Last Updated: March 2026

1. Introduction and Data Controller Information

Blue Spark Organisation is committed to protecting your privacy and complying with data protection laws. This Privacy Policy explains how we collect, use, store, and protect your personal information.

Data Controller:
Blue Spark Organisation
34–36 The Broadway, Haywards Heath, West Sussex, RH16 3AL
Email: info@blue-spark.org.uk
Phone: 0345 2600 737

Company Registration Number: 5660757
ICO Registration Number: Z9343437

We are a ‘data controller’ under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. This means we determine how and why your personal data is processed.

2. Personal Information We Collect

We collect and process the following categories of personal information:

From Job Seekers/Candidates:

• Personal details (name, address, email, phone number, date of birth)
• Employment history and CV information
• Educational qualifications and professional certifications
• References and reference contact details
• Right to work documentation
• Information from interviews and assessments
• Preferences regarding job opportunities
• Any other information you choose to provide

From Website Visitors:

• Technical information (IP address, browser type, device information)
• Usage data (pages visited, time spent, navigation patterns)
• Cookie data (see Cookie Policy below)

Sensitive Personal Data:

With your explicit consent, we may process special categories of data where necessary for recruitment purposes, including:

• Health information (for reasonable adjustments)
• Criminal conviction data (where relevant to specific roles)
• Diversity monitoring information (processed separately and anonymously)

3. Legal Basis for Processing Your Data

We process your personal data under the following legal bases:

Consent: When you register your CV with us or agree to specific processing activities. You can withdraw consent at any time.

Contract: To take steps at your request before entering into a contract (e.g., finding you employment) and to perform our obligations under any contract with you.

Legitimate Interests: For our business purposes including maintaining our database, improving our services, conducting market research, and pursuing our business activities, provided this does not override your rights and interests.

Legal Obligation: To comply with our legal and regulatory obligations (e.g., right-to-work checks, health and safety requirements, equal opportunities monitoring).

4. How We Use Your Personal Information

We use your personal information for the following purposes:

• Recruitment Services: Matching your skills and experience with suitable job vacancies
• Communication: Contacting you about opportunities via telephone, email, or post
• Placement Activities: Submitting your CV to prospective employers (with your explicit consent for each submission)
• Reference Checking: Obtaining and verifying references
• Compliance: Conducting right to work checks and other legal requirements
• Post-Placement Support: Following up after successful placements
• Service Updates: Keeping you informed about our services and relevant industry news
• Market Research: Compiling anonymised salary surveys and market analysis
• Website Improvement: Analysing website usage to enhance user experience

5. Sharing Your Personal Information

We will only share your personal information in the following circumstances:

With Your Consent: We will send your CV to prospective employers only with your explicit consent for each specific opportunity.

Service Providers: We may share data with trusted third-party service providers who assist us (e.g., IT support, cloud storage providers, background checking services). These providers are contractually obligated to protect your data and process it only on our instructions.

Legal Requirements: We may disclose your information where required by law, regulation, court order, or government authority.

Business Transfers: If our business is sold or merged, your data may be transferred to the new owner (you will be notified if this occurs).

We will never sell your personal information to third parties for marketing purposes.

6. International Data Transfers

Some of our service providers may process data outside the UK and European Economic Area (EEA). When we transfer your data internationally, we ensure appropriate safeguards are in place, including:

• Standard Contractual Clauses approved by the UK Information Commissioner’s Office (ICO)
• Adequacy decisions recognising the destination country has adequate data protection
• Other lawful transfer mechanisms under UK GDPR

Specifically, we use Google Analytics which may transfer data to the United States. Google has implemented Standard Contractual Clauses and additional security measures to protect your data.

7. Data Retention

We retain your personal information for as long as necessary to fulfil the purposes outlined in this policy:

Active Candidates: While you are actively seeking employment through us and for a reasonable period thereafter.

Inactive Candidates: If we have not heard from you or placed you within 24 months, we will contact you to confirm whether you wish to remain on our database. If we receive no response within 30 days, your data will be securely deleted.

Placed Candidates: We retain placement records for 7 years after placement to comply with legal and contractual obligations.

Legal Requirements: Some data may be retained longer to comply with legal, accounting, or regulatory requirements.

You can request deletion of your data at any time (subject to our legal obligations).

8. Data Security

We implement appropriate technical and organisational security measures to protect your personal information:

• Secure servers with encryption and firewall protection
• Access controls ensuring only authorised personnel can access data
• Regular security assessments and updates
• Staff training on data protection
• Secure backup systems
• Password protection and multi-factor authentication

Despite our precautions, no data transmission over the internet can be guaranteed as completely secure. You provide information at your own risk.

9. Your Rights Under Data Protection Law

You have the following rights regarding your personal data:

Right of Access: Request a copy of the personal data we hold about you (free of charge in most cases).

Right to Rectification: Request correction of inaccurate or incomplete data.

Right to Erasure: Request deletion of your data (“right to be forgotten”) in certain circumstances.

Right to Restrict Processing: Request that we limit how we use your data in certain circumstances.

Right to Data Portability: Request your data in a structured, commonly used format and transmit it to another controller.

Right to Object: Object to processing based on legitimate interests or for direct marketing purposes.

Rights Related to Automated Decision-Making: We do not use automated decision-making or profiling that produces legal or similarly significant effects.

Right to Withdraw Consent: Where processing is based on consent, you can withdraw it at any time.

To exercise any of these rights, please contact us using the details in Section 1. We will respond within one month (extendable by two months for complex requests).

Right to Complain: If you are unhappy with how we process your data, you have the right to lodge a complaint with the Information Commissioner’s Office (ICO):

• Website: www.ico.org.uk
• Telephone: 0303 123 1113
• Address: Information Commissioner’s Office, Wylfa House, Water Lane, Wilmslow, Cheshire SK9 5AF

10. Cookie Policy

What Are Cookies?

Cookies are small text files placed on your device when you visit a website. They help websites function efficiently and provide information to website owners.

Cookies We Use

We use the following types of cookies:

Strictly Necessary Cookies: Essential for the website to function. These cannot be disabled and do not require consent.

Performance/Analytics Cookies: Help us understand how visitors use our website through Google Analytics. These collect anonymised information including:

• Pages visited
• Time spent on site
• Navigation patterns
• Device and browser information
• IP address (anonymised)

Functionality Cookies: Remember your preferences and choices to enhance your experience.

Google Analytics

This website uses Google Analytics, a web analytics service provided by Google LLC. Google Analytics uses cookies to analyse website usage. Information generated by cookies (including your IP address, processed in a privacy-focused manner and not used to directly identify you) is transmitted to Google’s servers.

Google processes this data to:

• Evaluate website usage
• Compile activity reports for us
• Provide related analytics services

Data is transferred to the United States under Standard Contractual Clauses and Google’s additional security commitments. Google will not associate your IP address with other data they hold.

For more information: Google Analytics Privacy Policy

Managing Cookies

Cookie Consent: When you first visit our website, you will see a cookie banner allowing you to accept or reject non-essential cookies. You can change your preferences at any time through our Cookie Settings (Link in the footer)

Browser Settings: You can also block or delete cookies through your browser settings:

• Chrome: Settings > Privacy and Security > Cookies
• Firefox: Settings > Privacy & Security > Cookies and Site Data
• Safari: Preferences > Privacy > Cookies
• Edge: Settings > Privacy > Cookies

Please note that blocking cookies may affect website functionality.

Opt-out Tools:
Google Analytics opt-out: https://tools.google.com/dlpage/gaoptout

11. Children’s Privacy

Our services are not intended for individuals under 18 years of age. We do not knowingly collect personal information from children. If you are under 18, please do not provide any information through our website or services.

If we become aware we have collected data from a child under 13 without parental consent, we will delete it immediately. Parents who believe we may have information from or about a child should contact us immediately.

12. Data Breach Notification

In the unlikely event of a personal data breach that poses a risk to your rights and freedoms, we will:

• Report it to the ICO within 72 hours of becoming aware
• Notify affected individuals without undue delay if the breach poses a high risk
• Take immediate steps to contain and remedy the breach

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. We will notify you of significant changes by:

• Posting the updated policy on our website with a new “Last Updated” date
• Sending an email notification to registered users (for material changes)

Your continued use of our services after changes indicates acceptance of the updated policy.

14. Contact Us

If you have questions about this Privacy Policy or how we handle your data, please contact us:

Email: info@blue-spark.org.uk
Phone: 0345 2600 737
Post: Blue Spark Organisation, 34–36 The Broadway, Haywards Heath, West Sussex, RH16 3AL