Privacy Policy

This policy explains what we do with personal information. It covers:

• visitors to our website and people who contact us
• account administrators and users of the Illumini platform
• contacts at our clients and prospective clients
• hiring managers and other business contacts identified in public vacancy and company information
• candidates and other individuals whose records are submitted to us for enrichment
• individuals appearing in placement, introduction or fee records

Illumini provides a recruitment data platform with three modules: Vacancies, Missed Fees and Candidate Enrichment. What we do with personal information, and whether we are a controller or a processor, depends on which module is in use. Section 3 explains this.

If a recruitment agency holds your details

Much of the personal information that passes through our platform is processed on behalf of our clients, on their instructions. This policy does not apply to that information. Where a recruitment agency has supplied your record to us, or connected its CRM to our platform, that agency decides why your information is used and is responsible for it. If you want to know why your details are held, or you want them corrected or deleted, please contact that agency directly. If you contact us and we are not the controller, we will tell you, and we will assist the agency as the law requires.

Illumini as controller

We act as a controller where we determine the purposes and means of processing. This includes the vacancy, employer and professional information we source and maintain in our own databases from public and third-party sources, and the information we hold to run our website, accounts, billing, security, support and marketing.

Illumini as processor

We act as a processor where we process personal data on behalf of a client and on that client's instructions. This includes candidate records, vacancy records, placement records and other information supplied by a client or retrieved from the client's CRM or applicant tracking system in order to provide the services.

Where we act as a processor, the client remains responsible for determining the purposes of the processing and the lawful basis for it, and for its own transparency obligations to the individuals concerned. Our processing in that role is governed by our Terms of Service and, where the client requires one, a separate data processing agreement.

Vacancies

We collect and aggregate publicly available vacancy, employer and professional information, including information published on employer career websites and other public or third-party sources, in order to identify and rank live job vacancies relevant to a client's search criteria. Where the client's plan includes it, this may include the name and professional contact details of a hiring manager associated with a vacancy. We are generally the controller for this information.

Missed Fees

We process placement, introduction and hire records supplied by a client, or retrieved from the client's CRM or applicant tracking system with its authorisation, to identify cases where a candidate the client previously introduced may subsequently have been hired without an associated placement or fee record. Our output identifies matters that warrant review. It does not determine that a fee is owed. We act as processor for these records.

Candidate Enrichment

Where a client uses Candidate Enrichment, it provides us with candidate records. We process those records on the client's instructions and supplement them with professional information obtained from publicly accessible and other lawful third-party sources. This may include employment history, job title, employer, skills, qualifications and professional contact information. The enriched records are returned to the client for its recruitment and staffing activities. We act as processor for the records the client supplies.

Account and user information

• name and business contact details
• employer or company
• account credentials and authentication information
• subscription, licence and billing information
• support correspondence
• marketing preferences

Vacancy and hiring-manager information

• vacancy or job title and description
• employer and hiring organisation information
• name and job title of a hiring manager associated with a vacancy
• business email address and business telephone number, where published
• office or work location
• professional profile URL, where published
• the vacancy the person is linked to

We collect business contact details only. We do not knowingly collect personal mobile numbers, personal email addresses or home addresses for this purpose.

Candidate information

• name and professional contact details
• employment history, job title and employer
• skills and qualifications
• publicly available professional profile information
• other candidate information supplied by a client

Placement and fee information

• candidate, introduction, placement and hire records
• dates relating to introductions, placements and hires
• client and customer information
• fee and commission information

Information we infer

We generate new information about people by analysing the information above. This may include a relevance or match score for a vacancy or a candidate, an assessment of seniority or experience level, an indication of industry or skill area, and an indication that a record may relate to a prior introduction. Inferred information is personal information and is covered by this policy.

Technical and usage information

• IP address and login information
• device and browser information
• access times and activity logs
• error, security and performance logs

Information we do not seek

We do not intentionally collect special-category data (such as health, racial or ethnic origin, religious or philosophical beliefs, trade union membership, sex life or sexual orientation) or criminal-offence data. Clients should not supply it to us. Where such information is present in records a client supplies, we process it only as processor on the client's instructions and the client is responsible for its lawful basis for doing so.

Enquiry information

When you contact us through our website, an enquiry form or by email, we collect your name, contact details, company details and the contents of your enquiry, so we can respond, arrange demonstrations and manage our relationship with you.

Depending on the module in use, we may obtain personal information from:

• employer career pages and company websites
• job advertisements and job boards
• professional networking sites and other public professional profiles
• company registries, business directories and published company information
• licensed third-party data providers and other lawful data sources
• a client's CRM or applicant tracking system, where the client authorises the connection
• information supplied directly by clients and their users
• information supplied directly by individuals, for example when they contact us

Where we did not collect the information from you

Where we collect business contact information about hiring managers from public sources, we do not hold contact details that would let us notify each person individually without collecting further personal information about them, and doing so at the scale involved would require disproportionate effort. We therefore make this notice publicly available as the measure required by Article 14(5)(b) of the UK GDPR, and we draw attention to your right to object in section 8.

• Providing the services and operating client accounts - contract
• Responding to support requests and service communications - contract, and our legitimate interests in running the service
• Billing, invoicing and keeping accounting records - contract and legal obligation
• Security, authentication, abuse prevention and troubleshooting - our legitimate interests, and legal obligation where applicable
• Collecting and maintaining public-source vacancy, employer and professional information - our legitimate interests
• Improving the service using irreversibly anonymised information and technical telemetry - our legitimate interests
• Business marketing to professional contacts - our legitimate interests, subject to the Privacy and Electronic Communications Regulations 2003
• Establishing, exercising or defending legal claims and meeting regulatory obligations - legal obligation and our legitimate interests

Our legitimate interests explained

Public-source recruitment information. Our interest is in finding, aggregating and presenting publicly available information about live vacancies, the organisations advertising them and the professional contacts associated with them, so that recruitment businesses can identify relevant roles and the right person to approach about them. The information concerns people acting in a professional capacity, is limited to business-context information, and is not used to make decisions about any individual.

Identifying unacknowledged introductions. Our interest is in identifying cases where an individual may have been engaged without proper acknowledgement of a prior introduction, resulting in commercial loss or unfairness to the parties involved. This promotes accountability and deters practices that bypass agreed terms. The data is used solely to identify matters for review, not to make decisions affecting an individual's rights.

Service operation and improvement. Our interest is in keeping the platform secure, available and accurate, and in improving it. For improvement we use irreversibly anonymised information and technical telemetry only.

In each case we have considered the impact on the individuals concerned, and we limit the information we use to what is relevant, proportionate and securely held. You can object to processing based on legitimate interests - see section 8.

We use automated data collection, statistical models and machine learning to rank, score, match and identify patterns in recruitment and employment information. These processes may identify relevant vacancies, suggest potential matches, enrich candidate records, or flag records that warrant further review. The results are probabilistic and may be incomplete or inaccurate.

This analysis creates new information about people, described under 'Information we infer' in section 4. That inferred information is personal information, and the rights in section 11 apply to it, including the right to ask us to correct it.

We do not make decisions about whether an individual should be hired, rejected, employed or otherwise selected for a role. Our Terms of Service require clients not to use our output as the sole or determinative basis for an employment-related decision without independent human review.

We do not incorporate information supplied by a client, or retrieved for a client at its direction, into a shared repository; we do not use it to supplement or refresh the information available to other clients; and we do not disclose information retrieved for one client to any other client. Only irreversibly anonymised information and technical telemetry are used to improve the service.

Where we hold information about you as controller because we collected it from a public source - for example your name and business contact details as a hiring manager associated with a vacancy - you have the right to object to that processing at any time.

To object, email info@illumini-technology.io. We will stop processing your information for that purpose unless we can show compelling legitimate grounds that override your interests, and we will add your details to a suppression list so that the same information is not collected again when we next refresh our sources. We keep the suppression list for as long as we operate the service, because it is the only way to honour your objection on an ongoing basis.

If a recruitment agency holds your details through our platform, we act as processor and the agency decides how your information is used. Contact that agency directly, or contact us and we will pass your request on.

We may share personal information with:

• hosting, cloud infrastructure, database, security and other technology providers that process information on our behalf
• third-party data providers and sources used to deliver the services
• providers supporting client integrations, where the client authorises the connection
• professional advisers, insurers and auditors where reasonably necessary
• courts, regulators, law enforcement and other authorities where required or permitted by law
• any third party where you, or our client, has authorised the disclosure

We do not sell personal information. Clients can ask us for details of the regions in which their data is hosted and of the sub-processors we use to provide the services to them.

Personal information may be processed or stored outside the United Kingdom. Where it is, and a transfer mechanism is required, we rely on a lawful mechanism under applicable data protection law, such as an adequacy regulation, the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, or another safeguard permitted under Article 46 of the UK GDPR. Clients can ask us which applies to their data.

• Your right of access - to ask us for copies of your personal information.
• Your right to rectification - to ask us to correct information you think is inaccurate or incomplete.
• Your right to erasure - to ask us to delete your personal information.
• Your right to restriction of processing - to ask us to limit how we use your personal information.
• Your right to object to processing - including where we rely on legitimate interests, such as our use of public-source information.
• Your right to data portability - to ask us to transfer information you gave us to another organisation, or to you.
• Your right to withdraw consent - where we rely on consent.

If you make a request we will respond without undue delay and in any event within one month. For subject access requests we may ask for proof of identity, and will tell you if we need more information to deal with your request.

Where we process personal data on behalf of a client as processor, you may need to exercise your rights through that client, as it decides the purposes of the processing. We will provide reasonable assistance to the client as required by law. If you contact us and we are not the controller, we will tell you.

To make a request, contact us at info@illumini-technology.io.

We may use business contact details to send information about our products, services and relevant updates where permitted by applicable law. You can opt out at any time using the unsubscribe link in any message, or by contacting us at info@illumini-technology.io.

We use appropriate technical and organisational measures designed to protect personal information, including role-based access on a least-privilege basis, encryption of personal data in transit and at rest, logging and monitoring, backup and recovery measures, regular review of our processing activities and security measures, and confidentiality obligations for our personnel and service providers.

If something goes wrong

Where we are the controller, we will notify the ICO, affected individuals or other parties where required by law. Where we act as a processor, we will notify the relevant client in accordance with our data processing terms, which require notification without undue delay and in any event within 72 hours of becoming aware of a personal data breach affecting their data.

Client and account information

Kept for as long as necessary to administer the relationship, and afterwards for the applicable legal, accounting, tax, dispute-resolution and limitation periods.

Information we process for a client as processor

Kept for as long as needed to provide the services. On termination we make the client's data available for export for 30 days, and then return or delete it at the client's election, unless we are required by law to retain it.

Public-source information we hold as controller

We re-check this information against its source periodically. Where a record has not been re-verified for 12 months we delete it. Where a vacancy is no longer live, the associated contact information is deleted once it is no longer relevant to the purpose in section 6.

Suppression list

Where someone objects under section 8, we keep the minimum information needed to recognise them for as long as we operate the service, so that we do not collect their information again. This is the only way to honour an objection on an ongoing basis.

Irreversibly anonymised information

May be kept indefinitely, because it can no longer identify an individual, a client or a client's customers.

Enquiry and marketing information

Kept until you opt out, or for two years after our last contact.

We review retention periods periodically to make sure they remain appropriate.

If you have any concerns about our use of your personal information, please contact us at info@illumini-technology.io. We will acknowledge your complaint within 30 days and tell you the outcome of our investigation.

If you remain unhappy after raising a complaint with us, you can also complain to the Information Commissioner's Office.

The ICO's address

• Information Commissioner's Office
• Wycliffe House
• Water Lane
• Wilmslow
• Cheshire
• SK9 5AF

Helpline: 0303 123 1113

Website: https://www.ico.org.uk/make-a-complaint

Changes to this policy

This policy was last updated on 22 September 2026. It replaces the previous notice and reflects our three current modules, the split between the information we control and the information we process for clients, and our use of automated analysis. We keep previous versions and can confirm which one applied on a given date on request.