Wexlen Privacy Notice

Who we are

WEXLEN LTD is the controller responsible for personal information used in its recruitment, workforce assurance and related business services, website and online workspaces. Our company number is 17045576. Our registered office is 136–140 Wallasey Road, Wallasey, United Kingdom, CH44 2AF.

This notice covers candidates, workers, client and prospective-client contacts, supplier and other business contacts, website visitors and people who communicate with us. It applies to information handled through our website, portals, email, telephone, documents and recruitment records. Contact privacy@wexlen.com or write to our registered office about your information. Dan Webster handles privacy requests.

Candidates and workers

We use an external customer relationship management provider to manage recruitment contacts and follow-up. When you complete verified registration, we create or update a contact record and keep selected portal information current: your name, email, phone number, primary and additional roles, availability and available-from date, town or general area, profile-completion status, portal reference, secure staff link and update dates. Roles and availability are information you provide, not confirmation of qualifications or suitability. CVs, identity documents and detailed compliance records are not copied through this connection. Creating an account does not subscribe you to optional marketing.

We handle the identity and contact details, work history, trade or profession, skills, qualifications, certificates, trade cards, sector experience, availability, general location, postal address, travel preferences and work preferences relevant to your recruitment. This includes CVs or experience summaries, applications, interview arrangements, recruitment discussions, feedback and records of introductions or submissions for opportunities.

Your candidate profile is for recruitment information, CVs and relevant qualification certificates or trade cards. Do not upload medical information, criminal-record information, passports, right-to-work documents or bank details to your profile. A CV and certificates are optional when creating an account. We need sufficient contact and role information to manage your account and help you find suitable work.

When we request a right-to-work check, we use a restricted checking area for the necessary identity documents or share-code details, date of birth, your response, the recorded result, work restrictions and follow-up dates. You and authorised Wexlen staff can access these records. Where needed for an assignment, authorised staff can share selected documents and a check summary with a named client contact for a limited period. Stored share codes, dates of birth, emergency contacts and confidential support details are not included in the client summary. Selected documents may themselves contain identity details. We record sharing, access and revocation. A declaration or document upload does not complete a right-to-work check.

Where you choose to provide them, we record an emergency contact’s name, relationship and contact details, and whether you would like confidential recruitment support. Please let your emergency contact know you have provided their details. We do not ask for medical details in the registration form.

Clients and business contacts

For client, prospective-client, supplier and other business contacts, we handle names, job titles, organisation details, business contact details, enquiries, service requirements, correspondence and records of business discussions or instructions. Client records can include recruitment briefs, vacancies, projects, sites, service terms and related business records containing personal information.

For client workspace users, we also record invitations, organisation membership, project access, permissions and account activity. This includes actions you take within your authorised access, such as reviewing candidate information or approving or returning a timesheet.

You or an authorised colleague can provide business contact details and arrange workspace access. We need sufficient contact and authorisation information to respond to requirements, manage the relationship and provide the requested access.

Assignments and service records

For an assignment or placement, relevant records can include the role, client, project, site, dates, agreed terms and rates, onboarding tasks, qualification requirements, evidence review, compliance status and changes to the engagement. Timesheet records include dates and hours worked, submission and approval history, corrections and relevant review notes.

We use these records to arrange and administer work, coordinate requirements, check recorded readiness, resolve queries, confirm authorised hours and prepare information required for the applicable pay and charging arrangements.

Information needed only for a specific engagement, legal check or payment arrangement is requested through the relevant authorised process. It is not a requirement to provide every category of engagement information when first registering.

Website and account information

We use an external customer relationship management provider to manage website enquiries and follow-up. When you send an enquiry through our forms or enquiry button, we create or update a recruitment or business contact record and record your message, enquiry type, the public page used, the time of submission and any recognised link-source category. We use the contact, organisation, trade and location details you choose to provide to respond and manage the relationship. Sending an enquiry does not create a portal account or subscribe you to optional marketing. Please do not send CVs, identity documents, health information, bank details or right-to-work evidence through these forms.

Your sign-in service handles your password and authenticator credentials. Technical information such as IP addresses, browser details, access events and security logs helps us operate and protect the service. We record changes and document review activity to maintain an audit trail.

Where information comes from

Information comes from you, your authorised representatives, client contacts and colleagues who arrange services or account access. Recruitment records can also include relevant information supplied by prospective employers, clients or referees during a recruitment process, and records transferred from an existing recruitment system where Wexlen is entitled to use them.

Importing a record does not remove our responsibility to establish its source, purpose and lawful basis. When we obtain your information indirectly, we explain the relevant source and use within the applicable legal timescale, including at first contact or disclosure where required. If a publicly available source is used, we identify that source in the information provided to you.

Why we use it

Recruitment and workforce services: we use relevant information to respond to enquiries, understand experience and requirements, identify and discuss opportunities, manage applications and interviews, prepare reviewed candidate presentations, arrange engagements and coordinate assignment requirements. We maintain relevant talent-pool records for future work and review recorded qualification details and expiry dates.

Service and business administration: we use relevant records to manage client and supplier relationships, confirm instructions and agreed terms, operate workspaces, record authorised actions, administer timesheets and prepare or reconcile service records. We handle complaints, support requests and disputes, maintain appropriate records and protect legal rights.

Security and improvement: we use proportionate technical and audit information to manage access, investigate misuse, protect documents and maintain service reliability. Recruitment reporting helps us understand activity and improve services; we use anonymous totals where individual details are unnecessary.

Our lawful bases

Legitimate interests: we rely on our interests, and those of candidates and clients, in finding suitable work, meeting recruitment requirements, maintaining relevant professional relationships, administering services, protecting accounts and resolving disputes. We consider the effect on the people involved and limit information and contact to what is appropriate for those purposes.

Contract: where you are personally a party to an agreement with Wexlen, we use information necessary to perform it or take steps you request before entering it. A contract with an organisation you represent does not, by itself, make this the basis for processing your information.

Legal obligation: we process necessary information to meet applicable recruitment, employment, tax, accounting and other statutory record requirements where they apply to our role and the service provided. This includes work-finding records required under the Conduct of Employment Agencies and Employment Businesses Regulations 2003.

Consent: optional candidate job alerts rely on your consent. You can change your preferences or contact us to withdraw it. Creating an account, reading this notice or receiving an invitation does not provide blanket consent for marketing or other uses. We do not sell personal information or use it for unrelated promotions.

Profile reminders and your choices

An incomplete profile can receive up to three completion reminders, around days 2, 7 and 14 after registration. These prompts support the recruitment service you requested; they are not optional job-alert subscriptions. Completed profiles stop receiving these prompts. You can pause reminders, request help or turn off recruitment emails in your preferences.

Account verification, password recovery and essential security messages are separate from job alerts and profile reminders. A profile checklist describes information you have supplied. It does not verify a qualification, authorise an assignment or decide whether you get a job. Recruiters review information and make recruitment decisions; we do not make solely automated employment decisions.

We may email you about recorded certificate or trade-card expiry dates. You can pause renewal emails in your portal preferences. Candidate renewal reminders pause while a replacement awaits staff review and stop for the old evidence once a current renewal is verified. Client contacts who enable renewal emails receive summaries and expiry alerts limited to their authorised workforce. These emails link to the secure portal and do not include document attachments.

Sensitive information and employment checks

General candidate profiles and enquiry forms are for recruitment details, CVs and relevant qualification certificates or trade cards. Do not use them to send medical information, criminal-record information, passports, right-to-work documents or bank details.

Where a particular engagement requires identity, right-to-work, health, adjustment or other employment checks, the information requested must be relevant to that check and handled through a specified secure process. We explain the purpose, information required, recipients and any additional privacy terms at collection. Refusing information required by law or necessary for a particular engagement can prevent that engagement from proceeding.

Health and other special-category information require an additional legal condition as well as a lawful basis, and criminal-offence information is subject to separate legal restrictions. A request for a document or acceptance of this notice does not itself authorise those uses. We limit access to people who need the information for the particular purpose.

Who can see your information

Our customer relationship management service provider processes selected recruitment contact and profile information to support our recruitment administration and follow-up. Overseas hosting or support access can involve international processing; applicable supplier terms provide the relevant approved transfer safeguards. Contact privacy@wexlen.com for the arrangements and safeguards applicable to your information.

Authorised Wexlen staff access information needed for their work. For an opportunity, we share relevant reviewed details with the prospective employer or client. Ordinary client presentations do not include your original source CV. Client workspace access is limited to information released for that company or project. Clients are responsible for their own subsequent use and should provide their own privacy information.

Relevant client contact details, interview arrangements, site instructions and recruitment communications may be shared with the candidates or workers involved and with authorised colleagues in your organisation where needed to coordinate the service. We do not publish client contact records or give one client access to another client’s private workspace.

Assignment information and authorised timesheet or service records are shared only with the people involved in administering that engagement, such as the relevant client, worker and authorised Wexlen personnel. If an external employer or pay administrator, such as an umbrella company, needs information for an engagement, we identify the relevant recipient and purpose when arranging that service. We limit what we share to the task; access to a client workspace does not permit unrestricted access to worker records.

Service providers process information to operate the service, including hosting and backup providers, email delivery providers for account communications, and domain and network service providers for technical traffic. We may disclose necessary information to regulators, professional advisers or other parties where required by law or necessary to establish or defend legal claims.

Our application is hosted in the United Kingdom. Recovery backups are held in Germany and the Netherlands, within the European Economic Area, which is covered by UK adequacy arrangements. Our account-email service has a United Kingdom at-rest location commitment for the customer data covered by its core-service terms. Infrastructure, email and technical support can also involve processing in other countries. The hosting and email providers’ data-processing terms include approved standard contractual clauses with the UK transfer addendum for restricted overseas processing. Contact privacy@wexlen.com for the processing arrangements relevant to your information and to request a copy of applicable safeguards.

How we protect your information

We use access controls, secure connections, private document storage and security logging to protect personal information. Staff access is limited by their role and the work they need to perform. Uploaded documents are checked for security threats, and qualification review is separate from an upload or a completed checklist.

You are responsible for keeping your password and authenticator secure. Contact us promptly if you believe someone has accessed your account without permission.

How long we keep it

The same recruitment retention and review criteria apply to the selected information held in our contact-management service. We consider correction, restriction, objection and erasure requests across both the portal and those contact records. A profile update does not itself provide a new reason to retain information indefinitely.

We review talent-pool profiles after 12 months without meaningful recruitment contact where there is no active application or assignment. We delete or effectively anonymise information no longer needed. Keeping a profile after review requires a recorded reason and a further review date. An automatic reminder alone does not restart this review period.

This review does not override legal record requirements. Where we have provided work-finding services, the necessary compliance records are retained for at least 12 months after creation and at least 12 months after the last provision of those services. An unused speculative CV does not by itself require the same statutory retention.

We retain client and business contact records while they are needed to manage the relationship, ongoing recruitment, project activity and relevant service records. We review contacts when told they have changed role or left the organisation, and remove unnecessary access and outdated details. After a relationship or enquiry ends, continued retention depends on applicable record-keeping obligations, outstanding services, complaints or legal claims; it does not justify keeping every contact detail indefinitely.

Assignment, timesheet, rate, pay-preparation and related business records are assessed separately from the talent pool. Their retention depends on the engagement, the type of record, applicable employment, tax or accounting duties, outstanding queries and relevant legal-claim periods. We retain the necessary record set for the applicable purpose, rather than treating every document as subject to the same period. Contact us for the retention criteria applicable to a particular record.

We assess other records by their purpose, the continuing application or relationship, applicable legal duties, and any specific complaint, dispute or security investigation. We keep only the information needed for that purpose and restrict records retained solely to meet a legal duty or handle a claim.

Deletion from active systems does not immediately remove copies from existing recovery backups. Those copies remain restricted until rotation or approved archive disposal; they are not used for routine recruitment. Our recovery procedure requires deletion and restriction instructions to be reapplied before restored records return to normal use.

Your rights and how to object

You can object to our use of your information based on legitimate interests. Contact privacy@wexlen.com and tell us what you want to stop. We will consider your circumstances and explain any compelling grounds or legal-claims reason for continuing. You can stop direct marketing at any time.

You can ask for access to your information, correction, erasure or restriction where the relevant conditions apply. Portability applies to qualifying information processed automatically using consent or contract. Withdrawing consent does not affect earlier lawful use. Some records may need to remain for legal obligations or claims.

We may make proportionate identity checks to protect your information. We normally respond to rights requests within one month and will explain any lawful extension or refusal. You can raise a complaint with us or with the Information Commissioner’s Office. Contact the ICO.

Social links and website statistics

We measure public page views, approximate website entries, broad referral sources and device categories to improve our website and service. A small first-party script sends only the public page path, a broad source category and whether it is an entry to the website; device information is reduced to mobile, tablet, desktop or unknown. These values are immediately combined into daily totals, without retaining individual events, IP addresses, visitor IDs or browsing histories. We do not measure private portal activity or share these statistics with advertising platforms. This supports our legitimate interest in understanding and improving our service, not individual advertising or recruitment decisions.

You can turn off website measurement using Website measurement on our Cookies page, linked from the footer. A preference cookie remembers an objection on this browser for up to one year and is used only for that choice. Browser Do Not Track and Global Privacy Control signals are also respected. This does not change account access or marketing preferences.

Links we share on social media may contain a campaign reference identifying the post and platform. We use this to count link opens, registration starts, newly completed registrations and enquiries received through that link, so we can understand which communications are useful. This supports our legitimate interest in improving our website and recruitment communications. It does not subscribe you to marketing.

These reports contain daily totals, not individual browsing histories. We do not store IP addresses, device fingerprints or visitor identifiers in the campaign reports, add advertising pixels or tracking cookies, or send these results to social platforms. The campaign reference can accompany an enquiry or the short-lived secure registration transaction; aggregate registration counts do not retain an account identifier. Normal security and service records are separate.

You can use the same registration or contact page without the campaign reference by removing the query string from the address, or by opening the page directly. Your access to our services is unchanged. You can also contact privacy@wexlen.com about this use of your information.

Cookies and account access

We use cookies needed to establish secure sign-in, maintain account sessions and complete sign-out. Application sign-in flow cookies last up to 10 minutes; application session and logout cookies last up to 8 hours.

The identity service uses browser-session cookies to manage and restart sign-in, a short-lived authentication-state check lasting up to 60 seconds, and signed-in session cookies. Identity sessions expire after 30 minutes of inactivity or a maximum of 10 hours; the session-status cookie can remain for up to 10 hours. Remember-me sign-in is disabled.

Blocking necessary cookies can prevent sign-in or workspace functions from working. We do not use advertising or audience-tracking cookies. If you turn website measurement off, a separate preference cookie remembers that choice for up to one year; it is not a visitor identifier.

Changes to this notice

This notice is dated and versioned so you can identify the wording that applies. We review it when our processing changes. Where a new purpose or collection requires further information or a fresh choice, we provide that before using information for that purpose. Specific privacy information supplied for an engagement or check should be read alongside this notice.