Privacy Policy
Last updated: 25/02/2026
This Privacy Policy explains how McRoberts (“we”, “us”, “our”) collects, uses, shares, and protects personal data when you visit our website, contact us, post a job, apply for a role, or join our candidate database.
This Policy applies to:
- Website visitors
- Employers and business contacts
- Jobseekers and candidates
It should be read alongside our Cookie Policy.
1) Who we are
McRoberts is the data controller for personal data collected through this website, unless stated otherwise below.
Address: The Old Brewery, 50 Stratford Road, Shipston-on-Stour, Warwickshire, CV36 4BA
Phone: +44 2475 262 639
Email: joe@mcroberts.co.uk
If you are applying for a job advertised on our Site, the employer advertising the role may be the data controller for your application data. See section 5.
2) The personal data we collect
The data we collect depends on how you use the Site.
A) Website visitors
- IP address (and approximate location derived from it)
- Device and browser details
- Pages viewed and interactions
- Referral/source information (e.g., ads or campaigns)
B) Employers and business contacts
- Name, work email, job title, company, phone number
- Enquiry details and messages
- Information about hiring needs (roles, locations, volumes, timelines)
- Contract and billing information (where applicable)
C) Jobseekers / candidates
Depending on the form you complete, we may collect:
- Name, email, phone number
- Location (e.g., postcode) and role preferences
- CV (if provided) and/or employment history
- Qualifications, licences, eligibility/right-to-work confirmations (where relevant)
- Screening responses (e.g., availability, experience, commute)
- Any information you include in messages or free-text fields
Please do not include special category data (e.g., health information) unless it is specifically requested and necessary for the recruitment process.
3) How we use your personal data
We use personal data for the purposes below:
Website operations
- To provide and secure the Site
- To troubleshoot issues and prevent fraud/abuse
- To store your cookie preferences
Employer enquiries and services
- To respond to enquiries and provide information you request
- To set up and manage employer access (where applicable)
- To provide recruitment marketing, screening, and automation services
- To provide reporting and service communications
Job applications and candidate processing
- To enable you to apply for roles and to pass your application to the relevant employer
- To operate screening and routing workflows so employers receive suitable applications
- To communicate with you about your application (e.g., confirmations, requests for missing info)
Candidate database / job alerts (where you register)
- To create and maintain your candidate profile (with the information you provide)
- To match you to relevant roles and send job alerts or invitations to apply
- To share your details with employers where appropriate as part of the recruitment process (see section 5)
- To allow you to update preferences or opt out
Marketing (employers and candidates)
- To send marketing communications where permitted (see lawful bases below)
- To measure campaign performance and improve our marketing
4) Our lawful bases for processing (UK GDPR)
We process personal data under one or more of the following legal bases:
- Contract / steps to enter a contract: e.g., providing services to employers, enabling applications, providing access to tools.
- Legitimate interests: e.g., responding to enquiries, improving the Site, preventing fraud, measuring performance, and operating recruitment processes efficiently (balanced against your rights).
- Consent: e.g., where you choose to receive marketing communications or where cookies/trackers require consent.
- Legal obligation: e.g., compliance with applicable laws and regulatory requirements.
You can withdraw consent at any time (e.g., via unsubscribe links or cookie settings). Withdrawal does not affect processing that has already occurred.
5) Recruitment data roles: when McRoberts is the Controller vs Processor
How personal data is controlled and processed depends on which McRoberts service you are using.
A) McRoberts Jobs Platform (McRoberts as Data Controller)
When an employer posts a job on the McRoberts Jobs Platform, McRoberts is the Data Controller for the personal data collected and processed through the platform (for example, when you register, apply for a role, complete screening questions, or join the McRoberts candidate database/job alerts where offered).
We use this data to operate the platform, run screening and matching, communicate with you about your application or relevant roles, and share your application with the relevant employer.
Once your application is shared with an employer, that employer will usually become an independent Data Controller for the copy of your data they receive, and they will handle it in line with their own recruitment processes and privacy information.
B) Managed services (Client as Data Controller; McRoberts as Data Processor)
For certain managed recruitment marketing and hiring services (for example, fully managed campaigns where the client controls the recruitment process and systems), the client is the Data Controller for candidate personal data, and McRoberts acts as the Data Processor, processing personal data only on the client’s documented instructions.
Where we act as a processor, we do so under a Data Processing Agreement (DPA) and apply appropriate technical and organisational measures to protect personal data.
What this means in practice
- If you are a candidate, the way your data is used may differ depending on whether you apply via the McRoberts Jobs Platform or via a client-managed process.
- If you are an employer, the controller/processor position will be defined in your contract and supporting documents (including DPAs where relevant).
If you are unsure which model applies to a particular role or process, contact us using the details in section 1.
6) Cookies, analytics and advertising
We use cookies and similar technologies as described in our Cookie Policy. We use a range of analytics and advertising tools, which may include:
- Google Analytics 4 (GA4)
- Google Tag Manager (GTM)
- Google Ads
- Meta (Facebook/Instagram)
- LinkedIn (Insight Tag)
- Microsoft Ads
- Microsoft Clarity
- HubSpot (forms/CRM/marketing attribution, where enabled)
These tools help us understand usage, measure conversions, and improve marketing effectiveness. Where required by law, non-essential cookies are only used after consent via your cookie settings.
7) Who we share personal data with
We may share personal data with:
Employers (recruitment recipients)
If you apply for a role or join our candidate database, we may share relevant details with employers who are recruiting for roles that match your profile, so they can review and progress your application.
Service providers (processors)
We use trusted providers to operate the Site and deliver services, such as:
- Website hosting and publishing (e.g., Webflow)
- CRM, forms, marketing and automation (e.g., HubSpot)
- Analytics and performance tools (e.g., Google, Microsoft Clarity)
- Advertising platforms (e.g., Google Ads, Meta, LinkedIn, Microsoft Ads)
- ATS integrations and workflow tools (where configured)
We only share what is necessary, and we expect providers to protect data appropriately.
Legal and safety
We may disclose data if required to comply with law, enforce agreements, or protect rights, safety, or security.
8) International transfers
Some of our service providers may process data outside the UK (for example, in the US). Where this happens, we use appropriate safeguards, such as the UK International Data Transfer Addendum, Standard Contractual Clauses, and/or other recognised mechanisms, plus additional security measures where appropriate.
9) Data retention
We keep personal data only for as long as necessary for the purposes described in this Policy, including:
- Employer enquiries: retained for a reasonable period to manage the relationship and follow up.
- Candidate applications: retained to support the recruitment process and for audit/defence of claims where necessary.
- Candidate database profiles: retained while your profile remains active, and removed or anonymised after a period of inactivity or upon request (subject to legal requirements).
- Analytics data: retained in line with tool settings and our internal retention practices.
You can request deletion at any time (see section 11), and we will comply unless we have a lawful reason to retain the data.
10) Security
We take security seriously and apply appropriate technical and organisational measures to protect personal data. We are Cyber Essentials Plus certified, and we use controls such as access restriction, secure configuration, and governance over the tools we use to process data.
No method of transmission or storage is 100% secure, but we work to maintain strong protections and respond quickly to security issues.
11) Your rights
Under UK GDPR, you may have rights including:
- Access to your personal data
- Correction of inaccurate data
- Deletion (in certain circumstances)
- Restriction of processing
- Objection to processing (including some processing based on legitimate interests)
- Data portability (in certain circumstances)
- Withdraw consent (where processing is based on consent)
To exercise your rights, contact us using the details in section 1. We may need to verify your identity before responding.
12) Complaints
If you have concerns about our use of personal data, please contact us first and we’ll try to resolve it.
You also have the right to lodge a complaint with the UK supervisory authority:
Information Commissioner’s Office (ICO)
13) Children
Our Site is not intended for children, and we do not knowingly collect personal data from children.
14) Links to other sites
Our Site may link to third-party websites. We are not responsible for their privacy practices. Please review their policies.
15) Changes to this Privacy Policy
We may update this Policy from time to time. The “Last updated” date shows when it was most recently revised.
