Privacy Policy

Our Approach to Privacy

At Certus Services Ltd, we’re committed to safeguarding the privacy and personal data of individuals we interact with. We handle all personal information in accordance with this policy, unless otherwise notified.

This privacy policy outlines how we collect, store, and use personal information from individuals who engage with us as:

Clients who receive our services or have an ongoing business relationship with us.
Associates who have shared their details with us and may work through us in a consultancy capacity.
Candidates we identify from publicly available professional profiles and contact about contract opportunities.

In this document, we’ll refer to all such individuals as “you” or “your”.

Last updated: 18 October 2026

This policy may be updated periodically. The current version will always be available on our website or LinkedIn page. Where significant changes are made, we’ll publish a notice in advance on those platforms.

Who We Are

Certus Services Ltd is a UK-based IT Management Consultancy operating under the Certus Services name. We are the controller of the personal data described in this policy.

Registered Address:

C/O DIGI Accountancy

Sun House, 2-4 Little Peter Street

Manchester, M15 4PS

The Types of Information We Collect

We collect and store personal data in both physical and digital formats. This includes:

Contact details such as your name, email address, and phone number.
Details about your role and organisation.
CVs and other documents shared by associates.
Information submitted through the Certus Services Associates Form, where specific consent has been given.
For candidates we identify from publicly available sources, your name, profile link, job title, location and the professional experience you have chosen to make public.

If you’re engaged for a contract or consultancy role, we are legally required to collect:

Identification documents and right-to-work verification.
Information regarding any unspent criminal convictions or proceedings.
Details relating to your company (if applicable), including registration and VAT status, bank details, insurance documentation, National Insurance number, and Unique Taxpayer Reference.

For clients, we maintain records of your business requirements and any correspondence, to better support your needs.

We do not ordinarily collect special category data (e.g. health, religious beliefs, ethnicity). Where such data is voluntarily provided for a specific need (e.g. accessibility requirements), it will be processed only with your explicit consent.

Where We Source Your Data

We may collect your personal information from the following (non-exhaustive) sources:

Directly from you (via our forms, email, or CV submissions)
Professional recommendations or referrals
Online job platforms
Marketing and industry databases
Publicly available sources
Social networks (e.g. LinkedIn)
Professional search services that index publicly available information
Website interactions via cookies

Cookies help us understand your use of our site to improve your experience and gather analytics data. You can manage cookie settings via your browser.

If we contact you after finding your details in a publicly available source, we’ll tell you where we found them at the time of first contact.

How We Use Your Information

For Clients:

We use your information to stay in touch, provide updates, and share relevant service or resourcing information in line with our legitimate business interests.

For Associates:

Your initial data helps us determine suitable opportunities based on skills, availability, and location. We do this with your consent where you have submitted our Associates Form, and otherwise in line with our legitimate business interests. Once offered a role, the additional data collected ensures contractual, financial, and legal requirements are met with both you and our client.

Candidates and Professional Contacts:

When a client needs a contractor, we sometimes look for suitable professionals who haven’t yet been in touch with us.

What we collect. Your name, a link to your public professional profile (such as your LinkedIn profile), your headline or job title, your location, and the professional experience you have chosen to make public. We also keep our own assessment of how well your experience matches the role, which may quote short extracts from your public profile, and any notes our team adds. We don’t collect your email address or phone number at this stage.

Where it comes from. Publicly accessible sources: search engines, public professional-network profiles and professional search services that index publicly available information.

Why we use it. To work out whether a client role might suit you and, if it might, to contact you about it.

Our lawful basis. Our legitimate interests in finding experienced professionals for our clients’ contract roles. We think this is fair to you because we only use information you have made public in a professional context, only to tell you about professional opportunities, we keep it for a short time, and you can ask us to stop at any time. We tell you where we found your details when we contact you about a role.

AI-assisted assessment. AI tools help us search, filter and rank public profiles against the requirements of a role. A person reviews every shortlist and decides whether to contact anyone, and every message is sent by a person. We do not make decisions about you based solely on automated processing that have legal or similarly significant effects. See “AI-Assisted Assessment” below.

How long we keep it. Up to 90 days from when we found you, unless we decide there is a business reason to keep your details for longer, or you go on to work with us as an associate, in which case the associate retention periods apply. If we looked at your profile but didn’t shortlist you, we keep only a coded identifier (not your name or profile link) for up to 90 days, so that we don’t review you twice for the same role.

If you don’t want to hear from us. Reply to our message or email us (see “How to Contact Us”). We will delete the details we hold about you from all our candidate lists and add a one-way coded version of your profile link to our do-not-contact list. The coded version doesn’t include your name, and we use it only so that our searches recognise and skip you in future. See “If You Withdraw Consent or Ask Us Not to Contact You”.

Who else is involved. We use service providers for search, AI processing and hosting. Some are based outside the UK, including in the United States, and where your data is transferred we make sure appropriate safeguards are in place. See “Sharing Your Information”.

Your rights. You have the rights set out in “Your Rights and Choices”, including the right to object to this processing and to the profiling involved. To use them, see “How to Contact Us”.

AI-Assisted Assessment:

We use AI-assisted tools to help us assess how closely a publicly available professional profile, or the information you have shared with us, matches the requirements of a role. This is a form of profiling.

A person reviews every shortlist and makes every decision about whether to contact you or put you forward for a role. We do not make decisions based solely on automated processing that have legal or similarly significant effects on you. You can object to this profiling at any time by contacting us.

Sharing Your Information

We do not share client data unless you’ve agreed to it – for example, by providing a testimonial and approving its publication (with your chosen level of anonymity).

For associates, personal data is shared with clients only after you’ve granted us explicit permission. However, anonymised CVs may be shared as representative profiles to demonstrate our capability. Aggregated and anonymised information may also be used in the same way.

If you progress to an assignment, and with your written consent, your details may be passed to a third-party screening agency acting on our behalf to conduct background checks, including credit and criminal record checks. Outcomes of these checks may be shared with the client.

We use trusted service providers to help us run our business, including AI processing, search, email delivery, workflow automation and hosting services. They process your data only on our instructions and for the purposes described in this policy.

Some of these providers are based outside the UK, including in the United States. Where your data is transferred outside the UK, we make sure it is protected, relying on the UK-US Data Bridge, the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses.

We will never sell, trade, or pass your personal data to any unrelated third party.

How We Keep Your Data Safe

We treat the security of your personal data as a priority. Measures are in place to prevent unauthorised access, misuse, or loss, both internally and externally.

We rely on established software vendors who commit to GDPR compliance and data protection best practices. Access is tightly controlled and limited to those who need it to fulfil their duties. This may include contractors or agents working on our behalf, who are equally bound to adhere to our privacy policy and data handling procedures.

How Long We Retain Your Data

Your personal data is kept only as long as necessary. Retention periods are as follows:

Client data – 7 years after the business relationship ends.
Associates who have completed assignments – 7 years post-engagement, to satisfy reporting obligations.
Associates not engaged – 12 months from the last contact, e.g. after a non-response to a data update request.
Candidates identified from publicly available sources but not engaged – up to 90 days from when we found you, unless we decide there is a business reason to keep your details for longer or you go on to work with us (see “Candidates and Professional Contacts”).

After these periods, data will be securely deleted. If you request deletion earlier, and we’re not legally required to retain your information, we will comply and confirm which records have been erased or retained.

Keeping Your Data Accurate

Client information is checked as part of regular account reviews.

For associates, we periodically reach out to confirm the accuracy of your details — particularly availability status and preferences. We also verify data when discussing potential engagements.

You can help us by letting us know about any changes to your circumstances.

Your Rights and Choices

You have a number of rights under UK data protection law:

Right to be informed about how we use your data (this policy provides that).
Right of access to request a copy of your personal data.
Right to rectification if your data is incorrect or incomplete.
Right to erasure when data is no longer required.
Right to withdraw consent at any time, either fully or for specific types of processing such as marketing.
Right to restrict processing if there’s a dispute about accuracy or use.
Right to object to data processing based on legitimate interest, including profiling, or direct marketing.
Right to data portability where we process your data based on your consent or a contract.
Rights related to automated decision-making, including the right not to be subject to decisions based solely on automated processing that have legal or similarly significant effects on you.

You also have the right to complain to the Information Commissioner’s Office (ICO) at ico.org.uk or on 0303 123 1113. We would appreciate the chance to deal with your concerns first.

If You Withdraw Consent or Ask Us Not to Contact You

If you withdraw consent or ask us not to contact you — either by contacting us directly or using an unsubscribe link — we will retain only the minimal information needed (e.g. name, email, company) to ensure you are not contacted again in future. If we found you through a publicly available profile, we instead keep a scrambled record of your profile link, used only to make sure we never contact you again.

How to Contact Us

For any questions, data access requests, or privacy concerns, you can contact:

Email: dataprivacy@certus-services.com

Post: Certus Services Ltd, C/O DIGI Accountancy,

Sun House, 2-4 Little Peter Street,