Privacy Policy
Last updated: 2 August 2026
Peopleflow.ai Ltd (“Peopleflow”, “we”, “us”) provides recruitment, talent sourcing, Employer of Record and payroll services. This policy explains what personal data we collect, why we collect it, and the rights you have over it. We are the data controller for the personal data described below and we process it in line with the UK GDPR and the Data Protection Act 2018.
If you have any question about this policy or want to exercise your rights, contact us at info@peopleflow.ai. Our registered office address is available on request.
1. Who this policy covers
- Candidates — people who send us a CV, apply for a role, or whose professional profile we source for a role.
- Clients and prospective clients — business contacts at companies that hire through us.
- Workers we employ or pay — people engaged through our Employer of Record and payroll services.
- Website visitors.
2. What we collect
| Who | Data |
|---|---|
| Candidates | Name, email address, phone number, location, CV and its contents (work history, education, skills, qualifications), salary expectations, notice period and availability, right-to-work and visa status where relevant, interview notes and feedback, assessment or psychometric results where you complete one, and information from public professional sources such as LinkedIn. |
| Clients | Name, job title, business contact details, correspondence, and information about your hiring requirements. |
| Employed / paid workers | The above plus the information needed to employ and pay you lawfully: date of birth, address, national insurance or equivalent tax identifier, bank details, tax and social security data, contract terms, benefits elections, absence and time-off records. |
| Website visitors | Anything you enter into our forms, plus technical data such as IP address, browser and pages visited (see our Cookie Policy). |
We do not seek special category data (such as health or ethnicity) as part of recruitment. Where it is genuinely necessary — for example a reasonable adjustment for an interview, or a statutory payroll requirement — we process it only with your explicit consent or where the law otherwise allows it.
3. Why we process it, and our lawful basis
- To provide recruitment services — assessing your suitability, representing you to clients, arranging interviews and managing offers. Lawful basis: legitimate interests (running a recruitment business and connecting candidates with relevant roles), and performance of a contract where one is in place.
- To source candidates from public professional sources for roles we are working on. Lawful basis: legitimate interests. We always tell you where we found you and you can ask us to stop at any time.
- To provide Employer of Record and payroll services — employing, onboarding and paying workers, and meeting the associated tax, social security and employment obligations. Lawful basis: performance of a contract and legal obligation.
- To market our services to businesses. Lawful basis: legitimate interests, or consent where the law requires it. You can opt out of any marketing at any time.
- To run and secure our website, and to keep records. Lawful basis: legitimate interests and legal obligation.
We do not make decisions about you by automated means alone. We use technology to help identify and rank potentially relevant candidates, but every shortlisting decision is reviewed and made by a member of our team.
4. Who we share it with
- Our clients — we share your CV and profile with a client only for a specific role, and we tell you which client before we do so.
- Service providers acting on our instructions — our applicant tracking and CRM system, email and file storage providers, and our vetted payroll and Employer of Record platform partners who help us employ and pay workers in local jurisdictions.
- Professional advisers, auditors and insurers, where needed.
- Regulators, tax authorities and law enforcement, where we are legally required to.
We never sell your personal data.
5. International transfers
We place candidates and employ workers globally, so your data may be transferred outside the UK or EEA — including to a client or a local payroll provider in the country of the role. Where we do that, we rely on an adequacy decision or put appropriate safeguards in place, such as the UK International Data Transfer Agreement or the EU Standard Contractual Clauses.
6. How long we keep it
We keep candidate data for as long as it is useful for finding you relevant work, and review it periodically — normally deleting or anonymising records that have had no activity for 24 months. Where we have employed or paid you, we keep employment, payroll and tax records for the period required by law in the relevant country (usually six to seven years). Client and supplier records are kept for the life of the relationship plus six years.
7. Your rights
You have the right to ask us to: give you a copy of your data; correct it; delete it; restrict or object to how we use it (including objecting to marketing at any time); transfer it to another provider; and withdraw any consent you gave. Email info@peopleflow.ai and we will respond within one month.
If you are unhappy with how we have handled your data you can complain to the Information Commissioner’s Office at ico.org.uk — but please raise it with us first so we can try to put it right.
8. Security
We hold your data in access-controlled business systems, restrict access to the people who need it, and require our providers to maintain appropriate technical and organisational security measures.
9. Changes
We may update this policy from time to time. The date at the top shows when it was last changed.