From candidates (practitioners):

• Full name, contact details (email address, phone number)

• Location and travel preferences

• CV and employment history

• Qualifications (Level 2/3, CACHE, NVQ, etc.)

• DBS status (we record whether you hold a DBS certificate and its type — we do not retain or copy the certificate itself)

• Notes from our conversations about your job preferences and experience

From nurseries and employers:

• Contact name, job title, email address and phone number

• Nursery name, address and Ofsted registration details

• Vacancy details and hiring requirements

From website visitors:

• Enquiry form submissions (name, email, message)

• Standard server logs (IP address, browser type, pages visited) — collected automatically by our hosting provider, Squarespace

We collect and use your data on the following legal bases under UK GDPR:

Legitimate interest — to match candidates with suitable nursery roles and to provide recruitment services to nurseries seeking qualified practitioners.

Contract performance — to fulfil our obligations when a placement is made.

Legal obligation — to comply with our duties under employment agency legislation.

We use candidate data to: contact you about relevant roles, introduce you to nurseries we work with, and maintain a record of your registration and preferences.

We use nursery/employer data to: understand your hiring requirements, introduce suitable candidates, and manage our commercial relationship.

We do not use your data for automated decision-making or profiling.

We share candidate information with nurseries only when we believe there is a genuine match and only with your knowledge. We do not share your data with third parties for marketing purposes.

We use the following third-party services to operate our business:

• Microsoft 365 — for email and file storage (data processed within the UK/EU)

• Squarespace — for our website and contact forms

• Microsoft SharePoint — for our candidate and client database

• Make.com — for workflow automation

All third-party providers are contractually required to handle your data securely and in accordance with UK GDPR.

Data type and Retention period

• Candidate registrations (active) - Duration of active job search + 12 months

• Candidate records (placed) - 3 years from placement date

• Candidate records (no placement made) - 12 months from last contact

• Nursery client records - Duration of relationship + 3 years

• Enquiry form submissions - 6 months

• Financial records (invoices etc.) - 7 years (legal requirement)

After these periods, data is securely deleted from all systems.

Under UK GDPR you have the right to:

• Access — request a copy of the personal data we hold about you

• Correction — ask us to correct inaccurate or incomplete data

• Erasure — ask us to delete your data (subject to any legal obligations to retain it)

• Restriction — ask us to limit how we use your data

• Portability — receive your data in a portable format

• Object — object to our use of your data where we rely on legitimate interest

To exercise any of these rights, email us at josh@harbourtalent.uk. We will respond within 30 days.

If you are unhappy with how we handle your data, you have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk or by calling 0303 123 1113.

Our website is hosted on Squarespace, which uses cookies for essential site functionality and analytics. You can manage cookie preferences via the cookie banner when you first visit the site. For full details of Squarespace's cookie use, see squarespace.com/privacy.

We may update this policy from time to time. The date at the top of this page will always show when it was last updated. We recommend checking back periodically.

If you have any questions about this privacy policy or how we handle your data:

Harbour Talent Email: josh@harbourtalent.uk