At Total Ten we handle your personal with honesty, transparency and respect. This policy explains what we do with your personal information, why we want to use it, how we protect it, and your rights.

  1. Candidates 

If you have applied for a role then we will hold your personal details in order to process your application, and as such we believe we have a lawful basis for holding this information.


When you apply for a role via one of the job boards we use, your personal data enters our own Applicant Tracking System (ATS)


To share your data only with the specific client to whom you have applied.


If you are unsuccessful at the applicant stage we will keep your details only for the duration of the recruitment project (typically 2 months). Your details will not leave the ATS and once you have received a rejection letter, you can be assured that all the details we hold on you will be deleted.

If you are an active candidate (someone who we want to progress within the recruitment process), your details will be shared only with the client company to whom you have applied. This information will include your contact details, application form, CV and any telephone interview notes that have been generated. Our aim is to share as little as necessary, and only details relevant to the position for which you have applied. We have monthly procedures in place to ensure that any trails of personal data are deleted, and we have a comprehensive process for the removal of all data at the end of each recruitment project that we run.


One of the services that we offer to our clients is the identification of future potential from existing candidates (you may not be suitable for the position for which you have applied, but the client may have a future role for which you might be suitable). If we do identify you as having ‘future potential’ for our client, we will contact you for permission to retain your details, in which we will clearly state the length of time for which we would like to hold your details for this client only. You will need to give this permission to us in written format. After the stated length of time has passed, we will automatically delete all your details or contact you again for further permission if applicable.

If you are the successful candidate in one of our recruitment projects, you will be treated in the same way as our active candidates.


  1. Clients 

If you are an existing Total Ten client, we hold your name and contact details because we have a contractual obligation to deliver services to you. We need your contact details to deliver our services (such as to send you candidate and interview details, send you invoices and so on). We will hold your information for six years from the date of our last recruitment project with you, for legal records.


When Total Ten acts on your behalf as your internal recruitment team, you can be assured that we have robust procedures in place in order to comply with GDPR in terms of dealing with both your company’s data, and that of the candidates we process for you, in accordance with our ‘Terms & Conditions’ (Clause 2.7).


We store all our client information on a secure Customer Relationship Management System (CRM), including all relevant contact details (names, addresses, email addresses, mobile phone numbers and landlines), and records of conversations and actions relating to potential and active recruitment projects. This information is treated with the utmost confidentiality, as detailed in our ‘Terms & Conditions’ (Clause 2.6) and will not be shared with candidates without prior permission. This data will be stored on the CRM for as long as it remains relevant to our relationship with the client, unless we receive written notice that the client no longer wishes that we retain it.

Any communication between TotalTen and our clients, which is stored within our email system, will be deleted on a regular ongoing basis in line with our internal administration policies.

Whilst dealing with candidates on your behalf, we will treat the retention of their personal information as detailed in the above section, in order to comply fully with GDPR regulations.

All our clients are offered access to the ATS in order to view applicant information, and where clients have access to personal data about candidates, we assume that they too have robust systems in place to comply with GDPR.


If you are a previous TotalTen customer, in the six year period following the end of our last recruitment project, we may continue to contact you with information about our services because we think you will find it useful. We believe we have a legitimate interest in this direct marketing activity (and this is also permitted under the Privacy and Electronic Communications Regulations or ‘PECR’) but you are always able to unsubscribe by clicking the link at the bottom of the emails we send, or by emailing us at


If you’re not an existing customer we may have your contact details on our marketing list so we can contact you about our services. You may withdraw consent at any time – usually this is easiest by choosing the ‘unsubscribe’ option at the bottom of information we send to you. You can also email us at any time. Please note that if you do this, we will delete your records on our marketing list. If you remain on our marketing list, we will hold your information for two years from the time we last checked that you wanted to receive communication from us.


  1. Employees 

If you are an employee of (or temporary or contract worker at) TotalTen, we hold your personal details for remuneration, taxation, pension and benefits purposes. We have a legitimate interest in being able to use your information in this way, and we also believe it’s in your interests to show that you’re up to date with data protection training. We will hold your personal information for six years from the expiry of your employment with TotalTen, for legal records.


  1. Suppliers 

If you are a supplier or other business associated with TotalTen, we will hold your contact details because we have a legitimate interest in doing business with your company. We will aim to hold this information for three years since we were last in contact with you. It’s possible we picked this information up from public directories (such as LinkedIn and internet searches) or that you passed your details to us with a business card.

Who Receives your Personal Data? 

If you are a candidate and have applied for a role via a job board, your personal data will be received by the job board company, and then by RecruitBPM which is our SaaS ATS System. Where applicable, your personal data will be passed onto our clients if you are selected as a suitable candidate for one of their vacancies. Occasionally, your details may be relevant for a vacancy for which you have not applied, and if this is the case, we will always seek your permission before sharing your personal data with another client for your mutual benefit.

If you are a client, we hold your contact details on our CRM, ATS and MailChimp email marketing system. These companies are data processors for us.

If you are an employee of TotalTen, your personal data will be passed to HMRC for tax purposes, and to our payroll and pension providers for your personal benefit and remuneration.

Your Personal Data Rights 

The personal data we hold about you is your data, so you have certain rights over them. This section summarises your rights. You can exercise any or all these rights when you choose, and the easiest way is by dropping us an email at


Where we are processing your data based on your consent (e.g. for a job application) you can withdraw that consent and we must immediately stop processing your data. Please note that up to that point, we’re acting lawfully with your consent, and withdrawal of consent cannot be backdated.


You have the right to request a copy of all personal data we hold relating to you and we must provide this within 30 days. You also have the right to require us to correct any records that are wrong.


You have the right to require us to erase personal data and we must comply with this right. We retain the right to keep data that is needed to establish, exercise or defend a legal claim.


Where we process your data based on a ‘legitimate interest’ (underlined in the section on purpose and lawful basis, above) you still have the right to object to our processing of that data. From that point, we must stop processing your data until we have determined whether your rights override our interests.


Finally, you have the right to have your personal data transferred to another organisation, and we’re obliged to provide it to you in a clear and reasonable format.

The personal data we hold about you is your data, so you have certain rights over them. This section summarises your rights. You can exercise any or all these rights when you choose, and the easiest way is by dropping us an email at


Your Rights to Lodge a Complaint with Regulator  

At all times, you have the right to report a concern or lodge a complaint with the Information Commissioner’s Office. Please refer to the ICO at or by calling them on 0303 123 1113.


Of course, we hope that we can resolve your issue quickly and fairly – you can contact us at

Our Contractual Requirements to Use your Personal Data 

If you are a candidate, we have a legitimate interest in using your personal data for the purposes of processing your job application and sharing it with potential employers.

If you’re a TotalTen client, it’s a requirement that we collect personal information from you so that we can enter into a contract with your company.

If you’re an employee (or temporary or contract worker) at TotalTen, we have a legitimate interest in using your personal data for payroll, taxation, pension and benefits purposes. We use our legitimate interests as the lawful basis for processing your data (which is why we don’t ask for your consent to process it).

Automated Processing of your Personal Data 

The only automated processing we do of personal data is to take information provided to the job boards by candidates who apply for advertised roles, and move it into our applicant tracking system (ATS).


We also use Mailchimp and HubSpot to undertake some automated communications activities. You are able to manage the information you receive from us through these channels at any time.

Other Purposes for Processing Personal Data 

We don’t process your personal data for any other purpose than we’ve described here. We won’t sell your personal data to other companies.


As we develop the TotalTen range of products, we might add a new data process to our platform that uses your personal information. Should we decide that we want to develop a new processing purpose, we will contact you to let you know what we intend to do, the lawful basis we will use, and your rights over our intended new processing. We will also publish information about it here.

Changes to this Privacy Notice 

This privacy notice was last updated on 4th April 2019 and historic versions can be obtained by contacting us. We may change this privacy notice from time to time by amending this page.

How to Contact Us 

If you have any questions, concerns or just want some more information about our privacy management, drop us a line at