Candidate and Worker Privacy Notice and Declaration

OSJ Holdings Ltd trading as BRB Temps
Version 1.0 | Issued 30 September 2026

This notice explains how BRB Temps collects, uses, shares and retains your personal information when you apply, register, undertake training, accept a placement or work through us. Please read all five pages before signing the declaration on page 5. It applies to temporary workers and candidates for temporary or permanent roles, including those who are not placed.

1 Who is responsible for your information

OSJ Holdings Ltd trading as BRB Temps (BRB, we, us) is the data controller for the processing described here. We process information under the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and other applicable UK data protection law, as amended.

Privacy contact: Head of Operations
Privacy email: [insert monitored BRB privacy email]
Postal address: [insert BRB correspondence address]

2 Information we collect

We collect information relevant to your application, work or training. Depending on your role and stage of registration, this may include:

• Identity and contact details: name, address, date of birth, telephone number, email address, emergency contact details, identity documents and a photograph where needed for identification or a work profile.
• Recruitment and compliance information: CV, employment history, qualifications, training and competency records, references, interview notes, work preferences, availability, right to work evidence and restrictions, professional registration and relevant checks.
• Work and financial information: contracts, bookings, attendance, timesheets, pay rates, bank details, National Insurance number, tax and pension details, holiday, absence, appraisal, complaints, conduct and investigation records.
• Sensitive information where necessary and lawful: health and disability information relevant to fitness, adjustments or absence; equality monitoring information where collected; criminal offence, DBS, barred list and safeguarding information where the role permits or requires it.

3 How we obtain information

We obtain information from you through applications, interviews, forms, correspondence, websites and work or training systems. We may also obtain it from referees, former employers, clients, recruitment platforms and CV databases, relevant public professional profiles, training providers, occupational health providers, professional regulators, DBS and Home Office services. We use relevant public information fairly and do not routinely search private social media.

Where information comes from another source, we provide the required privacy information, including its source, within a reasonable period and no later than one month, or sooner at our first communication with you or first disclosure, unless a lawful exception applies. Please tell us about changes and ensure any emergency contact knows you have supplied their details.

4 Why we use information and our lawful bases

Our lawful basis depends on the particular purpose. Your signature records receipt and acknowledgement of this notice. We do not rely on blanket consent for ordinary recruitment, employment, payroll or statutory compliance processing.

• Recruitment, matching and submissions: we use identity, CV, experience, qualifications and availability to assess suitability, find roles, communicate with you and arrange interviews or assignments. We rely on legitimate interests in operating a recruitment business and placing suitable staff, or steps at your request before entering a contract where applicable.
• Registration and work administration: we use booking, contract, timesheet, attendance, pay, holiday and related information to deliver our contract with you. Contract is used only where the processing is necessary to perform that contract or take steps you request before it.
• Legal and regulatory compliance: we use relevant evidence for right to work, tax, pay, pension and other applicable obligations. We rely on legal obligation where a duty applies to BRB. Client requirements alone do not create a legal obligation for BRB.
• Suitability checks and safe supply: we obtain appropriate references, verify training and professional registration, maintain compliance profiles and assess complaints or incidents. We rely on legal obligation where applicable, otherwise legitimate interests in safe staffing, protecting people using services and maintaining professional standards.
• Business administration and disputes: we use relevant records for billing, audits, fraud prevention, system security, insurance, complaints, investigations and establishing or defending legal claims. We rely on legitimate interests, or legal obligation where applicable.
• Optional marketing: we use consent for the optional promotional emails and texts described on page 5. Contact about your application, bookings, compliance or pay is service communication and does not depend on marketing consent.

When we rely on legitimate interests, we assess necessity and balance our interests and those of clients or people using services against your rights and expectations. You may object. We do not sell your personal information.

5 Health information and other sensitive records

Special category information requires an additional legal condition. For necessary health, disability and employment rights processing, we use Article 9(2)(b) and Schedule 1 paragraph 1 of the Data Protection Act 2018 where their requirements are met. Occupational health assessments may use Article 9(2)(h) and Schedule 1 paragraph 2 with the required professional confidentiality safeguards. Necessary equality monitoring or safeguarding may use Article 9(2)(g) with the applicable Schedule 1 condition, such as paragraph 8 or 18, only where its requirements are met. Necessary legal claims processing may use Article 9(2)(f).

Criminal offence and DBS information requires an Article 6 basis and authorisation under Article 10, including a relevant Schedule 1 condition, such as paragraph 1 for necessary employment law obligations or paragraph 18 for qualifying safeguarding. We carry out only checks for which the role is eligible and apply DBS requirements, including restrictions on protected information.

We identify and record the applicable conditions for each activity and maintain an appropriate policy document where required. If a genuinely optional activity needs explicit consent, we seek it separately with a defined purpose and withdrawal route. Signing this form alone is not explicit consent for all sensitive information.

6 Who may receive your information

We share only information reasonably necessary for the purpose, with authorised recipients and appropriate safeguards. Recipients may include:

• Prospective and current clients, hiring organisations, care providers and their authorised booking, managed service or compliance portals: relevant CVs, profiles, qualifications, training, compliance status, work restrictions, bookings, timesheets and suitability information needed to assess or manage a placement.
• Referees and verification bodies, including professional regulators, DBS and Home Office services: information needed to request references, verify credentials and undertake lawful checks.
• Service providers: recruitment and booking systems, payroll and pension administrators, banks, IT and secure storage providers, training or e-learning providers, occupational health services and approved verification services.
• Professional advisers, insurers, auditors, courts, HMRC, law enforcement, local authority safeguarding teams and relevant regulators such as the NMC, CQC or Care Inspectorate Wales, where a lawful and necessary disclosure applies.

A client request does not automatically justify sending a complete compliance file, health record, DBS certificate or reference. We assess necessity, lawful basis and confidentiality before disclosure. Health information shared with clients is normally limited to relevant fitness or adjustment information. Allegations are identified as allegations and shared fairly where necessary. Clients and other recipients may be separate controllers and provide their own privacy notices.

7 Security and international transfers

We use organisational and technical safeguards appropriate to the information, including restricted access, secure systems, staff confidentiality and secure disposal. Information may be held in approved business systems, cloud services and secure paper records. Access is limited to authorised people who need it for their duties.

If information is transferred outside the UK, we use a lawful transfer route, such as UK adequacy regulations or appropriate contractual safeguards, and carry out the assessments required by law. You may ask the privacy contact for details of relevant transfers and safeguards.

8 How long we keep information

We review records and retain them only for a justified purpose. Our standard periods are:

• Unplaced or unsuccessful candidates: up to 12 months after the recruitment decision or last meaningful contact, followed by deletion or a review of any justified continuing talent pool relationship.
• Core worker, placement and contractual records: normally up to six years after the working relationship or last relevant placement ends, to deal with contractual matters and claims. This does not mean retaining every item in a compliance file for six years.
• Payroll, timesheet and accounting records: normally six years after the end of the relevant financial year, subject to any different mandatory period for the particular record.
• Right to work evidence: throughout employment and for two years after employment ends.
• DBS certificates and detailed certificate information: normally no longer than six months after the recruitment decision, unless an exceptional, documented reason justifies longer retention under DBS guidance. A limited check record may be retained for the applicable compliance purpose.

Health, safeguarding and other sensitive records are reviewed separately and kept for the shortest justified period. Records needed for an ongoing complaint, investigation, legal claim or statutory duty may be kept longer, with the reason and review date recorded. We securely delete or genuinely anonymise information when no longer needed; a minimal suppression record may be kept to honour contact preferences.

9 Your choices and data protection rights

You may request information, access, correction, erasure, restriction or portability where the relevant legal conditions apply. You may object to processing based on legitimate interests. You have an absolute right to object to direct marketing.

Rights are subject to lawful exemptions. Necessary records may remain for legal obligations or claims. We may redact information to protect others or apply an exemption, explaining our response as required. References genuinely given in confidence may be exempt from access under Schedule 2 paragraph 24 of the Data Protection Act 2018; your other rights remain.

Withdraw optional consent through the privacy contact or unsubscribe route. Withdrawal does not affect earlier lawful processing. Processing under contract, legal obligation or legitimate interests does not automatically stop when optional consent is withdrawn.

Make requests through the privacy contact on page 1 or any BRB contact; no special form is required. We respond without undue delay and normally within one month, subject to lawful identity checks, clarification and extensions, which we explain as required.

You may raise a data protection concern with BRB and complain to the Information Commissioner’s Office at www.ico.org.uk/make-a-complaint or on 0303 123 1113. Signing this document does not prevent a complaint or legal claim.

10 Required information and decisions about work

Necessary identity, right to work, qualification, reference and payroll information supports contracts, lawful checks and employment duties. Without it, we may be unable to register you, complete checks, arrange work or administer pay. We explain requirements when requesting information. Optional marketing choices do not affect applications or work.

Recruitment and suitability decisions should include meaningful human review. If solely automated decisions have legal or similarly significant effects, we provide the information and safeguards required by law, including routes to make representations, seek human intervention and contest the decision. Ask our privacy contact about such processing.

11 Confidentiality duties for candidates and workers

You must protect personal and confidential information accessed through BRB or a client, including information about people using services, relatives, staff and other workers. Use it only for authorised work, follow BRB and client instructions, and access only the records you need.

Do not copy, photograph, film, record, post or share confidential information or identifiable images without proper authorisation and a lawful basis. Do not use personal devices, accounts or storage for client or BRB information unless authorised. Report any loss, misdirected message, unauthorised access or suspected breach promptly to BRB and, where relevant, the client. Return or securely dispose of information as instructed when work ends. These duties continue afterwards.

These duties allow lawful safeguarding reports, protected disclosures, cooperation with regulators or police, and confidential professional advice. Breaches may be addressed fairly under the applicable contract and procedures.

12 Updates to this notice

We review this notice annually and when processing changes, and notify you of material updates. New uses require a lawful basis and fresh optional consent where required. Annual acknowledgement does not authorise new uses.

13 Candidate or worker declaration

Please read the complete notice before signing. Ask BRB about anything you do not understand. BRB must complete the contact details on page 1 before providing this notice for signature.

By signing below, I confirm that:

• I have received and read this Candidate and Worker Privacy Notice and Declaration, version 1.0, issued 30 September 2026, and have had an opportunity to ask questions.
• I understand the purposes of processing, the types of information collected, relevant sharing, retention and my rights as explained in the notice. My signature acknowledges the notice and is not blanket consent or a waiver of my data protection rights.
• The information I supply is accurate and complete to the best of my knowledge. I will promptly notify BRB of relevant changes, including contact details, right to work restrictions, professional registration and qualifications.
• I understand BRB will request and verify relevant references and compliance evidence for my application or assignments. Any separately required DBS or verification permission will be obtained through the relevant checking process.
• I agree to the confidentiality duties in section 11 where I access information through BRB or a client.