Privacy Policy

https://jobs.spa-uk.org/ (the “Website”) is a job board operated by The UK Spa Association (“we”, “us”, or “our”) and administered by our partners at 4Leisure Recruitment Ltd (4LR).

We are committed to protecting your personal data and respecting your privacy. This Privacy Policy explains how we collect, use, store, and protect your personal data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

1. Who we are (Data Controller)

For the purposes of data protection law, The UK Spa Association is the data controller of your personal data and 4Leisure Recruitment is the data processor.

Contact details:
Email: manager@spa-uk.org

2. Lawful bases for processing your personal data

We only process your personal data where we have a lawful basis under UK GDPR. These include:

  • Contractual necessity – where processing is required to provide recruiter services you have signed up for
  • Legitimate interests – to operate the job board, match candidates with employers, and communicate about relevant opportunities
  • Consent – where you have explicitly agreed to receive certain communications
  • Legal obligation – where we are required to retain or disclose data by law

3. What personal data we collect

We may collect and process the following categories of personal data:

a) Job seekers

  • Name
  • Email address
  • Telephone number
  • Job preferences (role type, location, sector)
  • CVs, cover letters, personal statements, and other documents you upload

b) Recruiters and employers

  • Name
  • Business name
  • Job title
  • Email address
  • Telephone number

c) Career information subscribers

  • Name
  • Email address

We do not intentionally collect special category data (such as health or biometric data). If you choose to include such data in documents you upload, you do so at your own discretion.

4. How we use your personal data

We use your personal data to:

  • Provide and operate the job board
  • Create and manage your account
  • Allow recruiters to search for suitable candidates (dependant on candidates' preferences)
  • Send job alerts, vacancy notifications, and relevant industry information
  • Communicate with you about your account or services
  • Improve our Website and services

Job seekers understand that by registering, they have the option of making their profile and application information available to employers and recruiters who use the Website.

You can control the visibility of your data through your account settings.

5. Marketing communications

We will only send marketing or promotional communications where:

  • They relate directly to recruitment or career services, and
  • You have consented, or we have a legitimate interest to do so

You can withdraw consent or opt out of communications at any time by:

  • Updating your account preferences, or
  • Using the unsubscribe link in any email

6. Data sharing

We may share your personal data with:

  • Employers and recruiters using the Website where you have made a direct application (job seekers only)
  • Trusted third-party service providers (e.g. website hosting, email delivery, analytics)

All third parties are contractually required to:

  • Process data only on our instructions
  • Keep your data secure
  • Comply with UK GDPR

We do not sell your personal data.

7. International data transfers

Your personal data is stored within the UK or European Economic Area (EEA).

If data is transferred outside the UK/EEA, this will only occur where appropriate safeguards are in place, such as:

  • Adequacy regulations, or
  • Standard Contractual Clauses

8. Data retention

We retain your personal data only for as long as necessary for the purposes for which it was collected.

  • Job seeker and recruiter accounts are retained while the account remains active
  • You may request deletion at any time
  • Data may be retained longer where required for legal, regulatory, or dispute resolution purposes

9. Your data protection rights

Under UK GDPR, you have the right to:

  • Access – request a copy of your personal data
  • Rectification – correct inaccurate or incomplete data
  • Erasure – request deletion of your data
  • Restriction – limit how we process your data
  • Data portability – receive your data in a structured format
  • Object – object to processing based on legitimate interests
  • Withdraw consent – at any time, where consent is the lawful basis

To exercise any of these rights, please contact us using the details above.

10. Account deletion

You may request closure of your account at any time. Once confirmed, we will delete your personal data unless retention is legally required.

11. Cookies

We use cookies and similar technologies to:

  • Analyse Website usage
  • Improve functionality and performance
  • Personalise user experience

You can manage or disable cookies through your browser settings.

For more information, visit:

  • www.aboutcookies.org
  • www.allaboutcookies.org

12. Third-party websites

Our Website may contain links to external websites. We are not responsible for the privacy practices or content of those websites. Please review their privacy policies separately.

13. Changes to this Privacy Policy

We may update this Privacy Policy from time to time. Any changes will be published on this page with an updated revision date.

14. Complaints

If you are unhappy with how we handle your personal data, you have the right to lodge a complaint with the Information Commissioner’s Office (ICO):

Website: www.ico.org.uk

We encourage you to contact us first so we can address your concerns.