Privacy & Cookie Policy

Giusto Care Recruitment Ltd ("we", "us", "our") is committed to protecting your privacy. This policy explains how we handle your personal data in line with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. Please read it carefully.

1. Who we are

Giusto Care Recruitment Ltd is a nurse-led healthcare staffing agency based in Northampton, Northamptonshire. We are the data controller responsible for your personal data. We are registered with the Information Commissioner's Office (ICO).

2. What personal data we collect

Depending on whether you are a care worker, a client, or a website visitor, we may collect:

If you are a care worker

• Identity and contact details (name, address, date of birth, phone, email)
• National Insurance number and right-to-work documentation
• DBS certificate details and disclosure information
• NMC registration (for nurses) and training certificates
• Employment history and references
• Bank details (for payroll only)
• Health information relevant to your role (special category data)

If you are a client

• Organisation name, address and CQC registration number
• Contact names, phone numbers and email addresses
• Shift requirements and placement records

If you visit our website

• Information you submit via contact or enquiry forms
• Limited technical data via essential cookies (see section 8)

3. How we use your data

We use your personal data to:

• Assess your suitability for care work and introduce you to clients
• Match suitable workers to client shift requirements
• Carry out vetting (DBS, references, right-to-work, training checks)
• Process timesheets, invoices and weekly payments
• Meet our legal, regulatory and safeguarding obligations
• Respond to your enquiries and provide customer support

4. Our legal basis for processing

We rely on the following lawful bases under UK GDPR: contract (to provide our staffing service), legal obligation (safeguarding, employment and tax law), legitimate interests (running and improving our agency), and consent (for marketing and certain optional cookies). For special category data such as health and DBS information, we rely on the "employment, social security and social protection" and "safeguarding" conditions.

Criminal record information. We process DBS and criminal-record information because the law and our clients’ regulators require us to check that people are suitable to work with vulnerable adults. We record the certificate number, issue date and outcome of each check, and we limit who can see it. We do not keep a copy of a DBS certificate for longer than the DBS code of practice allows.

5. Who we share your data with

We only share your data where necessary:

• Clients — we share relevant worker details (including DBS status and training) with care homes and organisations for the purpose of placements
• Regulatory bodies — the DBS, NMC, CQC or local safeguarding authorities where required by law
• Service providers — payroll, umbrella companies and IT providers who process data on our behalf under contract. These include our secure database and file-storage provider (hosted in the UK, London), our website and application hosting provider, and our email delivery provider. Each may only use your data to provide its service to us
• Referees — we contact the referees you name so that we can obtain your references
• HMRC and authorities — where legally required

We never sell your personal data to third parties. Where a provider processes data outside the UK, we make sure an appropriate safeguard is in place, such as the UK International Data Transfer Agreement or UK Addendum, or an adequacy decision.

6. How long we keep your data

We keep personal data only for as long as we need it. As a guide:

• Worker and client records (registration, vetting, placements) — for at least one year after our last dealings, as the Conduct of Employment Agencies and Employment Businesses Regulations 2003 require, and for longer where the law or a legitimate claim requires it
• Payroll, timesheet and invoice records — up to six years, for tax and accounting purposes
• DBS information — the certificate number, date and outcome for as long as your registration is active; any copy of a certificate for no longer than the DBS code of practice permits
• Website enquiries — up to 12 months unless they become a client or worker record

After these periods your data is securely deleted or anonymised.

7. Your rights

Under UK GDPR you have the right to:

• Access the personal data we hold about you
• Request correction of inaccurate data
• Request erasure of your data (where no legal obligation requires us to keep it)
• Restrict or object to certain processing
• Data portability
• Withdraw consent at any time (where we rely on consent)

To exercise any of these rights, contact us using the details in section 10.

8. Cookies

Cookies are small text files stored on your device. We use a minimal, privacy-friendly approach:

• Essential cookies — required for the website and portal to function (for example, remembering your cookie choice and keeping you logged in). These are always on.
• Analytics cookies (optional) — if enabled, these help us understand how visitors use the site so we can improve it. We only set these with your consent.

You can accept or decline optional cookies using our cookie banner, and you can change your choice at any time by clearing your browser data. You can also control cookies through your browser settings.

9. How we keep your data secure

We take appropriate technical and organisational measures to protect your data. Our online system requires a login for every user, requires a second verification step for our staff, and limits each person to the information they need: for example, workers see only their own records and clients see only their own bookings. Documents you upload are stored in private storage and only accessed by authorised staff for legitimate purposes. Changes to personal data are recorded in an audit log. No system is completely secure, so if we ever suffer a breach that puts your rights at risk we will tell you and the ICO as the law requires.

10. Contact us & complaints

If you have any questions about this policy or wish to exercise your rights, please contact us:

If you are not satisfied with our response, you have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk or by calling their helpline on 0303 123 1113.