Privacy Policy
How Starff Ltd collects, uses and protects your personal data.
1. Who we are
Starff Ltd (“Starff”, “we”, “us”) is a temporary recruitment agency registered in England and Wales, operating across Greater London. We are the data controller for the personal data described in this policy. Contact: hello@starff.co.uk.
2. What we collect
Depending on how you use Starff, we may collect:
- Candidates: name, contact details, right-to-work documents, photo ID, certifications and licences, work history, bank details for payroll, timesheet and shift records.
- Employers: company and contact details, site addresses, booking and invoicing records.
- Website visitors: enquiry form submissions and basic usage analytics.
3. Why we use it
We process personal data to register and vet candidates, match workers to shifts, run payroll and invoicing, meet legal obligations (including right-to-work checks under UK immigration law), and respond to enquiries. Our lawful bases are contract, legal obligation and legitimate interest.
4. Who we share it with
Candidate profiles are shared with employers only to the extent needed to confirm a placement. We use vetted processors for payroll, document verification, secure storage, and AI tools that help our team summarise and organise information within the platform. We only ever share the minimum personal data needed for each purpose, and we never sell personal data.
5. How long we keep it
Candidate records are kept for the duration of registration and for the statutory retention periods that apply to recruitment, payroll and right-to-work records. Enquiry data is kept no longer than 12 months unless it becomes a client or candidate relationship.
6. International transfers
Most of your data is stored on servers within the European Union. In limited cases — for example the AI features that help our team summarise and organise information — some data may be processed by trusted providers located outside the UK and EU, including in the United States. Where this happens we rely on appropriate safeguards, such as the provider’s data-processing terms and standard contractual clauses, and we share only the minimum data needed. Our AI providers do not use your data to train their models.
7. Your rights
You can request access to, correction of, or deletion of your data, object to processing, and lodge a complaint with the ICO. Email us and we will respond within one month.
8. Security
Documents are stored encrypted, access is role-restricted, and portal access is protected by authentication. We review our security measures regularly.
9. Changes
We may update this policy from time to time. Material changes will be flagged on this page with a new “last updated” date.