Introduction
Heart of Supply Education Recruitment Limited provides work-finding services to candidates and schools. In doing
so, we collect and process personal data in compliance with the UK GDPR, Data Protection Act 2018, and
employment-related legal obligations.
At Heart of Supply Education Recruitment Ltd, we care deeply about the people we work with, whether you’re a
candidate looking for your next opportunity or a school trusting us to find the right person. To support that
relationship, we need to collect and manage some personal information. We understand this is a responsibility, and
we’re committed to handling your data respectfully, safely, and in line with the law.
This notice outlines how we use, store, share, and protect your personal data, and explains your rights.
Purpose
Our goal is to connect our educators with our client schools; safely, legally, and with care. To do this, we process personal and sensitive information to:
- Match you with suitable job opportunities
- Comply with employment and safeguarding laws
- Maintain the records needed to operate a safe and effective service
- Support your professional journey in line with standards expected in Ofsted-regulated environments
We are a Data Controller under UK Data Protection law, including the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
Contents
1. Collection and use of personal data
- Purpose of processing and legal basis
- Consent
- Legitimate interest
- Statutory/contractual requirement
- Recipients of data
2. Information to be provided when data is not collected directly from the data subject
- Sources of data
- Overseas transfers
- Data retention
- Your rights
- Cookies
- Login files
- Links to external sites
- Sale of the business
- Data security
- Changes to this privacy statement
- Complaints or queries
1. Collection and use of personal data
a. Purpose of processing and legal basis
You may give your personal details to us directly whenever you contact us, such as on an application or registration form or via our website, or we may collect them from another source such as a jobs board. This includes for example, contacting you about job opportunities, assessing your suitability for those opportunities, updating our databases,putting you forward for job opportunities, arranging payments to you and developing and managing our services and relationship with you and our clients.
Heart of Supply Education Recruitment Ltd will collect your personal data (including special categories of personal data) whenever you contact us and provide us with information that we are able to identify you by, including when you contact us by phone, email or when you sign up to any of our services, and will process your personal data for the purposes of providing you with work-finding services. This includes for example, contacting you about job opportunities, assessing your suitability for those opportunities, updating our databases, putting you forward for job opportunities, arranging payments to you and developing and managing our services and relationship with you and our clients.
In some cases, we may be required to use your data for the purpose of investigating, reporting and detecting crime and to comply with laws that apply to us. We may also use your information during the course of internal audits to demonstrate our compliance with certain industry standards.
What We Collect
To support your experience with us, we may collect the following:
· Contact details: name, contact number, email, address
· Employment history, qualifications, references
· Right-to-work and ID documentation (e.g., passport, driving licence)
· DBS and safeguarding records
· Other compliance or legal documentation required by schools or authorities
· Relevant health information (e.g. if reasonable adjustments are needed)
· Criminal Convictions
· Ethnicity or biometric data, where required for compliance
Please note that the above list of categories of personal and/or sensitive personal data we may collect is not exhaustive.
The legal bases we rely upon to offer these services to you are:
· Your consent
· Where we have a legitimate interest
· To comply with a legal obligation that we have
· To fulfil a contractual obligation that we have with you
b. Consent
We will use your personal information where we have your consent to do so:
· Send specific marketing to schools or introduce you to a school
· Conduct status checks on your DBS through the update service
· Approach any individual or organisation that Heart of Supply Education Recruitment require/identify in order to obtain references to complete the registration process
Where you have consented to The Company processing your personal data and sensitive personal data, you have the right to withdraw that consent at any time by contacting Jessica Fisher, Heart of Supply Education Recruitment Limited, at dpo@heartofsupply.co.uk. Please note that if you withdraw your consent to further processing that does not affect any processing done prior to the withdrawal of that consent, or which is done according to another legal basis. There may be circumstances where The Company will still need to process your data for legal or official reasons. We will inform you if this is the case. Where this is the case, we will restrict the data to only what is necessary for the purpose of meeting those specific reasons.
It is your responsibility to ensure that any information submitted as part of the registration process is accurate and up to date. Should you wish to withdraw your consent at any time, please contact dpo@heartofsupply.co.uk
c. Legitimate interest
This is where we have a legitimate reason to process your data provided it is reasonable and does not go against what you would reasonably expect from us. Where we have relied on a legitimate interest to process your personal data our legitimate interests are as follows:
· Managing our database and keeping work-seeker records up to date
· Providing work-finding services to you and our clients in line with your requirements
· Sharing your personal data with our approved payroll providers
· Where there are legal obligations to provide your personal data to official bodies
· Contacting you to seek your consent where we need it
· Giving you information about similar products or services that you have used from us recently
· We will contact you about free training opportunities that you may be interested in attending. We have a legitimate interest to enhance the skills of our current workforce; to support your professional development. Your data will not be shared with any third-party training provider without your prior consent.
d. Statutory/contractual requirement
Your personal data is required by law and/or a contractual requirement (e.g. our client may require this personal data), and/or it is a requirement necessary to enter into a contract with you. You are obliged to provide the personal data and if you do not the consequences of failure to provide the data are:
· We would not be able to continue to provide-work-finding services to you.
e. Recipient/s of data
Heart of Supply Education Recruitment Limited will process your personal data and sensitive personal data with the following recipients:
· Clients (whom we may introduce or supply you to)
· Former employers whom we may seek references from
· Payroll service providers who manage payroll on our behalf or other payment intermediaries whom we may introduce you to
· We have appointed Agent Armour Accounts as our outsourced payroll provider. In order to process payments, we will share your necessary personal data with them, including your name, address, National Insurance number, bank details, and tax-related documentation. Agent Armour Accounts processes this information solely for the purpose of administering payroll on our behalf and in accordance with data protection legislation.
· Other recruitment agencies in the supply chain
· Auditors who are assessing the compliance and processes of the business to ensure its adherence to all relevant legislation and good practice guidance
· Any public information sources and third-party organisations that we may use to carry out suitability checks on work-seekers including the Disclosure and Barring Service (DBS), Department for Education (DfE)
· Any digital ID verification third party provider validating biometric data and right to work documents
· Law enforcement agencies and other regulators including the Police, Home Office, HMRC, Employment Agencies Standards Inspectorate (EASI), Local Authority Designated Officers (LADOs) and the GLAA· Auditors who are assessing the compliance and processes of the business to ensure adherence to all relevant legislation and good practice guidance
As part of the registration process, we may need to apply for a new DBS certificate for you. If this is the case, the following information will be provided to uCheck to process the DBS application:
· Name
· Email address
In order for us to verify your qualifications, we may be required to provide limited personal information to regulatory or awarding bodies, including the Teacher Regulation Agency (TRA).
In order to for you to complete relevant safeguarding and child protection courses required for our registration process, and for any further training needs identified during your work with the company. The following personal data will be shared with our safeguarding and training provider:
· Name
· Email address
There may be time we work with other agency education providers in a Master Vendor Supplier agreement, where an external agency has been appointed by its clients to coordinate and manage the procurement of the services of non-permanent staff from staffing agencies for onward supply via the external agency to its clients. Staff successfully confirmed for these bookings will be asked to give their written consent to provide the following information to the Master Vendor agency for the purposes of fulfilling the booking:
· Name
· Date of birth
· Job role
· Photo
· DBS number, issue date, and expiry date (if applicable)
· References received dates
· Medical reasonable adjustments required (if applicable)
· Privacy Notice Version 1 | Updated May 2025
· Confirmation Heart of Supply Education Recruitment Limited has completed compliance checks on the candidate to the required standard
Personal data will not be transferred to a Master Vendor agency for any candidate who has not given prior written consent. Any candidate who has given consent must withdraw this consent in writing.
In certain circumstances, we may be required by law to disclose your personal information to third parties such as government bodies, law enforcement agencies and data protection regulators. We provide outgoing employment and financial references, on request. You must confirm your consent in writing before a financial reference is provided to a requestor.
Heart of Supply Education Recruitment Ltd will use your personal information where we are legally obliged to do so, this includes:
· Establishing right to work
· Compliance with HMRC and tax laws
· Compliance with all regulatory pre-employment checks for the education sector
· To maintain records as required under the Conduct of Employment Agencies and Employment Businesses Regulations 2003
· For financial reporting and auditing purposes
· Employment placement history
· For anti-money laundering or fraud prevention, detection and reporting
· To maintain records of actions taken on your accountTo comply with the above, we collect the following special category data:
· Personal data revealing racial or ethnic origin via right to work documentation
· Biometric data (where used for identification purposes)
· Data concerning health
2. Information to be provided when data is not controlled directly from the data subject
a. Sources of data:
Where the data we collected did not come from you (the data subject), we sourced your personal and/or sensitive personal data from one of the following:
· LinkedIn and other job sites/boards
· A former employer
· A referee whose details you previously provided to us
· Our clients
· Software providers who we use to support our services
· Cookies listed in section 6
3. Overseas Transfers
Heart of Supply Education Recruitment Limited may transfer only the information you provide to us to countries outside the UK and/or the European Economic Area (‘EEA’) for the purposes of providing you with work-finding services. We will take steps to ensure adequate protections are in place to ensure the security of your information. The EEA comprises the EU member states plus Norway, Iceland and Liechtenstein.
4. Data Retention
We will retain your personal data only for as long as is necessary for the purpose we collect it. Different laws may also require us to keep different data for different periods of time.
How Long We Keep Your Information
We keep your data only for as long as necessary to meet legal, contractual, and safeguarding requirements. For example:
· Work-seeker records: at least 1 year from last contact
· Right-to-work documents: 2 years after your last assignment
· Payroll records: kept according to HMRC requirements
· Safeguarding-related records: up to 7 years, or longer if required by law
This supports our responsibility under Ofsted, KCSIE (Keeping Children Safe in Education), and other safeguarding guidance.
5. Your Rights
Please be aware that you have the following data protection rights:
The right to be informed
You have the right to know what personal data we collect about you, how we use it, for what purposes and in accordance with which lawful basis, who we share it with and how long we keep it. We use our privacy notice to explain this.
The right of access
You have the right to receive a copy of the personal data we hold about you. Please note any confidential personal information relating to you as set out in any references we receive from former employers is typically treated asconfidential by us. We therefore do not disclose these to you if you raise a subject access request unless we receive permission from your former employer to make the disclosure. You are entitled to contact your former employer directly to seek their consent if you wish.
The right to rectification
You have the right to have any incomplete or inaccurate information we hold about you corrected.
The right to erasure
You have the right to ask us to delete your personal data.
The right to restrict
You have the right to restrict our use of your personal data
The right to data portability
You have the right to ask us to transfer your personal data to another party, in certain circumstances
The right to object
You have the right to object to us processing your personal data. If you object to us using your personal data for marketing purposes, we will stop sending you marketing material.
The right not to be subjected to automated decision making and profiling
You have the right not to be subject to a decision based solely on automated processing which will significantly affect you. We do not use automated decision-making.
The right to withdraw consent
If you have provided your consent for us to process your personal data for a specific purpose, you have the right to withdraw your consent at any time. If you do withdraw your consent, we will no longer process your information for the purpose(s) you originally agreed to, unless we are permitted by law to do so.
The right to lodge a complaint
You have the right to lodge a complaint with the relevant supervisory authority if you are concerned about the way in which we are handling your personal data. The supervisory authority should you have any queries or complaints in relation to how we use your information, please contact us via the details set out in section 12.
If you believe that any of your data that The Company processes is incorrect or incomplete, please contact us using the details above and we will take reasonable steps to check its accuracy and correct it where necessary.
You can also contact us using the above details if you want us to restrict the type or amount of data we process for you, access your personal data or exercise any of the other rights listed above.
6. Cookies
A cookie is a small file which asks permission to be placed on your computer’s hard drive. Once you agree, the file is added, and the cookie helps analyse web traffic or lets you know when you visit a particular site. Cookies allow web applications to respond to you as an individual. The web application can tailor its operations to your needs, likes and dislikes by gathering and remembering information about your preferences.
Our website uses cookies to make your experience smoother. These help us understand how people use our site and improve it. You can manage your cookie preferences in your browser settings. The information generated relating to our website is used to create reports about the use of the website. Google will store this information. Google’s privacy policy is available at: http://www.google.com/privacypolicy.html
For more independent information about cookies, visit www.aboutcookies.org.
7. Login Files
We use IP addresses to analyse trends, administer the site, track users’ movements, and to gather broad demographic information for aggregate use. IP addresses are not linked to personally identifiable information.
8. Links to External WebsitesThe Company’s website may contain links to other external websites. Please be aware that The Company is not responsible for the privacy practices of such other sites. When you leave our site, we encourage you to read the privacy statements of each and every website that collects personally identifiable information. This privacy statement applies solely to information collected by the Company’s website.
9. Sale of Business
If The Company’s business is sold or integrated with another business your details may be disclosed to our advisers and any prospective purchasers and their advisers and will be passed on to the new owners of the business. Where the sale of the business results in the transfer of your details to a different data controller we will notify you of this.
10. Data Security
We take your data security seriously. From passwords to firewalls, we use trusted tools and practices to keep your data safe. But remember; email and the internet are not 100% secure, so avoid sharing sensitive data over unsecured networks. If you have any questions about the security for our website, you can email dpo@heartofsupply.co.uk
11. Changes to our Privacy Notice
Heart of Supply Education Recruitment Limited may amend this Privacy Notice at any time and where material changes are made to it, we will provide notice on our website. By continuing to use our services you agree to the updated Privacy Notice. If you do not agree to any changes that we make, you should not use or access (or continue to use or access) our services.
12. Complaints or Queries
If you wish to complain about this Privacy Notice or any of the procedures set out in it, please contact Jessica Fisher, Heart of Supply Education Recruitment Ltd, Tower House, Lucy Tower Street, Lincoln, LN1 1XW.
You also have the right to raise concerns with the Information Commissioner’s Office on 0303 123 1113 or at https://ico.org.uk/make-a-complaint/, or any other relevant authority should your personal data be processed outside of the UK, if you believe that your data protection rights have not been adhered to.