01Who we are
The Oyster Partnership Limited (“Oyster”, “we”, “us”, “our”) is a recruitment consultancy providing permanent and temporary recruitment, and managed and outsourced service delivery, to the UK public sector and its partners. We are registered in England and Wales under company number 05020374 at 19-20 Berners Street, Bischheim House, London W1T 3NW, and are registered with the Information Commissioner’s Office (ICO) under reference ZA094096.
We are the data controller for the personal data described in this notice. Where we act on a client’s instructions under a managed service contract we may act as a processor for that client, in which case the client’s privacy notice will also apply.
Questions about this notice, or requests to exercise your rights, should be sent to our Data Protection Lead at gdpr@oysterpartnership.com or by post to the address above.
02Who this notice applies to
This notice explains how we collect and use personal data about:
- Candidates and work seekers: anyone who registers with us, applies for a role, or whom we identify as a potential candidate;
- Temporary workers and contractors: anyone we place on an assignment, whether engaged through PAYE, their own limited company or an umbrella company;
- Client contacts: individuals at the organisations we recruit for, or would like to recruit for;
- Referees and emergency contacts: people named by a candidate or worker;
- Website visitors: anyone using www.oysterpartnership.com.
Our own employees are covered by a separate Employee Privacy Notice.
03The personal data we collect
| Who | What we collect |
|---|---|
| Candidates and work seekers | Name and contact details; CV, employment history, qualifications and professional memberships; right to work and identity documents; salary and rate expectations; work preferences and availability; interview notes and assessment results; correspondence with us; publicly available professional profile information. |
| Temporary workers and contractors | Everything above, plus: National Insurance number; date of birth; bank details; tax status and IR35 assessment information; limited company or umbrella company details; timesheets, pay and expenses records; references; and, where a role requires it, DBS (criminal record) checks, professional registration, qualifications and occupational health or fitness to work information. |
| Client contacts | Name, job title, employer, work contact details, and records of our dealings with you including vacancies, terms and feedback. |
| Referees and emergency contacts | Name, relationship to the candidate, contact details and (for referees) the reference you provide. |
| Website visitors | IP address, device and browser information, pages visited, and information you submit through forms, job applications or job alert sign ups. See our Cookie Notice. |
Special category and criminal records data
Some roles require us to process more sensitive information: health information (for fitness to work or reasonable adjustments), ethnicity and other diversity information (for equal opportunities monitoring, which is always optional and anonymised), and criminal records information (DBS checks, where a role legally requires one). We only collect this where it is necessary for the role, and we process it under Article 9(2)(b) UK GDPR and Schedule 1 of the Data Protection Act 2018 (employment obligations) or with your explicit consent. We maintain an appropriate policy document as the Act requires.
04Where we get your data from
- Directly from you: when you register, apply, send us a CV, complete our forms, attend an interview or talk to a consultant.
- From public and professional sources: LinkedIn, job boards on which you have posted a CV, professional registers and company websites, where you would reasonably expect recruiters to use that information.
- From third parties: referees, former employers, umbrella companies, DBS and identity verification providers, and clients who give feedback on your application or assignment.
- From our clients: where a client refers a candidate to us, or gives us details of client contacts to work with.
05How and why we use your data
| Purpose | Lawful basis |
|---|---|
| Assessing your suitability for roles, matching you to vacancies and presenting you to clients | Legitimate interests (running a recruitment business); performance of a contract where you have engaged us |
| Verifying identity, right to work, qualifications and references | Legal obligation (Immigration, Asylum and Nationality Act 2006; Conduct Regulations 2003); legitimate interests |
| Arranging and administering temporary assignments, including contracts, timesheets, pay, pensions and tax reporting | Performance of a contract; legal obligation (PAYE, agency worker and pensions legislation) |
| Carrying out DBS, professional registration and occupational health checks where a role requires them | Legal obligation; Schedule 1 DPA 2018 conditions; explicit consent where required |
| Contacting you about roles, market updates and events we think will interest you | Legitimate interests; you can opt out at any time |
| Managing our relationship with client organisations and their contacts | Legitimate interests; performance of a contract |
| Handling complaints, disputes and legal claims, and responding to regulators | Legitimate interests; legal obligation |
| Improving our website, services and internal processes | Legitimate interests; consent for non-essential cookies |
| Equal opportunities monitoring | Consent; substantial public interest (equality of opportunity) |
Where we rely on legitimate interests we have carried out a balancing test to confirm that our interests are not overridden by your rights. You can ask us for details of these assessments.
06Use of technology and automated decision making
We use software, including AI-assisted tools, to help us search databases, summarise CVs, match candidates to vacancies and manage our workflow. These tools support our consultants; they do not make decisions about you on their own. We do not make any decision that has a legal or similarly significant effect on you based solely on automated processing. A consultant is always involved in deciding whether to put you forward for a role.
08International transfers
We are a UK business and store your data in the UK or the European Economic Area wherever possible. Some of our service providers (for example cloud, productivity and AI tools) process data in the United States or elsewhere. Where they do, we rely on the UK Government’s adequacy regulations (including the UK-US Data Bridge) or the International Data Transfer Agreement, and we assess the risks of each transfer.
09How long we keep your data
| Category | Retention period |
|---|---|
| Candidates we have not placed | 3 years from our last meaningful contact with you, unless you ask us to delete your record sooner. We check in with you before this period ends. |
| Temporary workers and contractors we have placed | 6 years from the end of your last assignment, to meet tax, pensions, agency worker and contractual claims requirements. |
| Right to work evidence | Duration of the engagement plus 2 years, as required by the Home Office. |
| DBS certificate information | No longer than 6 months after the recruitment decision; we retain only the fact and date of the check thereafter. |
| Client contacts | Duration of our relationship with your organisation plus 6 years. |
| Referees | Held on the relevant candidate’s record and deleted in line with it. |
| Website enquiries and job alert sign ups | Until you unsubscribe or 24 months of inactivity. |
Where a legal claim, complaint or regulatory investigation is under way we keep the relevant records until it concludes.
10How we protect your data
We hold Cyber Essentials certification and apply technical and organisational measures appropriate to the risk, including access controls, encryption in transit and at rest, multi factor authentication, staff data protection training and supplier due diligence. All staff complete UK GDPR training and sign a data protection undertaking.
11Your rights
Under the UK GDPR you have the right to:
- Access the personal data we hold about you (a “subject access request”);
- Rectify data that is inaccurate or incomplete;
- Erase your data where there is no compelling reason for us to keep it;
- Restrict how we use your data in certain circumstances;
- Object to processing based on legitimate interests, and to direct marketing at any time;
- Port data you have provided to us to another provider in a machine readable format;
- Withdraw consent at any time where consent is our basis for processing;
- Not be subject to a solely automated decision with legal or similarly significant effects.
To exercise any of these rights, email gdpr@oysterpartnership.com. We will respond within one month, or tell you if we need longer for a complex request. We will not charge a fee unless a request is manifestly unfounded or excessive. We may need to verify your identity before acting.
12Complaints
If you are unhappy with how we have handled your data, please contact us first so we can put it right. You also have the right to complain to the Information Commissioner’s Office at www.ico.org.uk/make-a-complaint, by phone on 0303 123 1113, or by post to Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF.
13Changes to this notice
We review this notice at least annually and will publish any significant change on our website. This version was published in September 2026 and replaces all earlier versions.