Privacy policy

This policy was last updated on 20.11.2025.

This privacy policy explains how Thomas Brown Recruitment Ltd collects, uses and protects personal data when you visit our website or submit information in connection with job opportunities. We are committed to handling all personal data in line with UK GDPR and the Data Protection Act 2018.

Who we are

Thomas Brown Recruitment Ltd is the data controller for the personal data we process. Our registered office is provided on request. You can contact us with any data protection queries at info@thomasbrown.co.uk. Our director, Michele Thomas, acts as our data protection lead.

The data we collect

We collect personal data when you interact with our website or apply for a role. This may include:

first name and last name
email address
mobile number
job preferences
link to your CV
information contained within your CV
any additional information you choose to provide

We also collect technical and usage data through Google Analytics 4, including IP address, device information and browsing behaviour.

How we collect personal data

We collect data through the following methods:

forms and modals on our website
referrals submitted through our referral system
analytics tools such as GA4

How we use your personal data

We process personal data for the following purposes:

identifying suitable job opportunities
reviewing CVs and assessing candidate suitability
contacting you about roles, updates or queries
sharing limited job information with candidates
operating, improving and analysing our website
complying with legal obligations

Our legal basis for processing

We rely on the following lawful bases under the UK GDPR:

consent, for marketing communications and optional form fields
contract, when processing data in relation to job applications
legitimate interests, for recruitment operations, improving our website and communicating with you where appropriate

Sharing your personal data

We may share your personal data with:

clients in the EMEA region when progressing your application
HubSpot, our CRM provider
Make.com, which handles the transfer of Webflow form submissions into HubSpot
Webflow, which hosts our website
service providers who support our operations, for example analytics or cookie management tools

We only share the minimum data necessary and ensure that all third parties process personal data in accordance with UK GDPR.

International transfers

Some of our service providers may process personal data outside the UK or EEA. When this occurs, we ensure appropriate safeguards are in place, such as adequacy decisions or standard contractual clauses.

Data retention

We retain personal data only for as long as necessary for recruitment and operational purposes. If you apply for a role, we may retain your data for up to two years in line with industry practice unless you request deletion sooner.

Your rights

You have the following rights under UK GDPR:

access to your personal data
correction of inaccurate data
erasure of your data
restriction of processing
data portability
objection to processing based on legitimate interests
withdrawal of consent at any time

To exercise your rights, contact us at info@thomasbrown.co.uk.

Cookies and tracking

We use cookies for essential, analytics and marketing purposes. Our cookie consent tool, provided by Finsweet, allows you to manage your preferences. Full details are available in our cookies policy.

Security

We implement appropriate technical and organisational measures to protect personal data, including secure transmission of form submissions and access controls within our systems.

Changes to this policy

We may update this privacy policy from time to time. Any changes will be published on this page.

If you have any questions about this policy, contact us at info@thomasbrown.co.uk.