Legal
Privacy Notice
How White Onyx Search collects, uses and protects the personal data of candidates, contractors, clients and website visitors. Last updated 25 October 2026.
At a glance
Data controller
White Onyx Recruitment Ltd, trading as White Onyx Search
Company number
NI738321, registered in Northern Ireland
Registered office
106 Rose Cottages, Craigavon, BT62 1RY
Contact
fahad@whiteonyxsearch.com
Regulator
Information Commissioner's Office (ico.org.uk)
1. Who we are
White Onyx Search is a trading name of White Onyx Recruitment Ltd, a company registered in Northern Ireland (company number NI738321) with its registered office at 106 Rose Cottages, Craigavon, BT62 1RY. We recruit permanent and contract engineers and technical specialists for defence, aerospace, AI, data and technology employers.
For permanent placements we act as an employment agency, and for contract assignments we act as an employment business, under the Conduct of Employment Agencies and Employment Businesses Regulations 2003 and the Conduct of Employment Agencies and Employment Businesses Regulations (Northern Ireland) 2005.
We are the data controller for the personal data described in this notice. It explains how we collect, use, share and protect personal data under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. If you have any questions, email fahad@whiteonyxsearch.com.
2. Who this notice covers
• Candidates and contractors: people looking for permanent or contract work, and people we approach about a role.
• Clients: contacts at organisations who hire through us, or who we speak to about hiring.
• Referees: people who provide a reference for a candidate.
• Website visitors and anyone who contacts us.
3. The information we collect
Candidates and contractors
• Identity and contact details, such as your name, email address, phone number, location and LinkedIn profile.
• Career information, such as your CV, work history, qualifications, skills, current and expected salary or day rate, notice period, preferred locations and the roles you are interested in.
• Right to work and identity documents, where these are needed for a placement or assignment.
• Your security clearance level and status. We never ask for details of your vetting.
• Interview notes, feedback from employers and references.
• For contractors, the details needed to arrange and pay for an assignment, such as your limited company or payment route, IR35 status information and timesheet records.
Clients
Names, job titles, business contact details, hiring requirements and a record of our dealings with you.
Website visitors
Anything you send us through our website forms or by email, including any CV you upload when you register with us, and anonymous statistics about how the website is used.
4. Sensitive information
We avoid collecting special category data, such as information about your health, ethnicity, religion or sexual orientation, unless it is necessary. If you tell us about a disability so that an employer can make adjustments for an interview, we will only use that information for that purpose and with your agreement.
Some defence and aerospace roles require nationality, right to work or criminal record checks as part of security vetting. These checks are normally carried out by the employer or the relevant government body. Where we do need to handle this kind of information, we only do so where the law allows, including under the conditions in Schedule 1 of the Data Protection Act 2018, and we keep it to the minimum needed.
5. Where we get your information
• Directly from you, when you apply for a role, register with us, send your CV or speak to us.
• From job boards where you have made your CV or profile visible, including Totaljobs and Security Cleared Jobs.
• From professional networks such as LinkedIn, and other public professional profiles.
• From people who refer you to us, from your referees, and from clients who give feedback on your applications.
If we collect your details from a source other than you, we will tell you within one month and point you to this notice.
6. How we use your information and our lawful basis
• To find suitable roles and to introduce you to employers with your agreement. Lawful basis: our legitimate interests in providing a recruitment service, and steps taken at your request before entering into a contract.
• To arrange interviews, offers and placements, and to manage contract assignments, timesheets and payments. Lawful basis: contract.
• To carry out right to work, identity and other checks required by law. Lawful basis: legal obligation.
• To keep the records required by the Conduct Regulations and by tax and employment law. Lawful basis: legal obligation.
• To provide our services to clients and manage our client relationships. Lawful basis: contract and legitimate interests.
• To send you relevant roles and market updates. Lawful basis: legitimate interests. You can opt out at any time.
Where we rely on your consent, you can withdraw it at any time. We will never send your CV or details to an employer without first telling you about the role and getting your agreement.
We do not make decisions about you based solely on automated processing.
7. Who we share your information with
• Clients and prospective employers, only with your agreement to each introduction.
• Referees you have named, so we can ask for a reference.
• Service providers who support our business, including Vincere (our recruitment database), Google Workspace (email and documents), LinkedIn and job boards including Totaljobs and Security Cleared Jobs (sourcing and advertising roles), Framer (website hosting, website forms and analytics) and Uploadcare (secure storage of CVs uploaded through our registration form). They act on our instructions and must keep your data secure. We delete CV files held by Uploadcare in line with the retention periods in section 9.
• Payroll providers, umbrella companies and accountants, where needed to engage and pay contractors.
• Our professional advisers and insurers, and regulators, HMRC or law enforcement where the law requires it.
We do not sell your personal data.
8. International transfers
We recruit for employers in the UK, Europe, the United States and the Middle East, and some of our service providers store data outside the UK. When personal data is transferred outside the UK, we make sure it is protected, for example by relying on UK adequacy regulations, the International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses.
We will only share your details with an employer outside the UK when you have agreed to be put forward for that specific role.
9. How long we keep your information
• Candidates: for two years after our last meaningful contact with you. After that we delete or anonymise your details, unless you ask us to keep them.
• Placement and assignment records: for at least one year from when they are created or last used, as the Conduct Regulations require, and for up to six years where we need them for tax, accounting or legal claims.
• Client contacts: for as long as we work together, and for up to two years after our last contact.
• General enquiries: for up to 12 months, unless they lead to an ongoing relationship.
10. Your rights
Under UK data protection law you have the right to:
• Access the personal data we hold about you.
• Have inaccurate or incomplete data corrected.
• Have your data erased where we no longer have a lawful reason to keep it.
• Restrict how we use your data.
• Object to us using your data on the basis of legitimate interests, including for direct marketing.
• Receive data you gave us in a portable, machine-readable format.
• Withdraw your consent at any time, where we rely on consent.
To use any of these rights, email fahad@whiteonyxsearch.com. We will respond within one month, and there is normally no charge.
11. How we protect your information
We use access controls, multi-factor authentication and reputable, secure service providers to protect personal data. Only people who need your information to do their job can see it. If a data breach is likely to put your rights at risk, we will tell you and the Information Commissioner's Office where the law requires.
12. Cookies and analytics
Our website uses Framer's built-in analytics to understand how many people visit and which pages they use. We do not use advertising cookies or tracking pixels, and we do not use analytics to identify you. The website may use cookies that are strictly necessary for it to work.
If we introduce any non-essential cookies in future, we will ask for your consent first and update this notice.
13. Other websites
Our website links to other websites, such as LinkedIn. We are not responsible for how those websites handle personal data, so please read their privacy notices.
14. Complaints
If you are unhappy with how we have handled your personal data, please contact us first at fahad@whiteonyxsearch.com and we will try to put it right.
You also have the right to complain to the Information Commissioner's Office (ICO), the UK's data protection regulator, at ico.org.uk or on 0303 123 1113.
15. Changes to this notice
We may update this notice from time to time. The latest version will always be on this page, with the date it was last updated.