Scope
RTC Group acts as a data controller in relation to the personal data described within this Privacy Notice. This means RTC Group is responsible for determining how and why your personal data is processed.
Our Privacy Notice describes the ways we collect your personal data and governs how we will deal with it. We aim to ensure that any personal data we obtain and use will always be held, used and transmitted in compliance with the Data Protection Act 2018 (or its successor), Data (Use & Access) Act 2025 and the UK General Data Protection Regulations (together referred to as the ‘Data Protection Laws’)
This Privacy Notice is applicable to all RTC Group employees and prospective employees. This includes employees of;
• ATA Global Staffing Solutions Ltd (GSS)
• The Derby Conference Centre Ltd (DCC)
• Ganymede Solutions Ltd (GSL)
• RTC Group Plc
For the purpose of this Privacy Notice, any reference to RTC Group includes all subsidiaries outlined above.
The website containing this Privacy Notice may contain links to 3rd parties’ websites. The RTC Group assumes no responsibility for the privacy practices or the content of those websites. Therefore, please read carefully any privacy policies on those websites before either agreeing to their terms or using those websites.
This Privacy Notice applies with immediate effect to all Personal Data collected either in person or any other means.
The RTC Group may occasionally amend this Privacy Notice to reflect regulatory requirements and changes in our data collection and disclosure practices. Any new Privacy Notice will automatically be effective when it is published on the website or issued to you directly.
Responsibilities
The RTC Group Data Protection Representative (DPR) has overall responsibility for ensuring that this notice is applicable, compliant and in accordance with the RTC Group Data Protection Policy.
All staff of the RTC Group of companies, who interact with data subjects are responsible for ensuring that this notice is drawn to the data subject’s attention and where applicable, their consent to the processing of their data is secured.
Privacy Notice
Who are we?
RTC Group Plc is an AIM listed recruitment business that focuses on white and blue-collar recruitment, providing temporary and permanent labour to a broad range of industries and customers, in both domestic and international markets, through its geographically defined operating divisions:
Ganymede Solutions specialises in recruiting technical and engineering talent and providing complete workforce solutions to help build and maintain infrastructure and transportation for a wide range of UK customers. Whilst our ATA brand provides high-quality technical recruitment solutions to the manufacturing, engineering, and technology sectors.
Global Staffing Solutions works with customers across the globe that are focused on delivering projects in a variety of sectors in some of the world’s most hostile locations.
The Derby Conference Centre is our hotel, conferencing and events facility which houses the Group headquarters in Derby. In addition to providing office accommodation for our operating divisions, it offers rental opportunities for space not utilised by the Group.
As part of our commitment to managing individual’s rights, we have appointed an RTC Group Data Protection Representative.
Our RTC Group Data Protection Representative can be contacted here:
- DPR@rtcgroupplc.co.uk
What Personal Data do we collect?
Depending on the purpose for which we use your personal data, RTC Group may rely on one or more of the following lawful basis for processing under UK GDPR:
• Contract – where processing is necessary for us to enter into or fulfil a contract with you.
• Legal Obligation – where we are required to process personal data to comply with legal or regulatory requirements.
• Vital Interests – where processing is necessary to protect someone’s life or safety.
• Public Task – where processing is necessary for the performance of a task carried out in the public interest or under official authority.
• Legitimate Interests – where processing is necessary for our legitimate business interests, provided these are not overridden by your rights and freedoms.
• Consent – where you have given clear permission for us to process your personal data for a specific purpose.
The personal data we would like to collect on you is detailed below:
| Purpose of Processing | Categories of Personal Data | Lawful Basis (Article 6 UK GDPR) | Additional Condition for Special Category Data (Article 9 UK GDPR) |
| Reviewing applications and assessing suitability for employment opportunities | Contact details, CVs, employment history, qualifications and experience | Contract | N/A |
| Retaining candidate information for future employment opportunities | Contact details, CVs, employment history, qualifications and experience | Legitimate Interests | N/A |
| Verifying an individual’s right to work in the UK or relevant jurisdiction | Identification documents, right to work documentation | Legal Obligation | N/A |
| Managing employment relationships and personnel administration | Employment records, contact details, payroll and HR information | Contract | N/A |
| Processing payroll, tax and pension information | Payroll records, bank details, tax and pension information | Legal Obligation | N/A |
| Assessing fitness to work and managing workplace health obligations | Health information | Legal Obligation | Article 9(2)(b) – Employment, social security and social protection obligations and rights |
| Assessing fitness to work and supporting occupational health requirements | Health information | Legitimate Interests | Article 9(2)(h) – Occupational health and assessment of working capacity |
| Monitoring equality, diversity and inclusion within the workforce | Equality and diversity information | Legal Obligation | Article 9(2)(b) – Employment, social security and social protection obligations and rights |
| Monitoring equality, diversity and inclusion to support fair and inclusive workplace practices | Equality and diversity information | Legitimate Interests | Article 9(2)(g) – Reasons of substantial public interest |
| Responding to Subject Access Requests and managing data protection rights | Identity information, contact details and correspondence relating to the request | Legal Obligation | N/A |
| Managing relationships with clients, suppliers and business contacts | Contact details and business correspondence | Legitimate Interests | N/A |
| Managing contractual relationships with clients and suppliers | Contact details, contractual and business correspondence | Contract | N/A |
It may be necessary for us to collect personal data, which under Data Protection Law is classified as Special Categories of Personal Data.
The UK GDPR defines special category data as:
• personal data revealing racial or ethnic origin;
• personal data revealing political opinions;
• personal data revealing religious or philosophical beliefs;
• personal data revealing trade union membership;
• genetic data;
• biometric data (where used for identification purposes);
• data concerning health;
• data concerning a person’s sex life; and
• data concerning a person’s sexual orientation.
It is anticipated that the most common Special categories of personal data required from a job seeker will be for the purposes of Health Screening as well as information relating to Criminal Convictions, including criminal record checks, which we may be required to obtain in order to meet industry or job role requirements.
We may also at times process personal data in relation to other special categories such as (but not limited to) ethnic origin or sexual orientation in line with our Equality, Diversity and Inclusion processes, however, providing this data will not be mandatory. We may also process special category personal data in relation to Occupational Health where such processing is required.
How we collect your Personal Data if you are an Employee or Prospective Employee
For the purposes of this Privacy Notice the following definitions apply:
Prospective Employee: An individual who applies for a role with the RTC Group but does not become an employee of the RTC Group.
Employee: An individual whom the RTC Group has entered into a contract of employment with.
The RTC Group obtains personal data from you in the following five ways:
a) Personal Interaction
If you wish to apply for a vacancy in person or via a 3rd party, we may ask you for your contact information and/or CV details and/or job requirement details.
b) Submitting your details
If you wish to apply for a vacancy online or submit your details to one of our Group company recruiters, we may ask you for your contact information and/or CV details and/or job requirement details as you proceed through the stages of the application or the conversation.
c) Automatic collection
Like most websites, our website uses cookies and web beacons to enhance your visitor experience. Please visit our cookie policy for further details.
d) Contractual collection
We may collect specific pieces of personal data that are required for us to meet our contractual obligations with you. This personal data could be gathered directly from you or from the RTC Group company you are directly employed by.
e) Personal Data from 3rd parties
The RTC Group may also obtain personal data about you directly from 3rd parties, such as Social Media sites and previous employers.
How we collect your personal data if you are a Client, Prospective Client, Supplier or Prospective Supplier and other 3rd parties
The RTC Group obtains personal data from you in three ways:
a) Submitting your details
If you submit your details to us as a contact to enable us to manage a contractual obligation or provide information on our services or your products / services.
b) Automatic collection
Like most websites, our website uses cookies and web beacons to enhance your visitor experience. Please visit our cookie policy for further details.
c) Personal Data from 3rd parties
The RTC Group may also obtain personal data about you directly from 3rd parties, such as Social Media sites, referrals, your own company website. If we have found your details via a 3rd party, and we do not require them for contractual purposes they will only be retained during the process of establishing your consent for us to contact you.
Independent of how we collect your data, we will always ensure that you have access to the relevant Privacy Notice.
Additional Terms and Conditions associated with using our website, including our use of cookies, can be found on our website.
What will we do with your Personal Data if you are an Employee or Prospective Employee?
We will process and store your personal data for any or all of the following purposes;
If you have applied for a position with the RTC Group or other Group Company
The RTC Group may collect and store your personal data in order to process your job applications, respond to your enquiries and generally maintain the personal data we hold on you. You may restrict this use at any time.
Whilst employed
The principal purposes for which we collect and store your personal data whilst you are employed by an RTC Group company is to meet our contractual obligations.
To validate competency and suitability
The RTC Group may collect and store your personal data and validate it against external -party competency / experience management systems.
What will we do with your Personal Data if you are a 3rd Party?
We will process and store your personal data for any or all of the following purposes;
Contractual Obligations
The principal purposes for which we collect and store your personal data are to meet contractual obligations. In order to provide our services in an effective and efficient manner we need to ensure that we have the correct communication channels. This is managed through keeping a record of contact positions, email addresses, telephone numbers and business addresses.
Service / Product Procurement
The RTC Group may retain personal contact information in order to establish a supply chain of services or products required to ensure the RTC Group continues to provide an effective and efficient service for our clients.
Sharing Personal Data with 3rd Parties
The RTC Group will not sell your personal data to 3rd parties. However, on occasions it is necessary for us to share personal data with 3rd parties as described below for the purposes described above.
| 3RD PARTY | DATA AND PURPOSE |
| RTC Group Companies | The RTC Group acts on behalf of several RTC Group companies as listed in the Scope section of this Privacy Notice. We will share your personal data with the companies in order to meet our contractual and legal obligations, including those required for insurance and payroll. We may also provide your details to another of the RTC Group companies if we feel it is in your best interest with respect to providing your service or satisfying your role. |
| Website analytics providers | The RTC Group collates statistics about site traffic. This information is collected through 3rd parties to assist us in improving the services we provide to you. |
| Payroll, HR, Accounting Software, Pension & Benefits Providers and Legal Advisors. | The RTC Group may require to store or process your data with 3rd parties as is necessary to process your employment, payroll, pension, benefits, remittances or invoices. |
| Legal entities | The RTC Group may disclose your personal data if necessary to comply with regulations or law or to assist with law enforcement, to enforce the terms under which you are contracted with the RTC Group or Group Company or to protect our or other 3rd parties property and other rights. |
| Successor | In the event that RTC Group is sold, or some of its assets transferred to a 3rd party, your personal data, may also be transferred. However, use of your personal data will remain subject to this Privacy Notice. Similarly, your personal data may be passed on to a successor in interest in the event of a liquidation or administration of the RTC Group. |
Where possible all data processors will be within the European Economic Area (EEA). If it is a requirement to transfer data outside of the EEA, this will be in accordance with Transferring Personal Data outside of the UK or EEA below.
How long will we keep your Personal Data
The RTC Group will retain personal data only for as long as is necessary to fulfil the purposes for which it was collected, including to meet legal, regulatory, contractual and operational requirements.
Retention periods may vary depending on the nature of the information, the purpose for which it is processed, and any applicable statutory or regulatory obligations. When personal data is no longer required, it will be securely deleted, anonymised or otherwise disposed of.
In determining appropriate retention periods, the RTC Group considers factors such as legal requirements, business needs, contractual obligations, the nature and sensitivity of the data, and any actual or potential disputes or claims.
Transferring Personal Data Outside of the UK or European Economic Area (EEA)
The UK has an adequacy decision in place with the EU / EEA. The RTC Group will only transfer personal data outside of the EEA if necessary.
The RTC Group do not currently transfer your personal data outside of the European Economic Area. However, should this become necessary, appropriate safeguards will be implemented to protect your personal data, including adequacy decisions or approved contractual mechanisms such as the UK International Data Transfer Agreement (IDTA)
Where it is necessary to transfer personal data outside of the United Kingdom or European Economic Area (EEA), RTC Group will ensure that appropriate safeguards are in place and will assess the risks associated with the transfer in accordance with applicable data protection laws.
What Profiling and Automated Processing do we undertake?
The RTC Group does not carry out any automated processing activities.
How will we contact you?
We will contact you in the following circumstances;
| CIRCUMSTANCE | HOW | WHY |
| If you submit your details on a speculative basis to our website. | Telephone, email or appropriate communication platform | To further the conversation and to find out more about employment with us or to supply your services. |
| If we receive a referral | Telephone, email or appropriate communication platform | To find out if you are content to be referred, communicate our Privacy Notice and to confirm permissions if appropriate. |
| If we receive your CV or contact details through a 3rd Party job board / website / agency | Telephone, email or appropriate communication platform | To find out if you are content to be contacted, to communicate our Privacy Notice and to confirm permissions if appropriate. |
| If we believe that we have a need for your products or services. | Telephone, email or appropriate communication platform | To request information about services or products or to engage in contract negotiations. |
| If we require to contact you for contractual reasons. | Telephone, email or appropriate communication platform | To implement a contractual requirement. |
Your Rights as a Data Subject
At any point while we are in possession of or processing your personal data, you, the data subject, have the following rights:
• Right of access – you have the right to request a copy of the personal data that we hold about you.
• Right of rectification – you have a right to correct data that we hold about you that is inaccurate or incomplete.
• Right to be forgotten – in certain circumstances you can ask for the data we hold about you to be erased from our records.
• Right to restriction of processing – where certain conditions apply to have a right to restrict the processing.
• Right of portability – you have the right to have the data we hold about you transferred to another organisation.
• Right to object – you have the right to object to certain types of processing such as direct marketing.
• Right to object to automated processing, including profiling – you also have the right to be object to the legal effects of automated processing or profiling.
Requesting information on the Personal Data we hold
You may submit a Subject Access Request (SAR) at any time by contacting the RTC Group Data Protection Representative using the contact details provided at the end of this Notice. Requests may be made verbally or in writing.
In order to avoid personal data being disclosed to the wrong individual, we may ask for additional information to verify your identity before responding to a request. Any such request will be reasonable and proportionate.
Your request should be emailed to the DPR at SAR@rtcgroupplc.co.uk
We will endeavour to respond to your request within 1 month of confirming its validity. For more complex requests this may be increased by a further 2 months.
Complaints and Contact Details
If you have any concerns about how RTC Group collect, use, store, or otherwise process your personal data, we encourage you to raise them with us in the first instance. Complaints can be submitted by contacting us using the details provided in this Privacy Notice below. We will acknowledge your complaint within 30 days and aim to investigate and respond without undue delay.
If you are not satisfied with our response or believe that we have not handled your personal data in accordance with applicable data protection laws, you have the right to lodge a complaint with the Information Commissioner’s Office, details of which are provided below. Further information is available from the ICO’s website.
| RTC Group Contact Details | Supervisory Authority Contact Details | |
| CONTACT | Group Data Protection Representative | Information Commissioners Office (ICO) |
| ADDRESS | Derby Conference Centre London Road Derby DE24 8UX | Derby Conference Centre London Road Derby DE24 8UX |
| EMAIL/ONLINE | DPR@rtcgroupplc.co.uk | https://ico.org.uk/make-a-complaint/ |
Version 4 – June 2026