Privacy Policy


Grafton Haymes Consulting Ltd (“Grafton Haymes”) is committed to protecting the privacy of our candidates, clients and users of our website. When you use Grafton Haymes, you trust us with your information and we are committed to preserving that trust and providing a safe and secure user experience. We will ensure that the information you submit to us via our website or through any of our offices is only used for the purposes set out in this Data Privacy Notice.

The General Data Protection Regulation (GDPR) (Regulation (EU) 2016/679) replaces the Data Protection Regulation (Directive 95/46/EC) from 25 May 2018. The Regulation aims to harmonise data protection legislation across EU member states, enhancing privacy rights for individuals and providing a strict framework within which commercial organisations can legally operate.

Your new rights under the GDPR are set out in this notice but will only apply once the GDPR becomes law on 25th May 2018.

Please read the following carefully to understand our views and practices regarding your personal data and how we will manage it.

Who Controls Your Personal Data

The Data Controller is Grafton Haymes Consulting Ltd (“Grafton Haymes”) a company registered in the UK: Company Number 6884346
Address: 2-6 Boundary Row, London, SE1 8HP
Telephone: 0207 199 7500

What Personal Data Do We Collect

Candidate data:

As a Candidate you have the option of submitting your CV online for a specific vacancy, general registration or if you have registered for job alerts. In order to ensure the best levels of customer service and to provide you with the best possible employment opportunities, we may ask for details that will genuinely help us to help you. For example, name, contact details, education details, employment history, immigration status and any other relevant information that you may choose to share with us. In some situations, we may be required to carry out financial background checks, reference checks or the request details of a referee.

Such information is accepted on the following basis: You undertake to guarantee that the information you provide is complete, true and accurate in all respects.

Client data:

If you are a Client of Grafton Haymes, we may need to collect and use information about you or individuals at your organisation in order to find Candidates who are the right fit for you or your organisation.

Supplier data:

To ensure that our processes run smoothly, we only require a small amount of data from our Suppliers, such as the contact details of relevant individuals within your organisation so that we can communicate with you. We may also need additional information such as bank details so that we can pay for the provided services (if this is a part of the contractual arrangement between us). We may also hold information that a person within your organisation has chosen to disclose to Grafton Haymes.

People whose data we receive from Candidates/Clients such as Referees:

In order to provide candidates with suitable employment opportunities, safely and securely, we may need some basic background information from their Referees. We only ask for very basic contact details (such as name, email and telephone number) so that we can get in touch with you for a reference.

How Do We Collect Personal Data

Candidate data:

The two ways in which we collect your personal data are as follows:

Directly from you-
• Emailing your CV to Grafton Haymes or to a Grafton Haymes employee or being interviewed by a Consultant via telephone or in person.
• Applying for a job via the Grafton Haymes website or via our third-party sources.
• Leaving a hard copy of your CV with Grafton Haymes.

From third parties-
• Clients may share personal information
• Your Referees may disclose personal information from you
• Personal information may be obtained from sources such as LinkedIn and job sites to which you subscribe, or through which you apply for jobs
• Social Media (Twitter, Facebook etc.)
• Through referrals from an external source, or through the Grafton Haymes Referral Scheme.

Client data:

In order to make sure that we achieve our goal of having the best Candidates for your organisation, we collect your personal data in two ways:

Directly from you-
• When you contact Grafton Haymes proactively, usually via telephone or email
• When a Grafton Haymes employee contacts you either via phone, email or in person

From third parties (e.g. our Candidates or online/offline media)-
• From third party market research and individuals/companies in Grafton Haymes’ network
• Search engines, social media, online networking sites such as LinkedIn
• Delegate lists at relevant events

Supplier data:

• We collect personal data during the course of working with you.
• People whose data we receive from Candidates/Clients such as Referees:
• We only collect personal data when a Candidate provides it in order for you to serve as a Referee.

Who We Share Your Data With

Candidate data:

We may share your information with various parties in various ways. Primarily, we will share your information with prospective employers to increase your chances of securing a job. Grafton Haymes will never disclose personal information without your permission and will only use your personal data as outlined in this privacy policy.

Client data:

Grafton Haymes will only share your data, when instructed by the Client, to ensure that we are able to provide you with a suitable shortlist of Candidates.

Supplier data:

Unless you specify otherwise, we may share your information with associated third parties such as our service providers and organisations to whom we provide services.

Why We Process Your Personal Data

As a recruitment business, our legal basis for the processing of personal data is our legitimate business interests, although we also rely on contract, legal obligation and consent for specific uses of data.

Grafton Haymes introduce candidates to clients for permanent employment, fixed-term contract and temporary worker placements or independent professional contracts. The exchange of personal data of our candidates and our client contacts is a fundamental and essential part of this process.

In order to support our candidates’ career aspirations and our clients’ recruitment needs Grafton Haymes require a database of candidate and client personal data containing historical information as well as current resourcing requirements.

To maintain, expand and develop our business, Grafton Haymes need to record the personal data of prospective candidates and client contacts.

Retention Of Your Data

Grafton Haymes will retain your personal data for as long as deemed necessary in order to provide the recruitment service to you and for the purposes of satisfying any legal, accounting, regulatory or reporting requirements

Grafton Haymes do the following to try to ensure our data is accurate:

• prior to making an introduction Grafton Haymes check that we have accurate information about you
• Grafton Haymes keep in touch with you, so you can let us know of changes to your personal data
• Grafton Haymes make use of external websites (e.g. LinkedIn, Reed, TotalJobs) to verify the information about you.

The criteria used to determine whether Grafton Haymes should retain your personal data includes:

• the nature of the personal data
• its perceived accuracy
• our legal obligations
• whether Grafton Haymes have been active with you as part of our general recruitment service (e.g. discussing roles with you, arranging interviews or placing you in a new role)
• our recruitment expertise and knowledge of the industry by country, sector and job role

Grafton Haymes may archive part or all of your personal data or retain it on our financial systems only, deleting all or part of it from our systems.


With your consent, cookies are used to remember your login when you visit our website. We also use cookies to ensure you get the best possible experience when using our website and to improve our website. Grafton Haymes also uses the information from cookies to ensure we present you with the best options tailored to your preferences on your next visit to our website.

Where Your Data Is Stored And Its Security

Grafton Haymes will ensure, in so far as is reasonably practicable, that our systems and records are secure and not accessible to unauthorised third parties in line with contemporary practice.

Once we have your personal information, it is stored on our online system (cloud based) which can only be securely accessed by employees of Grafton Haymes. We may also gather information and statistics collectively about visitors to our website.

All of our internal systems are password and firewall protected and can only be accessed by employees of Grafton Haymes, or suppliers of the business.

Transfer Of Your Personal Data

Grafton Haymes may transfer data to countries or international organisations outside of the European Economic Area (EEA). For example, to Clients, Candidates, or third parties who provide support services to us. Where information is to be so transferred, it may be to a country in respect of which there is an adequacy decision from the EU Commission. However, if this is not the case, it is our policy to take steps to identify risks and in so far as is reasonably practicable, ensure that appropriate safeguards are in place.

In the event of a sale, merger, liquidation, receivership or the transfer of all or part of our assets to a third party, we may need to transfer your information to a third party. Any transfer will be subject to the agreement of the third party to this Privacy Notice and any processing being only in accordance with this Privacy Notice.

Consent To Processing Your Data

We may process your personal data on the basis that you have consented to us doing so for a specific purpose. For example, if you have provided your contact details in order that we may use these to provide you with details of our additional services, you may have consented to our processing of the data for that purpose. In other cases, you may have provided your written or verbal consent to the use of your data for a specific reason, for example for requesting references from you.

You may withdraw your consent to our processing of your personal data for a particular purpose at any stage. Please see the section below, ‘Your Rights’. However, please note that we may continue to retain, or otherwise use your personal information thereafter where we have a legitimate interest or a legal or contractual obligation to do so.

Our processing in that respect will be limited to what is necessary in furtherance of those interests or obligations. Withdrawal of consent will not have any effect on the lawfulness of any processing based on consent before its withdrawal.

Your Rights

• Request correction of the personal information that Grafton Haymes hold about you. This enables you to have any incomplete or inaccurate information Grafton Haymes hold about you corrected
• Request erasure of your personal information. This enables you to ask us to delete or remove personal information where there is no good reason for us continuing to process it. You also have the right to ask us to delete or remove your personal information where you have exercised your right to object to processing (see below)
• Object to processing of your personal information where Grafton Haymes are relying on a legitimate interest (or those of a third party) and there is something about your particular situation which makes you want to object to processing on this ground.
• You also have the right to object where Grafton Haymes are processing your personal information for direct marketing purposes
• Request the restriction of processing of your personal information. This enables you to ask us to suspend the processing of personal information about you, for example if you want us to establish its accuracy or the reason for processing it
• Request the transfer of your personal information to another party in certain formats, if practicable
• Make a complaint to a supervisory body which in the United Kingdom is the Information Commissioner’s Office. The ICO can be contacted through this link:

Changes To Our Privacy Notice

Any changes Grafton Haymes make to our privacy notice in the future will be posted on this page and, where appropriate, notified to you by e-mail. Please check back frequently to see any updates or changes to our privacy notice.

Contact And Access To Information

The Data Protection Act 1998 and the GDPR give you the right to access information held about you. Grafton Haymes also invites you to contact us to ensure your data is accurate and complete.

Questions, comments and requests regarding this Privacy Notice should be addressed to Paul Grafton, The Data Protection Manager, Grafton Haymes Consulting Ltd, 2-6 Boundary Row, London, SE1 8HP or via email to

Recruitment Consultancy for HR Professionals
Call us now 020 7199 7500
Subscribe to our job listings