Privacy policy

This policy explains how Hornsman Group Limited (“we”, “us”) collects, uses and protects personal information. It is written to comply with the UK General Data Protection Regulation and the Data Protection Act 2018.

Hornsman Group Limited is a company registered in England and Wales under company number 17249812, whose registered office is Suite RA01, 195–197 Wood Street, London E17 3NU. We are the controller for the personal data described here, and we are registered with the Information Commissioner’s Office under reference ZC211316.

For any question about this policy, or to exercise any of the rights set out in section 8, write to info@hornsmangroup.com.

We collect only what you choose to give us.

Enquiries. Your name, your contact details, and the content of your message.

Work seekers. Where you register with us, the information needed to represent you and to screen you for security work: your employment and activity history, identity documents, right-to-work evidence, licence details, references, and the results of the background checks that security roles require.

Clients. The contact details of the individuals we deal with, and the content of our correspondence about an assignment.

We use your information to reply to you and to provide recruitment services: taking a brief, identifying and screening candidates, making introductions, and administering the assignment that follows.

Our lawful basis for most of this processing is our legitimate interests in operating a recruitment practice and in making introductions that both sides want, balanced against your own interests and rights. Where we hold a contract with you, the basis is the performance of that contract. Where the law requires us to keep a record, the basis is our legal obligation.

Some security roles call for a check of criminal convictions. Information of that kind is governed separately from ordinary personal data. We will put the arrangements the law requires in place before any such information is obtained or held, and we will update this notice to describe them at that point.

No decision about you is made by automated means. Every determination concerning a candidacy is made by a person.

Access within the practice is limited to those handling your enquiry or your assignment.

A candidate’s details are passed to a prospective client only with that candidate’s agreement, on each occasion, and only so far as the client needs in order to reach a hiring decision. We do not forward a screening file.

We do not sell, trade, syndicate or otherwise circulate personal data, to other agencies, to job boards, or to anyone for marketing. We may share information in confidence where it is professionally necessary, for example with our solicitors or our accountant, or where the law requires it of us.

Correspondence reaches us by email and is held in our mailbox, which is provided by Microsoft. Candidate records and screening files are held on equipment under our own control in the United Kingdom, and are not placed on shared cloud recruitment platforms.

The third parties involved in the operation of this website and our email are listed in full in section 10. There are no others.

We keep information only for as long as there is a reason to, and no longer.

We have not fixed one period that applies to everything, because different material calls for different treatment. The criteria we apply are whether the matter it relates to is still live, whether a claim arising from it remains possible, and whether the law obliges us to keep it, as it does with accounting and tax records.

You may ask us to delete information about you at any time. We will do so unless we are obliged to keep a particular record, in which case we will tell you which record and on what basis.

We take the security of information seriously and use established providers for the services this practice depends on.

This website is served only over an encrypted connection, and it is configured so that a browser will refuse to load any script, style, font or image from a third party. That is enforced by a content security policy sent with every page, which you can inspect in your browser’s developer tools.

No system is ever wholly immune to risk. Where a breach occurs, we will meet the reporting obligations that data protection law places on us, including notifying you directly where the law requires it.

Under UK data protection law you may ask us to give you a copy of the personal data we hold about you; correct anything inaccurate; delete it; restrict what we do with it; provide it in a portable form; or stop processing it where we rely on legitimate interests. Where we rely on your consent for a particular thing, you may withdraw it at any time without affecting what was done before.

Write to info@hornsmangroup.com. We respond within one month.

If you believe we have handled your information wrongly you may complain to the Information Commissioner’s Office at ico.org.uk. We would rather you raised it with us first, but you are not obliged to.

This website is not directed at children, and we do not knowingly collect information about anyone under 18 other than, where a household engagement makes it unavoidable, the first names of children in a family whose security arrangements are being discussed. That information is given to us by the client, is held only for as long as the assignment requires, and is never used for anything else.

Hosting. This site is delivered by Cloudflare, Inc. through Cloudflare Pages. When you visit, your IP address and connection metadata reach Cloudflare so that it can route, deliver and protect the page. That is inherent to how any Cloudflare-served site works. Our lawful basis is our legitimate interest in keeping the site available and secure, and Cloudflare acts as our processor.

Cookies. We set no cookies of our own. This site uses no analytics of any kind, no advertising, and no cross-site tracking. Nothing on this site profiles you or follows you to another website. Cloudflare may set a strictly necessary security cookie where a particular protective feature is engaged; such a cookie is exempt from the consent requirement and carries no profiling.

Fonts, scripts and images. Every typeface, script and image on this site is served from this site. Nothing is requested from Google Fonts or from any other third-party host, and no third party learns that you visited.

Forms. There is no form on this site that submits data to us or to anyone else. Where a page offers to help you write to us, it opens a message in your own email program, which you send yourself. Nothing is transmitted until you send it.

Email. Our mailbox is provided by Microsoft Corporation as part of Microsoft 365. Mail you send us is processed and stored on that service and is subject to Microsoft’s terms as our processor.

Transfers outside the United Kingdom. Cloudflare and Microsoft are United States companies and may process data outside the United Kingdom. We rely on the safeguards recognised under UK data protection law for those transfers, including the International Data Transfer Addendum to the European Commission’s standard contractual clauses.

If we change how we handle information — by introducing analytics, a form that submits to us, or any new third-party service — we will update this policy and the date above before that processing begins. Where a change materially affects information you have already given us, we will tell you directly.