Privacy Policy

Last updated: 5th October 2026

This Privacy Policy explains how we collect, use, store, and protect personal data when providing background screening consultancy and advisory services. We are committed to maintaining the highest standards of privacy, confidentiality, and data protection in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

We operate exclusively as an advisory consultancy. We do not conduct background checks, do not process candidate data, and do not act as a data controller or processor for any screening‑related personal data. Any candidate information used within advisory engagements remains under the full control and responsibility of the client.

1. Who We Are

We are the data controller for the personal data we collect in the course of providing consultancy services.

Organisation Name: Rob Allinson Consulting

 Registered Address: 64 Greenfields Avenue, Alton, Hampshire, GU34 2EW

Contact Email: rob@roballinson.co.uk

 

2. Personal Data We Collect

We only collect personal data necessary for delivering consultancy services and managing client relationships. This may include:

Client and Business Contact Information

  • Name

  • Job title

  • Organisation

  • Email address

  • Telephone number

 

Information Provided During Consultancy Engagements

  • Background screening policies

  • Process documentation

  • Audit evidence

  • Vendor performance information

  • Role‑based risk frameworks

These materials may reference candidate‑related processes, but we require clients to ensure that any documents shared with us are anonymised or appropriately redacted.

Website and Technical Data

  • IP address

  • Browser type

  • Usage analytics

  • Cookie preferences

We do not intentionally collect or process special category data or criminal record information.

3. What We Do Not Collect

To avoid any ambiguity:

We do not collect, process, store, or access candidate personal data, criminal record information, identity documents, right‑to‑work evidence, or any data used for background checks.

Clients remain fully responsible for any candidate data they hold or share.

4. Lawful Basis for Processing

We process personal data under the following lawful bases:

Contract

To deliver consultancy services, respond to enquiries, and manage client engagements.

Legitimate Interests

To maintain business relationships, improve our services, and operate our website securely and effectively.

Legal Obligation

For financial record‑keeping, invoicing, and compliance with statutory requirements.

We do not rely on consent for core service delivery.

5. How We Use Personal Data

We use personal data to:

  • Provide background screening consultancy and advisory services

  • Communicate with clients regarding projects, proposals, and service updates

  • Review client policies, processes, and documentation

  • Deliver audits, assessments, and recommendations

  • Manage contracts, billing, and financial administration

  • Improve our services and website functionality

We do not use personal data for marketing without explicit opt‑in consent.

6. Sharing of Personal Data

We only share personal data with:

  • IT service providers (email, cloud storage, CRM systems)

  • Professional advisers (legal, accounting)

  • Regulatory authorities where legally required

We do not share personal data with background screening vendors, data brokers, or any third parties involved in candidate vetting.

7. International Data Transfers

We do not transfer data outside of the UK, all technology providers host data exclusively in the UK, unless we receive explicit written authorisation from clients. In such cases we ensure that we have the appropriate safeguards in place, including, but not limited to:

  • UK International Data Transfer Agreement (IDTA)

  • Standard Contractual Clauses (SCCs)

  • Adequacy decisions

We only work with reputable providers who meet UK GDPR standards.

8. Data Retention

We retain personal data only for as long as necessary:

  • Client engagement records: typically 6 years

  • Email correspondence: 2–6 years, depending on relevance

  • Website analytics: 12–24 months

We do not retain candidate data because we do not process it.

9. Data Security

We implement robust technical and organisational measures, including:

  • Encrypted storage and secure cloud environments

  • Access controls and role‑based permissions

  • Multi‑factor authentication

  • Regular security reviews

  • Vendor due diligence

We take all reasonable steps to protect personal data from unauthorised access, loss, or misuse.

10. Your Rights

Under UK GDPR, individuals have the right to:

  • Access their personal data

  • Request correction of inaccurate data

  • Request deletion (where applicable)

  • Restrict or object to processing

  • Request data portability

  • Lodge a complaint with the Information Commissioner’s Office (ICO)

Requests can be submitted to: rob@roballinson.co.uk

11. Cookies and Website Tracking

If our website uses cookies or analytics tools, we provide a separate Cookie Notice explaining:

  • Types of cookies used

  • Purposes (e.g., analytics, performance)

  • How users can manage preferences

12. Advisory Engagement Clarification

To ensure transparency:

During consultancy engagements, we may review anonymised or redacted candidate‑related documents provided by clients. We do not act as a data controller or processor for candidate data. Clients are responsible for ensuring any data shared with us is lawful, compliant, and appropriately minimised.

13. Changes to This Privacy Policy

We may update this Privacy Policy periodically to reflect changes in legislation, best practice, or our services. The latest version will always be available on our website.

14. Contact Us

If you have any questions about this Privacy Policy or how we handle personal data, please contact:

Email: rob@roballinson.co.uk