Privacy Policy

Data Protection Policy

Last Updated: November 2026

At Starfish People Ltd, we are committed to protecting the privacy and security of the personal information entrusted to us. We believe in being transparent about how we collect, use, store and protect personal data and in meeting our obligations under the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and other applicable data protection legislation.

This policy explains our approach to processing personal data relating to employees, workers, contractors, job applicants, candidates, suppliers and other individuals whose information we process as part of our HR and recruitment services.

We process personal information as part of our HR consultancy, recruitment, talent acquisition, candidate assessment, onboarding and business support services. We are committed to handling all personal information responsibly, securely and in accordance with applicable data protection legislation.

This policy does not apply to personal data processed on behalf of our clients under separate contractual arrangements or privacy notices.

Data Protection Lead

Starfish People Ltd has appointed David Price-Evans as its Data Protection Lead.

If you have any questions about this policy, wish to exercise your data protection rights, or require further information, please contact:

David Price-Evans
Data Protection Lead
[email protected]

What Is Personal Data?

Personal data is any information that can directly or indirectly identify a living individual.

Examples include:

  • Name
  • Address
  • Email Address
  • Telephone Number
  • National Insurance Number
  • Employment Records
  • Recruitment Information
  • Identification Documents

Special Category Data

Certain information requires additional protection under data protection law, including:

  • Racial or Ethnic Origin
  • Religious or Philosophical Beliefs
  • Trade Union Membership
  • Health Information
  • Biometric Data
  • Genetic Data
  • Sexual Orientation

Information relating to criminal convictions or offences is subject to separate legal safeguards.

Our Data Protection Principles

Starfish People Ltd is committed to ensuring that all personal data is:

Lawfully, Fairly and Transparently Processed

We only collect and use personal data where there is a lawful basis to do so and we explain how your information is used.

Collected for Legitimate Purposes

Information is only collected for specified, explicit and legitimate purposes.

Adequate, Relevant and Limited

We only collect information that is necessary for the purpose for which it is processed.

Accurate and Up to Date

Reasonable steps are taken to ensure that personal information remains accurate and current.

Stored Securely

We implement appropriate technical and organisational measures to protect information against unauthorised access, loss, misuse, alteration or disclosure.

Retained Only as Long as Necessary

Personal data is retained only for as long as required to fulfil the purpose for which it was collected or to meet legal obligations.

Accountable and Compliant

We maintain appropriate records of processing activities and regularly review our policies and procedures to ensure compliance with UK data protection legislation.

Your Rights

Under UK data protection law, individuals have a number of rights regarding their personal information.

  • The Right to Be Informed
  • The Right of Access
  • The Right to Rectification
  • The Right to Erasure (where applicable)
  • The Right to Restrict Processing
  • The Right to Object to Processing
  • The Right to Data Portability
  • Rights Relating to Automated Decision-Making and Profiling

Subject Access Requests

You have the right to request a copy of the personal information we hold about you.

When making a Subject Access Request, you may ask for:

  • Confirmation that we process your data
  • A copy of the personal data we hold
  • Information about how and why it is processed
  • Details of any recipients of the information
  • Details of retention periods
  • Information about your rights

Requests should be sent to:
[email protected]

We may request proof of identity before releasing information.

We will normally respond within one month of receiving a valid request. Where requests are particularly complex, the response period may be extended in accordance with applicable legislation.

Requesting Corrections or Deletion

You may ask us to:

  • Correct inaccurate or incomplete information
  • Restrict processing in certain circumstances
  • Delete personal data where there is no lawful reason for us to continue processing it
  • Object to processing where we rely on legitimate interests

Requests should be submitted to:
[email protected]

Data Security

Protecting personal information is extremely important to us.

We maintain a range of safeguards including:

  • Password-Protected Systems
  • Encrypted Data Storage Where Appropriate
  • Secure Cloud-Based Platforms
  • Controlled Access to Confidential Information
  • Staff Training on Data Protection Obligations
  • Secure Disposal Procedures for Confidential Information

We regularly review our security measures to ensure information remains protected against evolving risks.

Data Breaches

In the unlikely event of a personal data breach, Starfish People Ltd will investigate promptly and take appropriate action.

Where required by law, we will:

  • Report Notifiable Breaches to the Information Commissioner’s Office (ICO)
  • Inform Affected Individuals When a Breach Presents a High Risk to Their Rights and Freedoms
  • Maintain Records of All Identified Breaches and Remedial Actions Taken

International Transfers

Where personal data is transferred outside the United Kingdom, Starfish People Ltd will ensure appropriate safeguards are in place to protect the information and comply with UK data protection legislation.

Individual Responsibilities

Individuals who have access to personal data are expected to:

  • Access Information Only When Authorised
  • Use Personal Data Only for Legitimate Business Purposes
  • Keep Information Secure and Confidential
  • Follow Company Security Procedures
  • Report Suspected Data Breaches Immediately
  • Protect Devices Used to Access Company Systems

Deliberate misuse of personal data or failure to comply with data protection requirements may result in disciplinary action and, where appropriate, legal action.

Training and Awareness

All employees and individuals who process personal data on behalf of Starfish People Ltd receive appropriate guidance and training on their data protection responsibilities.

Additional training is provided where roles involve regular handling of personal or sensitive information.

Contact Us

If you have any questions about this policy or how Starfish People Ltd processes personal data, please feel free to contact us:

David Price-Evans
Data Protection Lead
[email protected]