A copy of our Subject Access Request Policy
To make a complaint directly to CMA if you believe that CMA has infringed data protection law in connection with your personal data

You can contact us to exercise these rights or raise a data protection complaint at any time. If we are unable to action a rights request, we will explain the reasons for our decision. Data protection complaints can be made directly to the Data Protection Officer at dpo@cmarecruitment.co.uk, or through any of CMA’s usual communication channels.

Your right to withdraw consent

Whenever you have given us your consent to use your personal data, you have the right to change your mind at any time and withdraw that consent. Please email your request to dpo@cmarecruitment.co.uk.

Where we rely on our legitimate interest

In cases where we are processing your personal data on the basis of our legitimate interest, you can ask us to stop for reasons connected to your individual situation.

We must then do so unless we believe we have a legitimate overriding reason to continue processing your personal data.

Direct marketing

You have the right to stop the use of your personal data for direct marketing activity through all channels, or selected channels. We must always comply with your request.

If you have a concern about marketing consent, continued marketing communications or how CMA has handled a request to stop direct marketing, you may raise this through CMA’s data protection complaints process using the contact details set out in this Privacy Notice.

Checking your identity

To protect the confidentiality of your information, we will ask you to verify your identity before proceeding with any request you make under this Privacy Notice.

To submit a request regarding any of the above please contact your regional office. Contact details are provided below.

Contact us

Southampton

T| 02380 638046

E| southampton@cmarecruitment.co.uk

Bournemouth

T| 01202 312222

E| bournemouth@cmarecruitment.co.uk

Portsmouth

T| 02392 480524

E| portsmouth@cmarecruitment.co.uk

Basingstoke

T| 01256 333222

E| basingstoke@cmarecruitment.co.uk

Guildford

T| 01483 651545

E| guildford@cmarecruitment.co.uk

Reading

T| 01256 333222

E| reading@cmarecruitment.co.uk

Making a Complaint

If you believe that CMA has infringed data protection law in connection with your personal data, you have the right to make a complaint directly to CMA. This includes concerns about how we collect, use, disclose, secure, retain or delete your personal data, or how we have handled a request relating to your data protection rights.

Data protection complaints should be submitted in the first instance to the Data Protection Officer by emailing dpo@cmarecruitment.co.uk. A complaint may also be raised through any of CMA’s usual communication channels, including email, telephone, post, website enquiries, social media or in person. Complaints may be submitted in any reasonable format, and CMA will provide reasonable support or alternative arrangements where needed to help individuals make or progress a complaint. You do not need to use the words “complaint”, “UK GDPR” or “data protection” for us to recognise a data protection complaint. Any complaint received through another CMA channel will be referred promptly to the Data Protection Officer for handling.

Where a concern raised through another CMA process appears to relate to CMA’s use of personal data, CMA will treat it as a data protection complaint or link it to the relevant data protection process, as appropriate. Where a complaint indicates that an individual may need additional support, CMA will take this into account when handling the complaint.

CMA will acknowledge receipt of a data protection complaint within 30 days, beginning with the day on which it is received. The Data Protection Officer will ensure that appropriate enquiries are made without undue delay, that the complainant is kept informed of progress at appropriate stages and that the outcome is communicated clearly without undue delay.

If you are dissatisfied with the handling or outcome of your complaint, or if the matter requires senior review, you may request escalation to the Managing Director by emailing neil.phillips@cmarecruitment.co.uk. Escalation will not delay or replace CMA’s obligation to acknowledge, investigate and respond to the complaint within the applicable requirements.

CMA will maintain an auditable record of the complaint, including the date received, key correspondence, enquiries undertaken, evidence considered, decisions, reasons, progress updates, the outcome and any corrective action. Where a complaint also includes a request to exercise another data protection right, such as a Subject Access Request or Right to Erasure request, the complaint and rights request may be handled at the same time but will be recorded, linked and managed separately against the legal requirements and deadlines applicable to each process.

CMA will review data protection complaint records periodically to identify recurring issues, monitor handling times, consider whether corrective action or process improvements are required and support any future regulatory reporting obligations relating to complaints handling.

Contacting the Regulator

You also have the right to complain to the Information Commissioner’s Office (ICO), the UK supervisory authority for data protection. You may contact the ICO whether or not you have first made a complaint to CMA, and making a complaint to CMA does not affect your right to raise the matter with the ICO.

You can contact the ICO using the following details:

Telephone: 0303 123 1113

Email: icocasework@ico.org.uk

Post:

The Information Commissioner’s Office

Wycliffe House

Water Lane

Wilmslow

Cheshire

SK9 5AF

Further information is available on the ICO website at How to make a data protection complaint.

An individual may wish to seek independent legal advice in relation to their concerns. The individual may use CMA’s internal complaints process, complain to the Information Commissioner’s Office, seek legal advice or pursue other available remedies as appropriate.

Policy Updates

It’s likely that we’ll need to update this Privacy Notice from time to time. This Privacy Notice explains how we use your personal data. We’ll notify you of any significant changes where required, but you’re welcome to come back and check it whenever you wish.

Updated September 2026