Privacy Policy

This Privacy Policy explains how ONHIGHUP Recruitment ("we", "us", "our") collects, uses, stores, and protects personal data when you visit onhighup.com or submit an enquiry through our website contact form.

We are committed to protecting your personal data and processing it in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

Section 01

Who We Are

ONHIGHUP Recruitment is a recruitment business operating across the United Kingdom and the Republic of Ireland, providing temporary and permanent recruitment solutions for employers, primarily small and medium-sized businesses.

Section 02

Data We Collect

We collect personal data only when you voluntarily submit our website enquiry form. The data we collect includes:

Data Type	Field	Required
Identity	Contact Name	Yes
Identity	Company Name	No
Contact	Email Address	Yes
Contact	Phone Number	No
Requirement	Job / Role	Yes
Requirement	Type of Hire	No
Requirement	Sector	No
Requirement	Urgency	No
Location	Location / Region	No
Free text	Additional Information	No
Technical	IP Address (logged automatically)	—
Compliance	GDPR consent timestamp	—

We do not collect sensitive personal data (such as race, religion, health, or financial information) through our website.

We do not use automated decision-making or profiling based on data submitted through our website.

Section 03

How We Use Your Data

We use the personal data you provide for the following purposes:

• To respond to your recruitment enquiry — reviewing your requirement and contacting you to discuss how we can help.
• To send an automated confirmation email — confirming we have received your enquiry.
• To assess whether we can provide a suitable recruitment service — matching your requirement to our capabilities.
• To maintain a record of your consent — as required under UK GDPR.
• To comply with legal obligations — retaining records as required by applicable law.

We will not use your data to send unsolicited marketing communications. We will not add you to any mailing list without your explicit separate consent.

Section 04

Legal Basis for Processing

Under UK GDPR, we rely on the following legal bases to process your personal data:

Processing Activity	Legal Basis
Responding to your enquiry	Legitimate interests — processing is necessary to respond to your request for recruitment services
Sending an auto-confirmation email	Legitimate interests — confirming receipt of your communication
Recording GDPR consent	Legal obligation — maintaining records of consent as required by UK GDPR Article 7
Retaining enquiry records	Legitimate interests — maintaining business records for accountability

Section 05

Data Retention

We retain personal data submitted through our website contact form for the following periods:

Data	Retention Period	Reason
Enquiry email content	24 months from date of submission	To maintain a record of the business relationship
GDPR consent record	36 months from date of submission	To demonstrate compliance with UK GDPR Article 7
IP address log	12 months	Security and fraud prevention

After the applicable retention period, your data will be securely deleted or anonymised. You may request earlier deletion at any time — see Section 6 (Your Rights).

Section 06

Your Rights

Under UK GDPR, you have the following rights in relation to your personal data:

• Right of access — you may request a copy of the personal data we hold about you.
• Right to rectification — you may request that we correct inaccurate or incomplete data.
• Right to erasure — you may request that we delete your personal data, subject to our legal obligations.
• Right to restrict processing — you may request that we limit how we use your data in certain circumstances.
• Right to data portability — you may request your data in a structured, commonly used, machine-readable format.
• Right to object — you may object to processing carried out on the basis of legitimate interests.
• Right to withdraw consent — where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, please contact us at:

Section 07

Cookies

Our website uses only a session cookie — a temporary, technically necessary cookie — to prevent form spam submissions (rate limiting). This cookie:

• Does not track you across websites.
• Does not contain any personal information.
• Is deleted automatically when you close your browser.
• Is not shared with any third party.

We do not use analytics cookies, advertising cookies, or any other non-essential cookies. No cookie consent banner is required for this website under the UK Privacy and Electronic Communications Regulations (PECR), as the only cookie used is strictly necessary for the operation of the contact form.

Section 08

Security

We take appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, destruction, or alteration. These measures include:

• HTTPS encryption for all data transmitted between your browser and our server.
• Server-side input validation and sanitisation on all form submissions.
• Honeypot and rate-limiting measures to prevent automated abuse of our contact form.
• Access to enquiry emails restricted to authorised personnel only.
• Email header injection protections to prevent third-party misuse of our mail system.

No method of transmission over the internet is 100% secure. While we use commercially reasonable measures to protect your data, we cannot guarantee absolute security.

Section 9

Third-Party Links

Our website may contain links to third-party websites. We are not responsible for the privacy practices or content of those websites. We recommend that you review the privacy policy of any website you visit.

Section 10

Contact Us

For any questions, requests, or concerns relating to this Privacy Policy or our data practices, please contact us: