Central Direct Group
Privacy policy
Last updated: 5 August 2026
Who we are: Central Direct Group is a trading name of Central Direct Ltd, company number 16559164, registered in England and Wales. Registered office: Suite A, 82 James Carter Road, Mildenhall, Bury St Edmunds, IP28 7DE.
Contact: [email protected]
1. Scope of this policy
This policy explains how we collect, use, disclose, retain and protect personal data when providing recruitment services, operating this website, communicating with candidates, prospective candidates, clients, prospective clients, referees, suppliers and other business contacts.
2. Personal data we may collect
Candidates and prospective candidates
We may collect identification and contact details; CVs; employment and education history; professional qualifications; skills; salary and availability information; location and mobility preferences; interview and assessment notes; communications; references; right-to-work information; and other information relevant to finding or assessing work.
Where lawful and necessary for a particular role, we may process special category data or criminal-offence information, for example information about health, disability, reasonable adjustments, diversity monitoring or criminal records. We will only do so where an additional legal condition applies and appropriate safeguards are in place.
Clients, prospective clients and business contacts
We may collect names, job titles, business contact details, recruitment requirements, vacancy information, communications, contractual information, feedback and payment or invoicing information.
Website users
We may collect information submitted through our contact and CV forms, along with basic technical information needed to operate and secure the website. We do not currently use advertising or analytics cookies.
3. How we obtain personal data
We may receive data directly from you, from employers or prospective employers, referees, public professional profiles, job boards and CV databases, recommendations, business directories, recruitment platforms and other lawful sources. When we obtain your data indirectly, we will provide privacy information within the period required by law, unless an exemption applies.
4. Why we use personal data and our lawful bases
| Purpose | Typical lawful basis |
|---|---|
| Responding to enquiries and taking steps requested before entering a contract | Contractual necessity and/or legitimate interests |
| Assessing candidates, matching them to opportunities and communicating about roles | Legitimate interests and, where applicable, contractual necessity |
| Introducing candidates to clients and managing recruitment processes | Legitimate interests and/or contractual necessity |
| Verifying information, references, qualifications and right to work where required | Legal obligation, legitimate interests and/or contractual necessity |
| Managing client relationships, contracts, invoicing and records | Contractual necessity, legal obligation and legitimate interests |
| Keeping suitable candidates informed about relevant future opportunities | Legitimate interests; consent where required by electronic marketing law |
| Preventing fraud, securing systems, handling complaints and establishing legal claims | Legitimate interests and legal obligation |
Where we rely on legitimate interests, we consider whether the processing is necessary and whether your rights override those interests. You may object to processing based on legitimate interests.
5. Special category and criminal-offence data
We only process sensitive information when necessary and lawful. Depending on the circumstances, this may be based on employment and social-protection law, substantial public interest, legal claims, occupational health, or explicit consent. We apply additional access controls and data-minimisation measures.
6. Sharing personal data
We may share personal data with prospective or actual employers, recruitment and technology service providers, reference providers, professional advisers, insurers, regulators, law-enforcement bodies and public authorities where necessary and lawful. We do not sell personal data.
We will normally discuss a specific opportunity with a candidate before submitting their CV to a client. There may be limited circumstances where another lawful and fair approach applies, but we will always aim to be transparent.
7. Website forms and CV delivery
Website enquiries and CV uploads are transmitted to our business email using FormSubmit, a third-party form-delivery provider. Submitted information, including an uploaded CV, is processed for the purpose of delivering it to us. You should not submit information that is not relevant to recruitment.
8. International transfers
Some service providers may process data outside the United Kingdom. Where personal data is transferred internationally, we will use an approved transfer mechanism or another lawful safeguard, such as UK adequacy regulations or the UK International Data Transfer Agreement/addendum, where required.
9. Retention
We keep personal data only for as long as reasonably necessary for recruitment, legal, regulatory and business purposes. Retention depends on the nature of the relationship and information.
- Candidate records may generally be retained for up to 24 months after the most recent meaningful contact, then reviewed, deleted or refreshed where there is a continuing lawful reason.
- Unsuccessful application and interview records may be retained for a period needed to handle queries or legal claims.
- Client, contractual, invoicing and tax records may be retained for up to six years or longer where legally required.
- Right-to-work and compliance records are retained in line with applicable legal requirements.
These periods may be shortened or extended depending on legal obligations, disputes, your request, ongoing recruitment activity or another valid reason.
10. Security
We use reasonable technical and organisational measures designed to protect personal data against loss, misuse, unauthorised access, alteration or disclosure. Access is limited to people and providers who need it for legitimate business purposes. No internet transmission or storage system can be guaranteed completely secure.
11. Your rights
Subject to legal conditions and exemptions, you may have the right to request access to your data; correction; erasure; restriction; portability; or to object to processing. Where processing is based on consent, you may withdraw consent without affecting earlier lawful processing. You also have rights relating to solely automated decisions with legal or similarly significant effects. We do not currently make recruitment decisions solely by automated means.
To exercise a right, email [email protected]. We may need to verify your identity.
12. Marketing
We may contact business contacts about relevant recruitment services where permitted by law. You can opt out at any time. Candidate communications about genuinely relevant work opportunities may form part of our recruitment service rather than general marketing; you can still ask us to stop contacting you or restrict how we use your data.
13. Cookies
This website does not currently set non-essential advertising or analytics cookies. Essential technical storage may be used where required for security or basic functionality. If this changes, we will update this policy and introduce an appropriate cookie notice where required.
14. Complaints
Please contact us first so we can try to resolve your concern. You also have the right to complain to the Information Commissioner's Office, the UK data-protection regulator, through its official website or helpline.
15. Changes to this policy
We may update this policy as our services, systems or legal obligations change. The latest version will be published on this page with an updated date.
16. Company information
Central Direct Group is a trading name of Central Direct Ltd. Central Direct Ltd is registered in England and Wales under company number 16559164. Registered office: Suite A, 82 James Carter Road, Mildenhall, Bury St Edmunds, IP28 7DE.