LEGAL / CANDIDATES
Candidate Privacy Notice
LAST UPDATED · 21 AUGUST 2026
1. Why you are reading this
MARK22 is a specialist technology recruitment agency. We introduce candidates to companies hiring for permanent technology roles, currently with a focus on DevOps, Platform and Cloud Engineering.
You may be reading this because you contacted us, applied for a role, were referred to us, or because we found your professional profile on LinkedIn or another public professional source and got in touch. This notice explains what we do with your information either way.
We are the data controller for your information.
2. How to contact us
Company
MARK22 LTD
Company number
17413098
Registered office
4–6 Greatorex Street, London, England, E1 5NF
For anything relating to your information — including asking us to delete it — email general@mark22.co.uk.
3. We never charge candidates
MARK22 does not charge candidates any fee for our services. Our fees are paid by the hiring company.
4. What information we process
Depending on how far you go in the process, we may process:
Identity and contact information
Name, email address, telephone number, general location (for example city or region).
Professional information
CV, employment history, current and previous employers and job titles, education and qualifications, technical skills and experience, certifications, LinkedIn or other public professional profile information, public code repositories or portfolios where you have made them public.
Preferences
Salary expectations, notice period, availability, working arrangement preferences (remote, hybrid, on-site), the types of role and company you are interested in.
Process information
Roles you have agreed to be put forward for, interview arrangements and outcomes, feedback from clients, offer details, and our correspondence and notes.
Where relevant and appropriate
References, identity information, and information about your authorisation or right to work.
We do not routinely ask for special-category data or criminal-offence data. Special-category data includes information about health, racial or ethnic origin, religion or belief, sexual orientation, political opinions, trade union membership, and genetic or biometric data. Information about criminal convictions and offences is subject to separate legal protections.
We will only process special-category data or criminal-offence data where it is necessary for a legitimate recruitment or legal purpose and where an appropriate additional legal condition applies. If you send us this type of information when it is not required, we may delete it.
Please do not send us your bank details, National Insurance number, passport or other identity documents unless we have specifically asked for them and explained why they are needed.
5. Where your information comes from
Directly from you — when you contact us, apply, send a CV, speak to us, or complete a form
From public and professional sources — LinkedIn and other professional networking platforms, public code repositories, public portfolios, professional communities, and job boards where you have made your profile visible to recruiters
From referrals — where someone recommends you to us. If you were referred, we will tell you who referred you if you ask
From clients — feedback following an interview
From referees — where you have agreed to a reference being taken
If we obtained your information from a public source rather than from you, we will provide you with this notice when we first contact you, and in any event within one month of obtaining your information.
6. Why we process your information, and our lawful basis
Contact you about roles that may suit your experience
Why: To provide recruitment services and match people to relevant opportunities
Lawful basis: Legitimate interests
Keep a record of your experience, skills and preferences
Why: To identify relevant roles now and in future
Lawful basis: Legitimate interests
Discuss a specific role with you and, with your agreement, put you forward
Why: To provide our recruitment service to you and to our client
Lawful basis: Legitimate interests
Arrange and support interviews, and pass on feedback
Why: To manage the recruitment process
Lawful basis: Legitimate interests
Support offer and start-date discussions
Why: To complete a placement
Lawful basis: Legitimate interests
Keep limited records of placements and fees
Why: To run our business and meet contractual, tax, accounting and regulatory requirements
Lawful basis: Legitimate interests; legal obligation
Handle identity, authorisation or right-to-work information, where applicable
Why: To meet relevant recruitment-sector requirements, confirm suitability for a role, or respond to a client’s legitimate requirements
Lawful basis: Legitimate interests; legal obligation where applicable
Our legitimate interests are in operating a recruitment business, helping people find suitable work, and helping companies fill roles. We have considered your interests and rights, and we limit what we collect to what is genuinely relevant to recruitment in our niche.
You have the right to object. Because most of our processing relies on legitimate interests, you can object at any time — including simply telling us to stop contacting you or asking us to delete your details. Email general@mark22.co.uk. We will consider and respond to your request and will stop the relevant processing unless we have a compelling lawful reason to continue or need the information to establish, exercise or defend legal claims.
7. How your information is shared with prospective employers
This is the part that matters most, so we want to be clear about it.
We will not send your CV or identifiable details to a company without telling you first and getting your agreement.
In practice:
Before any introduction, we tell you which company the role is with, what the role is, the salary range, the location and working arrangement, and anything else material we know about it.
If you are not interested, nothing is shared. We do not put you forward “just in case”, and we do not treat general conversations about your experience as permission to submit you anywhere.
Where we discuss the market with a client before you have agreed to anything, we do so on an anonymous basis — for example describing experience level, technical stack and availability, without your name, current employer or contact details, and without anything that would identify you.
Only once you have agreed to a specific role do we share your CV and identifying details with that specific client.
Your agreement is specific to that role. We do not treat it as blanket permission to share your details with other companies.
Your agreement to an introduction is a safeguard we apply as a matter of practice; the legal basis on which we process your information remains legitimate interests. That means withdrawing your agreement to an introduction, or objecting to our processing more generally, does not depend on us — you can do either at any time.
We may also share your information with:
Our service providers — email, storage, CRM, communications and IT providers acting on our instructions (see section 9)
Our professional advisers — where relevant, such as accountants, lawyers or insurers
HMRC, regulators or law enforcement — where legally required
We do not sell candidate information.
8. What happens to your information at the client
Once we introduce you to a client and you agree to proceed, that client becomes a data controller in its own right for the information it holds about you. What the client does with your information after that — including how long it keeps it and how it runs its own process — is governed by that company’s privacy notice, not this one. We ask clients to use candidate information only for legitimate recruitment purposes and to keep it secure, but they make their own decisions about it.
9. Systems and providers
We use the following to run our business:
Email and document storage
Microsoft 365 / Outlook
CRM and candidate database
Airtable
Website
Framer
Sourcing and professional networking
Messaging
WhatsApp Business
Accounting
Xero
Banking
Starling Bank
We may use other recruitment, communications or cloud providers where necessary, and we put written terms in place with providers who handle personal information for us.
10. International transfers
Some of our providers may store or access personal information outside the UK, including in the United States and the European Economic Area.
Where personal information is transferred outside the UK, we take steps to ensure the transfer is lawful and that appropriate safeguards are in place. Depending on the provider and destination, these may include UK adequacy regulations, the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, or the UK Extension to the EU–US Data Privacy Framework.
You can contact us at general@mark22.co.uk if you would like more information about the safeguards relevant to your information.
11. How long we keep your information
General candidate profile, CV, skills and preferences where no placement occurs
24 months from our last meaningful contact with you, then reviewed and deleted or anonymised unless you ask us to keep it longer
General candidate profile, CV, skills and preferences following a placement
24 months from our last meaningful contact with you, then reviewed and deleted or anonymised unless there is a specific reason to retain particular information for longer
Limited placement, contractual, financial and compliance records
Up to 6 years from the placement start date where needed for contractual records, legal claims, tax, accounting or regulatory requirements
Records where you have asked us to stop contacting you
A minimal suppression record only, kept so that we do not contact you again
You can ask us to delete your information sooner at any time. We will comply unless we have a specific lawful reason to retain some or all of it, such as meeting a legal obligation or establishing, exercising or defending legal claims.
We review the information we hold periodically and apply these periods across the systems we use.
12. Security
We take reasonable technical and organisational steps to protect your information, including access controls, multi-factor authentication where available, use of reputable providers, and keeping access limited to what is needed. No system can be guaranteed completely secure. If a breach occurs that is likely to result in a risk to you, we will notify the ICO and, where required, you.
13. Automated decision-making
We do not make decisions about candidates based solely on automated processing. We may use search filters and database tools to identify potentially relevant profiles, but a person always decides who to contact and who to put forward.
14. Your rights
You have the right to:
Be informed about how we use your information
Access a copy of the information we hold about you
Rectify anything inaccurate or incomplete
Erase your information in certain circumstances
Restrict how we process it in certain circumstances
Portability of information you gave us, in certain circumstances
Object to processing based on legitimate interests — including our contacting you about roles
Withdraw consent, where we have relied on consent
To exercise any of these, email general@mark22.co.uk. We will respond within one month, normally free of charge. We may ask you to confirm your identity first.
15. Complaints
Please contact us first at general@mark22.co.uk so we can put things right. You can also complain to the ICO at any time:
Information Commissioner’s Office
Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
Helpline: 0303 123 1113
16. Changes
We may update this notice. The current version is always at mark22.co.uk, with the date it was last revised at the top.