Privacy policy for candidates and contractors

Who we are

‍Brio Digital Ltd is a recruitment agency and employment business registered in England and Wales (company no. 13034664). We are registered with the Information Commissioner's Office (registration ZB143399).

We are a data controller for the information described in this notice. That means we decide what information to collect about you and why, and you can exercise your data protection rights directly with us. We are not simply handling your information on behalf of our clients.

Our data protection lead is the Director, Robert Foley. You can contact us at compliance@briodigital.io about anything in this notice.

Who this notice is for ‍

This notice applies to everyone we deal with as a work seeker. That includes people who apply for or are approached about permanent roles, contractors working through their own limited company, and contractors working through an umbrella company. If you supply your services through a company, this notice covers your own personal information.

What we collect, and where we get it

Depending on the role and how far the process goes, we collect:

• Your name, contact details and, where needed for checks, your date of birth.
• Your CV and career information: work history, qualifications, professional memberships, skills and certifications.
• The outcome of right to work and identity checks, which we are required by law to carry out. The checks themselves, including your passport, visa or share code, are carried out on our behalf by our screening provider, PeopleCheck.
• Information about the roles you apply for: interview feedback, availability, rate or salary expectations and notice period.
• Where we tell you in advance, a recording and transcript of your interview with us, and an AI assisted score and short summary of that interview (explained below).
• For placements: assignment records, timesheets, your umbrella or limited company details, and the invoices we receive and pay. We pay invoices to your limited company or umbrella company. We do not run payroll for contractors and we do not request, view or keep your payslips.
• Where a role legally requires screening, the outcome of that screening.
• Our communications with you, including emails, messages and, where applicable, recorded telephone calls.
  

We collect most of this from you. We also obtain information from job boards and application platforms, LinkedIn, professional sourcing tools, referrals from people who know you, referees you nominate, our clients, umbrella companies, and our screening provider.

If we obtain your information from somewhere other than you, we will send you this notice within one month of obtaining it, or sooner if we contact you or pass your details to a client before then.

Why we use it, and our legal basis

Where we rely on legitimate interests, we have assessed and documented the balance between our interests and your rights. You can ask us for a summary of that assessment.

Screening and criminal records ‍

We only arrange screening where a role legally requires it, or where a significant and particular risk justifies it. We do not screen as a matter of routine.

We do not carry out screening ourselves. Right to work, identity and screening checks are carried out on our behalf by PeopleCheck, a specialist screening provider, under a written agreement that requires it to keep your information secure, to use it only for that check, and to act on our instructions. PeopleCheck deletes the underlying documents after 12 months. We keep the record of each check (the outcome, the method and the date) for the length of your engagement plus two years, as the Home Office expects. We do not pass criminal records information to clients or to other employers.

We keep information about your health only where we need it to make reasonable adjustments during the process or to administer statutory entitlements. ‍

Contractors, umbrella companies and supply chain checks ‍

This section applies if you work through an umbrella company or your own limited company.

Since April 2026, where an umbrella company sits in the chain below us, we can be held liable for income tax and National Insurance that the umbrella fails to pay. We therefore only work with umbrella companies that are certified by SafeRec, an independent compliance auditor. SafeRec audits the umbrella company's payroll and HMRC submissions under its own arrangements with the umbrella company.

We do not ask for, view or keep your payslips, and we do not send your information to SafeRec. Each umbrella company sends us a monthly SafeRec audit report that shows only whether the umbrella has passed or failed its audit. It does not contain your individual pay details. We also check each umbrella's Companies House record, VAT registration and insurance.

If you have a concern about deductions from your pay, please tell us and we will raise it with the umbrella company.

Separately, you should receive a Key Information Document before you agree terms, setting out your rate, any deductions, umbrella fees and a worked example of your pay.

Who we share it with

• Clients, only in the course of representing you for a specific role. We send your details in anonymised form unless you have agreed that we may identify you for that role.
• Umbrella companies, where you are paid through one.
• PeopleCheck, our screening provider, for right to work, identity and screening checks.
• HMRC or other public authorities, where the law requires us to share information.
• Our software and IT suppliers, who handle information on our behalf under contract, including our recruitment database, our telephony provider (Ringover, which records and transcribes calls and interviews), our finance system and our productivity and storage provider (Google Workspace, including Google Meet recording and transcription).
• Our AI assistant provider, Anthropic, which provides the Claude service we use to help summarise and prepare candidate information and to help assess interviews. Anthropic acts only on our instructions under a data processing agreement.
• Professional advisers, insurers and auditors, where necessary.
  

We do not sell your information, and we do not share it with clients or anyone else for their own marketing. We do not send interview recordings, transcripts or AI scores to clients.

We may not be able to tell you the identity of a client at the very start of a conversation, but we will tell you as soon as we reasonably can, and always before we send your details to them in a form that identifies you.

Automated decisions and AI tools

We use software to search, sort and match records. We do not make decisions that significantly affect you by automated means alone. Where a tool ranks or filters candidates, a person at Brio reviews the result before any decision is made, and that review is a real one.

We also use an AI assistant, Claude, provided by Anthropic, to help our consultants work more efficiently. For example, we may use it to summarise or reformat your CV, compare your experience with a job description, or draft messages and submissions. In particular:

• We use Claude on a business account. Anthropic processes your information only to provide the service to us, under a data processing agreement, and does not use it to train its AI models.
• A consultant checks everything Claude produces before it is used, including checking any summary of your CV against your original CV for accuracy before it is sent to a client.
• Claude does not decide whether you are shortlisted, put forward or rejected; a person at Brio makes that decision.
• We do not upload health information, criminal records, identity documents or other sensitive documents to Claude, and we only use the information needed for the task. If you mention something sensitive during an interview, such as your health, it may appear in the transcript that Claude reads. Claude is instructed not to take it into account or include it in any score or summary.
  

Interview recording, transcription and AI assisted assessment

For some roles, we record and transcribe your interview with us (using Ringover for phone interviews, or Google Meet for video interviews) and use Claude to help a consultant assess it. This is how it works:

• We will tell you before the interview, and again at the start, that it will be recorded, transcribed and assessed with AI help. You can say no, before or during the interview, and we will interview you without recording or AI assessment. This will not affect how we treat you.
• Claude reads the transcript and produces a score and a short summary against the requirements of the role. The score is a guide only.
• A consultant reviews every score and summary and makes the decision about whether to put you forward. Claude never rejects a candidate, and no decision is made on the score alone.
• We keep the score and summary, not the transcript. Recordings and transcripts are deleted from Ringover and Google Workspace within 30 days of the interview, unless needed for a live complaint or dispute.
• If you need an adjustment, for example because of a disability, speech difference or because English is not your first language, please tell us and we can assess you without AI, or adjust the process.
• You can ask to see your score and summary, put your view to us, ask for a different consultant to reassess you, or challenge the outcome, by emailing compliance@briodigital.io.
  

We do not allow our suppliers to guess or infer your ethnicity, gender or any other characteristic from your name or anything else. If you think a decision about you was made automatically, you can ask for a person to look at it, put your view to us, challenge the decision and ask us to explain it. You can also object to us using AI tools to process your information, or ask to see what we have sent to a client about you, by emailing compliance@briodigital.io.

Call and interview recording

Where we record telephone calls, we will tell you at the start of the call that it is being recorded and why. We do not record every call. Recordings are kept for six months and then deleted, unless needed for a live dispute, and you can ask for a copy of any recording of you. Interview recordings and transcripts used for AI assisted assessment are kept for a shorter period, as explained above.

Where we keep it, and for how long

We store your information in the UK or the European Economic Area wherever we can. Where a supplier is part of a group based elsewhere, we only transfer information under a safeguard recognised by UK law, and we assess the risk of doing so where we are required to.

Anthropic, our AI assistant provider, processes information mainly in the United States. That transfer is protected by the UK International Data Transfer Addendum to the EU Standard Contractual Clauses, which is a safeguard approved under UK law. You can ask us for more information about this safeguard.

We keep your information only as long as we need it. The main periods are:

Full details are in our Data Retention Schedule, available on request. Some records must be kept for longer because employment, tax and recruitment law requires it, or because a legal claim is in progress. We do not keep information just in case, and we do not restart the clock simply because your record has been opened.

If you ask us to delete your information, we will ask whether you want it removed completely, or whether you would prefer we keep your name on a list of people not to contact. If we delete you completely we will hold no record of you at all, so if we later obtain your details from another lawful source we may contact you again.

Your rights

You have the right to:

• be told how we use your information (this notice);
• ask for a copy of the information we hold about you;
• have inaccurate information corrected;
• ask us to delete your information;
• ask us to restrict how we use it;
• object to our use of it, including to any profiling;
• receive certain information in a portable format;
• withdraw any consent you have given, at any time; and
• not be subject to a significant decision made by automated means alone.

If you ask us to stop marketing to you, we will act on that immediately and without exception. To exercise any of these rights, email compliance@briodigital.io. We will respond within one calendar month. That month starts when we receive your request or, if later, when we have confirmed your identity, received authority from you where someone is acting on your behalf, or received any fee we are entitled to charge. If your request is complex, or you have made several, we may take up to two months longer and we will tell you within the first month if we do. If we need to check what you are asking for, the time limit pauses until you reply. We will never ask you to narrow your request, only to clarify it.

Complaints

If you are unhappy with how we have handled your information, please tell us so we can put it right. You can complain by emailing compliance@briodigital.io. We will acknowledge your complaint within 30 days and tell you the outcome without undue delay.

You can also complain to the Information Commissioner's Office on 0303 123 1113 or at ico.org.uk/make-a-complaint. You do not have to complain to us first, although the ICO will normally expect you to have done so.

‍Changes to this notice

‍We review this notice at least once a year, and whenever the law or the way we work changes. The date at the top shows when it was last updated. Where a change materially affects how we use your information, we will tell you directly.