Privacy notice
How we look after candidates' personal information, and how we use AI in our work.
Candidate Privacy Notice
Who we are
HK Palmer Consulting Ltd (company number 17534383) helps businesses hire. When we find or consider you for a role, we are the controller of your personal information. Our registered office is 66 Havelock Road, Dartford, Kent DA1 3JB. We are registered with the Information Commissioner's Office (ICO), registration number ZC281921. Contact: Harry Palmer, harry@hkpalmer.co.uk.
What we collect
- Your name and contact details, and your CV and work history.
- Qualifications, licences and certifications.
- Salary expectations, notice period and location.
- Whether you have the right to work in the UK (yes or no only).
- Our notes from conversations with you.
We do not ask for or record protected characteristics such as age, disability, ethnicity, religion, sex or sexual orientation. Please don't include them in your CV.
Where it comes from
From you, or from places where you have made your profile available for recruitment, such as LinkedIn, CV-Library and Indeed. It can also come from people who refer you. If we find you ourselves, we will send you this notice when we first contact you, and always within one month.
Why we use it, and our lawful basis
- To assess whether you suit a role and to talk to you about it. Our lawful basis is legitimate interests: running a recruitment service that helps both candidates and employers.
- To introduce you to a client. We only send your details to a client after you have agreed to that specific role. Once the client has your details, it uses them under its own privacy notice.
- To keep you in our talent pool for future roles, only if you opt in (see below). Our lawful basis is consent.
- To meet legal obligations, such as record-keeping.
How we use technology
We keep records in Notion and Google Workspace. We use AI-assisted tools, including Claude by Anthropic, to help summarise CVs and compare them against the job's requirements. A person always reviews the results. No decision about you is made by automated means alone. You can ask for a person to review any assessment of you. Our AI-in-recruitment policy (below) explains more.
Who we share it with
- Clients you have agreed to be put forward to.
- Our service providers, which host our systems and act only on our instructions: Notion, Google, Anthropic and job board providers.
We never sell your data.
Transfers outside the UK
Some providers process data in the US or the EU. Where they do, we rely on UK adequacy regulations (including the UK-US data bridge) or the UK International Data Transfer Addendum.
How long we keep it
- If you are considered for a role, we delete your information 6 months after that role closes. A role closes when the hire starts or the role is cancelled.
- If you are hired through us, we keep your name, the role, the client and your start date for our records and fee purposes, and delete the rest.
- Talent pool (optional): if you say yes, we keep your details for 12 months so we can contact you about suitable roles. We'll ask you to renew before the 12 months is up. If you don't, we delete your details. You can leave at any time by emailing us.
Your rights
You can ask to see the information we hold about you; correct it or delete it; restrict how we use it, or object to it; or move it to someone else. You can also withdraw your consent, or ask us to stop contacting you. Email harry@hkpalmer.co.uk and we will reply within one month.
If you're unhappy, please tell us first. You can also complain to the ICO at ico.org.uk or on 0303 123 1113.
AI in Recruitment Policy
- Why we have this policy. We use AI to do the admin of hiring faster and more consistently, so that people have more time for people. This policy sets out what AI does and doesn't do in our work, for candidates, clients and anyone working with us.
- People decide. A person makes every decision about a candidate: shortlisting, rejection, offers and pay. AI supports that person and never replaces them. We never make a decision with legal or similarly significant effects on a candidate by automated means alone (UK GDPR Article 22).
- What we use AI for. Summarising CVs and interview notes. Scoring candidates from 1 to 10 against written, job-related criteria agreed with the hiring manager, with the evidence for each score. Drafting adverts, emails, interview questions and reports; a person checks every draft before it is sent. Planning, reminders and progress reports on hiring.
- What we don't use AI for. Using or inferring protected characteristics, or anything standing in for them (such as names, photos, dates of education used to guess age, or postcodes). Emotion, facial or voice analysis. Scraping data from sites against their terms, or collecting more than the role needs. Training AI models on candidate or client data; we use business tools whose providers don't train on our data. Contacting candidates automatically; a person approves every message.
- Fairness checks. Criteria are written before sourcing starts and must relate to the job. A person reviews AI scores against the full CV, never a list view alone. We check shortlists for patterns that suggest unfair exclusion, and record the reason for every change to a score. Anyone can ask for a person to review an assessment.
- Data and security. Each client's data is kept separate. Access is limited to named users with multi-factor login. Retention follows our privacy notice: 6 months after the role closes, or 12 months in the talent pool with consent. Where we work inside a client's hiring (as its processor), we follow the client's instructions and its own policies.
- Tools. We use Claude (Anthropic), Notion AI and our own Finch co-pilot, which is built on Claude. We assess any new tool for data protection before use. Where a new use could create high risk, we complete a data protection impact assessment first.
- Being open. We tell candidates when AI helps assess them, through our privacy notice. We tell clients how we use it in our terms. Questions: harry@hkpalmer.co.uk.
- Responsibility. Harry Palmer, Director, owns this policy.