Summary
A quick overview of how Palm uses personal data. Full detail is set out in the numbered sections below.
- Who we are: Palm Outsourcing Ltd, a UK staffing and contracting company, and the controller for its own recruitment and contracting.
- Who this is for: mainly candidates and the contractors we place ("Resources"), plus our client contacts and referees.
- What we collect: contact details, CV and work history, interview and assessment results, identity and right-to-work checks, readiness checks, and contract and payment details for placed Resources.
- Why we use it: to source, assess, place and manage contractors, run pre-start checks, handle payments, and meet our legal duties.
- Who we share it with: clients (each of us acting as a separate, independent controller) and service providers who help us operate. We do not sell your data.
- Where your data is handled: Your data is held by Palm, a UK company. Some data may be accessed or processed outside the UK, with appropriate security and contractual safeguards in place.
- How long we keep it: only as long as we need it for those purposes and to meet our legal duties.
- Your rights: you can ask to access, correct or delete your data, or object to how we use it, and you can complain to the ICO.
- Contact: support@palmoutsourcing.com (subject: "Privacy")
1. Introduction
This Privacy Notice explains how Palm Outsourcing Ltd ("Palm", "we", "us") collects and uses personal data, and the rights you have over it. It is written for the people whose personal data we hold.
Palm provides staffing and contracting services. We source, assess and place contractors ("Resources") with clients, and we hold the contracts on both sides — with the Resource and with the client. This notice sits alongside our Data Protection Policy and Information Security Policy.
2. Who this notice applies to
This notice applies to:
- Candidates and applicants — people we consider for roles
- Resources — contractors we place with clients
- Client contacts — staff at our client organisations
- Referees and others whose details are shared with us during recruitment
3. Our role: controller, and data sharing with clients
As a controller. For our own recruitment, assessment, contracting and business operations, Palm decides how and why personal data is used. Here Palm is the controller and this notice applies in full.
Sharing data with clients. When we share a candidate's or Resource's personal data with a client, Palm and the client each act as separate, independent controllers. Each of us is responsible for our own compliance with data protection law, and we share the data under the terms of our Services Agreement with the client. The client's own privacy information also applies to how it uses the data.
When Palm acts as a processor. Only where a specific written agreement provides for it will Palm act as a processor — handling personal data solely on a client's instructions and for the client's own purposes. Unless such an agreement is in place, Palm acts as a controller.
4. What personal data we collect
Candidate and Resource data:
- Identity and contact details (name, email, phone, country/location)
- CV, work history, skills, qualifications, and work samples or portfolio
- Interview notes, assessment and trial-task results
- Identity and right-to-work verification information
- Operational readiness information (device, connection reliability, workspace suitability)
- Contract and payment administration details for placed Resources
Client contact and billing data:
- Name, job title, work email and phone, and communication history
- Payment and billing details used to invoice and collect fees
Referee data:
- Name, contact details, and the reference provided
5. How we collect personal data
We collect personal data directly from you — for example when you apply, interview, or complete onboarding. We also collect it from other sources, including:
- Professional networking and sourcing platforms
- Referrals and referees
- Publicly available professional information
- Our clients (for example role requirements and feedback)
Where we collect your data from a source other than you, this notice tells you what we hold and why.
6. Why we use personal data, and our lawful basis
We use personal data for the purposes below. For each purpose we rely on one or more lawful bases under UK data protection law:
Purpose Lawful basis
Sourcing, assessing and matching candidates to roles Legitimate interests (running recruitment effectively) Taking steps to place you, and entering into and managing your contract Contract (including steps taken at your request before a contract) Pre-start checks and vetting Legitimate interests; legal obligation (e.g. right to work); contract Managing placements and service delivery to clients Contract; legitimate interests Client billing, payments and contractor administration Contract; legal obligation Managing our client relationships Legitimate interests Meeting legal, tax and regulatory duties Legal obligation Protecting Palm, our people and our clients (security, fraud prevention) Legitimate interests Where we rely on legitimate interests, we balance our interests against your rights and freedoms.
Where we rely on legitimate interests, we balance our interests against your rights and freedoms.
7. Special category and criminal offence data
We try not to collect special category data (such as health or ethnicity) unless it is necessary and permitted. Where a client engagement requires criminal record or police clearance checks, we carry these out only where they are legally permissible, role-relevant and available in the relevant country, and we apply the additional safeguards the law requires.
8. Who we share personal data with
We may share personal data with:
- Clients, where there is a genuine need (candidate assessment, placement and service delivery)
- Service providers who help us run our services, under contracts that require them to protect the data
- Professional advisers, and authorities where the law requires it
We do not sell personal data, and we do not routinely share full internal candidate records as a complete pack.
9. International transfers
Palm Outsourcing Ltd is a UK company and the controller of the personal data described in this notice. Some of the personal data we hold may be accessed or processed outside the UK — for example by members of our team or by service providers who help us run our services.
We protect this data through role-based access on a need-to-know basis, multi-factor authentication, and encryption in transit and at rest. Everyone who accesses it is contractually bound to keep it secure and confidential, to comply with UK data protection standards, and to report any breach immediately.
10. How long we keep personal data
We keep personal data only for as long as we need it for the purposes above, and to meet our legal and contractual duties. As a guide:
- Unsuccessful candidates: up to 12 months after the decision, unless you ask us to keep you on file for longer
- Placed Resources: for the duration of the engagement plus six years, to meet contract, tax and legal requirements
- Client contacts: for the duration of the relationship plus a reasonable period afterwards
We review personal data periodically and delete or anonymise it when it is no longer needed.
11. How we protect personal data
We apply the technical and organisational controls set out in our Information Security Policy and Data Protection Policy — including role-based access on a need-to-know basis, multi-factor authentication on core systems, encryption in transit and at rest, and controlled sharing.
12. Your rights
Under UK data protection law you have the right to:
- Access the personal data we hold about you
- Have inaccurate data corrected
- Have your data deleted in certain circumstances
- Restrict or object to how we use your data
- Data portability
- Withdraw consent, where we rely on it
To exercise a right, contact us using the details below. We will respond within the time the law allows (usually one month). Where Palm acts as a processor for a client, we will pass your request to the client (the controller) or assist them as our contract requires.
You also have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk. We'd ask you to contact us first so we can try to put things right.
13. Changes to this notice
We review this notice at least annually, and when there is a material change to our operating model, tools or client requirements. The current version and effective date are shown at the top of this document.
14. Contact us
For any privacy question, or to exercise your rights:
Email: support@palmoutsourcing.com (subject: "Privacy")
.png)