Privacy policy
Last updated 11 November 2026
The short version
- We’re a tech recruitment agency. We hold personal data so we can introduce candidates to the companies hiring, and to run our business.
- If you’re a candidate, we may have found your details on LinkedIn. We’ll tell you within a month and point you here.
- We’ll never send your CV to a client without talking to you and getting your agreement first.
- We don’t sell your data. We share it only with clients you’ve agreed to, and with the services that help us run Altrapoint.
- We keep candidate details for two years after we last spoke, and we’ll check with you before that time runs out.
- You can ask to see, correct or delete your data at any time. Email privacy@altrapoint.io. It’s free, and we’ll reply within one month.
- Our website doesn’t use cookies, analytics or advertising trackers.
Who we are
Altrapoint is the trading name of TTT Acquisitions Ltd, a company registered in England and Wales. We decide how your personal data is used, which makes us the “controller” under data protection law.
- Company number
- 16755635
- Registered office
- 2 Tower House, Hoddesdon, Hertfordshire, EN11 8UR
- ICO registration number
- ZC100441
- Privacy contact
- privacy@altrapoint.io
- Phone
- 020 3912 7300
We’re a small team, so we haven’t appointed a Data Protection Officer. One of our directors is responsible for privacy at Altrapoint, and every request sent to the address above reaches them.
What data we collect
If you’re a candidate
- Your name and contact details: email, phone, location, LinkedIn profile.
- Your CV, work history, skills and qualifications.
- What you’re looking for: roles, salary or day rate, notice period, working pattern and where you’d work.
- Notes from our conversations with you, and feedback from clients you’ve interviewed with. If we use Granola on a call with you, a transcript of the call and AI-written notes. Granola doesn’t keep a recording of the call.
- References, if you give us referees and we contact them.
- If you’re a contractor we place through 3R: the details they need to set up your contract. 3R runs the checks and pays you, and holds that information under its own privacy policy.
We don’t ask for sensitive information, such as health, ethnicity, religion or sexual orientation, and you don’t need to include it in your CV. If you tell us about a disability or health condition so we can arrange adjustments for an interview, we’ll use it only for that, with your agreement.
We don’t run right-to-work, reference or criminal records checks ourselves. For contractors, 3R runs them. For permanent roles, the employer does.
If you’re a client
- Your name, job title, company and work contact details.
- Notes from our conversations, the roles you’re hiring for and your feedback on candidates.
- Our terms of business, invoices and payment details.
If you visit our website
- Whatever you send us through a form: your name, email, phone number, message and, on the CV form, your CV.
- Technical data your browser sends when it loads a page, such as your IP address and browser type. Our hosting provider uses this to deliver the site and keep it secure.
If you write a recommendation for one of our team
If one of us asks you for a recommendation, you can write it on our recommendation page. We collect your name, email address and role, the type of company you work for (if you give it), how you know them and what you write.
- We send it to our team by email and send you a copy. It isn’t stored on the website.
- We’ll only quote it, on our website or in material for clients, if you ticked “You can quote me”. We’ll credit you the way you chose and check the exact wording with you first.
- Our legal basis for receiving it and replying is legitimate interests. For quoting it, it’s your consent, which you can withdraw at any time.
- We keep it until you ask us to delete it. To have it deleted, email privacy@altrapoint.io.
Where we get it
Most of it comes from you: through our website forms, by email, on the phone or when we meet.
We also find candidates ourselves. That’s a normal part of recruitment, and it means we may hold your details before you’ve heard from us. We get them from:
- professional networks, mainly LinkedIn
- replies to our LinkedIn job adverts and LinkedIn messages, where candidates often send us their CV
- someone who referred you, such as a former colleague (we’ll tell you who)
- your own public profiles, such as GitHub or a personal website
If we’ve found your details this way, we’ll tell you within one month, usually in our first message. That message links to this policy and explains how to ask us to delete your details.
For clients, we may also use your company’s website, LinkedIn and Companies House.
Why we use it, and our legal basis
The law lets us use personal data only when we have a reason it recognises, called a “legal basis”. Here’s ours for each thing we do.
| What we do | Whose data | Legal basis |
|---|---|---|
| Find people who might suit a role, and contact them about it | Candidates | Legitimate interests: finding the right people is our business, and most people in tech expect to hear about relevant roles |
| Match you to roles and introduce you to clients, with your agreement | Candidates | Legitimate interests, and steps you’ve asked us to take towards a job |
| Manage a placement, including passing a contractor’s details to 3R | Placed candidates | Contract, and legal obligation (tax and employment agency records) |
| Answer your enquiry and work on your roles | Clients | Contract, or legitimate interests before we have one |
| Reply to a message sent through our website | Anyone who uses a form | Legitimate interests |
| Send job alerts, market updates and news by email | Candidates and clients | Consent, given when you sign up. For news we send clients at their work address, legitimate interests. Every email has an unsubscribe link |
| Keep the website working and secure | Website visitors | Legitimate interests |
| Keep records we’re required to keep, and deal with legal claims | Everyone above | Legal obligation, and legitimate interests |
When we rely on legitimate interests, we’ve checked that our interest doesn’t override yours. You can object at any time (see Your rights).
We don’t need your consent to hold your details as a candidate, so we won’t ask for it. You can still tell us to stop at any time.
For health information shared for interview adjustments, we rely on your explicit consent.
Before we send your CV to a client
We’ll always talk to you about the role and get your agreement first. The Conduct of Employment Agencies and Employment Businesses Regulations 2003 require this, and we’d do it anyway.
How we use AI tools
We use two AI tools. Google Gemini, part of our Google Workspace, helps us read CVs, compare skills to a role and explain job specs. Granola transcribes our calls and briefings and writes notes from them. They help us work faster. They don’t make decisions.
- A person at Altrapoint decides who to shortlist and who to introduce to a client. No decision about you is made by software alone.
- Granola doesn’t join the call as a visible bot, so we’ll tell you at the start of a call if we’re using it. You can ask us to turn it off.
- Neither tool uses your data to train its AI models. We use Gemini only through our business Google accounts, and Granola’s training setting is off.
Our legal basis is legitimate interests. You can object, or ask for a person to review anything an AI tool produced about you.
Who we share it with
We don’t sell personal data, and we don’t share it for anyone else’s marketing.
- Clients. If you’re a candidate, we share your CV and details with a client only after you’ve agreed to that role.
- Referees, if you’ve asked us to take up references.
- 3R, if you’re a contractor we place through them. 3R handles the contract, the IR35 and umbrella arrangements, the checks and your pay, and is responsible for the data it holds.
- Our advisers, such as accountants and lawyers, when they need it to do their job.
- The authorities, such as HMRC or the police, when the law requires it.
We also use a few services to run Altrapoint. They handle data only on our instructions, under a written agreement that requires them to keep it safe.
| Service | What it does for us | Where it’s based |
|---|---|---|
| Vincere | Our recruitment database: candidates and their CVs, clients and roles | UK |
| Google Workspace (including Gemini) and Microsoft 365 | Email, documents and video calls (Microsoft Teams for some client calls), and the AI help described above | Microsoft 365: UK. Google Workspace: Google’s data centres, which may be outside the UK |
| Granola | Transcribes our calls and briefings and writes notes from them | USA |
| Finding and messaging candidates, job adverts, and CVs candidates send us there | USA. LinkedIn is responsible for its own copy of the data | |
| Cloudflare | Hosts our website | Worldwide network, run from the USA |
| Resend | Sends the emails from our website forms, and our job alerts and news | USA |
If we sell or restructure the business, personal data may pass to the new owner, who must keep using it in line with this policy.
Transfers outside the UK
Some of the services above are based in the USA, so your data may be stored or processed there. When that happens, we make sure it’s protected to the standard UK law requires, using one of these:
- the UK Extension to the EU–US Data Privacy Framework, when the company has signed up to it
- the UK’s International Data Transfer Agreement, or the UK Addendum to the EU standard contractual clauses
Transfers to the European Economic Area are covered by the UK’s adequacy regulations. If you’d like more detail on the safeguards for a particular service, ask us.
How long we keep it
We keep personal data only as long as we need it, then delete it.
| Whose data | How long | Why |
|---|---|---|
| Candidates we’re in touch with | Two years from the last time we spoke properly. Before then we’ll email to ask if you’d like to stay on file. If you don’t say yes, we delete your details | So we can tell you about roles that suit you |
| Candidates we found or who were referred to us, and didn’t reply | 90 days, then we delete them | Long enough to hear back from you |
| Candidates who sent a CV we can’t use | Up to 30 days | Long enough to reply to you |
| Candidates placed in a permanent role | The basic placement record for six years. Everything else follows the two-year rule above | Contract and accounting records |
| Contractors we’ve placed | Six years after your last assignment | Tax and contract rules |
| Records of what we did as an employment agency | At least one year | The Conduct of Employment Agencies Regulations require it |
| Client contacts | Two years after our last contact, or six years after our last contract | Ongoing relationship, then accounting records |
| Granola call transcripts and notes | 12 months, or as long as the candidate’s record if we copy the notes into it | Accurate notes of what we discussed |
| Website enquiries that don’t go further | 12 months | To follow up and answer questions |
| Website security logs | Set by our hosting providers, usually 30 days or less | To keep the site secure |
If you ask us to delete your data, or withdraw consent to marketing, we’ll do it promptly. We keep only your email address on a do-not-contact list, so we don’t contact you again by mistake. Where the law requires us to keep a record, such as payroll for a placement, we keep that and delete the rest.
Your rights
You have the right to:
- See your data. Ask for a copy of what we hold about you.
- Correct it. If something’s wrong or out of date, we’ll fix it.
- Delete it. Ask us to remove your details. We’ll also tell any clients we sent your CV to, where we can.
- Object. Ask us to stop using your data where we rely on legitimate interests, including to stop contacting you about roles.
- Stop marketing. Unsubscribe from any marketing email at any time, or tell us.
- Limit how we use it, for example while we check a correction you’ve asked for.
- Ask for a person to review anything an AI tool produced about you.
- Take it with you. Ask for the data you gave us in a format you can reuse.
- Withdraw consent, where we rely on it. This doesn’t affect anything we did before.
Some rights have exceptions. For example, we can’t delete records the law says we must keep. If an exception applies, we’ll tell you which one and why.
How to make a request or complain
Email privacy@altrapoint.io or call 020 3912 7300. You can also reply to any message from us, or tell any of us on a call, and we’ll treat it the same way.
- It’s free.
- We’ll reply within one month. If your request is complex, we may need up to two more months, and we’ll tell you why within the first month.
- We may ask you to confirm who you are, but only if we’re not sure. We won’t ask for more than we need.
If you’re unhappy with how we’ve handled your data
Please tell us first, at the same address. We’ll acknowledge your complaint within 30 days, look into it and tell you what we’ve found and what we’ll do.
You can also complain to the Information Commissioner’s Office (ICO), the UK’s data protection regulator, at ico.org.uk/make-a-complaint or on 0303 123 1113.
Cookies and analytics
Our website doesn’t use cookies or analytics, and it doesn’t store anything on your device. If that ever changes, we’ll update this policy, and ask you first where the law requires it.
- We don’t use advertising or social media trackers.
- Our fonts are hosted on our own site, so loading a page doesn’t send your details to Google or anyone else.
Changes to this policy
We’ll update this policy when the way we use personal data changes. The date below shows the latest version. If a change affects you significantly, we’ll tell you directly.
Last updated: 11 November 2026