Privacy Policy

​Fortes People. Data Access and Retention

Fortes People ensures that all our records are readily accessible and only retained for as long as they must be to fulfil the purposes for which they were collected and as may be required by law. At all times, our data policies comply with GDPR and the Conduct Regulations, specifically Regulation 29. Fortes People Group acts as both a Data Processor and a Data Controller at various points in fulfilling our role as a recruitment business and agency.

Types of Data Collected

Fortes People collects many forms of candidate date in order to fulfil it’s function of supplying temporary and permanent staff to organisations.

Data that is collected for temporary candidates are as follows:


Date of Birth,

National Insurance Number,

Citizenship/Right to Work status,

Contact information, including address, phone numbers and email addresses,

Qualifications and Training information,

Working History,

Address history,

References and appraisal records,

Permanent candidates are subject to less stringent data collection, but will still be providing the below information:


National Insurance Number,

Citizenship/Right to Work status,

Contact information, including address, phone numbers and email addresses,

Qualifications and Training information,

Working History

Data Storage

All Fortes People systems are held within a cloud environment hosted on an onsite server. Fortes People employee’s can only access data by logging into the cloud environment using an authorised device. Data cannot be digitally copied from this cloud environment and all access of data is logged.

Candidate data is stored on the network drive within the cloud environment. Special Category data relating to health records and criminal history is stored on a separate drive with access restricted to the Directors and Senior Management.

Candidate contact, address and Right to work information is stored on the database and is accessible by all Fortes People staff, but only via the cloud environment.

Only company issued devices can access the cloud and therefore candidate data. When an employee leaves Fortes People their devices are returned to us and all login information is changed to absolutely ensure that no further access can be made.

Hard copy documents that must be kept are stored in lockable filing cabinets on site by the Fortes People compliance manager. Only the compliance manager and directors have keys to these cabinets. All non-essential hard copy documents will be copied and stored within the cloud environment before the originals are returned to the applicant or shredded using our confidential waste contractor. Consignment and Destruction notices are collected from the confidential waste contractor on a monthly basis.

Ready Access

All data is stored on site at Fortes People offices, either in hard copy filed format, or as soft-copy within the cloud environment. This ensures that any and all candidate data is immediately accessible by authorised personnel when required.

In the instance that a candidate requests copies of the information held by Fortes People, a digital copy can be provided on the same day (if it is a business day), or the next business day where requests are made out of hours.

If hard copy documentation is requested, this can be facilitated and sent on the next business day of a request being made.

Data Retention

Fortes People will only retain candidate data for as long as is necessary to fulfil the purpose for which it was collected and to satisfy any legal, accounting or reporting requirements.

Candidates who do not complete registration with Fortes People and express that they have no further interest in future work with Fortes People will have their personal information deleted. If the candidate does not request that their data is removed, or does not specifically express that they do not wish to work with us, then data will be retained for 3 years from the last point of contact.

Candidate Rights

The following information will be provided to all candidates via email/hard copy application pack regarding their data rights:

You have a number of rights as outlined below. When exercising these rights we will need to validate your identity to ensure the request is from you. This is a security measure to ensure personal data is not disclosed to an unauthorised third party. You may exercise your rights by contacting us via the contact details below.

7.1 Right to be informed

Your ‘Right to be Informed’ encompasses the right to be provided with ‘fair processing information’ to ensure transparency over how your personal data is used. This is included in this Privacy Notice and our Terms and Conditions. The information provided should be:

· concise, transparent, intelligible and easily accessible;

· written in clear and plain language, and

· free of charge.

7.2 Right to Restrict Processing

You have the right to ask us not to process your personal data for e.g. marketing purposes. We will inform you (before collecting your data) if we intend to use your data for such purposes or if we intend to disclose your information to any third party for such purposes. You can exercise your right to prevent such processing by checking certain boxes on the forms we use to collect your data. You can also exercise the right at any time by contacting us.

7.3 Right of Access

You have the right to access the information we hold about you. An access request is free of charge unless considered repetitive or excessive when a small admin charge may be made. A request for access can be made via the contact details below.

7.4 Right of Rectification

You are entitled to have your personal data corrected if it is inaccurate or completed if incomplete. If the personal data in question has been disclosed to third parties, we will inform them of the rectification where possible and confirm with you which third parties the data has been disclosed to.

7.5 Right to Erasure

You have the right to request the deletion of personal data where there is no compelling reason for its continued processing. There are some circumstances where this right may not be met and a request refused e.g. to comply with a legal obligation such as HMRC or framework retention requirements.

7.6 Right to Data Portability

The right to data portability allows you to obtain and reuse your personal data. It allows you to move, copy or transfer personal data easily in a safe and secure way, without hindrance to usability. The right to data portability applies to personal data:

· provided by you;

· where you have provided consent for processing or the processing is for the performance of a contract; and

· when processing is carried out by automated means.

7.7 Right to Object

You have the right to object to processing based on the performance of a task in the public interest or processing based on a legitimate interest e.g. direct marketing. An objection must be based on your particular circumstances and processing must cease unless there are compelling reasons otherwise e.g. defence of a legal claim.

7.8 Rights Relating to Automated Decision Making and Profiling

Data protection legislation provides safeguards for individuals against the risk that a potentially damaging decision is taken solely based on automated processing i.e. without human intervention.

Fortes People employs no fully automated processes that result in particular individuals being impacted


A majority of Fortes Peoples candidate data is processed by way of legitimate interest. However, all candidates are required to give their consent to data processing and sharing with specific third parties (occupational health bodies, training providers and end clients) in order to process their application.

Candidates are required to Opt In to various methods of communication at the point of registration, this covers telephone, post, email and SMS. Mailshot’s are opted in separately.

All consent and communication preferences are recorded in the data base. Consent can be varied or revoked at any time via email and information is included in the email signature of all Fortes People staff as well as in the candidate Handbook.