Legal

Privacy Policy

Last updated 9 June 2026

Welcome to the privacy policy of Burnaby Human Capital Limited, trading as The Needle (“The Needle”, “we”, “us” or “our”).

The Needle respects your privacy and is committed to protecting your personal data. This privacy policy explains how we look after any personal data we collect through our website (regardless of where you visit it from), tells you about your privacy rights and explains how the law protects you.

Our website is primarily an informational site about our recruitment services. It is not a candidate registration platform: we do not operate online accounts or profiles, and we do not store candidate or client records on the website itself. We collect personal data through the website only in limited ways — principally when you contact us, and through cookies and analytics. This policy also explains how we handle the personal data of candidates and clients who deal with us, including any CV or personal information you send us, in the section “Candidates: how we handle your CV and personal data” below.

Please read this policy alongside any other privacy or fair processing notice we may give you on specific occasions, so you are fully aware of how and why we are using your data. This policy supplements those other notices and does not override them.

Contents

  1. Important information and who we are
  2. The data we collect about you
  3. How your personal data is collected
  4. How we use your personal data
  5. Candidates: how we handle your CV and personal data
  6. Disclosures of your personal data
  7. International transfers
  8. Data security
  9. Data retention
  10. Cookies
  11. Your legal rights
  12. Glossary

Important information and who we are

Purpose of this privacy policy

This privacy policy aims to give you information on how The Needle collects and processes your personal data through your use of this website, including any data you provide through it.

This website is not intended for children and we do not knowingly collect data relating to children.

Data controller

Burnaby Human Capital Limited, trading as The Needle, is the controller and responsible for your personal data. We are registered in England and Wales under company number 07809867 and have our registered office at 17 Wigginton Road, Tamworth, Staffordshire, England, B79 8RH.

We are a recruitment company and a limited company. As a data controller, we are responsible for deciding how we hold and use personal data about you. We are required to provide certain information to you under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

We have appointed a person responsible for overseeing questions in relation to this privacy policy. If you have any questions about this policy, including any request to exercise your legal rights, please contact us using the details below.

Contact details

If you have any questions about this privacy policy or our privacy practices, please email us at info@theneedle.uk.

We are regulated by the Information Commissioner’s Office (ICO). Our ICO registration number is ZA819137.

You have the right to make a complaint at any time to the ICO, the UK supervisory authority for data protection issues (www.ico.org.uk). We would, however, appreciate the chance to deal with your concerns before you approach the ICO, so please contact us in the first instance.

Changes to this privacy policy and your duty to inform us of changes

We keep our privacy policy under regular review. This version was last updated on 9 June 2026. Historic versions can be obtained by contacting us.

It is important that the personal data we hold about you is accurate and current. Please keep us informed if your personal data changes during your relationship with us.

This website may include links to third-party websites, plug-ins and applications. Clicking on those links or enabling those connections may allow third parties to collect or share data about you. We do not control these third-party websites and are not responsible for their privacy statements. When you leave our website, we encourage you to read the privacy policy of every website you visit.

The data we collect about you

Personal data, or personal information, means any information about an individual from which that person can be identified. It does not include data where the identity has been removed (anonymous data).

Because our website does not host accounts or candidate profiles, the personal data we collect through it is limited. We may collect, use and store the following kinds of personal data:

  • Identity Data includes your first name and last name.
  • Contact Data includes your email address and telephone number, and any contact details you choose to give us.
  • Enquiry Data includes any information you provide in the body of an enquiry, email or attachment you send us, which may include details of your career, role or hiring needs.
  • Technical Data includes your internet protocol (IP) address, browser type and version, time zone setting and location, operating system and platform, and other technology on the devices you use to access this website.
  • Usage Data includes information about how you use our website, such as the pages you view and how you navigate the site.
  • Marketing and Communications Data includes your preferences in receiving marketing from us and your communication preferences.

We do not seek to collect any special categories of personal data (such as data about your race or ethnicity, religious beliefs, sexual orientation, health or genetic and biometric data) through this website, and we ask that you do not send us such information unless we specifically request it for a clear and lawful purpose.

We also collect, use and share Aggregated Data, such as statistical or demographic data, for any purpose. Aggregated Data may be derived from your personal data but is not considered personal data in law, as it does not directly or indirectly reveal your identity. If we combine Aggregated Data with your personal data so that it can identify you, we treat the combined data as personal data, used in accordance with this policy.

If you fail to provide personal data

Where we need to collect personal data by law, or under the terms of a contract we have or are entering into with you, and you fail to provide that data when requested, we may not be able to perform that contract or respond to your enquiry. We will tell you if this is the case at the time.

How your personal data is collected

We use different methods to collect data from and about you, including through:

  • Direct interactions. You may give us your Identity, Contact and Enquiry Data by contacting us by email or telephone, by completing a contact or enquiry form on our website, by sending us your CV or details of a role, or by asking to receive marketing from us.
  • Automated technologies or interactions. As you interact with our website, we may automatically collect Technical Data and Usage Data about your equipment, browsing actions and patterns. We collect this data using cookies and similar technologies. Please see the Cookies section below.
  • Third parties or publicly available sources. We may receive Technical Data from analytics providers, and we may receive contact and professional information from publicly available sources such as professional networking and social media channels (for example LinkedIn).

How we use your personal data

We will only process your personal data when the law allows us to, on a lawful basis. Most commonly, we will use your personal data in the following circumstances:

  • Where we need to perform a contract we are about to enter into or have entered into with you.
  • Where it is necessary for our legitimate interests (or those of a third party) and your interests and fundamental rights do not override those interests.
  • Where we need to comply with a legal or regulatory obligation.

Generally we do not rely on consent as a legal basis for processing your personal data, although we will obtain your consent before sending you direct marketing communications by email or text message where we are required to do so. You have the right to withdraw consent to marketing at any time by contacting us.

Purposes for which we will use your personal data

We have set out below the main ways we expect to use your personal data, and the legal bases we rely on:

  • To respond to and manage your enquiry, and to communicate with you about it — on the basis of our legitimate interests, and where relevant the performance of a contract with you.
  • To provide our recruitment services and to discuss potential roles or candidates with you — on the basis of our legitimate interests and the performance of a contract.
  • To send you marketing communications about our services where you have asked to receive them, or where it is in our legitimate interests to do so and the law permits — on the basis of consent or our legitimate interests.
  • To administer and protect our business and this website (including troubleshooting, data analysis, testing, system maintenance, support and hosting) — on the basis of our legitimate interests and to comply with a legal obligation.
  • To use data and analytics to improve our website, services and customer relationships — on the basis of our legitimate interests.
  • To comply with legal or regulatory requirements — on the basis of compliance with a legal obligation.

Automated decision making

You will not be subject to decisions that have a significant impact on you based solely on automated decision-making.

Change of purpose

We will only use your personal data for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason that is compatible with the original purpose. If we need to use your personal data for an unrelated purpose, we will notify you and explain the legal basis that allows us to do so. We may process your personal data without your knowledge or consent where this is required or permitted by law.

Candidates: how we handle your CV and personal data

This section applies if you are a candidate — that is, if you send us your CV or personal information, or if we contact you about a potential role. As a recruitment business, processing candidate data is central to what we do, and we want to be clear about how we handle it.

What we collect

When you engage with us as a candidate, we may collect and process: your name and contact details; your CV and the information in it, including your employment history, qualifications, skills and professional experience; your current and expected remuneration; your right to work; details of your suitability and preferences for particular roles; and any other information you choose to share with us or that arises during our discussions.

Where we obtain your data

We usually collect this information directly from you. We may also obtain professional information about you from publicly available sources, such as professional networking sites (for example LinkedIn), or receive your details through a referral. Where we obtain your personal data from a source other than you, we will, where required, provide you with this privacy information within a reasonable period and in any event within one month.

Why we process it and our lawful basis

We process candidate data in order to provide our recruitment services — to assess your suitability for roles, to discuss opportunities with you, and, with your agreement, to introduce you to prospective employers. We rely on our legitimate interests as the lawful basis for this processing: it is in our interest, and yours, to match suitable candidates with suitable roles. Where we take steps at your request towards a placement, we may also rely on the performance of a contract. We will only rely on consent where the law specifically requires it, such as for certain marketing.

Special category data

We do not ask you to provide special category data (such as information about your health, race or ethnicity), and we ask that you do not include it in your CV unless it is necessary. Where we do process such data — for example, to make reasonable adjustments to a recruitment process, or for equal opportunities monitoring — we will do so only where an additional condition under data protection law applies.

Sharing your data with prospective employers

We will share your details with a prospective employer only with your agreement, on a role-by-role basis. We will never send your personal information to a client without your express consent. Once you are introduced to a prospective employer and engage with their own application or hiring process, that employer is a separate data controller and will handle your data under its own privacy policy.

How long we keep candidate data

We keep your candidate data for as long as we are actively considering you for roles, and for a period afterwards — typically up to two years from our last meaningful contact with you — in case suitable opportunities arise, unless you ask us to remove your details sooner. We may keep certain information for longer where we are required to do so for legal, regulatory or tax reasons, or where there is a prospect of a legal claim.

Your rights, the security measures we apply, and the way we handle international transfers, all as described elsewhere in this policy, apply equally to candidate data.

If at any time you want us to update or delete your details, or you no longer wish to be considered for roles, please contact us at info@theneedle.uk.

Disclosures of your personal data

We may share your personal data with the following parties:

  • Service providers acting as processors who provide IT, system administration, hosting and analytics services.
  • Professional advisers acting as processors or joint controllers, including lawyers, bankers, auditors and insurers.
  • HM Revenue & Customs, regulators and other authorities who require reporting of processing activities in certain circumstances.
  • A prospective buyer or seller in the event that we sell, transfer or merge parts of our business or assets, in which case we may disclose your personal data to the prospective party.

In the course of providing recruitment services, we may share a candidate’s details with a prospective employer, or an employer’s details with a candidate — but only with the relevant individual’s agreement, and not through this website.

We require all third parties to respect the security of your personal data and to treat it in accordance with the law. We do not allow our third-party service providers to use your personal data for their own purposes, and we only permit them to process it for specified purposes and in accordance with our instructions.

International transfers

We aim to store and process your personal data within the UK. Where any of our service providers process personal data outside the UK, we will ensure a similar degree of protection is afforded to it by ensuring at least one appropriate safeguard is in place — for example, transferring only to countries that have been deemed to provide an adequate level of protection, or using contracts approved for use in the UK (such as the International Data Transfer Agreement or Addendum to the EU Standard Contractual Clauses). Please contact us if you would like further information on the specific mechanism we use.

Data security

We have put in place appropriate security measures to prevent your personal data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. In addition, we limit access to your personal data to those employees, agents, contractors and other third parties who have a business need to know. They will only process your personal data on our instructions and are subject to a duty of confidentiality.

We have put in place procedures to deal with any suspected personal data breach and will notify you and any applicable regulator of a breach where we are legally required to do so.

Unfortunately, the transmission of information via the internet is not completely secure. Although we will do our best to protect your personal data, we cannot guarantee the security of data transmitted to us, and any transmission is at your own risk. Once we have received your information, we will use strict procedures and security features to try to prevent unauthorised access.

Data retention

We will only retain your personal data for as long as reasonably necessary to fulfil the purposes we collected it for, including to satisfy any legal, regulatory, tax, accounting or reporting requirements. We may retain your personal data for a longer period in the event of a complaint, or if we reasonably believe there is a prospect of litigation in respect of our relationship with you.

To determine the appropriate retention period, we consider the amount, nature and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure, the purposes for which we process it and whether we can achieve those purposes through other means, and the applicable legal requirements.

By law we have to keep basic information about our clients (including Contact, Identity and transaction data) for at least six years after they cease being clients, for tax purposes. In some circumstances we will anonymise your personal data, so that it can no longer be associated with you, for research or statistical purposes, in which case we may use this information indefinitely without further notice to you.

Cookies

Our website uses cookies and similar technologies to distinguish you from other users, to help us provide you with a good experience when you browse, and to allow us to improve the site. You can set your browser to refuse all or some browser cookies, or to alert you when websites set or access cookies. If you disable or refuse cookies, please note that some parts of this website may become inaccessible or may not function properly. For more information about the cookies we use, please see our cookie policy.

Under certain circumstances, you have rights under data protection laws in relation to your personal data, including the right to:

  • Request access to your personal data (a “data subject access request”).
  • Request correction of the personal data we hold about you.
  • Request erasure of your personal data.
  • Object to processing of your personal data where we are relying on a legitimate interest, and to object to direct marketing at any time.
  • Request restriction of processing of your personal data.
  • Request the transfer of your personal data to you or to a third party.
  • Withdraw consent at any time where we are relying on consent to process your personal data.

If you wish to exercise any of these rights, please contact us at info@theneedle.uk.

No fee usually required

You will not have to pay a fee to access your personal data, or to exercise any of the other rights. However, we may charge a reasonable fee if your request is clearly unfounded, repetitive or excessive. Alternatively, we may refuse to comply with your request in these circumstances.

What we may need from you

We may need to request specific information from you to help us confirm your identity and ensure your right to access your personal data, or to exercise any of your other rights. This is a security measure to ensure that personal data is not disclosed to any person who has no right to receive it. We may also contact you to ask for further information in relation to your request, to speed up our response.

Time limit to respond

We try to respond to all legitimate requests within one month. Occasionally it may take us longer if your request is particularly complex or you have made a number of requests. In this case, we will notify you and keep you updated.

Glossary

Legitimate Interest means the interest of our business in conducting and managing it to enable us to give you the best service and the most secure experience. We make sure we consider and balance any potential impact on you and your rights before processing your personal data for our legitimate interests. We do not use your personal data for activities where our interests are overridden by the impact on you, unless we have your consent or are otherwise required or permitted by law.

Performance of Contract means processing your data where it is necessary for the performance of a contract to which you are a party, or to take steps at your request before entering into such a contract.

Comply with a legal obligation means processing your personal data where it is necessary for compliance with a legal obligation that we are subject to.

Burnaby Human Capital Limited, trading as The Needle · Company no. 07809867 · ICO registration no. ZA819137