Important: This Privacy Policy explains how Yvonne Lewis Group Ltd collects, uses, and protects your personal data. Please read it carefully. If you have any questions, contact us at admin@yvonnelewisgroup.com.
1. Who we are
Yvonne Lewis Group Ltd ("YLG", "we", "us", "our") is a specialist recruitment and workforce training company serving the supported housing sector across the United Kingdom.
We are the Data Controller for personal data collected through this website. This means we determine the purposes and means by which your personal data is processed.
Registered address: YLG Limited, 167-169 Great Portland Street, London, W1W 5PF
Company number: [COMPANIES HOUSE NUMBER]
ICO registration: [ICO REGISTRATION NUMBER]
Email: admin@yvonnelewisgroup.com
Phone: 020 8681 1080
The bracketed details above must be completed before this website goes live. You can check your ICO registration at ico.org.uk.
2. What personal data we collect
Account and registration data
- First name and last name
- Email address
- Phone number
- Current location (town or region)
- Job role type (e.g. Support Worker, Team Leader, Manager)
- Years of experience
- Password (stored as a hash — we never see your plain-text password)
Employment and recruitment data
- CV filename and upload reference
- DBS check status and type (Basic, Standard, Enhanced)
- Job preferences and availability
- Application history and status
- Interview or meeting bookings
Employer / client data
- Company or organisation name
- Contact person name and job title
- Business email address and phone number
- Job vacancy details (role, salary, location, requirements)
Contact enquiry data
- Name, email address, and message content submitted through our contact form
Technical and usage data
- IP address and approximate location (processed by our hosting provider, Hostinger)
- Browser type and version
- Pages visited and time on site (if analytics are enabled)
- Cookie consent preferences
3. How we collect your data
We collect personal data in the following ways:
- Job Seeker Portal (dashboard.html): when you register an account, upload a CV, or apply for jobs
- Contact form: when you submit an enquiry through our Contact page
- Booking form: when you book a meeting, consultation, or training session
- Browser storage: your profile and preference data is stored in your browser's localStorage. This data stays on your device and is not automatically transmitted to our servers unless you take an action (such as submitting a form)
- Email communications: when you reply to emails we send
- Third parties: we may receive your details from employers or training partners who refer you to our services
4. Why we process your data (legal basis)
Under UK GDPR, we must have a legal basis for processing your personal data. We rely on the following bases:
| Purpose | Legal basis |
|---|---|
| Creating and managing your account on the platform | Performance of a contract (Article 6(1)(b)) |
| Matching your CV and profile to suitable job vacancies | Legitimate interests (Article 6(1)(f)) — connecting job seekers to opportunities |
| Sending job alerts and vacancy notifications | Legitimate interests / Consent where applicable |
| Processing training course enrolments and bookings | Performance of a contract (Article 6(1)(b)) |
| Responding to contact form enquiries | Legitimate interests (Article 6(1)(f)) — responding to your request |
| Sending transactional emails (booking confirmations, application updates) | Performance of a contract / Legitimate interests |
| Improving our website and services (analytics) | Consent (Article 6(1)(a)) — only when you opt in via cookie preferences |
| Maintaining business and financial records | Legal obligation (Article 6(1)(c)) — UK HMRC record-keeping requirements |
Where we rely on legitimate interests, we have carried out a balancing test and are satisfied that our interests do not override your fundamental rights and freedoms. You have the right to object to processing based on legitimate interests — see Your Rights.
5. How long we keep your data
| Data type | Retention period |
|---|---|
| Active account data (profile, CV, applications) | Until you request deletion, or 2 years after your last login — whichever is sooner |
| Successful placement records | 3 years from placement date |
| Contact enquiries | 6 months from date of enquiry |
| Booking and meeting records | 3 years |
| Financial and invoicing records | 7 years (UK HMRC legal requirement) |
| Cookie consent preferences | 12 months from consent date, then renewed |
| Email communications | 2 years from last correspondence |
After the relevant retention period, your data is securely deleted or anonymised so it can no longer identify you.
6. Who we share your data with
We do not sell your personal data to third parties. We share your data only in the following circumstances:
Potential employers and client organisations
With your knowledge and where appropriate, we may share your CV and profile information with client organisations recruiting for roles that match your preferences. We ensure clients are informed of their own data protection obligations before any data is shared.
Technology and service providers
- Hostinger — website hosting and email delivery (EU/EEA data centres). Your data is processed under Hostinger's data processing agreement.
- Google — Google Fonts are loaded from Google's servers. This involves your IP address being transmitted to Google. See International transfers.
Legal and regulatory obligations
We may disclose your data to law enforcement, regulatory authorities, or courts where required by law or to protect the rights, property, or safety of YLG, our clients, or others.
Business transfers
In the event of a merger, acquisition, or sale of all or part of our business, your data may be transferred to the new owner. We will notify you before your data is transferred and becomes subject to a different privacy policy.
7. International data transfers
Our primary hosting is within the UK/EEA. However, some third-party services we use may transfer data outside the UK:
- Google Fonts: When your browser loads our website, it may request fonts from Google's servers in the United States. This involves transmitting your IP address to Google. Google LLC participates in the EU-U.S. Data Privacy Framework and processes such transfers under Standard Contractual Clauses (SCCs) approved by the UK ICO.
Where transfers occur outside the UK, we ensure appropriate safeguards are in place in accordance with UK GDPR Chapter V.
8. Your rights under UK GDPR
Under UK GDPR you have the following rights regarding your personal data:
- Right of access: request a copy of the personal data we hold about you (Subject Access Request). We will respond within one month.
- Right to rectification: ask us to correct inaccurate or incomplete data.
- Right to erasure ("right to be forgotten"): request deletion of your data where there is no compelling reason for us to continue processing it.
- Right to restrict processing: ask us to limit how we use your data in certain circumstances.
- Right to data portability: receive a copy of your data in a structured, commonly used, machine-readable format, and request transfer to another controller.
- Right to object: object to processing based on legitimate interests, including profiling. We must stop processing unless we can demonstrate compelling legitimate grounds.
- Rights related to automated decision-making: we do not make solely automated decisions with significant effects on you. Our CV matching uses algorithms to suggest roles, but all placement decisions involve human review.
- Right to withdraw consent: where processing is based on consent, you may withdraw it at any time. Withdrawal does not affect the lawfulness of processing before withdrawal.
To exercise any of these rights, contact us at admin@yvonnelewisgroup.com with the subject line "Data Rights Request". We may need to verify your identity before processing your request. There is no charge for most requests; we will inform you if an administrative fee applies.
9. Cookies and browser storage
Our website uses browser localStorage (not traditional cookies) to store your preferences and profile data. localStorage is stored on your device and is not transmitted to our servers unless you take a specific action.
Storage items we use
| Key | Purpose | Category | Expires |
|---|---|---|---|
ylg_cookie_consent |
Records your cookie/storage consent choices | Strictly necessary | 12 months |
YLG |
Stores your profile, job preferences, application history, and saved jobs | Functional | Until you clear browser data or delete your account |
ylg_email_templates |
Custom email template settings (admin panel only) | Functional (admin) | Persists until cleared |
Third-party cookies
Google Fonts may set a session cookie or log your IP when loading fonts. We do not control Google's cookie behaviour. You can review Google's privacy policy at policies.google.com/privacy.
Managing your preferences
You can update your cookie and storage preferences at any time by clicking Cookie Preferences in the page footer, or by clearing your browser's localStorage through your browser settings.
10. Security of your data
We take the security of your personal data seriously and have implemented appropriate technical and organisational measures, including:
- HTTPS encryption for all data in transit (SSL/TLS)
- SMTP authentication and encryption for email delivery
- Server-side storage of credentials (SMTP passwords are not stored in your browser)
- Access controls limiting admin panel access to authorised personnel only
- Regular review of our security practices
However, no method of transmission over the internet or electronic storage is 100% secure. If you believe your data has been compromised, please contact us immediately at admin@yvonnelewisgroup.com.
In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the ICO within 72 hours and inform affected individuals without undue delay as required by UK GDPR Article 33 and 34.
11. Children
Our services are directed at individuals aged 18 and over. We do not knowingly collect personal data from anyone under the age of 18. If you believe we have inadvertently collected data from a minor, please contact us immediately and we will delete it promptly.
12. Changes to this policy
We may update this Privacy Policy from time to time to reflect changes in our practices, services, or applicable law. When we make material changes, we will:
- Update the "Last updated" date at the top of this page
- Display a notice on our website
- Where required by law, seek your consent again
We encourage you to review this policy periodically. Your continued use of our services after changes are posted constitutes acceptance of the updated policy.
13. How to complain
If you are unhappy with how we have handled your personal data, please contact us first at admin@yvonnelewisgroup.com so we can try to resolve the matter.
You also have the right to lodge a complaint with the Information Commissioner's Office (ICO), the UK's supervisory authority for data protection:
- Website: ico.org.uk/make-a-complaint
- Phone: 0303 123 1113
- Post: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
14. Contact us
For any questions, concerns, or requests relating to this Privacy Policy or your personal data, please contact us:
- Email: admin@yvonnelewisgroup.com
- Phone: 020 8681 1080
- Post: Data Protection, YLG Limited, 167-169 Great Portland Street, London, W1W 5PF
We aim to respond to all data-related enquiries within 5 working days, and to Subject Access Requests within one calendar month as required by UK GDPR.