How Adesto uses the personal data of locum workers and work-seekers.

---

This notice tells you how Adesto Recruitment Limited ("Adesto", "we", "us", "our") collects, uses and protects your personal data when you register with us as a locum worker or work-seeker, and throughout our working relationship with you. It is given to you at the point we collect your data (when you register), and sits alongside our Privacy Policy.

1. Who we are

Adesto Recruitment Limited ([Company registration number — to be confirmed]) is a recruitment business operating under the Employment Agencies Act 1973 and the Conduct of Employment Agencies and Employment Businesses Regulations 2003. We supply temporary healthcare workers to client organisations. For the purposes of data protection law we are a data controller of your personal data.

Our data protection contact: [DPO contact — to be confirmed] — or write to Adesto Recruitment Limited, [Registered office address — to be confirmed].

2. What personal data we collect

We collect and hold the following categories of personal data about you:

• Identity and contact details: name, title, preferred/known-as name, date of birth, home address, email address, telephone number, and your right-to-work status.
• Professional details: job role(s), grade/band, specialism and skills, professional registration number and status (e.g. NMC, GMC, HCPC), qualifications, training certificates and mandatory training records.
• Compliance and vetting: DBS certificate and DBS Update Service status, references, occupational health information, identity documents, and any information needed to verify your identity and right to work in the UK.
• Work-related data: your availability, shift preferences, shifts offered, booked and worked, timesheets, performance feedback, and payment records (including bank details and National Insurance number for PAYE payroll).
• Special category data: where required for your work, we may process special category data such as health information (occupational health / fitness to work) and, where legally permitted, criminal conviction data (via DBS checks).
• Technical data: IP address, device information and login records needed to run the platform, and push-notification subscription details if you use our app.

3. Where we get your data

• Directly from you — when you register, update your profile, upload documents, complete forms, or otherwise contact us.
• From your referees — when we request references with your consent.
• From clients and third parties — for example a client organisation that has invited you to join their bank, or a training provider that issues your certificates.
• From regulatory and vetting bodies — such as the NMC, GMC, HCPC, and the DBS Update Service, when we verify your registrations and checks.

4. How we use your data and the legal bases

Purpose	Legal basis
Setting up and managing your registration and profile	Performance of a contract (with you) / steps taken at your request before entering into a contract
Matching you to shifts and managing bookings, offers and timesheets	Performance of a contract / legitimate interests (operating our recruitment business)
Verifying identity, right to work, professional registration and compliance (including DBS checks)	Legal obligation / substantial public interest (employment & social security / safeguarding)
Processing PAYE payroll and payments	Performance of a contract / legal obligation (tax and employment law)
Communicating with you about shifts, compliance and system updates	Performance of a contract / legitimate interests / consent (where required)
Keeping records for audit, quality and safeguarding purposes	Legitimate interests / legal obligation

Where we rely on consent (for example, for marketing communications or contacting referees), you can withdraw it at any time by updating your notification settings or contacting us.

5. Who we share your data with

We share your personal data only where necessary to provide our services or where the law requires it:

• Client organisations — to arrange and confirm your shifts, verify your compliance, and process timesheets. We share only the information relevant to that placement.
• Regulatory and vetting bodies — the NMC, GMC, HCPC, DBS Update Service and similar, to verify registrations and checks.
• Training providers — such as Health & Safety Group and Train Healthcare, to verify and sync your training records.
• Payroll and payment providers — to pay you under PAYE (bank, payroll and tax/National Insurance processing).
• IT and platform suppliers — our hosting, email and cloud storage providers who process data on our behalf (see the sub-processor list).
• Authorities and regulators — where we have a legal obligation to do so (e.g. HMRC, the ICO, the CQC, or the police).

We never sell your personal data.

6. How long we keep your data

We keep your personal data only for as long as necessary for the purposes set out above. In particular: while you are an active member of our bank we keep your records for the duration of your relationship with us; after you leave, we keep the minimum required to meet our legal and tax obligations (up to six years) and to maintain audit records for compliance and safeguarding. See our Privacy Policy for the full retention schedule.

7. Your rights

Under the UK GDPR you have the right to:

• access a copy of the personal data we hold about you;
• ask us to correct inaccurate or incomplete data;
• ask us to erase your data (subject to legal obligations);
• ask us to restrict or object to certain processing;
• receive your data in a portable format; and
• withdraw consent at any time where we rely on it.

To exercise any of these rights, contact our data protection contact at [DPO contact — to be confirmed]. We will respond within one calendar month. You also have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk (0303 123 1113).

8. Our legal and regulatory obligations

As a recruitment business supplying healthcare workers we comply with the Employment Agencies Act 1973, the Conduct of Employment Agencies and Employment Businesses Regulations 2003, the Agency Workers Regulations 2010, the Working Time Regulations 1998, and applicable care-sector law. These obligations require us to collect and verify the information described above. See our CARE Regs compliance terms for more detail.

9. Contact

Questions about this notice? Contact us at [email protected], or write to Adesto Recruitment Limited, [Registered office address — to be confirmed].

---