UK GDPR Privacy Notice
This Privacy Notice explains how TLG Infrastructure Ltd collects, uses, stores and protects your personal data throughout the recruitment process and, where applicable, during your employment or assignment. We process personal data in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and other applicable data protection legislation.
Your rights under the UK GDPR are explained in this privacy notice and were last updated on 5 August 2026.
You are responsible for ensuring that the information you provide to us is accurate and kept up to date. Please notify us promptly of any changes to your personal information.
Data Controller
TLG Infrastructure Ltd
Registered address: Mary Sheriden House, 11-19 St Thomas Street, SE1 9RY
Email: info@tlgrp.co.uk
ICO Registration Number: ZC127893
Information we collect
To carry out our core recruitment activities, we collect information about you which may include: your name, address and post code; private and business e-mail address and phone number; financial information and compliance documentation; references verifying your qualifications and experience and your right to work in the United Kingdom; curriculum vitae and photograph; employment details and preferences; links to your professional profiles available in the public domain e.g. LinkedIn, Twitter, Facebook for Business or business website.
How we collect your information
Information we collect about you will be provided by you, either by filling out a form on our website jobs.tlgrp.co.uk or by corresponding with us by phone, e-mail or otherwise. It will also include information you provide when you register to use our website, subscribe to our services, attend our events, participate in discussion boards or other social media functions on our website, enter a competition, promotion or survey, and when you report a problem with our site.
We may also obtain information about you from other sources such as LinkedIn, corporate websites, job board websites, online CV libraries, your business card, personal recommendations, and any relevant social media sites. In this case – and within 30 days of collecting – we will inform you that we hold this personal data, the source the data originated from, whether it came from publicly accessible sources, and for what purpose we intend to retain and process your personal data.
Our lawful basis for processing data
We process your personal data using the following lawful bases under the UK GDPR:
Activity Lawful basis
Recruitment Legitimate Interests
Payroll Contract
Right to work Legal Obligation
Marketing Consent
Special Category Data
In some circumstances, we may collect and process special category personal data where it is necessary to provide our recruitment and workforce services. This may include information relating to:
- Health or medical conditions, including fitness for work or occupational health assessments;
- Disabilities or reasonable adjustments required during the recruitment process or assignment;
- Equality, diversity and inclusion monitoring information (such as ethnicity, age or gender, where voluntarily provided);
- Trade union membership where required for payroll or statutory purposes.
We will only process this information where we have a lawful basis under Article 6 of the UK GDPR and an additional condition under Article 9 of the UK GDPR. These conditions may include:
- Compliance with employment, social security and social protection law;
- Your explicit consent, where required;
- The establishment, exercise or defence of legal claims;
- Occupational health purposes and assessment of your fitness for work, where appropriate.
Health information may be processed for:
- Safety-critical medicals
- Drug and alcohol testing
- Sentinel competence
- Occupational health assessments
- Right to work verification
- Client compliance and security clearances (where applicable)
Criminal Convictions and DBS Checks
Where a role requires it, we may process information relating to criminal convictions, Disclosure and Barring Service (DBS) checks, or other security vetting. We will only do so where authorised by law and where it is necessary to comply with legal or contractual obligations, protect the public, or meet our clients' compliance requirements.
Who we share your information with
We may share your personal information where necessary with:
- Clients and prospective employers;
- Payroll providers and umbrella companies;
- Pension providers;
- Occupational health providers;
- Training and accreditation providers;
- Background screening and right to work verification providers;
- Disclosure and Barring Service (DBS) where required;
- IT service providers who support our systems;
- Professional advisers including legal and financial advisers;
- Government departments and regulatory bodies where required by law.
Where we store your personal data
We have implemented appropriate technical and organisational measures to protect personal data against accidental loss, unauthorised access, disclosure, alteration and destruction. All information stored on our recruitment software is secured through the Microsoft Azure Infrastructure and located at two data centre locations within Europe. Our primary centre is located in Microsoft’s Western European centre, and these facilities are secured by a series of measures, including (but not limited to) biometric access, security alarm systems and round-the-clock security staff. Additional security information on Microsoft’s data centres is available on Microsoft's website.
Where personal data is transferred outside the United Kingdom, we will ensure appropriate safeguards are in place, including adequacy regulations or approved contractual safeguards in accordance with UK GDPR.
Retention periods
We retain different types of data for differing periods of time. The criteria we use to determine whether we should retain your personal data and how long for includes:
- The nature of the personal data
- The accuracy of your data
- Your engagement levels with our services
- Our legal obligations following an offer or when a placement has been made.
We may archive part or all of your personal data, or retain it on our financial systems but delete all or part of it from our recruitment software system. On removal, we may anonymise parts of your data – particularly following a request for suppression or deletion of your data – to ensure we do not re-enter your personal data to our database, unless you have requested us to do so.
Candidate records will normally be retained for two years from the date of our last meaningful contact with you, unless a longer retention period is required by law or is necessary for the establishment, exercise or defence of legal claims.
Your rights
The UK GDPR provides you with the following rights:
- The right to be informed about the personal data we process on you
- The right of access to the personal data we process on you
- The right to rectification of your personal data
- The right to erasure of your personal data in certain circumstances
- The right to restrict processing of your personal data
- The right to data portability in certain circumstances
- The right to object to the processing of your personal data
- The right not to be subjected to automated decision-making and profiling.
Therefore, we encourage you to log in to your profile through our website to ensure your data is accurate, complete and up to date at all times.
You also have the right to withdraw your consent at any time where we rely on consent as the lawful basis for processing. Withdrawal of consent will not affect the lawfulness of processing carried out before consent was withdrawn.
Changes to our privacy notice
Any changes we make to our privacy notice in future will be posted on this page and, where appropriate, you will be notified by e-mail. Please check back frequently to view any updates or changes to our privacy notice or for any further information please email info@tlgrp.co.uk
Contact us
If you have any questions about this Privacy Notice or how we process your personal data, please contact:
TLG Infrastructure Ltd
Mary Sheridan House
11–19 St Thomas Street
London SE1 9RY
Email: info@tlgrp.co.uk
ICO complaints
If you have concerns about how we process your personal data, we encourage you to contact us in the first instance. You also have the right to lodge a complaint with the Information Commissioner's Office (ICO), the UK's independent regulator for data protection. Further information can be found at www.ico.org.uk.