1. Introduction

Connect Legal Partners ("we", "our", "us") is committed to protecting the privacy and security of your personal information. This Privacy Policy explains how we collect, use, store, and share your personal data when you use our website, contact us, or engage our recruitment services.

We are a specialist legal recruitment firm. In the course of our business, we process personal data of candidates seeking new roles, clients (law firms and legal departments) looking to hire, and visitors to our website.

Connect Legal Partners is a trading name of ConnectRecruitmentHub Ltd, company number 15100597.

We comply with the UK GDPR, the Data Protection Act 2018 (as amended by the Data (Use and Access) Act 2025), the Privacy and Electronic Communications Regulations (PECR), and the Conduct of Employment Agencies and Employment Businesses Regulations 2003.

We are registered as a data controller with the Information Commissioner's Office (ICO).

2. What Personal Data We Collect

Candidates

When you engage with us as a candidate, we may collect:

Full name, email address, phone number, and postal address
Curriculum vitae (CV), including employment history, qualifications, and skills
Current and desired salary, notice period, and availability
Right to work status and professional qualifications (e.g. SRA registration)
LinkedIn profile URL and other publicly available professional information
Notes from telephone or video conversations with our consultants
Interview feedback and references (where provided with your consent)
Any other information you voluntarily provide to us

Clients

When you engage with us as a client, we may collect:

Contact name, job title, email address, and phone number
Firm name, address, and website
Job specifications and hiring requirements
Fee agreements and terms of business
Payment and invoicing details

Website Visitors

When you visit our website, we may collect:

IP address, browser type, device type, and operating system
Pages visited, time spent on site, and referral source
Information submitted through contact forms or download forms
Cookie data (see Section 10 below)

3. How We Use Your Personal Data

We process your personal data for the following purposes:

To provide recruitment services, including matching candidates to suitable vacancies
To communicate with you about opportunities, applications, or our services
To send you our salary benchmarking reports or other market intelligence you have requested
To fulfil our contractual obligations to clients under our terms of business
To verify professional qualifications and right to work (where required)
To improve our website and services through analytics
To comply with legal and regulatory obligations
To send occasional updates about our services (with your consent, and you may unsubscribe at any time)

4. Legal Basis for Processing

We process your personal data on the following legal bases under the UK General Data Protection Regulation (UK GDPR):

Consent - where we rely on your consent for a specific purpose, such as sharing your CV or identifiable candidate profile with an agreed prospective employer for a specific role. Consent must be freely given, specific, informed and unambiguous. Oral permission may be valid under UK GDPR when we can demonstrate it, subject to any legal formalities explained below.
Legitimate interests - where processing is necessary for proportionate recruitment matching, recruitment communications, managing candidate and client relationships, improving our services or protecting our business, provided our interests are not overridden by your rights. This is not blanket permission to distribute CVs and is not a fallback after you withdraw consent for a specific sharing activity.
Contract - where processing is necessary for a contract with you, or to take steps you request before entering into a contract with you. Our contract with a hiring firm does not by itself provide this lawful basis for processing a candidate's data.
Legal obligation - where processing is necessary to comply with identified legal, regulatory, tax, accounting, employment agency, data protection or court requirements that apply to us.
Recognised legitimate interests - the Data (Use and Access) Act 2025 introduced a new, narrower lawful basis for certain defined purposes. We only rely on this basis where a specific legal assessment confirms it applies. Ordinary recruitment activity does not automatically qualify, so in practice we continue to rely on consent, contract, legitimate interests or legal obligation for our day to day processing.

5. Who We Share Your Data With

We will never sell your personal data to third parties. We may share your data with:

Prospective employers - authorised people at an agreed law firm, legal department or other prospective employer for the application, introduction or opportunity concerned
Our technology service providers - such as our website hosting provider, email service provider, and CRM system, all of whom are bound by data processing agreements
Professional advisors - such as accountants or legal advisors where necessary
Regulatory bodies - where required by law or regulation

Anonymous market testing

Once we have spoken and you are happy for us to test the market, we can do this anonymously. We share a short summary of your skills and experience with firms to see what interest there is. This summary does not include your name, your current or past employers, your contact details or anything else we think could identify you. Where a niche specialism or a small location could point to you, we keep that detail general.

When firms are interested, we come back to you with who they are and what is on offer. We only release your name, CV and other identifiable details to a firm once you have given us the go ahead for that firm. The rest of this section explains how we record that go ahead.

Candidate sharing and permission

We treat your job search confidentially. We share your CV or identifiable candidate profile with a prospective employer only within the scope of your clear instructions or permission for the employer and opportunity concerned. The information shared may include relevant CV details, qualifications, work history, preferences, application information and consultant notes needed for that application or introduction.

You can give permission verbally, which we must document, by email or message, or through an informed application for a specific role where the employer, intended sharing and purpose have been made clear before we rely on that application as permission. Where any law requires consent in a written or legible electronic form, we obtain it in that form.

Third-party job-board applications are treated as permission only where the application clearly requested Connect Legal Partners to act for that employer and role and included the relevant notice. Unnamed confidential-employer listings and general interest forms require clarification and your instructions or permission before identifiable disclosure.

Applying for one role never permits sharing with unrelated employers or roles, speculative or bulk circulation, or marketing. Silence, mere browsing, uploading a CV, registering interest, making a general enquiry, or accepting our terms or privacy notice is not consent to circulate your details.

We will not disclose your job search or candidate information to your current employer, including for references, without your separate prior consent in a written or legible electronic form, and you may withdraw that consent before disclosure. Our work-finding service is not conditional on giving that consent.

Our permission and consent records can include dated consultant notes of oral instructions, emails or messages, and application records stating what was explained and agreed, the employer, role, purpose, limits and notice version where applicable.

You may withdraw consent or change your instructions by contacting your consultant verbally, emailing info@connectlegalpartners.co.uk or calling 0333 034 7109. We will stop further consent-based sharing after withdrawal. Withdrawal does not affect the lawfulness of processing based on consent before it was withdrawn. Employers who have already received your data are generally separate controllers with their own responsibilities and privacy notices. Where we rely on legitimate interests, we will respect objections in line with applicable law.

Applying for a role or uploading a CV does not automatically authorise processing or sharing of special-category data or criminal offence information. Separate lawful requirements and conditions apply. Please do not provide unnecessary sensitive information.

6. How Long We Keep Your Data

We retain your personal data only for as long as is necessary for the purpose for which it was collected:

Candidate data - retained for up to 2 years from last meaningful contact, unless you ask us to delete it sooner or give consent to retain it longer
Client data - retained for the duration of our business relationship and for up to 6 years afterwards for contractual and accounting purposes
Website analytics data - retained for up to 26 months
Email marketing data - retained until you unsubscribe
Call recordings and automated transcripts - retained for 90 days by default, unless a longer period is needed for a live complaint, claim or investigation

You may request deletion of your data at any time (see Section 8). We may need to retain proportionate records where required for legal obligations, regulatory compliance, evidence of instructions or consent, or legal claims. We do not retain data indefinitely without a lawful reason.

7. Call Recording and Transcription

Where we record calls or use automated transcription, we do so for a documented purpose such as training, quality and keeping an accurate record of your instructions. We will tell you at the start of a call if it is being recorded or transcribed, and where practical we can offer a non recorded alternative if you prefer. Access to recordings and transcripts is restricted, and we keep the original recording separately from any corrected transcript or summary.

8. Your Rights

Under the UK GDPR, you have the following rights:

Right of access - you may request a copy of the personal data we hold about you
Right to rectification - you may ask us to correct any inaccurate data we hold about you
Right to erasure - you may ask us to delete your personal data ("right to be forgotten")
Right to restrict processing - you may ask us to limit how we use your data
Right to data portability - you may request your data in a structured, commonly used format
Right to object - you may object to our processing of your data based on legitimate interests
Right to withdraw consent - where processing is based on consent, you may withdraw it at any time
Rights relating to automated decision making - where we use automated tools that produce a significant decision about you without meaningful human involvement, you have the right to be informed, to request human intervention, and to challenge the decision

To exercise any of these rights, please contact our data protection lead, Christopher Brain, at chris@connectlegalpartners.co.uk. We will respond without undue delay and normally within one month, subject to extensions or adjustments permitted by applicable law, which we will explain where relevant.

If you are dissatisfied with how we have handled your data, you have the right to lodge a complaint with the Information Commissioner's Office (ICO) at www.ico.org.uk.

9. AI and Automated Decision-Making

We may use approved AI tools to help with parts of our recruitment process, such as drafting candidate summaries. We check the outputs of these tools for accuracy and bias, and a person with the authority to correct them reviews any candidate facing description before it is used or shared. Our default is meaningful human review of decisions that matter to you, such as whether your application proceeds to a client. We do not make significant decisions about candidates using solely automated means without human involvement. If this ever changes for a specific process, we will assess the safeguards required by law, including your right to information, to express your point of view, and to challenge the decision, before that process goes live.

10. Cookies

Our website uses cookies to improve your experience and to help us understand how visitors use our site.

Essential Cookies

These are necessary for the website to function and cannot be switched off. They include cookies for security, form submission, and basic site functionality.

Analytics Cookies

We use Google Analytics to understand how visitors interact with our website. These cookies collect information such as pages visited, time on site, and referral source. This data is aggregated and anonymised. You can opt out of Google Analytics by installing the Google Analytics Opt-Out Browser Add-on.

Marketing Cookies

If installed, the LinkedIn Insight Tag allows us to measure the effectiveness of our LinkedIn presence and may be used for retargeting. This cookie can be managed through your browser settings or LinkedIn privacy settings.

You may manage your cookie preferences at any time using our cookie consent banner or by adjusting your browser settings. For a fuller explanation of which cookies we use and why, see our Cookie Policy.

11. Data Security

We take the security of your personal data seriously. We implement appropriate technical and organisational measures to protect your data against unauthorised access, alteration, disclosure, or destruction. These measures include:

Secure, password-protected systems and devices
Encryption of data in transit (SSL/TLS on our website)
Restricted access to personal data on a need-to-know basis
Regular review of our data handling practices

While we take all reasonable precautions, no method of electronic storage or transmission is 100% secure. We cannot guarantee absolute security of your data.

12. International Data Transfers

Your personal data is primarily processed and stored within the United Kingdom and the European Economic Area. Where we transfer data outside the UK, for example through a cloud based service provider, we first check that a valid transfer route is in place, such as UK adequacy regulations or the UK International Data Transfer Agreement (IDTA) or UK Addendum to the EU Standard Contractual Clauses, together with a transfer risk assessment. Using a supplier's UK facing website or its general encryption claims alone is not enough for us to treat a transfer as compliant, so we check the underlying safeguards directly.

We also recruit for law firms in the United States. If you give us the go ahead to share your details with a US firm, that is a transfer outside the UK and we only make it with a valid transfer route in place, as set out above. If you are based in the United States, this policy applies to you in the same way, and you can contact us at any time to ask what we hold about you, correct it or have it deleted.

13. Third-Party Links

Our website may contain links to third-party websites, including LinkedIn, law firm websites, and other resources. We are not responsible for the privacy practices of these external sites. We encourage you to read the privacy policies of any third-party website you visit.

14. Children's Privacy

Our services are not directed at individuals under the age of 18. We do not knowingly collect personal data from children. If we become aware that we have inadvertently collected data from a child, we will take steps to delete it promptly.

15. Changes to This Policy

We may update this Privacy Policy from time to time. Any changes will be posted on our website with an updated last-updated date. Updates do not retrospectively create consent or expand earlier permissions; we seek fresh permission where the scope of candidate sharing changes. We encourage you to review this policy periodically. Material changes will be communicated directly where appropriate.

16. Contact Us

If you have any questions about this Privacy Policy, wish to exercise your data rights, or have concerns about how your data is being processed, please contact our data protection lead.

Christopher Brain, Connect Legal Partners
Email: chris@connectlegalpartners.co.uk
Phone: 0333 034 7109
Website: www.connectlegalpartners.co.uk

Connect Legal Partners is a trading name of ConnectRecruitmentHub Ltd, company number 15100597, registered in England and Wales.