Privacy Policy

Last updated: 17 March 2026

1. Introduction

YOUR DWM LIMITED ("we", "us", or "our") is committed to protecting the privacy and security of personal data. This Privacy Policy explains how we collect, use, store, and protect personal information through DWMTrak, our candidate tracking and recruitment management system ("the Service").

We are the data controller for the personal data processed through the Service and are registered with the Information Commissioner's Office (ICO) in the United Kingdom.

2. Legal Basis for Processing

We process personal data under the following legal bases as defined by the UK GDPR:

  • Legitimate interests: Processing candidate data for recruitment purposes, managing applications, and improving our hiring processes
  • Contractual necessity: Processing data to progress job applications and potential employment relationships
  • Legal obligation: Retaining records as required by employment law and regulatory requirements
  • Consent: Where candidates have provided explicit consent for specific processing activities
3. Personal Data We Collect

We collect and process the following categories of personal data:

Candidate Data
  • Identity information: Name, date of birth, nationality
  • Contact information: Email address, phone number, postal address
  • Application information: CV/resume, cover letter, position applied for, application status
  • Documents: Photo ID, right to work documents, qualifications, references
  • Assessment data: Interview notes, assessment centre results, hiring decisions
  • Source information: How the candidate found us (job board, referral, etc.)
User Data (Staff)
  • Account information: Username, email address, role
  • Activity logs: Actions taken within the system for audit purposes
  • Authentication data: Login timestamps, MFA settings (secrets are encrypted)
4. How We Use Personal Data

We use personal data for the following purposes:

  • Managing and progressing job applications through our recruitment pipeline
  • Communicating with candidates about their applications
  • Scheduling and managing assessment centres and interviews
  • Verifying candidate identity and right to work
  • Making informed hiring decisions
  • Maintaining audit trails for compliance and security
  • Improving our recruitment processes through reporting and analytics
  • Sending candidates portal access links to manage their applications
5. Data Sharing

Personal data processed through DWMTrak is used internally within YOUR DWM LIMITED for recruitment purposes only. We do not sell, rent, or share candidate data with third parties for marketing purposes.

We may share data with:

  • Service providers: Email delivery services (for sending communications)
  • Google: Calendar integration for scheduling (assessment centre events only, no personal candidate details)
  • Legal authorities: When required by law or to protect our legal rights
6. Data Retention

We retain candidate personal data for 6 years from the date of last activity or the conclusion of the recruitment process, whichever is later. This retention period aligns with UK statutory requirements for employment records and limitation periods for potential claims.

After the retention period, personal data is securely deleted or anonymised.

Audit logs and system records may be retained for longer periods for security, legal compliance, and operational purposes.

7. Data Security

We implement appropriate technical and organisational measures to protect personal data, including:

  • Encrypted password storage using industry-standard hashing algorithms
  • Role-based access controls limiting data access to authorised personnel
  • Optional Multi-Factor Authentication (MFA) for user accounts
  • Comprehensive audit logging of all data access and modifications
  • Secure session management with automatic timeouts
  • Magic link authentication for candidate portal access (time-limited, single-use tokens)
8. Your Rights

Under UK GDPR, you have the following rights regarding your personal data:

  • Right of access: Request a copy of your personal data
  • Right to rectification: Request correction of inaccurate or incomplete data
  • Right to erasure: Request deletion of your data (subject to legal retention requirements)
  • Right to restrict processing: Request limitation of how we use your data
  • Right to data portability: Receive your data in a structured, commonly used format
  • Right to object: Object to processing based on legitimate interests
  • Right to withdraw consent: Withdraw consent at any time where processing is based on consent

To exercise any of these rights, please contact us using the details provided below. We will respond to your request within one month.

9. Candidate Portal

Candidates may be provided access to a self-service portal where they can:

  • View their application status
  • Upload and manage documents
  • Update their contact information

Portal access is provided via secure magic links sent to the candidate's registered email address. These links expire after 1 hour for security purposes.

10. Cookies and Tracking

The Service uses essential cookies for authentication and session management. These cookies are strictly necessary for the Service to function and cannot be disabled.

We do not use tracking cookies, analytics cookies, or advertising cookies.

11. International Transfers

Personal data is primarily stored and processed within the United Kingdom. If any data is transferred outside the UK, we ensure appropriate safeguards are in place in accordance with UK GDPR requirements.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any significant changes by posting the updated policy on this page with a new "Last updated" date.

13. Complaints

If you are unhappy with how we have handled your personal data, you have the right to lodge a complaint with the Information Commissioner's Office (ICO):

Information Commissioner's Office
Wycliffe House, Water Lane
Wilmslow, Cheshire SK9 5AF
Website: ico.org.uk
Helpline: 0303 123 1113
14. Contact Us

If you have any questions about this Privacy Policy or wish to exercise your data protection rights, please contact us:

YOUR DWM LIMITED
Data Protection Enquiries
Company Number: 14752156
2nd Floor, 3-5 St Pauls Square
Birmingham, West Midlands, B3 1QU
United Kingdom

Email: recruitment@dwmas.co.uk