Privacy Policy

BLKT Management Ltd ("BLKT", "we", "us", "our") is a staffing and recruitment business. We supply skilled workers to construction, heavy equipment, plant and engineering projects in the United Kingdom and overseas, including fly-in fly-out assignments.

This policy explains what personal information we collect, why we collect it, who we share it with, how long we keep it and what rights you have. It applies to our website and to everything we do away from it. Please read it before you apply for a role with us or send us your details.

We are the data controller for the information described here. That means we decide how and why your information is used, and we are accountable for protecting it under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

1. Who this policy covers

This policy applies to:

• Visitors to our website.
• People who apply for a role advertised by us, or who send us their details speculatively — we call you applicants and candidates.
• Workers and subcontractors we engage, place or supply to a client.
• Our own office staff.
• People you give us as referees.
• Individual contacts at our clients, end-hirers, suppliers, agents and professional advisers.

Where a section applies only to one of these groups, we say so.

2. The information we collect

2.1 If you visit our website

2.2 If you apply for a role or register with us

2.3 If we engage, place or supply you

In addition to everything in section 2.2:

2.4 If you are a contact at a client, end-hirer, supplier, agent or adviser

• Your name, job title, employer, business email address and business telephone number.
• Records of our correspondence with you, meeting notes, and the contracts, orders and invoices you are named on.
• Your preferences about how and whether we contact you.

2.5 If you are given to us as a referee

• Your name, job title, employer and contact details, given to us by the candidate.
• The content of the reference you give and the date you gave it.

3. Special category and criminal offence data

Some of the information we hold is given extra protection by law. We only collect it where we need it and where we have a specific condition allowing us to.

3.1 What special category data we hold

• Health data — fitness-to-work confirmations, medical certificates and occupational health information, where the role requires it.
• Information that may reveal racial or ethnic origin — we do not ask for this, but it can be inferred from the nationality and identity documents we are legally required to check and copy for right-to-work purposes.

We do not ask for, want, or knowingly collect information about your religion or beliefs, political opinions, trade union membership, sex life or sexual orientation, or your genetic or biometric data. Please do not send it to us. If you do, we will delete it unless we have a lawful reason to keep it.

3.2 The conditions we rely on

For special category data we rely on one or more of the following, in addition to a lawful basis under Article 6:

Because we rely on the employment condition, the law requires us to keep an Appropriate Policy Document setting out how we comply with the data protection principles and how long we keep this information. We have one in place, we review it, and you can ask us for a copy using the contact details above.

3.3 Criminal offence data

We do not collect criminal record information for placements in the United Kingdom.

Some overseas visas, and some clients' own site rules, require a criminal record check or a certificate of good conduct. Where that applies, the check is normally carried out through the client's own system or through the relevant immigration authority, and the outcome is not shared with us.

If we ever do need to hold criminal offence data, we will only do so where Article 10 UK GDPR permits it and a condition in Schedule 1 to the Data Protection Act 2018 applies — in practice paragraph 1 (employment) or paragraph 10 (preventing or detecting unlawful acts) — and only with an Appropriate Policy Document in place. We will not ask you about convictions that are spent under the Rehabilitation of Offenders Act 1974. Please do not volunteer criminal record information to us; if you do, we will delete it unless a condition applies.

4. Where we get your information from

• Directly from you — when you apply through our website, email us, speak to us, or complete our onboarding paperwork.
• From your CV and the documents you upload.
• From referees you name.
• From our clients and end-hirers, about how a placement is going.
• From referrals — where someone who knows you passes on your details because they think a role would suit you.
• From job boards and professional networking sites, where you have made your profile available for recruitment purposes.
• From identity and right-to-work verification services, and from the Home Office online right-to-work checking service.
• From publicly available sources such as Companies House, the VAT register and HMRC's subcontractor verification service.
• Automatically, from cookies and similar technologies when you use our website.

5. Why we use your information, and our lawful basis

5.1 Our legitimate interests

Where we rely on legitimate interests, we have weighed our interest in doing the thing against your interests, rights and freedoms, and have satisfied ourselves that our interest is not overridden. In short: our interest is in running a recruitment business properly — matching people to work, supplying competent workers to our clients, keeping our records straight and protecting ourselves against claims. We only use the information needed for that purpose.

You have the right to object to processing we carry out on this basis. See section 13. You can ask us for more detail about the balancing exercise for any particular purpose.

6. Do you have to give us your information?

Some of it, yes.

7. Who we share your information with

We share your information only where it is necessary to provide our services, to meet a legal obligation, or where you have asked us to. We share it with:

• Clients and end-hirers — to put you forward for a role, and to manage your placement once it starts.
• Overseas clients, agents, partners and subcontractors — where you are placed on, or being sourced for, a project outside the UK.
• HM Revenue & Customs, the Home Office and other government or regulatory bodies — where the law requires it.
• Our accountants, payroll providers and umbrella companies — to pay you and to meet our tax obligations. An umbrella company that employs you becomes a data controller in its own right and will have its own privacy notice.
• Our software and IT providers — who process your information on our behalf, under contract and on our instructions only. They are listed in section 7.1.
• Insurers, auditors, solicitors and other professional advisers — where reasonably required.
• A buyer or successor — if we sell, merge or restructure the business, in which case your information transfers as part of it.

We do not sell your personal information, and we do not share it with third parties for their own marketing purposes.

7.1 Our processors

Each of the providers below acts as our processor. They may only use your information to provide their service to us, on our written instructions, under a contract that meets the requirements of Article 28 UK GDPR.

This list is accurate at the version date on the front of this policy. If we add or change a provider we will update this section.

8. Sending your information outside the UK

We place workers on projects in the UK, in Europe and worldwide, and some of our providers store or process data outside the UK. That means your information may be transferred abroad.

Where it is, we make sure it is protected to a standard equivalent to UK law, by relying on one or more of the following:

• A UK adequacy decision — where the receiving country has been assessed by the UK Government as providing an adequate level of protection. This covers the European Economic Area and a number of other countries.
• The UK Extension to the EU–US Data Privacy Framework, where a United States provider is certified under it.
• The ICO's International Data Transfer Agreement, or the UK Addendum to the EU Standard Contractual Clauses, supported by a transfer risk assessment.

Where you are placed in a country that is not covered by an adequacy decision, we put contractual safeguards in place before your information is sent, and we send only what the placement actually requires. You can ask us which safeguard applies to a particular transfer.

9. How long we keep your information

We keep your information only for as long as we need it for the purposes set out in this policy, or for as long as the law requires. Our normal retention periods are:

Where a legal claim, audit, investigation or regulatory matter is live or reasonably anticipated, we keep the records relevant to it until it is concluded. When information is no longer needed, we securely delete it or make it anonymous so it can no longer identify you.

10. How we keep your information secure

We use appropriate technical and organisational measures to protect your information against unauthorised access, loss, alteration and misuse. These include:

• Multi-factor authentication on the accounts that hold personal data.
• Role-based access, so that people can only see what their job requires. Charge rates are visible to administrators only, and workers can see only their own timesheet and their own records.
• Encryption of data in transit, and encryption at rest by the providers listed in section 7.1.
• Written contracts with every provider who handles data on our behalf.
• Keeping the people who work for us trained on how to handle personal information.
• Secure deletion of documents and records once their retention period has expired.

No system is completely secure. If a personal data breach occurs we will record it, assess it, report it to the Information Commissioner's Office within 72 hours where we are required to, and tell you without undue delay where the breach is likely to result in a high risk to your rights and freedoms.

11. Cookies and similar technologies

A cookie is a small file placed on your device when you visit a website. Some are essential to make a site work; others tell the site owner how the site is being used.

We set the following:

Strictly necessary cookies are set automatically, because the site cannot work without them. Everything else is only set once you have agreed to it through the banner shown when you first visit. You can change your mind at any time using the cookie settings link in the footer of our site, or by clearing cookies in your browser.

Most browsers let you block or delete cookies. If you block strictly necessary cookies, parts of our site — including the application form and the timesheet area — will stop working.

We do not currently use advertising cookies, social media pixels or similar tracking technologies. If we add any, we will update this policy and ask for your consent before setting them.

12. Automated decision-making and profiling

We do not make decisions about you based solely on automated processing that produce legal effects for you, or that similarly significantly affect you. Every decision about whether to put you forward for a role, or to engage you, is taken by a person.

Two things are worth explaining, because they involve automation or profiling but do not amount to a solely automated decision:

• Document checks on the application form. Where a job requires particular documents, our online form will not let you submit until you have uploaded them. That is a completeness check on the form, not an assessment of you, and it does not reject your application.
• Worker ratings. We record a rating or tier against workers based on our own experience and feedback from clients, and we take it into account when deciding who to put forward. This is profiling. The rating is set and reviewed by a person, and it informs a human decision rather than replacing one. You can ask us what rating we hold for you, and ask us to correct it if you think it is wrong.

13. Your rights

Under data protection law you have the right to:

To exercise any of these rights, email us at info@blktmanagement.com. There is no charge. We will respond within one month, and will tell you if we need to extend that by up to a further two months because your request is complex — the law allows this. We may need to confirm your identity before we act, to make sure we are not disclosing your information to someone else.

Withdrawing consent does not affect anything we did before you withdrew it, and it does not affect processing we carry out on another lawful basis — for example, records we are legally required to keep.

14. How to complain

If you are unhappy with how we have handled your information, please tell us first so we have the chance to put it right. Contact us using the details at the top of this policy.

You also have the right to complain to the Information Commissioner's Office, the UK's data protection regulator, at any time:

15. Data protection responsibility

We are not required to appoint a statutory Data Protection Officer. Responsibility for data protection at BLKT Management Ltd sits with the Managing Director. Any question about this policy, or about how we handle your information, should go to the email address at the top of this policy.

16. Changes to this policy

We review this policy at least once a year, and whenever we change what we do with personal information. The version number and effective date are shown at the top of this page. Where we make a significant change we will say so on our website and, where it affects you directly and we hold your contact details, we will tell you.

Schedule A — Engagement status and what it means for your information

The basis on which you work with us affects what we are required to collect, who we have to share it with, and how long we have to keep it. This schedule explains the differences.

We record the basis on which you are engaged, and we will tell you if it changes. A status determination under the off-payroll working rules is a decision about your engagement made by a person, not by a machine, and you can ask us to review it.

Version history