Privacy Policy — Milton Contracts Ltd

Milton Contracts Ltd ("we", "us", "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, store and disclose your personal data and your rights in relation to that data, in accordance with the UK General Data Protection Regulation ("UK GDPR") and the Data Protection Act 2018.

At a glance: We are the data controller for the personal data we hold about you. We collect data to help you find a job, to help our clients hire, and to run our business. We never sell your data. You have rights, and you can contact us any time.

1. Who We Are

Milton Contracts Ltd, registered in England & Wales (company number 14082971), is the data controller responsible for your personal data. Our contact details are:

Milton Contracts Ltd
The Willows, Stroude Road, Egham, England, TW20 9UW
Email: dpo@miltoncontracts.co.uk
Phone: 01784 618017

We are registered with the UK Information Commissioner's Office under registration number ZA547821.

2. The Data We Collect

2.1 If you are a candidate

Identity data: name, title, date of birth, gender, nationality
Contact data: address, email, phone number
Employment data: CV, work history, qualifications, professional memberships, references
Right-to-work data: passport, visa, share code, biometric residence permit (where applicable)
Financial data: bank account details (for contractor payments), national insurance number, tax code
Special category data (only where strictly necessary): health information for reasonable adjustments, criminal record information for vetted roles, equality monitoring data on a voluntary basis
Communications: records of conversations, emails, interview feedback

2.2 If you are a client contact

Name, job title, employer, business contact details
Records of communications and meetings
Information about your hiring requirements
Marketing preferences

2.3 If you visit our Site

Technical data (IP address, browser type, device type)
Usage data (pages visited, time on site, referring URL)
Cookie data (see Cookies Policy below)

3. How We Use Your Data & Lawful Basis

Purpose	Lawful Basis
Matching candidates to suitable roles and introducing them to clients	Legitimate interest / contract performance
Fulfilling contractual obligations to candidates and clients	Contract performance
Verifying right to work and conducting compliance checks	Legal obligation
Processing payments to contractors and managing umbrella relationships	Contract performance / legal obligation
Sending job alerts and marketing communications you have opted into	Consent
Improving our services, training staff and managing our business	Legitimate interest
Complying with HMRC, financial reporting and audit obligations	Legal obligation
Defending or pursuing legal claims	Legitimate interest

4. Who We Share Your Data With

We share your personal data only where necessary and with appropriate safeguards. Recipients may include:

Prospective employers (clients) — where we believe your profile matches a role and (in the case of permanent roles) you have given consent
Reference providers — where references are requested as part of an offer process
Background screening providers — for DBS, BPSS, SC, DV and other vetting processes
Umbrella companies and accountancy partners — for compliant contractor payment
HMRC — for PAYE and intermediaries reporting obligations
IT service providers — for hosting, CRM, email and security services (all bound by data processing agreements)
Professional advisers — lawyers, auditors and insurers as required
Regulators and law enforcement — where legally required

We do not sell your personal data to third parties for marketing purposes. Ever.

5. International Transfers

The majority of our data processing takes place within the UK and European Economic Area. Where we transfer personal data outside the UK (for example, to a cloud provider with US-based infrastructure), we ensure that the transfer is made under an appropriate safeguard such as the UK International Data Transfer Agreement, the EU Standard Contractual Clauses with the UK Addendum, or to a country recognised by the UK Government as providing adequate protection.

6. How Long We Keep Your Data

Type of Data	Retention Period
Active candidate records	Duration of engagement plus 5 years
Inactive candidate records (no contact for 24 months)	Deleted after 36 months unless you ask us to retain them
Placed candidate records (permanent)	6 years from last placement
Contractor payroll & tax records	6 years from end of engagement (HMRC requirement)
Right-to-work documentation	2 years from end of engagement (Home Office requirement)
Client contracts and invoices	7 years (for tax and contractual purposes)
Marketing preferences and consent records	Until withdrawn plus 2 years
Website analytics	26 months

7. Your Rights

Under UK GDPR you have the following rights:

Right of access: request a copy of the personal data we hold about you
Right to rectification: ask us to correct inaccurate or incomplete data
Right to erasure: ask us to delete your data ("right to be forgotten") in certain circumstances
Right to restriction: ask us to limit how we use your data
Right to portability: receive your data in a structured, machine-readable format
Right to object: object to processing based on our legitimate interests, or to direct marketing
Right to withdraw consent: where processing is based on consent
Rights related to automated decision-making: we do not currently make decisions about you using purely automated means

To exercise any of these rights, please email dpo@miltoncontracts.co.uk. We will respond within one calendar month.

8. How We Protect Your Data

We take information security seriously. Our measures include:

Encryption of data in transit (TLS 1.2+) and at rest
Multi-factor authentication on all internal systems
Role-based access controls — staff see only what they need
Regular penetration testing and security reviews
Annual mandatory data protection training for all staff
Documented breach response procedures

If we become aware of a personal data breach which is likely to result in a risk to your rights and freedoms, we will notify the Information Commissioner's Office within 72 hours and you without undue delay.

9. Complaints

If you are unhappy with how we have handled your personal data, please contact us first at dpo@miltoncontracts.co.uk so we can try to resolve the issue. You also have the right to complain to the UK Information Commissioner's Office:

Information Commissioner's Office
Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF
Telephone: 0303 123 1113
Website: ico.org.uk

Cookies Policy

This section explains what cookies we use on our Site and how you can control them.

What are cookies?

Cookies are small text files placed on your device when you visit a website. They allow the site to recognise your device and remember information about your visit (such as your preferences, login details and browsing actions).

Cookies we use

Cookie	Type	Purpose	Duration
`milton_session`	Strictly necessary	Maintains your session for forms and account areas	Session
`cookie_consent`	Strictly necessary	Remembers your cookie preferences	12 months
`_ga`, `_ga_*`	Analytics	Google Analytics 4 — anonymised website usage statistics	13 months
`li_at`	Marketing (optional)	LinkedIn Insight Tag — measures effectiveness of LinkedIn job campaigns	12 months
`fr`	Marketing (optional)	Meta Pixel — measures effectiveness of social campaigns	3 months

Managing cookies

You can manage your cookie preferences at any time by clicking "Cookie Settings" in the footer, or by adjusting your browser settings. Most browsers allow you to refuse or delete cookies — see aboutcookies.org for guidance. Please note that disabling certain cookies may affect the functionality of the Site.

Changes to This Policy

We may update this Privacy & Cookies Policy from time to time. The current version will always be available on this page with the effective date stated at the top. Material changes will be communicated to registered candidates and clients by email.