Privacy Notice

1.Purpose and scope

This Privacy Notice explains how RSS collects, uses, discloses, stores and otherwise processes personal data in connection with its website, practitioner network, staffing and recruitment activities, regulatory workforce services, consultancy and managed services, client relationships, supplier relationships and digital platforms.

It is intended to provide privacy information to individuals including prospective and registered practitioners, contractors, candidates, applicants, client and prospective-client contacts, suppliers, professional advisers, website visitors, portal users and other individuals whose personal data is processed in connection with RSS's activities.

Where a more specific privacy notice is supplied for a particular service, project, client arrangement or processing activity, that more specific notice should be read alongside this notice and may take precedence for that activity.

2.Who we are and how to contact us

Regulatory Staffing Solutions Ltd is a company registered in England and Wales.

• Company number: 17395253
• Registered office: 128 City Road, London, United Kingdom, EC1V 2NX
• Principal website: regulatorystaffingsolutions.com
• ICO registration number: CSN9071343
• General enquiries: enquiries@regulatorystaffingsolutions.com
• Privacy enquiries and data protection rights requests: enquiries@regulatorystaffingsolutions.com

For the processing described in this notice, RSS will often act as a controller. In some client engagements RSS may instead process personal data on behalf of a client as a processor. The relevant contract, data processing terms and project-specific information should identify the applicable role.

3.Categories of personal data

The personal data RSS processes will depend on the individual's relationship with RSS and the services being used. It may include:

• Identity and contact data: name, title, postal address, email address, telephone number, date of birth and other identifiers where necessary.
• Professional and recruitment data: CV, employment history, role preferences, availability, skills, experience, qualifications, professional registrations, memberships, training, licences, certifications and portfolio information.
• Eligibility and compliance data: identity-verification information, right-to-work evidence, references, background/compliance checks, expiry dates and assignment-specific compliance records.
• Assignment and workforce data: proposed and current assignments, work location, timesheets, availability, performance or service-delivery information, client feedback and assignment communications.
• Client and business contact data: organisation, job title, business contact details, purchasing/procurement information, enquiries, service requirements and relationship-management records.
• Financial and transaction data: invoicing details, payment status, bank/payment information where required, tax or company information and records necessary to administer payments.
• Account and authentication data: usernames, authentication status, access permissions, account events and security information.
• Technical and usage data: IP address, browser/device information, session data, log records, security events and information generated through use of the website or portals.
• Communications data: emails, contact-form submissions, support requests, call notes and other correspondence.
• Marketing data: preferences, consent records, opt-outs and engagement with permitted communications.
• Other information voluntarily provided to RSS or required for a particular assignment or service.

4.Special category and criminal offence data

RSS may, where necessary and lawful, process information that receives additional protection under data protection law. This may include health or disability information needed for reasonable adjustments, equality-monitoring information where appropriate, or other special category data supplied in connection with an assignment or legal obligation.

RSS may also process criminal offence information where a role or legal/regulatory requirement makes appropriate vetting necessary. RSS will identify an appropriate lawful basis and, where required, an additional condition for processing, apply data minimisation and access controls, and maintain any policy document required by law.

5.How we obtain personal data

RSS may obtain personal data:

• directly from the individual, including through forms, registration, portals, email, telephone and meetings;
• from clients or prospective clients in connection with requirements, assignments, projects or service delivery;
• from referees, former employers, professional bodies, qualification providers and verification/compliance providers, where appropriate;
• from recruitment, professional networking or publicly available professional sources where lawful and relevant;
• from suppliers and service providers supporting RSS's systems, verification, communications or administration;
• through website, portal and security technologies; and
• from other lawful sources where the individual has been informed or where another lawful transparency route applies.

6.Purposes and lawful bases

RSS will identify an appropriate lawful basis for each processing purpose. Depending on the circumstances, this may include taking steps at an individual's request before entering a contract, performing a contract, complying with a legal obligation, pursuing legitimate interests, or obtaining consent where consent is the appropriate basis.

7.Practitioner matching, analytics and artificial intelligence

RSS may use technology to assist with activities such as searching and organising professional information, matching practitioner attributes against client requirements, analysing documents, producing draft reports or summaries, identifying compliance status, generating workforce insights and supporting administrative or regulatory-knowledge workflows.

Where personal data is used in these functions, RSS will apply data protection principles including lawfulness, fairness, transparency, purpose limitation, data minimisation, accuracy, security and accountability.

Unless expressly stated otherwise in a specific notice, RSS does not intend an AI-generated recommendation, score or output by itself to constitute a final decision that determines whether an individual receives an assignment, membership status or another opportunity. Material decisions should involve meaningful human assessment appropriate to the context.

If RSS introduces solely automated decision-making that produces legal or similarly significant effects, RSS will assess the applicable legal requirements before deployment, provide additional transparency and safeguards where required, and update this notice.

8.Verification and third-party checks

RSS may use specialist providers to support identity, right-to-work, credential, background or other compliance checks. The scope of a check will depend on the role, client requirement and applicable law. RSS will not represent a practitioner as having passed a particular verification unless that verification has actually been completed under the relevant RSS process.

9.Sharing personal data

RSS may disclose personal data where necessary and lawful to:

• clients and prospective clients where relevant to a proposed or current engagement;
• verification, compliance and screening providers;
• cloud hosting, database, authentication, communications, document, analytics, support and security providers;
• payment, accounting, payroll or invoicing providers where applicable;
• professional advisers, auditors, insurers and legal representatives;
• regulators, law-enforcement bodies, courts, government bodies or other authorities where required or permitted by law;
• prospective purchasers, investors or advisers in connection with a legitimate corporate transaction, subject to appropriate safeguards; and
• other parties where the individual directs or authorises disclosure or another lawful basis applies.

RSS does not sell personal data.

10.Processors and sub-processors

RSS will maintain appropriate contractual arrangements with processors handling personal data on its behalf. A current list or category description of material processors is maintained internally and, where appropriate, made available through the website or on request.

11.International transfers

Some service providers or recipients may process personal data outside the United Kingdom. Where UK data protection law requires safeguards for a restricted transfer, RSS will use an appropriate transfer mechanism and complete any required transfer risk assessment or equivalent assessment.

12.Retention

RSS will retain personal data only for as long as reasonably necessary for the purposes for which it was collected, including legal, regulatory, contractual, accounting, insurance, dispute and evidential requirements.

Retention periods vary by record type. RSS maintains a Records Retention Schedule setting out defined periods or criteria for, at minimum, practitioner applications and inactive profiles, verification evidence, right-to-work records, assignment records, contracts, timesheets, invoices, client records, security logs, support records, marketing records and rights-request records. A copy of the applicable retention criteria is available on request.

13.Security

RSS uses organisational and technical measures designed to protect personal data against unauthorised or unlawful processing and accidental loss, destruction or damage. Measures may include access controls, authentication, role-based permissions, encryption where appropriate, logging, backups, vulnerability management, malware controls, secure development practices, supplier due diligence and incident-response procedures.

No online system can be guaranteed to be completely secure. Users are responsible for protecting their account credentials and should notify RSS promptly of suspected unauthorised access.

14.Individual rights

Subject to applicable law and any relevant exemptions, individuals may have rights including access to personal data, rectification, erasure, restriction, data portability, objection, withdrawal of consent where processing is based on consent, and rights relating to certain automated decisions.

Requests should be sent to enquiries@regulatorystaffingsolutions.com. RSS may need to verify identity before acting on a request.

Where processing is based on consent, withdrawing consent does not affect the lawfulness of processing carried out before withdrawal.

15.Direct marketing

RSS will send direct marketing only where permitted by applicable law. Individuals can opt out of marketing communications at any time using the unsubscribe method provided or by contacting RSS. Service and administrative communications that are necessary for an account, assignment or contract are not marketing communications.

16.Cookies and storage/access technologies

The RSS website and portals may use cookies and other technologies that store information on, or access information from, a user's device. Further information is provided in the RSS Cookie & Storage Technologies Notice and through the website's consent/preference controls.

17.Children

RSS's professional staffing and practitioner services are not directed at children. RSS does not knowingly seek to register children as professional practitioners. If RSS develops services that intentionally process children's personal data, it will assess the additional legal and design requirements before launch.

18.Complaints

Privacy concerns should first be raised with RSS at enquiries@regulatorystaffingsolutions.com so that RSS has an opportunity to investigate and respond.

Individuals may also have the right to complain to the UK Information Commissioner's Office (ICO). Current contact and complaint information is available at ico.org.uk/make-a-complaint.

19.Changes to this notice

RSS may update this notice to reflect changes in law, regulatory guidance, services, technology or processing. Material changes will be communicated appropriately. The current version and review date are displayed at the top of this page.