Privacy Policy
How we collect, use and protect your personal information
Last updated: September 2026
1. Who we are and what this policy covers
Ultimate Asset Ltd (“Ultimate Asset”, “we”, “us”) is a specialist recruitment and executive search business. We are the controller of the personal information described in this policy.
- Registered company number: 05597205 (England and Wales)
- Registered office: 167-169 Great Portland Street, London W1W 5PF
- Trading address: LABS House, 15-19 Bloomsbury Way, London WC1A 2TH
- Privacy contact: info@ultimateasset.com
This policy explains how we collect and use personal information about:
- candidates looking for permanent or contract roles;
- contractors we place with clients;
- people who work for our clients and suppliers;
- referees and emergency contacts candidates give us; and
- visitors to our website.
You can view the public pages of our website without giving us any personal information. We comply with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations 2003 (PECR), as amended by the Data (Use and Access) Act 2025. Where we deal with people in the EU, we also comply with the EU GDPR.
2. Information we collect
| Who | What we collect |
|---|---|
| Candidates | Name, contact details, CV, work history, qualifications, skills, current and expected salary, job preferences, notice period, location, notes from our conversations and interviews, references, and right-to-work information such as passport or visa details. |
| Contractors | All of the above, plus bank details, National Insurance number, tax status, limited company or umbrella company details, timesheets and rates. |
| Client and supplier contacts | Name, job title, employer, work email, phone number, notes of our dealings with you, and details of the roles you are recruiting for or services you provide. |
| Referees and emergency contacts | Name, contact details, relationship to the candidate, and the reference or other information you provide. |
| Website visitors | Information collected by cookies and similar technologies (see Section 10), and anything you enter into our forms. |
We may also collect special category data and criminal record information in limited cases. Section 6 explains when and why.
3. Where we get your information
Most information comes directly from you: when you apply for a role, send us your CV, register with us, speak to a consultant or contact us through the website.
We also get information from other sources:
- professional networking sites such as LinkedIn, company websites and other public professional profiles;
- job boards and CV databases where you have made your information available;
- referrals from people who know you, and contact details you give us at events;
- your referees and previous employers;
- our clients, for example interview feedback or timesheet approvals; and
- background-check and right-to-work verification providers, where a role requires it.
If we collect your details from one of these sources, we will provide the information required by data protection law within the applicable timeframe, generally within one month of obtaining it or when we first contact you if sooner.
4. How we use your information and our lawful bases
Data protection law requires us to have a lawful basis for each use of your information. We rely mainly on legitimate interests, contract and legal obligation, and on consent where it is the appropriate basis.
| Purpose | Lawful basis |
|---|---|
| Assessing your skills and matching you to suitable roles | Legitimate interests: running a recruitment business and helping candidates find work. |
| Sending your CV or profile to a client | Legitimate interests. We will discuss a specific role with you and get your agreement before sending your details to a client. |
| Arranging interviews, collecting feedback and managing offers | Legitimate interests; contract where relevant once you ask us to act for you. |
| Keeping in touch about your career and future roles | Legitimate interests, subject to applicable marketing and privacy rules. |
| Checking your right to work in the UK and keeping required records | Legal obligation, including applicable immigration and recruitment regulations. |
| Processing timesheets, invoicing clients and paying contractors | Contract and legal obligation, including tax and National Insurance requirements. |
| Finding candidates for clients and managing client relationships | Legitimate interests: providing recruitment and executive search services to businesses. |
| Sending job alerts and marketing communications | Consent or another lawful basis where permitted by applicable data protection and electronic marketing law. |
| Running and improving our website | Legitimate interests; consent for non-essential cookies where required (see Section 10). |
| Diversity monitoring | Explicit consent or another appropriate legal condition where applicable (see Section 6). |
| Handling complaints, legal claims and requests from regulators or law enforcement | Legal obligation and/or legitimate interests in protecting and defending our business. |
Where we rely on legitimate interests, we consider our interests against your rights and freedoms and only proceed where the processing is necessary and proportionate. You can object to processing based on legitimate interests in certain circumstances (see Section 12).
Giving us your information is not generally a legal requirement. However, we may be unable to put you forward for roles, make a placement or pay you for contract work without certain information.
5. Technology, AI, call recording and transcription
Technology and AI tools
We use search and AI-assisted tools to help us find, summarise, organise and format candidate and client information, for example to support CV-to-role matching, research, note preparation and internal administration. A consultant reviews the results and remains responsible for recruitment judgements and decisions. We do not make decisions about you based solely on automated processing, such as the automatic rejection of applications, where those decisions would produce legal or similarly significant effects.
We do not intentionally input special category information into AI tools unless there is an appropriate lawful basis and safeguard for doing so. Where third-party AI providers process personal information on our behalf, we use approved providers and appropriate contractual and data protection safeguards, including controls around the use of our data for model training where available.
Call recording and transcription
We may use approved technology to record or transcribe certain telephone calls, video meetings and reference conversations where this helps us keep accurate records or administer our recruitment services.
Where a call or meeting is being recorded or transcribed, we will make participants aware before or at the start of the recording.
Recordings, transcripts and AI-generated summaries are treated as personal information. Access is restricted to authorised staff and the information is retained only for as long as reasonably necessary for the purpose for which it was created.
6. Special category and criminal record information
We only collect sensitive information when it is needed and lawful to do so, and we apply additional safeguards.
- Health and disability: if you tell us about a disability or health condition so that we or a client can make reasonable adjustments, for example for an interview. We process this only where an appropriate legal condition applies.
- Diversity monitoring: we may ask about characteristics such as ethnicity, sexual orientation or religion. Answering is optional. Where we rely on consent, it will be explicit. We aim to keep identifiable diversity information separate from recruitment decision-making and use it in anonymised or aggregate form where possible.
- Criminal records: only where a role requires an appropriate check. We process criminal offence data only where permitted by law and with the required safeguards.
7. Who we share your information with
We do not sell your personal information. We share it only where necessary with:
- clients: potential employers or hirers, for specific roles we have discussed with you;
- service providers who act for us: including recruitment CRM, outreach and communications providers, website and analytics providers, IT and hosting providers, payroll or timesheet providers, and approved AI, recording and transcription providers;
- umbrella companies and payroll intermediaries: if you choose to work through one, and pension scheme providers for auto-enrolment where applicable;
- referees and verification providers: to obtain references and complete right-to-work or background checks;
- professional advisers: including accountants, lawyers, insurers and compliance advisers;
- authorities: including HMRC, the Home Office, regulators, courts and law enforcement, where required or permitted by law; and
- a buyer, successor or other relevant party if our business is sold, reorganised or restructured.
Our service providers may only process your information in accordance with our instructions and applicable data protection requirements and must keep it appropriately secure.
International transfers
Some of our technology and service providers may process or store personal information outside the United Kingdom.
Where personal information is transferred internationally, we use appropriate safeguards required under UK data protection law. These may include UK adequacy regulations, recognised international data transfer frameworks, the UK International Data Transfer Agreement, the UK Addendum to approved Standard Contractual Clauses, or another legally recognised transfer mechanism.
If we send your personal information to a client outside the UK as part of a recruitment process, we will discuss the relevant opportunity with you first.
You can contact us if you would like more information about the safeguards we use for international transfers.
8. How long we keep your information
We keep information only for as long as we need it for the purposes described in this policy or as the law requires. After that, we delete it securely or anonymise it.
| Information | How long we keep it |
|---|---|
| Candidate records (CV, notes, contact details) | 3 years from our last meaningful contact with you, unless there is an ongoing relationship or another reason to retain them. |
| Records of introductions and placements | At least the period required by applicable recruitment regulations, and potentially longer where needed for contracts, legal claims or other lawful purposes. |
| Right-to-work check records | For the period required by applicable immigration and employment legislation. |
| Contractor timesheets, pay and tax records | For the period required by applicable tax, accounting and employment legislation. |
| Client and supplier contact records | 3 years from our last meaningful contact, or longer while we have an active commercial relationship or another lawful reason to retain them. |
| Diversity monitoring information | Only for as long as necessary for the stated monitoring purpose, with anonymisation or deletion of identifiable information as soon as reasonably practicable. |
| Marketing subscriptions | Until you unsubscribe or until we determine the information is no longer needed for the marketing purpose. |
| Call recordings and transcripts | Only for as long as reasonably necessary for the purpose for which they were created, and typically for a shorter period than the underlying recruitment record. |
“Meaningful contact” means a genuine two-way interaction, such as a call, email reply, application or other active engagement with us.
You can ask us to delete information sooner (see Section 12). We may need to keep some records where the law requires it or where we have another lawful reason to do so. If you ask us to delete your details, we may keep a minimal suppression record, such as your name and email address, so that we do not add you back to our systems from another source by mistake.
9. Job alerts and marketing communications
You may sign up to receive job alerts, recruitment updates, newsletters or other relevant communications from us. We may use third-party communications providers to help us deliver these messages and to understand engagement with our communications.
Where communications constitute direct marketing, we send them only where permitted by applicable data protection and electronic marketing law and provide an easy way to opt out.
For business contacts, we may send relevant updates to your work email where permitted by law. You can opt out at any time.
You can unsubscribe using the link in any marketing email, or by emailing info@ultimateasset.com. Unsubscribing from marketing will not stop us contacting you about a role you are actively being considered for, an active recruitment assignment or another service-related matter.
10. Cookies
Cookies are small files stored on your device when you visit a website. Our website uses cookies and similar technologies for essential functionality and, where applicable, analytics and advertising purposes.
| Cookie category | Purpose and consent |
|---|---|
| Strictly necessary cookies | Support core website functions and remember essential settings. These cookies do not require consent where they are strictly necessary. |
| Analytics cookies | Help us understand how visitors use the website and measure performance. We use consent where required by law and may rely on a statutory exemption only where its conditions are met. |
| Advertising and social media cookies | May measure advertising effectiveness, support remarketing or enable third-party social features. We use these only with consent where required. |
When you first visit our website, our cookie controls allow you to manage non-essential cookies. Where consent is required, rejecting non-essential cookies will not prevent you from using the main functions of the website.
You can also block or delete cookies through your browser settings. Blocking strictly necessary cookies may affect some website functionality.
Our cookie settings or cookie notice may provide further information about the specific cookies and technologies in use at any given time.
11. Security and data breaches
We use appropriate technical and organisational measures to protect your information from loss, misuse and unauthorised access. These may include:
- encryption in transit on our website and relevant systems;
- access controls and multi-factor authentication where appropriate;
- regular software updates and security monitoring;
- staff data protection and security training; and
- contractual security and data protection requirements for relevant service providers.
No system can be guaranteed to be completely secure, but we review our safeguards regularly.
If a personal data breach is likely to result in a risk to people’s rights and freedoms, we will notify the Information Commissioner’s Office where required and within the applicable legal timeframe. If the risk to an affected person is high, we will also notify that person where required. We keep appropriate records of personal data breaches.
12. Your rights
Depending on the circumstances, you may have the following rights over your personal information:
- Access: ask for a copy of the personal information we hold about you (a subject access request).
- Rectification: ask us to correct inaccurate information or complete information that is incomplete.
- Erasure: ask us to delete your information in certain circumstances.
- Restriction: ask us to limit how we use your information in certain circumstances.
- Portability: in certain circumstances, ask for information you provided to us in a commonly used electronic format or ask us to send it to another organisation.
- Objection: object to certain processing based on legitimate interests. You have an absolute right to object to direct marketing.
- Withdraw consent: where we rely on consent, withdraw it at any time. This does not affect processing carried out before withdrawal.
- Automated decisions: rights in relation to decisions made solely by automated means that produce legal or similarly significant effects.
To exercise a right, email info@ultimateasset.com or write to us at the address in Section 14. There is normally no charge. We will respond within the timeframe required by data protection law and may ask you to confirm your identity first.
Some rights are subject to legal limits. For example, we may need to retain certain records to meet legal obligations or establish, exercise or defend legal claims. If a right does not apply in full, we will explain why.
13. Complaints
If you are unhappy with how we have handled your personal information, please contact us first so that we can investigate and respond.
- We will acknowledge a data protection complaint within 30 days.
- We will investigate it without undue delay and may ask you for further information.
- We will tell you the outcome of our investigation and any action we have taken or propose to take.
You also have the right to complain to the Information Commissioner’s Office (ICO), the UK data protection regulator. Further information is available at ico.org.uk.
14. Other information
Equal opportunities
We are committed to diversity, inclusion and equal opportunities. We treat candidates fairly and do not discriminate on the basis of protected characteristics under the Equality Act 2010.
Children
Our recruitment services are intended for adults. We do not knowingly collect personal information from children through our recruitment services.
Links to other websites
Our website may link to websites operated by other organisations, such as job boards or professional networks. We are not responsible for how those organisations handle personal information, so we recommend reviewing their privacy information.
Changes to this policy
We review this policy periodically and update it when our practices, technology or the law changes. The date at the top shows when it was last updated. Where a significant change affects how we use personal information, we will take appropriate steps to bring it to the attention of affected people.
Contact us
For questions about this policy, to exercise your rights or to raise a concern about your personal information:
- Email: info@ultimateasset.com
- Post: Data Protection, Ultimate Asset Ltd, LABS House, 15-19 Bloomsbury Way, London WC1A 2TH