1. Who we are
Digimasters Ltd (“Digimasters”, “we”, “us” or “our”) is the data controller for the personal data described in this policy. This means we decide how and why your personal data is used.
- Registered in England and Wales, company number 10917139
- Registered office: 12 Nut Grove, Welwyn Garden City, England, AL8 7SQ
- Registered with the Information Commissioner's Office (ICO), registration number Z7482916
- Privacy contact: support@digimasters.co.uk
We process personal data in line with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations 2003 (PECR), as amended by the Data (Use and Access) Act 2025. Section 15 contains additional information for people in the United States.
2. Who this policy applies to
This policy applies to:
- visitors to our website
- prospective clients, clients' staff and other business contacts
- job applicants and candidates for roles or contractor engagements with Digimasters
Our employees and contractors receive a separate staff privacy notice when they join us.
This policy does not cover personal data that we process on behalf of our clients when delivering services to them. In that situation our client is the controller, and we act as their processor (or “service provider” or “processor” under US state laws) under a written contract. Please see the relevant client's privacy notice for information about that processing.
3. What personal data we collect
3.1 Website visitors
- Technical data, such as your IP address, browser type and version, device type, time zone setting and operating system
- Usage data, such as the pages you visit, the links you click and how long you spend on each page, collected through cookies and similar technologies (see our Cookie Policy)
- Information you give us when you complete a contact or enquiry form, such as your name, email address, company and message
3.2 Business contacts and clients
- Name, job title, employer, business email address and telephone number
- Records of our correspondence and meetings with you
- Your marketing preferences
3.3 Job applicants
- Name and contact details (email address, telephone number and postal address)
- CV, covering letter and any supporting documents you provide
- Work history, qualifications, education and professional certifications
- References and information provided by referees
- Right-to-work documents and identity verification information, such as a passport or visa
- Current or most recent pay and notice period, where relevant
- Interview notes and assessment results
- Any other information you choose to share with us during the recruitment process
3.4 Criminal record checks
For certain roles, we carry out a basic criminal record check through the Disclosure and Barring Service (or Disclosure Scotland) after we have made a conditional offer. We only do this where it is relevant to the role, and we will tell you before any check takes place. We rely on the conditions in Schedule 1 of the Data Protection Act 2018 relating to employment, and we have an appropriate policy document that explains how we protect this information.
3.5 Special category data
We do not ask for special category data (such as information about your health, ethnicity, religion or sexual orientation) as part of our standard recruitment process. If you tell us about a disability or health condition so that we can make reasonable adjustments, we process that information because it is necessary for us to meet our obligations as an employer under the Equality Act 2010 (UK GDPR Article 9(2)(b) and Schedule 1, paragraph 1 of the Data Protection Act 2018). We keep an appropriate policy document covering this processing, and we only share the information with the people who need it to make the adjustments.
4. Where we get your personal data from
- From you, when you apply for a role, contact us, complete a form on our website or meet with us
- From third parties, including recruitment agencies, professional networks such as LinkedIn, referees and, where applicable, background check providers
- Automatically, through cookies and similar technologies when you use our website (see our Cookie Policy)
5. How we use your personal data and our lawful basis
UK GDPR requires us to have a lawful basis for each way we use your personal data. The table below sets out each purpose and the basis we rely on.
| Purpose | Personal data used | Lawful basis |
|---|
| Responding to enquiries through our website or by email | Contact details and your message | Legitimate interests: responding to people who contact us |
| Managing our relationship with clients and business contacts | Business contact details and correspondence | Contract, where you or your employer is our client; otherwise legitimate interests in running our business |
| Sending business-to-business marketing emails | Business contact details and marketing preferences | Legitimate interests in promoting our services to businesses, or consent where PECR requires it (see Section 8) |
| Running, securing and improving our website | Technical and usage data | Legitimate interests in keeping our website secure and working well; consent for non-essential cookies |
| Assessing job applications and running interviews | Applicant data listed in Section 3.3 | Steps taken at your request before entering into a contract with you; legitimate interests in recruiting suitable people |
| Using AI tools to help review applications (see Section 7) | CV and application materials | Legitimate interests in reviewing applications efficiently and consistently, subject to the safeguards in Section 7 |
| Checking your right to work in the UK | Identity and right-to-work documents | Legal obligation under the Immigration, Asylum and Nationality Act 2006 |
| Taking up references | Referee details and references | Legitimate interests in verifying information about candidates |
| Keeping your details for future roles (talent pool) | Applicant data | Consent, which you can withdraw at any time |
| Making reasonable adjustments | Health or disability information you give us | Legal obligation; Article 9(2)(b) UK GDPR |
| Dealing with legal claims and complaints | Any relevant data | Legitimate interests in defending our legal position |
| Complying with the law and regulators | Any relevant data | Legal obligation |
Where we rely on legitimate interests, we have balanced our interests against your rights and freedoms. You can ask us for more information about that balancing exercise, and you have the right to object (see Section 12). Where we rely on consent, you can withdraw it at any time by contacting support@digimasters.co.uk. Withdrawing consent does not affect processing that took place before you withdrew it.
6. Do you have to give us your personal data?
You do not have to give us any personal data. However, if you apply for a role and do not provide the information we need to assess your application, we may not be able to consider you. If we make you an offer, you must provide proof of your right to work in the UK because the law requires us to check it. We cannot employ you without it.
7. Use of artificial intelligence in recruitment
We use AI tools to help our team review job applications. This section explains what the tools do, the safeguards in place and your rights.
7.1 What the AI tools do
AI tools may be used to:
- summarise CVs and application materials
- identify skills, qualifications and experience that match the requirements of the role
- suggest an order in which our team reviews applications
- help with interview note-taking and documentation
The tools we use are: ChatGPT (OpenAI, United States).
7.2 Human review of every application
We do not make recruitment decisions based solely on automated processing. A member of our team reviews every application in full before any decision is made or communicated, and no application is rejected by an AI tool. AI outputs are used to support our team's judgement.
We have completed a data protection impact assessment for our use of AI in recruitment and we review it whenever we change the tools or how we use them. We also check the tools' outputs regularly for accuracy and for signs of unfair bias.
7.3 AI providers
Where our AI tools are provided by third parties, those providers act as our processors under written contracts. The contracts require them to protect your personal data in line with UK GDPR and prevent them from using your data to train their models or for any purpose other than providing their service to us.
7.4 Your rights in relation to AI and automated decisions
In addition to your rights in Section 12, you can:
- ask for your application to be reviewed without the use of AI tools
- ask for an explanation of how AI tools were used in reviewing your application
- make representations to us about any decision about your application
- ask for a member of our team to reconsider any decision and contest a decision you disagree with
If we ever make a significant decision about you based solely on automated processing, we will tell you that we have done so, and you will have the right to make representations, to obtain human intervention and to contest the decision, as set out in Articles 22A to 22D of UK GDPR.
To exercise any of these rights, email support@digimasters.co.uk.
8. Marketing
We may send marketing emails about our services, events and insights to people at the businesses we work with or want to work with. We send these to corporate email addresses on the basis of our legitimate interests. If you are a sole trader or in a partnership, we will only send you marketing emails if you have agreed to receive them or you have bought or asked about similar services from us.
Every marketing email includes an unsubscribe link. You can also opt out at any time by emailing support@digimasters.co.uk. We will stop sending you marketing as soon as we can, and in any case within one month.
9. Who we share your personal data with
We do not sell your personal data. We share it only with:
- Service providers who process data on our behalf, such as cloud hosting providers, email and IT providers, AI tools and recruitment software platforms. All of them are bound by data processing agreements
- Recruitment agencies that referred you to us
- Referees and background check providers, with your knowledge
- Professional advisers, including solicitors, accountants, auditors and insurers, who are bound by duties of confidentiality
- Regulators, law enforcement bodies and courts, where the law requires us to disclose information
- A buyer or investor, if we sell or restructure all or part of our business, under strict confidentiality
10. International transfers
Some of our service providers, including Google (for website analytics) and some of our AI and software providers, store or access personal data outside the UK, mainly in the United States and the European Economic Area.
When personal data is transferred outside the UK, we make sure it is protected by one of the following:
- a UK adequacy decision (UK adequacy regulations), including the UK Extension to the EU-US Data Privacy Framework (the “UK-US data bridge”) where the US recipient is certified under it
- the International Data Transfer Agreement (IDTA) or the International Data Transfer Addendum to the EU Standard Contractual Clauses, both issued by the ICO
You can ask us for more information about the safeguards used for a particular transfer by emailing support@digimasters.co.uk.
11. How long we keep your personal data
| Type of data | How long we keep it |
|---|
| Unsuccessful job applicants | Six months from the date we tell you our decision, so that we can deal with any questions, complaints or legal claims |
| Talent pool (with your consent) | Up to 12 months from the date you give consent, unless you withdraw consent sooner |
| Successful applicants | Your application data becomes part of your staff record, which is covered by our staff privacy notice |
| Right-to-work documents | For the duration of employment and two years after it ends, as required by the Home Office |
| Website enquiries and business contact data | Up to two years from our last contact with you |
| Client contract and account records | Six years after the end of the contract, for legal and tax purposes |
| Marketing suppression list (people who have opted out) | For as long as we send marketing, so that we do not contact you again |
| Website analytics data | Up to 14 months |
At the end of each period we securely delete your personal data or anonymise it so that it can no longer be linked to you. We review the data we hold regularly to make sure these periods are applied.
12. Your rights
Under UK GDPR you have the right to:
- Access a copy of the personal data we hold about you
- Rectification of inaccurate or incomplete data
- Erasure of your data, unless we have to keep it for legal reasons
- Restriction of how we use your data in certain circumstances
- Data portability, meaning you can receive data you gave us in a structured, machine-readable format
- Object to our use of your data where we rely on legitimate interests, and to object at any time to direct marketing
- Withdraw consent at any time where we rely on consent
- Rights relating to automated decision-making, as described in Section 7.4
To exercise any of your rights, email support@digimasters.co.uk. There is no charge. We will respond without undue delay and within one month. The month starts when we receive your request, or when we have confirmed your identity if we need to. If your request is complex or you make several requests, we may extend this by up to two further months and we will tell you why within the first month. If we need you to clarify what information you are asking for, we may pause the time limit until you reply.
13. How to complain
If you are unhappy with how we have handled your personal data, please tell us first so that we can try to put things right. You can complain to us:
- by email: email us about a data protection complaint, or write to support@digimasters.co.uk with “Data protection complaint” in the subject line
- by writing to Data Protection, Digimasters Ltd, 12 Nut Grove, Welwyn Garden City, England, AL8 7SQ
We will acknowledge your complaint within 30 days of receiving it. We will then investigate, keep you updated on our progress, and give you our response without undue delay.
You also have the right to complain to the Information Commissioner's Office (ICO) at any time, at ico.org.uk/make-a-complaint or by calling 0303 123 1113. The ICO will usually expect you to have raised your complaint with us first.
14. How we protect your personal data
We use appropriate technical and organisational measures to protect your personal data against unauthorised access, accidental loss, alteration or disclosure. These include access controls, encryption, secure storage and regular staff training on data protection.
If a personal data breach is likely to result in a risk to your rights and freedoms, we will report it to the ICO within 72 hours of becoming aware of it. If the risk to you is high, we will tell you directly without undue delay. Where a breach affects people outside the UK, we will also meet the notification requirements of the laws that apply to them, including US state breach notification laws.
15. Information for people in the United States
- Effective date. This policy is effective from the “Last updated” date shown at the top of the page.
- Categories of information and who we share it with. These are described in Sections 3 and 9.
- Reviewing and correcting your information. You can ask to see or correct the personal information we hold about you by emailing support@digimasters.co.uk.
- Do Not Track. Our website does not currently respond to browser “Do Not Track” signals because there is no agreed industry standard for them. You can control cookies using the Cookie Settings link in our website footer.
- Third-party tracking. We allow Google Analytics to collect information about how you use our website. Google may collect information about your online activities over time and across different websites. We do not allow third parties to collect your information for advertising on our website. You can opt out of Google Analytics at tools.google.com/dlpage/gaoptout.
- Changes. We will post any changes to this policy on this page and update the “Last updated” date.
- Data breaches. If a data breach affects your personal information, we will notify you and any relevant state authority as required by the breach notification law of the state where you live.
16. Cookies
Our website uses cookies and similar technologies. Our Cookie Policy explains which cookies we use and how you can control them.
17. Changes to this policy
We may update this policy to reflect changes in the law, technology or our practices. The current version will always be on this page, with the date it was last updated. If we make significant changes, we will tell affected people directly where we can.
18. Contact us
If you have any questions about this policy or how we handle your personal data, please contact:
Data Protection, Digimasters Ltd
12 Nut Grove, Welwyn Garden City, England, AL8 7SQ
Email: support@digimasters.co.uk
Website: www.digimasters.co.uk