How we look after your personal data.

1. Who we are

This notice explains how Milestone Recruitment Partners Limited, trading as Milestone Talent and Milestone Partners (“Milestone”, “we”, “us”), collects and uses personal data. We are a recruitment business providing permanent, project-based and interim hiring services.

We are the controller of your personal data under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

2. Who this notice covers

• Candidates – people who apply for roles, register their CV, or whom we approach about opportunities.
• Client contacts – people at organisations who hire through us, or who we think may want to.
• Referees – people who give references about our candidates.
• Suppliers – people at businesses that provide services to us.
• Website visitors – anyone using milestone-partners.co.uk.

3. What we collect and where it comes from

Candidates

• Contact details: name, email, phone number, location, LinkedIn profile.
• Career information: your CV, current and previous roles, skills, qualifications, notice period, salary and package expectations, and the kind of role you want.
• Assessment information: interview notes, assessment results, feedback from clients and references.
• Right-to-work and identity documents, where a client or the law requires us to check them.
• For interim or contract work: the bank, tax and company details needed to pay you.

We collect this from you (for example through our Register your CV form, by email or in conversation), from public professional sources such as LinkedIn and job boards, from clients who give feedback on you, from referees, and from people who recommend you to us.

If we first obtain your details from a public professional source, we will tell you how we got them and share this notice with you when we first contact you, and within one month at the latest.

Client contacts, referees and suppliers

Name, job title, employer, business email and phone number, and records of our conversations and dealings with you. We collect this from you, from your organisation, from public sources such as company websites and LinkedIn, and from introductions.

Website visitors

Whatever you choose to send us through our forms, plus the technical information your browser shares when it loads a page (such as your IP address). See section 12.

4. How we use it, and our lawful basis

What we do	Lawful basis
Finding, assessing and contacting candidates about roles that may suit them	Legitimate interests – running a recruitment business and helping people find work
Introducing a candidate to a client and sharing their CV	Legitimate interests, and we always get your agreement first for each client
Arranging interviews, managing offers and our 90-day check-in after you start	Legitimate interests; contract where we are acting for you
Checking right to work and identity when required	Legal obligation
Paying interim and contract workers	Contract; legal obligation (tax and accounting)
Understanding client hiring needs, delivering our services and invoicing	Contract; legitimate interests
Getting and passing on references	Legitimate interests
Sending market insight and service information to business contacts	Legitimate interests (see section 13)
Replying to website enquiries and CV registrations	Legitimate interests; steps at your request before entering a contract
Keeping records, preventing fraud, dealing with legal claims	Legal obligation; legitimate interests

Where we rely on legitimate interests, we have balanced our interests against yours. You can object at any time (see section 11).

5. Sensitive information

We don’t ask for sensitive (“special category”) information such as health, ethnicity, religion or sexual orientation, and we’d ask you not to include it in your CV. We only process it where it is genuinely needed and allowed by law – for example, to make reasonable adjustments for an interview if you tell us you need them, or for anonymous and voluntary diversity monitoring. We only process criminal records information where a client role legally requires a check, and only with your knowledge.

6. Our use of AI

We use AI-assisted tools to support our consultants: mapping the talent market, matching skills to roles, drafting outreach, and taking and summarising notes. A Milestone consultant reviews the output and makes every decision – including who we shortlist and introduce to clients. We do not make decisions about you based solely on automated processing.

We choose AI providers that act as our processors under contract, do not use your data to train their models, and apply appropriate security. If you have questions or would like a consultant to review something about you, contact us.

7. Who we share it with

• Clients – we only share a candidate’s CV or details with a client after the candidate has agreed.
• Referees you nominate.
• Service providers who process data for us under contract, including: Microsoft 365 (email and documents), GoDaddy (website hosting), Brevo (sending website emails), WPForms (form entry backup), our recruitment database, and AI-assisted tools (section 6).
• Professional advisers such as accountants, lawyers and insurers.
• Authorities such as HMRC, the Home Office or law enforcement, where the law requires it.
• A buyer or successor if our business is sold or restructured.

We never sell your personal data.

8. International transfers

Some of our service providers, and some clients, are based outside the UK (for example in the EU or the USA). When your data is transferred outside the UK we make sure it is protected: either the country benefits from UK adequacy regulations, or we use the UK International Data Transfer Agreement or Addendum to the EU Standard Contractual Clauses. Contact us for more information.

9. How long we keep it

• Candidates, client contacts and referees: up to three years from our last meaningful contact with you. After that we delete or anonymise it, unless we have a continuing reason to keep it.
• Financial and payment records: seven years, as required for tax and accounting.
• Information needed for a legal claim: for as long as the claim may be brought.
• Website form backups (WPForms): up to one year.

You can ask us to delete your data sooner – see section 11.

10. Security

We protect your data with access controls, encrypted connections, secure business systems and multi-factor authentication where available. Only people who need your information to do their job can see it. If a data breach creates a risk to you, we’ll tell you and the ICO where the law requires it.

11. Your rights

You have the right to:

• access the personal data we hold about you;
• have inaccurate data corrected;
• have your data deleted;
• restrict how we use it;
• object to us using it on the basis of legitimate interests, and to direct marketing at any time;
• receive data you gave us in a portable format, where processing is based on consent or contract;
• withdraw consent at any time, where we rely on it.

To use any of these rights, email rebecca@milestone-partners.co.uk. It’s free, and we’ll reply within one month. We may need to confirm your identity first.

12. Our website and cookies

Our website only uses cookies that are strictly necessary for it to work and stay secure. We don’t use analytics or advertising cookies. If that changes, we will update this notice and ask for your consent where required.

Our pages load fonts from Google Fonts, which means your browser shares your IP address with Google when a page loads. Links to LinkedIn take you to LinkedIn’s own site, which has its own privacy policy.

When you use our forms, we receive what you enter. Contact enquiries are emailed to our team; CV registrations are emailed to Rebecca Huggett with your CV attached. The website does not keep uploaded CVs after sending them. Copies of contact-form entries are backed up by WPForms for up to one year.

13. Marketing

We may send business contacts occasional emails about our services, market insight or salary benchmarks. Every email includes a way to unsubscribe, and you can opt out at any time by emailing us. We only send candidates role alerts or updates that relate to what you’ve told us you’re looking for, and you can ask us to stop at any time.

14. Complaints

If you’re unhappy with how we’ve handled your data, please contact us first at rebecca@milestone-partners.co.uk so we can put it right.

You also have the right to complain to the UK regulator, the Information Commissioner’s Office (ICO): ico.org.uk/make-a-complaint, telephone 0303 123 1113.

15. Changes to this notice

We may update this notice from time to time. The latest version will always be on this page, with the date it was last updated.