Prospective Candidate/Candidate, Client and Supplier Privacy Notice (Updated 07.08.2026)
1. Scope
Our Privacy Notice describes the ways we collect your Personal Data and governs how we will deal with it. We aim to ensure that any Personal Data we obtain and use will always be held, used and transmitted in compliance with the Data Protection Act 2018 (or its successor), Data (Use & Access) Act 2025 and the UK General Data Protection Regulations (together referred to as the ‘Data Protection Laws’).
For the purposes of the GDPR, we are a Controller when collecting and processing personal data for recruitment, placement, and work finding activities and are registered with the ICO reference Z8040566.
The website containing this Privacy Notice may contain links to 3rd parties’ websites. Ganymede assumes no responsibility for the privacy practices or the content of those websites. Therefore, please carefully read any privacy policies on those websites before either agreeing to their terms or using those websites.
This Privacy Notice applies with immediate effect to all Personal Data collected either in person, through the Ganymede or ATA Recruitment website, or any other means.
Ganymede may occasionally amend this Privacy Notice to reflect regulatory requirements and changes in our information collection and disclosure practices. Any new Privacy Notice will automatically be effective when it is published on the website or issued to you directly.
2. Responsibilities
The RTC Group Data Protection Representative has overall responsibility for ensuring that this notice is applicable, compliant and in accordance with the RTC Group Data Protection Policy. Ganymede’s Head of Compliance and Assurance, acting as the Ganymede Data Protection Representative (DPR), is responsible for ensuring that the contents of the Notice are implemented on behalf of the company.
All staff of Ganymede who interact with data subjects are responsible for ensuring that this notice is drawn to the data subject’s attention and that personal data is processed in accordance with the lawful bases set out in this Privacy Notice.
3. Privacy Notice
3.1 Who are we?
Ganymede Solutions specialises in recruiting technical and engineering talent and providing complete workforce solutions to help build and maintain infrastructure and transportation for a wide range of UK customers. Whilst our ATA brand provides high-quality technical recruitment solutions to the manufacturing, engineering, and technology sectors.. We work with trusted partners in order to provide our service and with whom we may share your personal data.
As part of our commitment to protecting our candidates, employees, workers, clients, suppliers and third-parties’ data, we have implemented a stringent Information Security Management system to protect both the security and integrity of the data we process. We have appointed a Data Protection Representative, responsible for all Data Protection activities, to work alongside the RTC Group Data Protection Representative.
Our Ganymede Data Protection Representative (DPR) can be contacted directly here: dpr@ganymedesolutions.co.uk.
3.2 What Personal Data do we collect?
The personal data we would like to collect on you is detailed below:
Categories of Personal Data | Purpose of Processing | Legal Basis (Article 6 UK GDPR) | Additional Condition for Special Category Data (Article 9 UK GDPR) |
Contact Name, Social Media profile (publicly available), Job title, previous experience (collected from you or from professional networking sites and job boards) | To provide recruitment services, including maintaining candidate records and supporting job opportunities | Legitimate Interest | N/A |
Contact information (name, address, telephone number) (provided by you during registration, enquiries, or ongoing communication) | To manage enquiries, provide recruitment services, and communicate with you | Legitimate Interest | N/A |
Email address (collected directly from you or via communications with you) | To communicate with you about opportunities and our services | Legitimate Interest | N/A |
CV information (provided directly by you or via social media platforms, job boards or our website) | To provide recruitment services and maintain candidate records | Legitimate Interest | N/A |
Other Personal Data such as your employment preferences and work requirements (provided directly by you) | To support provision of recruitment services and understand your preferences | Legitimate Interest | N/A |
Health data (occupational health screening information provided during onboarding or assessment processes) | To assess suitability for roles and comply with health and safety requirements | Legitimate Interest / Contract / Legal Obligation | Article 9(2)(b) – Employment, social security and social protection obligations and rights |
Health information (occupational health screening information collected during onboarding, assessment, or during an assignment/engagement) | Assessing fitness to work and supporting occupational health assessments | Legitimate Interest / Contract / Legal Obligation | Article 9(2)(h) – Occupational health and assessment of working capacity |
Personal health data, including medical information relating to pregnancy (collected during an assignment or engagement) | Managing health and safety requirements and supporting workplace adjustments where necessary | Contract / Legal Obligation | Article 9(2)(b) – Employment, social security and social protection obligations and rights |
Right to work documentation (provided by you and/or verification services) | To verify eligibility to work in the UK | Legitimate Interest / Contract | N/A |
Equality and diversity data (provided directly by you where voluntarily supplied) | To monitor equality and diversity and meet reporting obligations where applicable | Consent | N/A |
Website usage data (collected automatically when you use our website) | To analyse website use and improve our services and user experience | Legitimate Interest | N/A |
Cookie data and web beacons (collected via cookies and similar technologies) | To enable website functionality and analyse performance | Legitimate Interest | N/A |
Data processing preferences (provided directly by you) | To record and manage your preferences in relation to our services | Legitimate Interest / Contract | N/A |
Subject access request information (provided by you when exercising your data rights) | To respond to and manage data subject rights requests | Legitimate Interest / Contract | N/A |
Financial information including bank account details and National Insurance numbers (provided by you or relevant onboarding/payroll processes) | To process payments and administer contractual arrangements | Legitimate Interest / Contract | N/A |
Interview notes and assessment records (created by us and/or clients during recruitment processes) | To support recruitment processes and maintain records of assessments and decisions | Legitimate Interest / Contract | N/A |
Contact details and business correspondence (clients, suppliers and business contacts) | Managing day-to-day communications and business relationships with clients, suppliers and other business contacts | Legitimate Interest | N/A |
Contact details, contractual information and business correspondence (clients and suppliers) | Entering into, managing and performing contracts with clients and suppliers | Contract | N/A |
It may be necessary for us to collect Personal Data, which under Data Protection Law is classified as Special Categories of Personal Data.
The UK GDPR defines special category data as:
personal data revealing racial or ethnic origin;
personal data revealing political opinions;
personal data revealing religious or philosophical beliefs;
personal data revealing trade union membership;
genetic data;
biometric data (where used for identification purposes);
data concerning health;
data concerning a person’s sex life; and
data concerning a person’s sexual orientation.
It is anticipated that the most common Special categories of personal data required from a job seeker will be for the purposes of Health Screening as well as information relating to Criminal Convictions, including criminal record checks, which we may be required to obtain in order to meet industry or job role requirements.
We may also at times process data in relation to other special categories such as (but not limited to) ethic origin or sexual orientation in line with our Equity, Diversity and Inclusion processes, however, this will be anonymised, and providing this data will not be mandatory.
3.3 How we collect your information if you are a job seeker or prospective job seeker?
Ganymede obtains Personal Data from you in the following four ways:
a) Personal Interaction
If you wish to apply for a vacancy by visiting our office, via a 3rd Party or having a conversation with one of our staff members, we may ask you for your contact information and/or CV details and/or job specification details.
b) Submitting your details
If you wish to apply for a vacancy online or submit your details to one of our staff members, we may ask you for your contact information and/or CV details and/or job specification details as you proceed through the stages of the application either via our website, directly with one of our staff members via email/telephone or face-to-face.
c) Automatic collection
Like most websites, our website uses cookies and web beacons to enhance your visitor experience. Please refer to our Cookie Policy for further information.
d) Personal Data from 3rd parties
Ganymede may also obtain information about you directly from third parties, such as third-party job boards, social media sites and CV websites and online qualification and competency systems such as Sentinel or CITB. Ganymede will use this information to update our database records.
3.4 How we collect your information if you are a client, prospective client, supplier or prospective supplier?
Ganymede obtains Personal Data from you in three ways:
a) Submitting your details: If you submit your details to us as a contact to enable us to manage a contractual obligation or provide information on our services or your products / services.
b) Automatic collection: Like most websites, our website uses cookies and web beacons to enhance your visitor experience. Please visit our Cookie Policy for further details.
c) Personal Data from 3rd parties: Ganymede may also obtain Personal Data about you directly from third parties, such as social media sites, referrals, your own company website.
Independent of how we collect your data, we will always ensure that you have access to this Privacy Notice. If we have gathered your information from a third-party, we will notify you that we are storing and processing your data.
Additional details in relation to using our website, including our use of cookies, can be found in our Cookie Policy which can be accessed at www.ganymedesolutions.co.uk.
3.5 What will we do with your information if you are a job seeker or potential job seeker?
We will process and store your Personal Data for any or all of the following purposes:
During the provision of job seeking activities
Ganymede may collect and store your Personal Data in order to process your job applications, respond to your enquiries, get in touch with you about possible job opportunities and generally maintain the information you hold with us. If we are in discussion with you about a particular role or assignment, we may be required to share your information with our client in order to assist us in providing you with jobseeking services. You will be given the opportunity to restrict this use at any time.
We may also create and retain interview notes and assessment records, including feedback provided by clients, as part of our evaluation of your suitability for roles. The legal basis for processing these records is legitimate interest to ensure fair, consistent and non‑discriminatory recruitment practices and in establishing, exercising or defending legal claims.
To validate competency and suitability
Ganymede may collect and store your Personal Data and validate it against external third-party competency/experience management systems as well as obtain information in relation to your previous experience and suitability for a role by taking up references with previous employers.
To assist with marketing of Ganymede services
In order to ensure that we provide you with the best possible employment opportunities and our client with the best possible service, we may also use your data for marketing purposes.
Occasionally, Ganymede may contact you by telephone for the purposes of market research, marketing our services (and for telemarketing). You are under no obligation to participate in the call and can opt-out of marketing by emailing us at dpr@ganymedesolutions.co.uk.
In addition, we may use an IP address to identify you and to gather broad demographic information about you, which may be used to assist Ganymede in market segmentation activities, to help identify problems with our server and to administer our website.
3.6 What will we do with your information whilst on assignment or placed in a role
We will process and store your Personal Data for any or all of the following purposes while you are engaged with us in a role or assignment:
To meet contractual and legal obligations:
Ganymede will collect and store your Personal Data to fulfil our contractual responsibilities and comply with legal and regulatory requirements. This may include providing relevant information to clients you are working with, processing payments, managing timesheets, and maintaining records of your assignment details.
To maintain effective communication:
We will use your contact details to ensure clear and timely communication throughout your assignment. This may involve sharing updates, responding to queries, and coordinating work-related logistics.
To support client requirements:
In some cases, our clients may require access to specific Personal Data to support operational or compliance processes. Where applicable, your Personal Data may be shared with the client for these purposes.
To monitor performance and ensure safety:
We may process certain information to monitor your performance, support workplace safety, and ensure that assignment objectives are met in line with client expectations and health and safety standards.
To assist with ongoing support and service delivery:
Your information may be used to provide you with support during your placement, including HR support, wellbeing services, and other assignment-related matters.
3.7 What will we do with your information if you are a client / supplier or potential client / supplier
We will process and store your information for any or all of the following purposes:
To meet contractual obligations
To carry out new business development activities by offering you Ganymede services or products
To procure / assess possible services or products that could lead to a contractual engagement.
Contractual Obligations
The principal purposes for which we collect and store your Personal Data are to meet contractual obligations. In order to provide our services in an effective and efficient manner we need to ensure that we have the correct communication channels. This is managed through keeping a record of contact positions, email addresses, telephone numbers and business addresses.
New Business Development
Occasionally, Ganymede may contact you by telephone or email to inform you of our services and capabilities with the intention of developing new business.
In addition, we may use an IP address to identify you and to gather broad demographic information about you, which may be used to assist Ganymede in market segmentation activities.
You can opt-out of marketing by emailing us at dpr@ganymedesolutions.co.uk.
Service / Product Procurement
Ganymede may retain personal contact information in order to establish a supply chain of services or products required to ensure that
Ganymede continues to provide an effective and efficient recruiting solution for our clients.
3.8 Sharing with Third-Parties
Ganymede will not sell your Personal Data to third parties. However, on occasions it is necessary for us to share Personal Data with third
parties as described below for the purposes described above.
Third-Party | Data and Purpose |
RTC Group | Ganymede is part of the RTC Group Plc family of companies. We will share your Personal Data with the RTC Group in order to meet our contractual and legal obligations, including those required for insurance and payroll. We may also provide your details to another of the RTC Group companies if we feel it is in your best interest with respect to job seeking. |
Website analytics providers | Ganymede collates statistics about site traffic, sales and other commercial information. This information is collected through 3rd parties to assist us in improving the services we provide to you. We also use demographic information to tailor the website to the interests of our work seekers and clients, which we share with 3rd parties, so that we can build up a better picture of our customer base and general consumer trends. |
Recruitment and Communications Software | Ganymede may require to store or process your Personal Data with 3rd parties as is necessary to process your application for a particular role. |
Competency and Experience validation | Ganymede may share your Personal Data with industry specific safety systems to ensure your safety whilst on assignment. |
Legal entities | Ganymede may disclose your Personal Data if necessary to comply with regulations or law or to assist with law enforcement, to enforce the terms under which you are contracted with Ganymede or to protect our or other third parties’ property and other rights. |
Third-Party Recruiter/ Job board | You may have accessed our website via a hyperlink from another job board. Your Personal Data including behavioural patterns, may be shared between Ganymede and that 3rd party. |
Successor | In the event that Ganymede is sold, or some of its assets transferred to a 3rd party, your Personal Data, as a valuable asset of the company, may also be transferred. However, use of your Personal Data will remain subject to this Privacy Notice. Similarly, your Personal Data may be passed on to a successor in interest in the event of a liquidation or administration of Ganymede. |
Clients/Potential Employers | Ganymede may be required to share your data with our clients as is necessary to provide you with job-seeking services and process your application for a particular role. |
Third-Party Suppliers | Ganymede may disclose your Personal Data if necessary to third party suppliers including but not limited to training providers, medical screening companies, and PPE suppliers, to support your recruitment, safety, and compliance requirements both during the recruitment process and whilst on assignment. |
Master Vendors / Neutral Vendors / Other Recruitment Agencies | Where Ganymede operates as a second‑tier or sub‑contracted agency within a supply chain, we may be required to share your personal data with a master vendor, neutral vendor, managed service provider (MSP), or other recruitment agencies involved in the supply chain. This sharing is necessary to provide work‑finding services, submit you for suitable roles, and comply with contractual and operational requirements. |
Where possible all data processors will be within the EEA. If it is a requirement to transfer data outside of the EEA, this will be in accordance with 3.9 Transferring Data outside of the European Economic Area EAA.
3.9 Transferring Data outside of the European Economic Area (EAA)
The UK has an adequacy decision in place with the EU / EEA. Ganymede will only transfer data outside of the EAA if necessary. This section explains how we use and protect personal data when sharing it outside of the EEA.
To provide our recruitment services, it may be necessary for us to transfer personal data to recipients located outside the EEA. These recipients may be our clients, partners, or service providers situated in countries that do not have the same level of data protection laws as the EEA. We are committed to ensuring the security and confidentiality of personal data transferred outside the EEA and will take all reasonable steps to protect it in accordance with applicable laws and regulations.
To ensure the protection of personal data transferred outside the EEA, we implement appropriate safeguards in accordance with the GDPR.
These safeguards may include:
Adequacy Regulations: We may transfer Personal Data to countries that have been deemed to provide an adequate level of protection by the UK government.
Approved contractual mechanisms such as the UK International Data Transfer Agreement (IDTA).
Consent: We may rely on explicit consent only where no other safeguard is available and the transfer is optional for the individual.
Risk Assessment: We may carry out a transfer risk assessment to enable us to consider whether, in the circumstances of the transfer, the relevant protections under the UK data protection regime will be undermined.
Individuals whose personal data is transferred outside the EEA still retain their data subject rights under the GDPR. Individuals can also exercise their right to lodge a complaint with the relevant supervisory authority.
3.10 Lawful Basis for Processing Data
Depending on the purpose for which we use your personal data, Ganymede may rely on one or more of the following lawful basis for
processing under UK GDPR:
Contract – where processing is necessary for us to enter into or fulfil a contract with you.
Legal Obligation – where we are required to process personal data to comply with legal or regulatory requirements.
Vital Interests – where processing is necessary to protect someone’s life or safety.
Public Task – where processing is necessary for the performance of a task carried out in the public interest or under official authority.
Legitimate Interests – where processing is necessary for our legitimate business interests, provided these are not overridden by your rights and freedoms.
Consent – where you have given clear permission for us to process your personal data for a specific purpose.
For the purposes of this Privacy Notice, Ganymede processes personal data based primarily on legitimate interests and contractual obligations, with consent sought only when required under the GDPR, particularly for Special Categories of Personal Data.
By submitting your CV, applying for a specific role (either directly or via a third-party), or by providing your details, Ganymede will process and retain your personal data in accordance with this Privacy Notice and our Data Retention Policy.
If we have obtained your details via a third-party, such as job boards or social media sites, we will advise you that we are storing your data for the purposes of providing work-finding services. Upon your request, we shall remove your details from our system.
By engaging with Ganymede or entering into a contract with us for an assignment, you agree to the processing of your data necessary to fulfil legal and contractual obligations, as described in this Privacy Notice.
If you request that we stop contacting you for marketing or recruitment purposes, we will respect your wishes and retain only the minimal information necessary to record your preferences and avoid future contact.
Ganymede will seek formal consent if data is to be used for the following activities:
Processing of UK GDPR defined Special Categories of Personal Data, (i.e., Any data associated with Health, or our Equality & Diversity Commitments etc.).
Adding of your contact details to a marketing list that is different from the uses stated in section 3.5, 3.6 and 3.7 of this Privacy Notice and your contract.
Transferring Data outside of the European Economic Area (EAA) as stated in Section 3.9 of this Privacy Notice.
Where we are asking you for Special Categories of Personal Data we will always tell you why and how the information will be used.
You may withdraw Consent at any time by contacting us at dpr@ganymedesolutions.co.uk.
3.11 Profiling and Automated processing
Ganymede may utilise automatic profiling to establish whether a candidate meets the minimum requirements of job application or assignment. The exact details of these decisions can be made available upon request.
Automatic profiling is also employed whilst establishing suitability for assignments using information stored on third-party competency and training management systems.
You have the right to object to profiling at any time, including profiling used for marketing purposes. If you wish to object to this type of processing, you can email your request to dpr@ganymedesolutions.co.uk.
3.12 Retention period
Ganymede will retain personal data only for as long as is necessary to fulfil the purposes for which it was collected, including to meet legal, regulatory, contractual and operational requirements.
Ganymede retains Personal Data in accordance with our Data Retention Policy. Unplaced candidates are retained for up to 5 years from the last meaningful contact. Placed candidates are retained for 6 years from the end of the tax year in which the placement ended. We may retain data longer where necessary to establish, exercise or defend legal claims.
3.13 How will we contact you?
We will contact you in the following circumstances:
Circumstance | How | Why |
you submit your details to our website in response to a particular job advertisement. | Telephone or email in the first instance. | To inform you of the status of your application and to further the conversation. |
If you submit your details on a speculative basis to our website. | Telephone or email in the first instance. | To further the conversation and to find out more about how we can help you seek work. |
If we receive a referral. | Telephone, email or social media where appropriate. | To find out how we can help you seek work and communicate our Privacy Notice. |
If you visit one of our offices and apply for a post or request us to act as a sponsor. | Telephone or email in the first instance. | To confirm suitability and availability and provide information on relevant assignments. |
If we find your details on Social Media and think that you may be suitable for a current opportunity. | Social Media, email and telephone. | To find out how we can help you seek work and communicate our Privacy Notice. |
If we receive your CV or contact details through a third-party job board / website | Telephone or email in the first instance | To find how we can help you seek work and communicate our Privacy Notice. |
3.14 Your Rights as a Data Subject
At any point while we are in possession of or processing your personal data, you, the data subject, have the following rights:
Right to be informed – you have the right to be provided with clear, transparent, and easily accessible information about how we will collect, use and process your personal data.
Right of access – you have the right to request a copy of the Personal Data that we hold about you.
Right of rectification – you have a right to correct data that we hold about you that is inaccurate or incomplete.
Right to be forgotten – in certain circumstances you can ask for the data we hold about you to be erased from our records.
Right to restriction of processing – where certain conditions apply to have a right to restrict the processing.
Right of portability – you have the right to have the data we hold about you transferred to another organisation.
Right to object – you have the right to object to certain types of processing such as direct marketing.
Right to object to automated processing, including profiling – you also have the right not to be subject to the legal effects of automated processing or profiling.
3.15 Requesting information on the data we hold
Ganymede, at your request, can confirm what information we hold about you and how it is processed. This is called a Subject Access Request. If Ganymede does hold personal data about you, you can request copies of the information we hold by emailing us at dpr@ganymedesolutions.co.uk.
In order to avoid personal data about one individual being sent to another, either accidentally or as a result of deception, we are required to be satisfied that we can verify the identity of the person requesting the information. We may therefore ask for further information from you to judge whether you are the person that the data is about, however, we will ensure that any request will be reasonable and proportionate.
3.16 Complaints and Contact Detail
If you have any concerns about how Ganymede collect, use, store, or otherwise process your personal data, we encourage you to raise them with us in the first instance. Complaints can be submitted by contacting us using the details provided in this Privacy Notice below.
We will acknowledge your complaint within 30 days and aim to investigate and respond without undue delay.
If you are not satisfied with our response or believe that we have not handled your personal data in accordance with applicable data protection laws, you have the right to lodge a complaint with the Information Commissioner's Office, details of which are provided below.
Further information is available from the ICO's website.
| Supervisory authority contact details | Data Protection Representative |
Contact Name: | Information Commissioners Office (ICO) | Head of Compliance & Assurance |
Address Line 1 | Wycliffe House | The Derby Conference Centre |
Address Line 2 | Water Lane | London Road |
Address Line 3 | Wilmslow | Derby |
Address Line 4 | SK9 5AF | DE24 8UX |
| DPR@rtcgroupplc.co.uk | |
Telephone | 0303 123 1113 | 0333 011 2048 |
Online | https://ico.org.uk/make-a-complaint/ | |