Legal

Privacy policy

Last updated 10 October 2026.

This policy explains how Christopher Ali Ltd collects, uses and protects personal data. It covers three groups of people:

  • Candidates: people we represent, or might represent, for permanent, contract or executive roles.
  • Client contacts: people at companies that hire through us, or might.
  • Website visitors: anyone who uses christopherali.co.uk or contacts us through it.

 

We handle personal data under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. In short: we only collect what we need to find people the right roles and companies the right people, we never share a candidate’s details with a client without their agreement, and you can ask us to stop at any time.

Who we are

Christopher Ali Ltd is a specialist technology recruitment business. We are the data controller for the personal data described in this policy, which means we decide how and why it is used.

  • Company: Christopher Ali Ltd
  • Registered in: England and Wales
  • Company number: [Company number]
  • Registered office: [Registered office address]
  • ICO registration number: [ICO registration number]
  • Data protection contact: [Name], info@christopherali.co.uk

 

For any question about your data, email info@christopherali.co.uk with “Data protection” in the subject line.

What we collect

Candidates

  • Name, email address, phone number, location and LinkedIn profile
  • CV, employment history, qualifications, skills and references
  • Current salary or day rate, salary expectations, notice period and the kind of role you want
  • Right-to-work documents, where a client or the law requires us to check them
  • Notes from our calls and interviews, and feedback from clients after interviews

We don’t ask for special category data, such as health, ethnicity, religion or sexual orientation. If you choose to tell us something like this, for example to request an interview adjustment, we use it only for that purpose and only with your explicit consent.

Client contacts

  • Name, job title, company, work email and phone number
  • Details of the roles you are hiring for, and notes from our conversations

 

Website visitors

  • Anything you enter in our contact form: your reason for getting in touch, name, email, phone number, LinkedIn profile, subject and message
  • Basic technical data your browser sends, such as your IP address, which our hosting provider records in server logs

Where we get it

  • From you directly: when you send us your CV, fill in our contact form, email us, message us on LinkedIn or speak to us.
  • From public professional sources: we search LinkedIn and other professional networks, job boards and sites such as GitHub to find people whose experience fits a role. We only use information you have made public for professional purposes.
  • From referrals: when someone recommends you to us.
  • From clients: interview feedback, and details of the people we deal with at their company.
  • From referees: when you have given us their details and agreed that we can contact them.

 

If we collect your details from a public source, we will tell you within one month. In practice this is usually the first time we contact you, when we will point you to this policy and explain how to opt out.

How we use it and our lawful basis

UK GDPR requires a lawful basis for each way we use personal data. This is the one that applies to each activity:

  • Finding candidates for roles and contacting them about opportunities: legitimate interests, running a recruitment business and helping people find work
  • Representing you to a client for a specific role: consent. We always ask you first, every time.
  • Arranging interviews and passing on feedback: contract, or steps you’ve asked us to take before one
  • Checking right to work and keeping placement records: legal obligation
  • Working with client contacts on their hiring: legitimate interests
  • Replying to messages sent through our website: legitimate interests
  • Sending market updates, salary benchmarks or job alerts by email: consent, which you can withdraw at any time
  • Defending or bringing legal claims: legitimate interests

 

Where we rely on legitimate interests, we have checked that our interests don’t override your rights. You can object at any time (see Your rights). We don’t make decisions about you by automated means alone.

Who we share it with

We never sell personal data. We share it only in these cases:

  • Clients: we send a candidate’s CV and details to a client only after the candidate has agreed to be put forward for that role.
  • Service providers: companies that help us run the business and act only on our instructions. These are our recruitment database (ATS/CRM), email and office software, cloud storage, website hosting and our website contact form. [List the providers you use, e.g. Microsoft 365 or Google Workspace, your ATS, your web host.]
  • Background and right-to-work checks: screening providers, where a client requires checks and you have agreed.
  • Professional advisers: our accountants, lawyers and insurers, where they need it.
  • Authorities: HMRC, the police, regulators or courts, where the law requires us to.

International transfers

We store data in the UK and the European Economic Area wherever we can. Some of our service providers may process data in other countries, such as the United States. When that happens, we make sure the transfer is protected by a UK adequacy decision, the UK International Data Transfer Agreement or Addendum, or the UK Extension to the EU–US Data Privacy Framework.

If a client outside the UK is hiring for a role you have agreed to be put forward for, we will tell you where the client is before sending your details.

How long we keep it

We keep personal data only as long as we need it, then delete or anonymise it.

  • Candidate records: 2 years from our last meaningful contact with you. Before deleting, we may ask whether you’d like us to keep your details.
  • Records of placements, including right-to-work checks: 6 years after the placement ends, for legal and tax reasons
  • Client contact records: 2 years after our last business with your company
  • Contact form messages that don’t lead to further work: 12 months
  • Email marketing list: until you unsubscribe

 

“Meaningful contact” means a real exchange, such as a call, a reply to an email or a role we discussed. An automated email that you didn’t respond to doesn’t count.

How we keep it secure

We use password-protected systems with two-factor authentication, encrypted connections (HTTPS) on our website, and access limited to people who need it. Our service providers are bound by contract to protect your data. If a breach is likely to put your rights at risk, we will tell you and the Information Commissioner’s Office (ICO) within 72 hours of finding out.

Your rights

You have the right to:

  • Access the personal data we hold about you and get a copy
  • Correct anything that is wrong or incomplete
  • Delete your data, where we have no legal reason to keep it
  • Restrict how we use your data while a concern is looked into
  • Object to us using your data based on legitimate interests, including being contacted about roles. We will stop unless we have a compelling reason not to.
  • Opt out of marketing emails at any time, using the unsubscribe link or by emailing us
  • Withdraw consent wherever consent is our lawful basis
  • Data portability: receive data you gave us in a common electronic format

 

To use any of these rights, email info@christopherali.co.uk. It’s free, and we will reply within one month. We may ask you to confirm your identity first.

If you’re unhappy with how we’ve handled your data, please tell us so we can put it right. You can also complain to the Information Commissioner’s Office at ico.org.uk/make-a-complaint or on 0303 123 1113.

Cookies

Our website uses only the cookies it needs to work, such as those that keep the site secure and stop spam on our contact form. These don’t need your consent and don’t track you across other sites.

We don’t currently use analytics or advertising cookies. If we add them, we will ask for your consent first with a cookie banner and update this section.

Our website loads fonts from Google Fonts. To do this, your browser connects to Google’s servers, which receive your IP address. Google’s use of that data is covered by its own privacy policy.

Changes to this policy

We review this policy at least once a year and whenever the way we handle data changes. The date at the top of the page shows when it was last updated. If we make a significant change, we will tell the people affected.

Questions about this policy or your data: info@christopherali.co.uk.