This notice explains how Luma Education Recruitment Ltd uses your personal information when you register with us as a candidate and when you work on assignments we arrange. Please read it alongside our Data Protection (GDPR) Policy and our Safeguarding and Child Protection Policy.
1. Who we are
Luma Education Recruitment Ltd ("Luma", "we", "us") is the data controller for the personal information described in this notice. We are an employment business that supplies temporary workers to schools, colleges and early years settings.
| Detail | Information |
|---|---|
| Company | Luma Education Recruitment Ltd, company number 16683838 |
| Registered address | Office 6914, 58 Peregrine Road, Hainault, Ilford, IG6 3SZ |
| ICO registration number | ZC042466 |
| Data Protection Officer | Daniel Benson, info@lumaedrec.com, 0204 576 4344 |
2. The information we collect
Because you will be working with children, the law and statutory guidance (including Keeping Children Safe in Education) require us to carry out detailed checks before you start. We collect:
- Identity and contact details: name and any previous names, date of birth, address history, phone number, email address, photo ID and proof of address.
- Right to work: passport, visa, share code or other right to work documents and the result of the check.
- Your career: CV, full employment history and explanations of any gaps, qualifications, QTS and induction status, training certificates, references, and interview notes.
- Safeguarding and suitability checks: your enhanced DBS certificate and DBS Update Service status, children's barred list result, Teaching Regulation Agency check results (including any prohibition), overseas police checks or letters of professional standing, childcare disqualification declarations, your self-declaration about criminal records, and the outcome of a pre-placement online search (we tell you before we do this).
- Health and fitness to work: your health and medical fitness declaration and any reasonable adjustments you ask for.
- Work and pay details: assignment and booking details, timesheets, National Insurance number, bank details, tax information and pay records.
- Feedback and safeguarding records: feedback from schools, and records of any concern, complaint, low-level concern or allegation involving you.
- Communications: emails, messages and notes of calls with our team.
Some of this is "special category" data (for example health information) or criminal offence data. We only collect it where the law allows and where it is needed to keep children safe and to meet our legal duties.
3. Where we get it from
Most information comes from you. We also receive information from referees, the Disclosure and Barring Service, the Teaching Regulation Agency, the Home Office right to work service, identity verification providers, schools you work in, job boards where you have applied, and public online sources.
4. Why we use it and our lawful basis
| What we do | Lawful basis |
|---|---|
| Register you, find you suitable work and manage your assignments | Taking steps to enter into, and performing, our contract with you |
| Right to work, identity, DBS, barred list, TRA, references and other safer recruitment checks | Legal obligation (including the Conduct of Employment Agencies and Employment Businesses Regulations 2003 and immigration law) and our legitimate interest in keeping children safe; for criminal offence and health data, the employment and safeguarding conditions in the Data Protection Act 2018 |
| Telling schools which checks we have carried out and, where the DBS certificate disclosed information, sharing a copy with them | Legal obligation and legitimate interests (schools must be able to complete their single central record) |
| Paying you, deducting tax and National Insurance, and keeping pay records | Contract and legal obligation |
| Responding to safeguarding concerns and allegations, and referring to the DBS or TRA where required | Legal obligation (Safeguarding Vulnerable Groups Act 2006) and substantial public interest (safeguarding children) |
| Keeping your compliance up to date (annual and 12-week re-checks) | Legal obligation and legitimate interests |
| Telling you about new vacancies and training | Legitimate interests; you can opt out at any time |
5. Who we share it with
We only share what is needed, and we never sell your information. We may share it with:
- Schools, colleges and nurseries where you are being put forward or booked, including confirmation of your vetting checks.
- Our service providers, each under a data processing agreement: Hello Edun (candidate onboarding, compliance records and bookings), QUBA (timesheets, payroll and invoicing), Matrix eBulk (DBS applications), ACI (occupational health screening) and Microsoft 365 (email and document storage).
- HMRC and pension providers, to pay you correctly.
- The Disclosure and Barring Service, the Teaching Regulation Agency and the Home Office, to carry out checks.
- Framework customers (for example under the GCA RM6376 and Value Match frameworks) where they audit our compliance or need to be told about a safeguarding matter.
- Local Authority Designated Officers (LADOs), the police and children's social care where there is a safeguarding concern or allegation.
- Our professional advisers, auditors and accreditation bodies (such as APSCo), under confidentiality.
6. How long we keep it
We keep your information only for as long as we need it, in line with our Data Retention Schedule. In summary:
- If we do not place you: 12 months from our last meaningful contact, unless you ask to stay registered.
- Your recruitment and compliance file (including references, checks, identity and training records): 6 years after your last assignment.
- DBS certificate information: no longer than 6 months after the suitability decision. After that we keep only the date, certificate number, check type, Update Service status and decision.
- Right to work evidence: for as long as you work with us and for two years afterwards.
- Timesheets, pay and tax records: 6 years after the end of the relevant tax or financial year.
- Records of safeguarding allegations: until you reach normal pension age or for 10 years from the date of the allegation, whichever is longer, in line with KCSIE Part 4.
Deletion is paused for any record linked to an ongoing safeguarding investigation, complaint, legal claim or audit.
7. Keeping it safe
Your information is stored on secure, encrypted systems with multi-factor authentication, and only authorised staff can see it. Safeguarding records are kept separately from general candidate files with restricted access. DBS information is handled in line with the DBS Code of Practice. We do not transfer your data outside the UK unless the destination is covered by UK adequacy regulations or appropriate safeguards are in place. We do not make decisions about you based solely on automated processing; every placement decision is made by a director.
8. Your rights
You have the right to:
- be told how we use your information (this notice);
- ask for a copy of your information;
- ask us to correct anything that is wrong;
- ask us to delete your information, or restrict how we use it, where there is no lawful reason for us to keep using it;
- object to us using your information for our legitimate interests or for marketing;
- ask us to transfer information you gave us to another organisation.
Some rights are limited where we must keep information to meet a legal or safeguarding duty. To use any of these rights, contact our Data Protection Officer at info@lumaedrec.com. We will reply within one month.
9. Complaints
If you are unhappy with how we have used your information, please contact us first. You can also complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.
10. Changes to this notice
We review this notice at least once a year and will tell registered workers about any important changes.