Privacy & Data Retention Policy

Last updated: June 2026

1. Introduction

19 London Limited (“19 London”, “we”, “us” or “our”) is committed to protecting and respecting your privacy and handling your personal information responsibly.

This Privacy & Data Retention Policy explains what personal information we collect, how and why we use it, who we may share it with, how long we retain it, how we protect it and the rights available to you.

This policy applies to candidates, prospective candidates, clients, prospective clients, suppliers, business contacts and other individuals who interact with 19 London.

We may update this policy from time to time. The most current version will always be available on our website.

2. Who is responsible for your personal information?

19 London Limited is the data controller responsible for your personal information.

19 London Limited
48 Warwick Street
London
W1B 5AW
United Kingdom

Email: hello@19london.com
Website: www.19london.com

3. The personal information we collect

The information we collect depends upon your relationship with us.

Candidates

We may collect and process information including:

• name and contact details;
• address and location;
• CV and employment history;
• education, professional qualifications and certificates;
• salary, remuneration and job preferences;
• availability and notice periods;
• references and referee details;
• interview notes and communications with you;
• photographs or professional headshots where provided;
• passport and other identity-document information;
• driving licence information where relevant;
• right-to-work documentation and share-code information;
• DBS information where relevant to a role;
• information relating to professional licences or certifications;
• information that you provide to us in connection with your suitability for a particular role;
• records of roles for which you have been considered, introduced, interviewed or placed;
• correspondence between you and 19 London;
• information obtained from publicly available professional sources, such as LinkedIn; and
• other information you voluntarily provide to us.

Some information may constitute special-category or otherwise particularly sensitive personal data. Where we process this information, we will only do so where we have an appropriate lawful basis and, where required, an additional condition for processing under applicable data-protection law.

Clients and prospective clients

We may collect:

• names;
• business and personal contact details;
• job titles;
• details relating to recruitment assignments;
• communications and correspondence;
• billing and payment information;
• information necessary to enter into and administer our Terms of Business; and
• information relevant to providing our recruitment services.

Suppliers and other business contacts

We may collect names, contact details, job titles, payment information and correspondence necessary to manage our relationship with you.

4. How we collect information

We may obtain personal information:

• directly from you;
• when you register through our website or candidate database;
• when you apply for a vacancy;
• by email, telephone, video call or other correspondence;
• through job boards and recruitment platforms;
• through professional networking sites such as LinkedIn;
• from referees;
• from clients;
• from publicly available professional information;
• from another recruitment business or third party where there is an appropriate lawful basis for doing so; and
• through our website and associated technologies.

5. Why we use your personal information

We use personal information where necessary to operate our recruitment business and provide our services.

This may include:

• assessing candidate suitability;
• matching candidates with appropriate vacancies;
• discussing vacancies and opportunities with candidates;
• introducing candidates to clients;
• arranging interviews;
• obtaining and recording references;
• verifying identity, qualifications and right-to-work status where appropriate;
• managing temporary and permanent placements;
• communicating with candidates, clients and other business contacts;
• maintaining appropriate records of our recruitment activities;
• administering our contractual relationships;
• processing invoices and payments;
• complying with legal and regulatory obligations;
• preventing fraud and protecting our business;
• establishing, exercising or defending legal claims;
• improving our services; and
• keeping individuals informed about relevant services or opportunities where permitted by law.

6. Our lawful bases for processing

Depending on the circumstances, we may process personal information because:

• it is necessary for our legitimate interests in operating a recruitment business and providing recruitment services;
• it is necessary to take steps at your request before entering into a contract or to perform a contract;
• processing is necessary to comply with a legal obligation;
• you have provided consent, where consent is the appropriate lawful basis; or
• processing is necessary for the establishment, exercise or defence of legal claims or another basis permitted by applicable data-protection legislation.

Where we rely on legitimate interests, we consider those interests against the rights and interests of the individual concerned.

Where we rely upon consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out before consent was withdrawn.

7. Candidate information and introductions to clients

A core part of our recruitment service involves introducing suitable candidates to clients.

Where appropriate, we may therefore provide a client with information such as your:

• CV;
• professional profile;
• employment history;
• qualifications;
• experience;
• salary expectations;
• availability;
• location;
• relevant interview information; and
• other information reasonably required to assess your suitability for a role.

We do not routinely provide copies of passports, driving licences, right-to-work documents, DBS certificates or similar identity documentation to clients as part of an initial candidate introduction.

Where it becomes necessary to disclose such information for a particular placement or legal requirement, we will only do so where there is an appropriate reason and lawful basis.

8. Identity and right-to-work documentation

We may request identity and right-to-work documentation where appropriate as part of our candidate registration, verification or placement process.

Access to such documentation is restricted to individuals who reasonably require access for recruitment, verification, compliance or administrative purposes.

We do not retain identity documentation simply because it may potentially be useful at some unspecified point in the future.

Where an individual asks us to delete identity or right-to-work documentation, we will consider that request in accordance with applicable data-protection law and our legal and regulatory obligations.

Where we have no continuing lawful or operational requirement to retain the documentation, it will be securely deleted in accordance with our retention procedures.

If the individual subsequently wishes to be considered for another role for which the documentation is required, we may need to request it again.

9. Who we share information with

Depending upon the circumstances, we may share personal information with:

• clients and prospective employers in connection with recruitment assignments;
• companies providing recruitment technology and applicant-tracking/database services;
• IT, hosting, cloud-storage and communications providers;
• payroll or accounting providers;
• professional advisers;
• background-screening or DBS providers where relevant;
• job boards and recruitment platforms;
• regulators, law-enforcement bodies or public authorities where legally required; and
• other service providers necessary to operate our business.

We require service providers processing personal information on our behalf to protect that information appropriately and only process it for authorised purposes.

We do not sell candidate personal information.

10. International recruitment and transfers

19 London operates internationally and may recruit for clients and positions located outside the United Kingdom.

Where you are being considered for an international position, relevant candidate information may therefore be transferred to or accessed from another country.

Some of our technology and service providers may also process information outside the United Kingdom.

Where personal information is transferred internationally, we take appropriate steps to ensure that the transfer complies with applicable UK data-protection law. Depending on the destination and circumstances, this may include reliance upon applicable adequacy regulations or appropriate contractual or other safeguards.

You may contact us if you would like further information about the safeguards applicable to a particular transfer.

11. Data Retention Policy

We retain personal information only for as long as reasonably necessary for the purposes for which it was collected, including providing recruitment services, maintaining appropriate business records, complying with legal or regulatory requirements and establishing, exercising or defending legal claims.

Retention periods vary according to the type of information and our relationship with the individual.

Our standard retention approach is set out below.

Candidate CVs and recruitment profiles

We will normally retain candidate CVs, professional profiles, employment histories, qualifications, recruitment notes and related information for up to 6 years from the candidate’s last meaningful interaction with us.

This reflects the ongoing nature of recruitment, where candidates may return to the market or be suitable for opportunities several years after first registering.

We may contact candidates periodically to confirm that they wish to remain registered and/or to update their information.

Candidates may ask us to delete their profile at any time, subject to information we are required or reasonably entitled to retain.

Candidate identity and right-to-work documentation

Copies of passports, driving licences, right-to-work documentation and similar identity documents will be retained only for as long as reasonably necessary for the recruitment, verification or placement purpose for which they were collected.

Where a candidate is not progressing with a role and there is no continuing requirement to retain the documents, they may be deleted earlier than the candidate’s general recruitment profile.

Candidates may request deletion of these documents at any time. We will comply where there is no legal or other lawful reason requiring continued retention.

DBS and background-check information

DBS certificates and information relating to criminal-record checks will only be retained for as long as reasonably necessary for the relevant recruitment or compliance purpose and in accordance with applicable legal and regulatory requirements.

We will avoid retaining copies of DBS certificates for longer than necessary.

References and professional qualifications

References, referee information and professional qualifications may normally be retained as part of a candidate’s recruitment record for up to 6 years from the last meaningful interaction, unless there is a reason for a shorter or longer period.

Recruitment correspondence and interview records

Emails, interview notes and other recruitment correspondence may normally be retained for up to 6 years from the last meaningful interaction or completion of the relevant recruitment process, where reasonably required for our business records or the establishment, exercise or defence of legal claims.

Routine correspondence that is no longer required may be deleted earlier.

Successful placements

Records relating to successful permanent or temporary placements, introductions, fees, contracts and related business transactions may normally be retained for up to 6 years after the relevant contractual or business relationship ends, or longer where required by law.

Client records

Client contact details, recruitment instructions, Terms of Business, placement records and associated correspondence may normally be retained for up to 6 years after the end of the relevant business relationship or transaction, subject to any longer legal requirement.

Financial and accounting information

Invoices, payment records and other accounting information will be retained for the period required under applicable tax, accounting and company-law requirements.

Legal disputes and complaints

Where information is relevant to an actual or reasonably anticipated complaint, dispute, investigation or legal claim, we may retain relevant information for longer than our normal retention period where reasonably necessary to establish, exercise or defend our legal rights.

Marketing information

Where we use personal information for direct marketing, we will retain the information for as long as the individual remains appropriately subscribed or until they object or unsubscribe.

We may retain a minimal suppression record after an individual unsubscribes so that we can ensure that they are not inadvertently contacted again for marketing purposes.

12. How deletion works

When personal information reaches the end of its applicable retention period, or where we agree to a valid deletion request, it will be securely deleted or anonymised where reasonably practicable.

Deletion from live systems does not necessarily mean that information is immediately removed from every backup copy.

Information contained in secure system backups may remain until the relevant backup is overwritten or expires in accordance with the applicable backup cycle. Where appropriate, such information will be put beyond ordinary use and will not be restored or otherwise processed except where necessary for legitimate disaster-recovery or security purposes.

Where personal information has been disclosed to another organisation and applicable law requires us to notify that recipient of an erasure request, we will take reasonable steps to do so.

13. Keeping information accurate

We ask candidates, clients and other individuals to let us know when important information changes.

Candidates can contact us at any time to update or correct the information we hold.

We may also periodically contact candidates to check whether their information remains accurate and whether they wish to remain registered with us.

14. Security

We use appropriate technical and organisational measures designed to protect personal information against unauthorised access, alteration, disclosure, accidental loss or destruction.

Access to personal information is limited according to business need.

We also require service providers processing personal information on our behalf to maintain appropriate security and confidentiality.

We maintain procedures for identifying and responding to suspected personal-data breaches and will notify affected individuals and/or the Information Commissioner’s Office where required by law.

15. Your data-protection rights

Depending on the circumstances and the lawful basis upon which we process your information, you may have the right to:

• request access to personal information we hold about you;
• request correction of inaccurate or incomplete information;
• request erasure of your personal information;
• request restriction of processing;
• object to certain processing;
• request transfer of certain information in a portable format;
• withdraw consent where processing is based upon consent; and
• object to the use of your information for direct marketing.

These rights are not absolute and certain exemptions may apply.

For example, we may be entitled or required to retain particular information despite a request for deletion where it is necessary to comply with a legal obligation or to establish, exercise or defend legal claims.

We may ask for information reasonably necessary to verify your identity before actioning a request.

We will respond to data-protection rights requests within the time required by applicable law.

To exercise your rights, please contact: hello@19london.com

16. Complaints

If you have concerns about how we have handled your personal information, please contact us first so that we can investigate and respond.

You also have the right to complain to the UK’s data-protection regulator:

Information Commissioner’s Office (ICO)
www.ico.org.uk

17. Changes to this policy

We keep this Privacy & Data Retention Policy under review and may update it where our services, technology, legal obligations or processing activities change.

The current version will always be published on our website.

Last updated: June 2026