Privacy Policy
Last updated:
On this page
1. Who we are
Verify Recruits is a pre-employment screening platform operated by Atmen Ltd, a company registered in England and Wales (company number 12736447). Our registered office is 45 Albemarle Street, London W1S 4JL.
Verify Recruits is a trademark of Atmen Ltd. In this policy, "we", "us" and "our" mean Atmen Ltd.
- Privacy contact: myatmen@myatmen.com
- ICO registration number: ZA786199
- Website: www.verifyrecruits.com
2. Who this policy covers and our role
This policy covers four groups of people:
- Candidates whose pre-employment checks are run through Verify Recruits
- HR users at the organisations that use Verify Recruits (our customers)
- Referees who complete reference requests
- Website visitors
When we run checks for an employer, the employer is the controller and we are their processor. The employer decides which checks to run and why, and we act on their instructions. Candidates should also read the employer's own privacy notice.
We are the controller for HR users' account details, our billing and business records, website data, and the security of our service.
Age. Verify Recruits is designed for checks on candidates aged 18 and over. If an employer runs a check on a candidate aged 16 or 17, for example for an apprenticeship, the employer is responsible for making sure the check is appropriate and lawful.
3. What personal data we collect
| Who | Data we collect |
|---|---|
| Candidates | Name, email, phone number, the role applied for, your CV and the employment dates you provide, PAYE and Self Assessment records retrieved from HMRC with your permission (section 4), any explanations you give for gaps in your history, the names and contact details of your referees, your consents, and the results of each check |
| HR users | Name, work email, job title, organisation, login details, how you use the platform, and the check packages, questionnaires and reminder settings your organisation sets up |
| Referees | Name, contact details, relationship to the candidate, and your answers to the employer's reference questionnaire |
| Website visitors | IP address, browser and device information, and cookie data (see our Cookie Policy) |
Where your data comes from:
- Candidates: the employer gives us your name and contact details to start a check. Everything else comes from you, or from HMRC with your permission.
- Referees: the candidate gives us your name and contact details. Your reference answers come from you.
- HR users: you or your organisation, when your account is set up.
Sensitive information. We do not ask for special category data, such as health information, as a standard part of our checks. However, when you explain a gap in your employment history, you may need to share sensitive information. We pass anything you share only to the employer that requested the check. The employer, as controller, is responsible for having a lawful basis to use it.
4. HMRC records
Some checks verify your employment and income history directly with HMRC. This only happens if you choose to connect your HMRC account.
- The employer sends you a secure link by email. You open it and log in to Verify Recruits.
- If the employer has chosen an HMRC check, you select "Connect" and are taken to HMRC's own Government Gateway sign-in page.
- You sign in on HMRC's website. We never see or store your Government Gateway user ID or password.
- HMRC asks you to give Verify Recruits permission to view your records. You can refuse.
- If you agree, HMRC sends us a secure access token. We use it to retrieve your PAYE and Self Assessment records, which confirm your employment and self-employment dates.
- We compare those dates with the dates on your CV. We flag any break of 4 weeks or more, and any dates that do not match.
- If we flag a gap, we ask you to explain it while you are still completing your checks. Your explanation is included in the report.
- The employer reviews the report, which brings together your HMRC records, your explanations and any references.
We use HMRC data only to complete the check you agreed to. We do not use it for marketing, sell it, use it for any other check, or combine it with other data to profile you.
We store access tokens encrypted and delete them as soon as the check is complete. If you prefer not to connect your HMRC account, tell the employer, who can offer another way to verify your history.
Verify Recruits is not provided, endorsed or approved by HMRC.
5. How we use data and our lawful bases
| Purpose | Lawful basis |
|---|---|
| Running checks requested by an employer | We act as processor; the employer sets the lawful basis, usually legitimate interests in safe recruitment |
| Retrieving HMRC records | Your explicit permission, given through HMRC's sign-in |
| Comparing HMRC dates with your CV and asking you to explain gaps | We act as processor, on the employer's instructions |
| Collecting references | We act as processor; referees choose whether to respond |
| Sending reminders to candidates and referees | We act as processor, using the reminder rules the employer sets |
| Providing HR user accounts and support | Performance of our contract with your organisation |
| Keeping the service secure and preventing fraud | Our legitimate interests |
| Keeping business and tax records | Legal obligation |
| Occasional product updates to business contacts | Our legitimate interests; you can opt out at any time |
HR decides the outcome. Flags for gaps or mismatched dates are prompts for the employer to review alongside your explanation. They are not decisions. We do not make automated decisions about whether a candidate is hired.
6. Who we share data with
We never sell personal data. We share it only with:
- The employer that requested a candidate's check
- Service providers (sub-processors) that help us run Verify Recruits, under written data processing agreements
- Regulators, courts or law enforcement, where the law requires it
| Sub-processor | What they do | Where data is processed |
|---|---|---|
| Base44 | Application hosting, database, and sending check links and reminder emails | United States |
7. Where data is stored
We store Verify Recruits data in the United States, with our hosting provider Base44. We protect this transfer with the UK–US data bridge, if Base44 is certified under the UK Extension, or the UK International Data Transfer Agreement or Addendum in our agreement with Base44.
You can ask us for a copy of the safeguards we use.
8. How long we keep data
We keep data only as long as we need it. Employers can set shorter periods for their own checks.
| Data | How long we keep it |
|---|---|
| HMRC access tokens | Deleted as soon as the check is complete |
| Check results, including HMRC records and references | 12 months after the check is completed, unless the employer sets a shorter period |
| HR user account data | For the life of the account, then deleted within 90 days of closure |
| Billing and business records | 6 years, as UK tax law requires |
| Website analytics | Up to 13 months |
9. How we keep data secure
- All data is encrypted in transit (TLS 1.2 or higher) and at rest (AES-256).
- Each customer's data is kept separate, so one organisation cannot see another's candidates or checks.
- Access to customer data within Atmen is limited to authorised personnel, using multi-factor authentication.
- We test the platform for security weaknesses and review our controls against the ICO's information security checklist.
If a personal data breach occurs, we will tell affected employers without undue delay. Where required, we will report it to the ICO within 72 hours.
10. Your rights
Under UK data protection law you have the right to:
- Access a copy of your personal data
- Correct data that is wrong or incomplete
- Ask us to delete your data
- Restrict or object to how we use it
- Receive your data in a portable format, or have it sent to another provider
- Withdraw your permission at any time, including your HMRC permission
To use any of these rights, email myatmen@myatmen.com. We respond within one month.
If you are a candidate, the employer that requested your check is responsible for your check data. We will pass your request to them, or help them respond to it.
If you are an HR user, you can export your organisation's check records or ask us to delete your account. If you switch providers, we will give you your data in a common format.
11. Cookies, complaints and changes
Cookies. Our Cookie Policy explains the cookies we use and how to control them.
Complaints. Please contact us first at myatmen@myatmen.com so we can try to resolve your concern. You also have the right to complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.
Changes. We may update this policy. We will post the new version here with a new "last updated" date, and tell HR users about significant changes by email.
Verify Recruits is a trademark of Atmen Ltd.