London & UK Operations: 
020 8036 1046
A&T Team Hospitality Recruitment
REQUEST STAFF
Compliance & Governance/Data Protection

GDPR & Data Protection Statement

A&T Recruitment Company Limited • Company No. 13579446
Effective Date: October 2026 | Last Reviewed: October 2026

This statement sets out the data protection and privacy standards of A&T Recruitment Company Limited ("A&T", "we", "us", or "our"). We are committed to protecting the privacy, confidentiality, and security of all personal data processed in the course of our hospitality staffing and recruitment operations across the United Kingdom.

1. Our Data Protection Commitment & Scope

A&T Recruitment processes personal data in strict compliance with applicable UK data privacy legislation, including:

  • The UK General Data Protection Regulation (UK GDPR)
  • The Data Protection Act 2018 (DPA 2018)
  • The Privacy and Electronic Communications Regulations 2003 (PECR)
  • Relevant regulatory guidance issued by the Information Commissioner's Office (ICO)

This statement applies to all candidates, agency workers, permanent applicants, hospitality venue clients, suppliers, and website visitors whose personal data we collect and process.

2. Data We Collect & Process

Depending on whether you are a hospitality professional or a client partner, we may process:

Candidates & Workers

  • Full name, date of birth, contact details (phone, email, address)
  • UK Right-to-Work documentation (passports, BRP, digital share codes)
  • Hospitality certifications (Food Hygiene Level 2/3, Allergens, Personal Licence)
  • Bank details and National Insurance number for PAYE payroll
  • Shift attendance logs, digital timesheets, and venue feedback

Clients & Venue Partners

  • Company registration name, number, VAT registration details
  • Authorized booking contacts, telephone numbers, and email addresses
  • Billing address, credit evaluation records, and payment history
  • Staffing request specifications, site protocols, and shift parameters
  • Communications and service agreement documentation

3. Lawful Bases for Processing

We only collect and process personal information where we have a lawful basis under Article 6 of the UK GDPR:

  • Contractual Necessity: To fulfill contracts with clients and assignment agreements with hospitality workers.
  • Legal Obligation: To comply with UK statutory obligations, including HMRC PAYE reporting, Home Office Right-to-Work verification, and Working Time Regulations.
  • Legitimate Interests: To operate, coordinate, and safeguard our staffing service, prevent fraud, and verify worker qualifications.
  • Consent: Where explicitly provided for optional communications or specialized notifications.

4. Technical & Organizational Security Measures

We employ rigorous security measures to protect personal data against accidental loss, unauthorized access, alteration, or disclosure:

  • Encrypted data transmission (TLS/HTTPS) across all public and internal platform endpoints.
  • Role-based access control (RBAC) ensuring only authorized administrative and operations personnel access personal files.
  • Hashed credential storage using industry-standard bcrypt algorithms; passwords and sensitive keys are never stored in plaintext.
  • Secure UK-based data hosting with automated backups and firewall monitoring.

5. Statutory Data Retention Periods

In accordance with UK statutory requirements, we retain personal data only for as long as necessary:

  • Payroll & Tax Records: 6 years following the end of the tax year (Taxes Management Act 1970).
  • Right-to-Work Checks: 2 years after employment or engagement ceases (Home Office statutory guidance).
  • Invoices & Timesheets: 6 years following company financial year end (Companies Act 2006).
  • Unsuccessful Candidate Data: 12 months from application unless extended consent is provided.

6. Your Statutory Rights Under UK GDPR

Individuals have the following rights under UK data protection law:

Right of Access: Request a copy of the personal data we hold about you (Subject Access Request).
Right to Rectification: Request correction of inaccurate or incomplete personal records.
Right to Erasure: Request deletion of data where retention is no longer legally required.
Right to Object: Object to processing carried out under our legitimate interests.

To exercise any of these rights, contact our Data Governance Officer at admin@atrecruitment.co.uk.

7. Governance & Contact Details

A&T Recruitment Company Limited

Registered Office: 392 Katherine Road, London, E7 8NW, United Kingdom

Company No: 13579446 • VAT Reg: 390008910

Direct Telephone: 020 8036 1046 • Email: admin@atrecruitment.co.uk

You have the right to lodge a complaint at any time with the Information Commissioner's Office (ICO), the UK supervisory authority for data protection issues (ico.org.uk).