Privacy Policy

1. Who we are

Phoenix Pathway Ltd ("Phoenix Pathway", "we", "us") is a UK recruitment agency supporting apprenticeships, graduate and university programmes, training and professional recruitment. We are the data controller for the personal data described in this notice.

Registered in England & Wales. Company number: 15470610.

• Address: 14 Kingsway, Manchester M2 4WU
• Email: admin@pathwayphoenix.com
• Telephone: +44 7848 447760

This notice is written to meet the transparency requirements of the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, following guidance from the Information Commissioner's Office (ICO).

2. Personal data we collect

Depending on how you use our services, we may collect:

• Identity and contact details: name, date of birth, address, email, phone and WhatsApp number.
• Career information: CV, employment history, education, qualifications, references, role and location preferences.
• Screening answers: for example whether you hold A-levels or a Level 3 qualification and whether you have previously applied to or attended university.
• Qualification evidence: certificates, transcripts and Level 3 knowledge-check attempts, scores and results.
• Identity and eligibility documents: passport, driving licence, proof of address, citizenship or UK residency status, immigration status and share codes, and related screenshots.
• Onboarding information: answers in your onboarding pack, course and study-centre preferences, and your signature.
• Programme records: university interview dates, induction, Week 1 and Week 2 attendance, university reference details and progress notes.
• Communications: emails, calls, WhatsApp messages and notes of conversations with our team.
• Employer contacts: names, job titles, business contact details and enquiry information.
• Technical data: IP address, browser type and device information, used for security, spam prevention and recording failed staff sign-in attempts.

3. Special category and criminal offence data

We only collect more sensitive information where it is needed. This may include health or disability information so we can make reasonable adjustments for interviews or training, equality monitoring information you choose to give, and information about nationality or immigration status needed for right-to-work and funding eligibility checks.

We rely on Article 9(2)(b) UK GDPR (employment obligations) together with Schedule 1 of the Data Protection Act 2018, or your explicit consent where appropriate. Criminal record information is only processed where an employer or provider legally requires it for a role (for example in health and social care), under Article 10 and Schedule 1 conditions.

4. Our lawful bases

• Contract (Article 6(1)(b)): to provide recruitment, onboarding and placement services you have asked for.
• Legal obligation (Article 6(1)(c)): right-to-work checks under the Immigration, Asylum and Nationality Act 2006, record-keeping under the Conduct of Employment Agencies and Employment Businesses Regulations 2003, tax and accounting duties.
• Legitimate interests (Article 6(1)(f)): matching candidates to opportunities, keeping our services and website secure, preventing fraud and spam, and managing employer relationships. We balance these interests against your rights.
• Consent (Article 6(1)(a)): newsletters, job alerts and any optional marketing. You can withdraw consent at any time.

5. How we use your data

• Matching you with apprenticeships, graduate roles, university programmes, training courses and jobs.
• Submitting applications to employers, universities and training providers with your agreement.
• Preparing job selection packs, onboarding packs, interview preparation and Level 3 knowledge checks.
• Arranging the employer and government funding for your programme.
• Contacting you by phone, email or WhatsApp about your application and programme.
• Checking identity, eligibility and right to work.
• Tracking interview, induction and attendance progress so we can support you.
• Improving our services and keeping our systems secure.

6. Who we share data with

We only share what is needed, and never sell personal data. Recipients may include:

• Employers you agree to be put forward to.
• Universities and education providers, such as Arden University, NCG, VCAD / Arts University Plymouth and William College.
• Awarding and assessment bodies, such as MKNCC Global, for Level 3 qualifications.
• Government bodies where an apprenticeship or funding route requires it, such as the Department for Education.
• Trusted service providers who host our website, database, storage, email and communications, under written data processing terms.
• Regulators, the police or courts where the law requires it.

7. International transfers

Some of our service providers may store or process data outside the UK. Where this happens we make sure an adequate safeguard is in place, such as a UK adequacy regulation, the ICO International Data Transfer Agreement, or the UK Addendum to the EU Standard Contractual Clauses.

8. How long we keep data

• Candidate records: 2 years after your last meaningful contact with us.
• Unsuccessful applications: 6 to 12 months after the decision.
• Right-to-work and identity copies: for the length of your placement plus 2 years, as recommended by the Home Office.
• Agency records required by the 2003 Conduct Regulations: at least 1 year after their creation or last service provided.
• Financial and invoicing records: 6 years.
• Failed sign-in security records: only as long as needed for security monitoring.

After these periods data is securely deleted or anonymised, unless the law requires us to keep it longer.

9. Security and automated decisions

Documents are kept in private, encrypted storage with access restricted to authorised staff. Candidate links are unique and time-limited, staff access is protected by role checks, and we monitor failed sign-in attempts.

Our application form uses screening questions. For example, an answer that you have previously applied to or attended university may mean you are not eligible for certain funded routes. Our team reviews applications and you can always ask for a human review of any decision, give your view and challenge it, in line with Article 22 UK GDPR.

10. Your rights

• Access a copy of your data (subject access request).
• Have inaccurate data corrected.
• Have your data erased in certain circumstances.
• Restrict or object to how we use your data, including direct marketing.
• Data portability.
• Withdraw consent at any time where we rely on consent.

To use any right, email admin@pathwayphoenix.com. We will reply within one month, which can be extended by two months for complex requests. We may need to confirm your identity first. There is usually no charge.

If you are unhappy with how we handle your data, you can complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113. We would appreciate the chance to resolve your concern first.

• ICO: Your data protection rights
• ICO: Make a complaint

11. Cookies

We use essential cookies and similar storage needed for the site to work and to keep staff signed in securely. We do not use advertising cookies. If we introduce non-essential analytics cookies we will ask for your consent first, in line with the Privacy and Electronic Communications Regulations (PECR).

12. No payment, ever

Phoenix Pathway never takes payment from candidates, apprentices or students, and we will never ask you for any form of direct payment, deposit or fee at any stage.

Apprenticeship training is funded through the apprenticeship levy and government co-investment, and university programmes are fully funded through employer and government backing. Nothing is repayable by you, and you never pay anything to us or to your provider.

If anyone claiming to represent Phoenix Pathway asks you for money or bank details, do not pay and contact us straight away at admin@pathwayphoenix.com.

13. Changes to this notice

We may update this notice from time to time. The latest version is always on this page with its last updated date.