Privacy Policy | Andy File Associates

Last updated: May 2026

Andy File Associates Ltd ("we", "us", "our") is committed to keeping your personal data safe and secure from unauthorised access, alteration, disclosure or destruction. We are the data controller for the personal data we process. This policy explains what information we hold, how we use it, and the rights you have.

Our security measures

Encryption of our services and data.
Regular review of our information collection, storage and processing practices, including physical security measures.
Restricting access to personal information to employees, contractors and agents who need it in order to process it for us, and who are subject to contractual confidentiality and processing obligations. They may be disciplined or have their contract terminated if they fail to meet these obligations.
Internal policies setting out our data-security approach, and training for employees.

How we use your personal information

We use personal information to do some or all of the following:

Communicate with you as part of our business. Our prime and only usage of your data is for the purposes of obtaining employment (temporary or permanent).
Send you important information about changes to our policies, terms and conditions, and other administrative information.
Manage our infrastructure and business operations and comply with internal policies and procedures, including auditing, finance and accounting, billing and collections, IT systems, data and website hosting, business continuity, and records management.
Resolve complaints and handle requests for data access or correction.
Comply with applicable laws and regulatory obligations, such as those relating to anti-money laundering and anti-terrorism, comply with legal process, and respond to requests from public and governmental authorities.
Establish and defend legal rights; protect our operations, rights, privacy, safety or property; and pursue available remedies or limit our damages.

Andy File Associates does not involve any third-party direct marketing.

How long we keep your data

We hold your data for a period of 12 months, unless employment law requires us to hold it for longer (as with direct permanent employment).

How we store your data

CRM: all electronic data is stored in a secure, restricted-access web hosting environment.
Internal computer drive: storage of candidate details. The drive is password protected (available to Andy File personnel only), and details are archived after 12 months; the archive is also password protected.
Hard copies: registration forms and paper CVs are kept in a lockable cabinet, the key held by the DPO, and stored for 12 months.
Temporary storage on email and mobile phones (generally when meeting candidates off site), deleted once transferred to the internal computer drive, within 30 days.

How we delete and archive data

CRM: all electronic data is archived within 12 months of registration (archive is password protected and available to senior management only) and deleted from the CRM within 12 months, unless you ask us to delete it sooner.
Hard copies: retained for 12 months, after which they are removed and destroyed by a registered confidential-waste company within a 6-month period.
Temporary storage on email/phones: responsibly deleted by all staff within 30 days of obtaining the data.

Your rights

You have rights under data protection law, which you can exercise free of charge except in very limited circumstances (which we will explain to you if relevant). These rights do not apply in all circumstances.

Right of access: to request access to your personal data, confirmation that it is being processed, and certain information about how it is processed.
Right of rectification: to ask for your personal data to be corrected if it is inaccurate, and completed if it is incomplete.
Right to erasure ("to be forgotten"): in certain circumstances, to ask us to erase your personal data. We may be unable to do so where, for example, a legal duty or employment law requires us to retain it.
Right to restriction of processing: in certain circumstances, to ask us to restrict how we process your data.
Right of portability: in certain circumstances, to move, copy or transfer your personal data. This applies where processing is based on consent or a contract and is carried out automatically.
Right to object: in certain circumstances, to object to processing based on legitimate interests, direct marketing, or statistics.

Automated decision-making

Andy File Associates does not make automated decisions, and does not profile your data for marketing or communication purposes. We do not carry out automated decision-making that would produce legal or other significant effects on you. Where we rely on consent as the legal basis for using your data, you can withdraw it at any time.

Cookies

Our website uses only minimal, privacy-respecting cookies and does not use advertising or analytics tracking. For full details, see our Cookie Policy.

Complaints

If you have a concern about how we handle your personal data, please contact us first so we can try to put things right. You also have the right to lodge a complaint with the Information Commissioner's Office (ICO), the UK supervisory authority, at ico.org.uk.

Changes to this policy

We review this Privacy Policy regularly and may make changes at any time to reflect changes in our business and legal requirements. Updates are published on this page; please check the "last updated" date above.

Contact us

For more information about your rights, or to exercise any of them, please contact our Data Protection Officer at dpo@andyfileassociates.com.

Andy File Associates Ltd, Aizlewoods Mill, Nursery Street, Sheffield, S3 8GG.