Skip to content
TIFA Recruits
24/7 emergency staffing: 01792 949842
Privacy

Privacy notice

How TIFA Recruits handles personal data. Last updated 27 May 2026.

This notice explains how TIFA Recruits collects, uses, stores and shares personal data when you interact with this website or submit information through one of our forms. It is written under the UK General Data Protection Regulation and the Data Protection Act 2018.

1. Who we are

TIFA LIFE LTD trading as TIFA Recruits is the data controller for personal data submitted through this site. TIFA Recruits is the staffing division of TIFA Life and operates under the TIFA Life Ltd legal entity.

  • Data controller: TIFA LIFE LTD
  • Trading name: TIFA Recruits
  • Registered office: Unit 23, The Courtyard, South Court, Woodlands, Bradley Stoke, Bristol, BS32 4NH
  • Operational base: Swansea, South Wales
  • Email: recruitment@tifa.co.uk
  • Phone: 01792 949842
  • ICO registration: ZC131131 (Tier 1, registered 22 April 2026)

If you have a question about how your data is handled, contact us at recruitment@tifa.co.uk with "Data query" in the subject line. We aim to respond within 5 working days, and always within the 30-day statutory deadline.

2. The data we collect, and why

We only collect what we need to operate. Three forms on this site collect personal data:

2a. Client registration (/contact)

  • What: organisation name, organisation type, your name, your role, work email, work phone, local authority area, urgency, and a free-text description of staffing needs.
  • Why: to respond to your enquiry and assess whether we can support your service.
  • Lawful basis: legitimate interests (business-to-business enquiry handling).
  • Retention: for the lifetime of any active commercial relationship that follows. If no relationship begins, the enquiry is deleted after 24 months.

2b. Shift booking (/book-staff)

  • What: organisation name, your name, your role, contact details, LA area, shift type, start date, and a free-text shift description.
  • Why: to fulfil a contractual shift request.
  • Lawful basis: performance of a contract.
  • Retention: held under the terms of the commercial agreement with the booking organisation, typically 6 years to satisfy HMRC requirements after final invoice.

2c. Job application (/jobs/* and /join)

  • What: full name, email, phone, area, role applied for, shift availability, right-to-work status, care experience, a short personal note, and your CV upload.
  • Why: to assess your suitability for a role and contact you about it.
  • Lawful basis: taking steps at your request prior to entering a contract of employment.
  • Retention: 12 months from the application date if the application is unsuccessful or paused. If you join our workforce, application data is folded into your employee record and retained per HMRC and employment-law requirements (typically 6 years after employment ends).

2d. Site usage data

We host this site on Vercel. Vercel records standard server logs (IP address, user-agent, requested URL, timestamp) for security and operational purposes. These logs are retained according to Vercel's own data policy, typically 30 days.

This site sets no analytics cookies, no advertising cookies, and no third-party trackers. There is no cookie banner because there is nothing to consent to.

3. Lawful bases at a glance

  • Contract performance: handling shift bookings, processing applications, employing workforce members.
  • Legitimate interest: responding to commissioner enquiries, matching candidates to suitable roles, basic site security and abuse prevention.
  • Legal obligation: tax and payroll records (HMRC), DBS records (Disclosure and Barring Service), safeguarding records (Social Services and Well-being (Wales) Act 2014), right-to-work verification (Home Office).
  • Consent: only where we ask for it explicitly, e.g. on form-submission consent checkboxes. You may withdraw consent at any time.

4. DBS and safeguarding data

DBS certificate numbers are not collected at the application stage. We collect DBS data only after we have made you a conditional offer and you have accepted it. This is deliberate, to keep the volume of sensitive data on file proportionate to actual hiring need.

  • When collected: post-offer, at onboarding.
  • How stored: on our purpose-built workforce platform, with encryption at rest and access restricted to named compliance, HR and management roles.
  • Access: the Designated Safeguarding Lead, HR, payroll, and named operational managers. No client organisation accesses raw DBS data; instead, they receive a compliance pack confirming clearance status.
  • Retention: safeguarding records (incident logs, allegations against staff, training certificates, DBS clearance confirmations) are held for 7 years from end of employment, in line with All Wales Safeguarding Procedures and Social Care Wales expectations. DBS certificate numbers themselves are kept only as long as needed and rechecked at renewal.

5. Who we share data with

We share only what is necessary, and only with named recipients:

  • Resend (resend.com) processes outbound email from our forms to recruitment@tifa.co.uk. Form payloads transit through Resend in the course of delivery and are not retained by Resend beyond standard email-log retention.
  • Vercel (vercel.com) hosts this site and runs the serverless functions that handle form submissions. Standard server logs apply.
  • Commissioning client organisations receive the parts of an applicant's profile relevant to a placement decision (skills, experience, availability, compliance status), once an applicant has been matched to a role.
  • HMRC, the DBS, the Home Office, and CIW receive data we are legally required to share.
  • Police, courts, or statutory safeguarding bodies receive data on lawful request related to a safeguarding investigation.

We do not sell personal data, ever. We do not share it for advertising or marketing purposes.

6. International transfers

Personal data is stored in the UK and EU. Where a processor (e.g. Resend) operates in a third country, transfers are protected by standard contractual clauses or an equivalent UK GDPR-compliant safeguard. The hosting region for our serverless functions is London (lhr1), specifically so personal data submitted through forms stays in the UK in transit.

7. Your rights

Under UK GDPR you have the right to:

  • Access the personal data we hold about you.
  • Rectify data that is inaccurate or incomplete.
  • Erase data ("right to be forgotten"), subject to our legal retention duties for safeguarding, tax and employment records.
  • Restrict processing in certain circumstances.
  • Portability, receiving your data in a structured, machine-readable format.
  • Object to processing based on legitimate interests or for direct marketing.
  • Withdraw consent at any time where consent is the lawful basis.

To exercise any of these rights, email recruitment@tifa.co.uk. We may need to verify your identity before responding.

If you are not satisfied with how we handle your data, you have the right to complain to the Information Commissioner's Office at ico.org.uk or 0303 123 1113. We would prefer to resolve concerns directly first, so please contact us before going to the ICO if you can.

8. Changes to this notice

If we change how we handle personal data, we update this notice and revise the "Last updated" date at the top. Material changes (a new processor, a new category of data, a change in lawful basis) are communicated by email to anyone with an active relationship with TIFA Recruits.

Last updated 27 May 2026.