Privacy & Cookie Policy

1. Who we are

This website is operated by THISTLE ROSE RECRUITMENT LTD, trading as Thistle Rose Recruitment (“we”, “us”, “our”), a recruitment business operating in the United Kingdom.

• Registered address: 1 Linkwood Court, Elgin, Scotland, IV30 6LD
• Company registration number: SC887313
• ICO registration number: No ICO registration number is currently published.

We are the data controller for the personal information described in this policy.

2. How to contact us

For any question about this policy, or to exercise your rights, contact us at toby@thistleroserecruitment.co.uk or on 07396 540891.

Our nominated privacy contact is Toby Bigmore at toby@thistleroserecruitment.co.uk.

3. The personal information we collect

Contact form submissions

When you complete the enquiry form on this website we collect your first name, last name, email address, and — where you choose to provide them — your phone number, company name, enquiry type, message, and any CV document you attach. A CV may contain further personal information such as your employment history, qualifications and contact details.

Mailing list submissions

If you sign up to our mailing list we collect your email address, your first name where you choose to give it, and a record of the consent you gave, including the date and time.

Website usage information

If, and only if, you accept analytics cookies, we collect information about how you use the site, such as the pages you visit, approximate location derived from your IP address, referring website, and browser and device type.

Security information

We use Cloudflare Turnstile on our enquiry form to distinguish genuine visitors from automated abuse. This processes limited technical information about your browser and connection.

4. Cookies and similar technologies

A cookie is a small file stored on your device. We use the following categories:

• Strictly necessary. Required for the website to work. This includes remembering your cookie choice, which we store in your browser’s local storage rather than in a cookie, and the protection applied to our enquiry form. These cannot be switched off.
• Analytics (optional). Google Analytics, which helps us understand how the site is used. These are set only if you switch analytics on. Analytics is denied by default, and no Google Analytics script is loaded and no analytics request is sent until you give consent.

You can change or withdraw your choice at any time using the Cookie Preferences link in the footer of every page. Withdrawing consent stops any further analytics collection; it does not affect processing that already took place.

You can also block or delete cookies through your browser settings, although parts of the site may then not work as expected.

5. Why we use your information, and our lawful bases

Where we rely on legitimate interests, we have considered whether those interests are overridden by your rights and freedoms. Where we rely on consent, you may withdraw it at any time.

A CV may contain special category information, for example about health or ethnicity. We ask that you do not include such information unless it is necessary. Where we do process it, we do so on the basis of your explicit consent or, where applicable, the employment condition under Article 9(2)(b) UK GDPR.

6. How long we keep your information

We keep personal information only for as long as we need it:

• Enquiry form submissions and CVs: up to 24 months after your last meaningful contact with us
• Candidate and client records: up to 24 months after the end of our working relationship or last meaningful contact
• Mailing list records: until you unsubscribe, plus a record of your unsubscribe request
• Analytics data: as configured in Google Analytics, currently 14 months

When information is no longer needed we delete it securely or anonymise it.

7. Who we share your information with

We do not sell your personal information. We share it only where necessary, with:

• Client employers, where you are a candidate and you have agreed to be put forward for a role.
• Service providers acting as our processors, which currently include our secure web hosting provider, our email delivery provider Postmark (Wildbit, LLC), Cloudflare for form protection and security, and Google for analytics where you have consented. If mailing list sign-up is connected to Mailchimp (Intuit Inc.), that provider will also process your email address.
• Professional advisers, regulators or law enforcement, where we are required to do so by law.

Our processors act only on our instructions and are bound by written contracts that require them to keep your information secure.

8. International transfers

Some of our providers, including Google, Cloudflare, Postmark and Mailchimp, are based in or transfer data to the United States. Where personal information is transferred outside the UK, we rely on appropriate safeguards, such as the UK International Data Transfer Addendum to the European Commission’s standard contractual clauses, or the UK Extension to the EU–US Data Privacy Framework. You can ask us for more detail about the safeguards in place.

9. How we keep your information secure

This website is served over an encrypted HTTPS connection, and enquiry form submissions are transmitted to us over encrypted channels. We restrict access to personal information to those who need it, and we keep our systems up to date. No method of transmission over the internet is completely secure, so we cannot guarantee absolute security.

10. Your rights

Under UK GDPR you have the right to:

• be informed about how we use your personal information;
• request a copy of the personal information we hold about you;
• have inaccurate information corrected;
• ask us to erase your information in certain circumstances;
• ask us to restrict how we use your information;
• data portability, where processing is based on consent or a contract and is automated;
• object to processing based on our legitimate interests;
• object at any time to direct marketing; and
• withdraw consent at any time where we rely on it.

To exercise any of these rights, contact us using the details in section 2. We will respond within one month. There is normally no charge.

11. Complaints

If you are unhappy with how we have handled your personal information, please tell us first so we can try to put it right. You also have the right to complain to the Information Commissioner’s Office (ICO), the UK supervisory authority for data protection:

• Website: ico.org.uk/make-a-complaint
• Helpline: 0303 123 1113
• Post: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

12. Changes to this policy

We may update this policy from time to time. Any changes will be published on this page with a revised “last updated” date.