Privacy Policy
Sarflix Care Recruitment Ltd
| Version | 1.1 |
| Effective date | 24 September 2026 |
| Next review due | 24 December 2026 (reviewed every three months) |
| Company number | 17423229 |
| Address | Suite RA01, 195-197 Wood Street, London E17 3NU |
| ICO | Registered with the Information Commissioner’s Office |
| Contact | hello@sarflixrecruitment.co.uk or +44 7760 892378 |
1. Who we are
Sarflix Care Recruitment Ltd (company number 17423229) is an employment agency and employment business. We supply nurses, care assistants and support workers to care homes, NHS services and home care providers, starting in Mansfield and Nottinghamshire. In this policy “we”, “us” and “our” mean Sarflix Care Recruitment Ltd.
We are the data controller for the personal data described in this policy, and we are registered with the Information Commissioner’s Office (ICO).
Our contact details:
- Address: Suite RA01, 195-197 Wood Street, London E17 3NU
- Email: hello@sarflixrecruitment.co.uk
- Telephone: +44 7760 892378
- Data Protection Lead: Felix Ugbesia, Director
We have not appointed a Data Protection Officer. The law only requires one in certain situations, and we keep this under review as we grow. Our Data Protection Lead is responsible for how we handle personal data.
2. Who this policy covers
This policy explains how we handle personal data about:
- Candidates and workers: anyone who registers with us, applies for work, or is employed and placed by us.
- Clients: staff and representatives of care homes, NHS bodies, home care providers and other organisations we supply staff to.
- Website visitors and enquirers: anyone who visits sarflixrecruitment.co.uk or contacts us.
- Referees, emergency contacts and next of kin: people whose details a candidate gives us.
- Suppliers: contacts at organisations we buy services from.
3. The personal data we collect
3.1 Candidates and workers
| Type | Examples |
|---|---|
| Identity and contact | Name, previous names, date of birth, photograph, address, email, phone number, National Insurance number |
| Right to work | Passport or other identity documents, Home Office share code, immigration permission and expiry dates |
| Suitability for work | CV, work history, gaps in employment, qualifications, training records, professional registration (such as an NMC PIN), references, interview notes |
| Work preferences | Availability, shift preferences, where you are willing to work, pay expectations |
| Placement and pay | Assignments, timesheets, shifts worked, pay rate, bank details, tax code, pension, holiday and sickness records |
| Health (special category data) | Fitness to work, reasonable adjustments, occupational health outcomes, vaccination evidence where a client requires it |
| Equality monitoring (special category data) | Ethnicity, religion, sex, sexual orientation and disability, collected only if you choose to give it and never used to make decisions about you |
| Criminal records (criminal offence data) | Enhanced DBS outcome, certificate number and date, barred list check, DBS Update Service status, your own declaration of convictions |
| Conduct and safety | Safeguarding concerns, incident reports, client feedback, complaints |
| Communications | Records of our calls, emails, texts and messages with you |
3.2 Clients
Name, job title, employer, work email and phone number, our correspondence, staffing requests, contract, invoicing and payment details.
3.3 Website visitors and enquirers
If you contact us, we collect what you tell us: usually your name, phone number, email address and message. Our hosting provider records technical information such as your IP address, browser type and the pages you visit, which it uses to keep the site secure and working. See section 12 on cookies.
3.4 Referees and emergency contacts
Name, job title, organisation, relationship to the candidate and contact details, given to us by the candidate. We ask candidates to tell you they have shared your details.
4. Special category and criminal offence data
Some information needs extra protection under the law. We collect it only where it is necessary to recruit safely into health and social care.
| What we process | Why | Legal condition |
|---|---|---|
| Health and fitness to work | To check you can safely do the role, make reasonable adjustments and manage sick pay | UK GDPR Article 9(2)(b) with Data Protection Act 2018 Schedule 1 paragraph 1 (employment) |
| Occupational health advice | To assess fitness for work | Article 9(2)(h) with Schedule 1 paragraph 2 |
| Equality monitoring | To check we treat people fairly | Article 9(2)(g) with Schedule 1 paragraph 8 (equality). This is optional |
| Safeguarding information | To protect adults and children at risk | Article 9(2)(g) with Schedule 1 paragraph 18 (safeguarding) |
| DBS and barred list results, and conviction declarations | To make sure it is safe for you to work with adults at risk, as the law requires | Article 10 and section 10(5) of the Data Protection Act 2018, with Schedule 1 paragraphs 1, 10 and 18 |
We carry out DBS checks through a registered umbrella body. We see the original certificate, we do not keep a copy for more than six months after a recruitment decision, and after that we keep only the certificate number, date, level of check and the decision we made. A disclosure on a certificate is never an automatic bar: we talk to you and record a fair decision. The only exception is a barred list match, because placing a barred person in regulated activity is a criminal offence.
We have an Appropriate Policy Document that explains how we protect this data, as required by Schedule 1 Part 4 of the Data Protection Act 2018. You can ask for a copy at hello@sarflixrecruitment.co.uk.
5. Where we get your data from
- From you, through our forms, your CV, interviews, calls and emails.
- From your referees and previous employers.
- From job boards where you have posted your CV or applied for a role we advertised.
- From public registers such as the Nursing and Midwifery Council register, to check registration.
- From the Disclosure and Barring Service, through our umbrella body.
- From clients, such as timesheet approvals, feedback and incident reports.
- From someone who refers you to us. We will tell you who, if you ask.
6. Why we use your data and our lawful basis
| Purpose | Lawful basis (UK GDPR Article 6) |
|---|---|
| Registering you, assessing your suitability and matching you to shifts | Legitimate interests in running a recruitment business and helping you find work. Contract once you are employed by us |
| Checking identity, right to work, qualifications and registration | Legal obligation under immigration law. Legitimate interests in supplying safe, verified staff |
| References, DBS and barred list checks | Legal obligation and legitimate interests in safe recruitment, with the conditions in section 4 |
| Employing you, placing you, paying you and keeping working time records | Contract and legal obligation (tax, National Insurance, pensions, working time) |
| Meeting our duties as an employment agency and employment business | Legal obligation under the Conduct of Employment Agencies and Employment Businesses Regulations 2003 |
| Working with clients, quoting and invoicing | Contract and legitimate interests. Legal obligation for accounting records |
| Replying to website enquiries | Legitimate interests in answering people who contact us |
| Telling you about suitable work or our services | Your consent where the law requires it, otherwise legitimate interests. You can opt out at any time |
| Handling safeguarding concerns, complaints and legal claims | Legal obligation and legitimate interests |
| Keeping our systems and data secure | Legitimate interests, which the Data (Use and Access) Act 2025 recognises for network and information security |
Where we rely on legitimate interests, we have checked that our interests do not override yours. You can ask us for a summary of that check, and you can object at any time (section 10).
If you do not give us the information we need for right to work, DBS or registration checks, we will not be able to offer you work.
7. Who we share your data with
| Who | Why |
|---|---|
| Clients | To put you forward for shifts and confirm your checks. We share only what they need, and tell you before we send your profile to a named client |
| Referees and previous employers | To get and check references |
| Our DBS umbrella body and the Disclosure and Barring Service | To carry out criminal record checks |
| Professional regulators such as the NMC | To check registration and, where required, to report a concern |
| Occupational health providers | To give advice on fitness to work. We receive an outcome, not your medical records |
| Training providers | To arrange and record training |
| Payroll, accountancy and pension providers | To pay you and meet pension duties |
| HMRC, the Home Office and other public bodies | Where the law requires it |
| Local authorities, the police, the CQC and safeguarding boards | Where there is a safeguarding concern or a lawful request |
| IT, hosting, email and recruitment software providers, including Hostinger for our website and email | To run our systems. They act on our instructions under written contracts |
| Insurers, auditors and legal advisers | To manage claims, audits and legal advice |
We do not sell your personal data, and we do not share it for other companies’ marketing.
8. Sending data outside the UK
Most of our data stays in the UK. Some service providers may store or access data outside the UK, for example when your browser loads the fonts on our website from Google’s servers. When we transfer personal data outside the UK, we make sure the country has UK adequacy status, or that approved safeguards are in place such as the International Data Transfer Agreement. You can ask us for details.
9. How long we keep your data
| Record | How long | Why |
|---|---|---|
| Website enquiries that do not lead further | 12 months from our last contact | To follow up and answer questions |
| Applications where you are not placed | 12 months from our last meaningful contact | To offer you suitable work and respond to any claim |
| Records of workers we employed and placed | 6 years after your last assignment | Contract and tax time limits |
| Employment agency records | At least 1 year from creation or last supply of services | Conduct Regulations 2003, regulation 29 |
| Right to work documents | Length of employment plus 2 years | Home Office requirements |
| DBS certificate content | No more than 6 months after the recruitment decision | DBS Code of Practice |
| DBS record (number, date, level, decision) | 6 years after your last assignment | Evidence of safe recruitment |
| Payroll, tax and pension records | 6 years after the end of the tax year | HMRC requirements |
| Working time and holiday records | 2 years | Working Time Regulations 1998 |
| Accident records | 3 years from the last entry | RIDDOR and social security rules |
| Safeguarding records | 25 years, reviewed before deletion | Safeguarding practice and possible inquiries |
| Complaint records | 6 years after the complaint is closed | To show how we handled it and respond to any claim |
| Client contracts and invoices | 6 years after the contract ends | Contract and tax time limits |
| Marketing opt outs | For as long as needed to respect your choice | So we do not contact you again |
At the end of these periods we securely delete or anonymise the data.
10. Your rights
You have the right to:
- Be informed about how we use your data.
- Access a copy of your data.
- Rectification: have inaccurate data corrected.
- Erasure: have your data deleted where we no longer need it, unless the law requires us to keep it.
- Restriction: ask us to pause using your data, for example while we check it is accurate.
- Portability: receive data you gave us in a format a computer can read, where we rely on consent or contract.
- Object to processing based on legitimate interests, and to direct marketing at any time.
- Withdraw consent where we rely on it.
- Human review of any significant decision made about you by automated means.
To use any right, email hello@sarflixrecruitment.co.uk, call +44 7760 892378, or write to us. We reply within one month. For complex requests we can extend this by up to two more months, and we will tell you if we need to. We may ask you to confirm your identity. There is normally no charge.
11. Automated tools and AI
We use software, which may include AI tools, to help us organise information and match workers to shifts, for example by location, availability and qualifications. A member of our team always reviews the results and makes the decision. We do not make decisions about you based only on automated processing that have a legal or similarly significant effect. You can ask us to explain a decision and to have a person look at it again. Before we introduce any tool that scores or ranks candidates, we will complete a Data Protection Impact Assessment and update this policy.
12. Cookies
Our website does not use analytics, advertising or tracking cookies. Please see our Cookie Policy for details. If this changes, we will ask for your consent first and update the Cookie Policy before any new cookie is used.
13. Security
We protect your data with access controls, strong passwords and multi factor authentication, encryption, written contracts with our providers, and training. DBS and safeguarding information is kept in restricted storage. If a data breach is likely to put your rights at risk, we will report it to the ICO within 72 hours and tell you directly if the risk to you is high.
14. Children
Our services are for people aged 18 and over. We do not knowingly collect data from children. If you think we hold data about a child, contact us and we will delete it.
15. Changes to this policy
We review this policy every three months and whenever the law or the way we use data changes. The version number and dates are shown at the top. If a change affects you significantly, we will tell you directly.
16. Complaints
If you are unhappy with how we have handled your personal data, please tell us. You can complain by email, phone, post or through the complaint form on our website. We will acknowledge your complaint within 30 days, look into it without undue delay, keep you updated and tell you the outcome. Our full Complaints Procedure is published on our website.
You also have the right to complain to the Information Commissioner’s Office:
- Website: ico.org.uk/make-a-complaint
- Helpline: 0303 123 1113
- Address: Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF
The ICO usually expects you to raise your complaint with us first, but you can contact them at any time.