Website Privacy Notice

1. Who We Are

AVTAV Ltd is a specialist recruitment and training provider operating in the aviation and security sectors. We supply temporary and permanent labour, deliver accredited security and compliance training, and provide comprehensive background screening and vetting services.

We are registered in England and Wales under Company No: 12704296. Our registered address is Suite A, Ground Floor, Sovereign Court, 625–635 Sipson Road, West Drayton, UB7 0JE.

AVTAV Ltd is the Data Controller for personal data collected and processed in connection with our website and services. This means we determine the purposes and means by which your personal data is processed and we are responsible for ensuring it is handled lawfully and securely.

Website: www.avtav.co.uk | Email: hr@avtav.co.uk | Tel: 0203 9844197

2. What This Notice Covers

This Privacy Notice explains how AVTAV Ltd collects, uses, stores, shares, and protects your personal data. It applies whenever you:

• Visit or use our website at www.avtav.co.uk

• Apply for work, a temporary assignment, or a permanent role through us

• Enrol in or enquire about any of our training courses

• Engage with us as a client, business partner, or supplier

• Contact us by phone, email, or via any online form

This notice applies to candidates, clients, trainees, website visitors, contractors, and suppliers. We may provide additional or supplementary privacy information at the point of data collection where appropriate (for example, in a candidate registration form or training enrolment document).

We encourage you to read this notice carefully. If you have any questions, please contact our Data Protection Lead at hr@avtav.co.uk.

3. What Personal Data We Collect

The personal data we collect will depend on your relationship with us and the services you are accessing. We collect only what is necessary, relevant, and proportionate to the purpose for which it is being processed.

a) Personal and Contact Information

• Full name, home address, telephone number, and email address

• Date of birth and nationality

• Government-issued identity documents (e.g., passport, driving licence, biometric residence permit)

• Employment history, CV, professional references, and qualifications

• Training records, certificates, and accreditation details

• Right to work documentation and immigration status

• Vetting and background check data, including DBS disclosures and CAA background check results

• Emergency contact details (where provided)

b) Sensitive / Special Category Data

In certain circumstances, and only where strictly necessary and with appropriate safeguards, we may process special category data including:

• Criminal record information (via DBS checks required for regulated roles)

• Health or disability information (where relevant to a role or reasonable adjustments)

• Nationality and immigration status data (for right to work compliance)

Special category data is processed only under lawful bases permitted by UK GDPR Article 9 and the Data Protection Act 2018, and is handled with the highest level of care and security.

c) Website Usage Data

• IP address, browser type and version, operating system

• Pages visited, time spent on pages, and navigation paths

• Device identifiers and screen resolution

• Referring URLs and search terms used to reach our site

• Form submissions and enquiry content

Please see our Cookie Policy for full details of how we use cookies and similar tracking technologies on our website.

d) Business Contact Information

Where you engage with us as a client, supplier, or business partner, we may hold your name, job title, business address, email address, and telephone number for the purposes of managing our business relationship.

4. Why We Use Your Personal Data

We process personal data only for specific, legitimate purposes. We do not process personal data in ways that are incompatible with the purpose for which it was originally collected. Our key processing purposes are:

• To deliver recruitment and labour supply services, including sourcing, screening, and placing candidates into roles

• To carry out legally required vetting and background checks, including right to work verification, DBS checks, identity checks, and CAA security checks

• To enrol, manage, and certify trainees on our accredited training programmes

• To manage client accounts, contracts, and service delivery

• To comply with legal and regulatory obligations, including those imposed by HMRC, the Home Office, the CAA, the DBS, and the GLAA

• To process enquiries, respond to communications, and provide customer support

• To maintain accurate business records and fulfil contractual obligations

• To improve our website, services, and operational processes

• To send relevant service updates or communications (where you have consented or where we have a legitimate interest to do so)

5. Lawful Basis for Processing

Under UK GDPR, we must have a lawful basis for processing your personal data. The bases we rely on are:

Contract: Where processing is necessary to perform a contract with you or to take steps at your request before entering into a contract. For example, processing candidate data to place them in a role, or trainee data to deliver a course.

Legal Obligation: Where processing is necessary to comply with a legal or regulatory requirement. For example, right to work checks under the Immigration, Asylum and Nationality Act 2006, DBS checks under the Rehabilitation of Offenders Act 1974, and record-keeping obligations under HMRC rules.

Legitimate Interests: Where processing is necessary for our legitimate business interests, provided those interests are not overridden by your rights and freedoms. For example, managing client relationships, improving our services, and maintaining the security of our systems.

Consent: Where you have given us clear and specific consent to process your data for a particular purpose, such as receiving marketing communications or the use of non-essential cookies. You have the right to withdraw consent at any time.

For special category data, we additionally rely on the explicit consent of the data subject or the processing being necessary for reasons of substantial public interest (as defined in Schedule 1 of the Data Protection Act 2018), including for the purposes of safeguarding and employment vetting.

6. Who We Share Your Personal Data With

AVTAV Ltd does not sell, rent, or trade personal data. We share personal data only where necessary and only with parties who are bound by appropriate confidentiality and data protection obligations. Recipients may include:

• Client organisations — for the purposes of confirming a candidate’s suitability, facilitating a placement, or fulfilling a vetting requirement

• The Disclosure and Barring Service (DBS) — for criminal record checks

• The Civil Aviation Authority (CAA) — for aviation security background checks

• HM Revenue & Customs (HMRC) — for payroll, tax, and employment record obligations

• The Gangmasters and Labour Abuse Authority (GLAA) — where required by our licence conditions

• The Home Office — for right to work verification

• Training accreditation and awarding bodies — to register learners and issue certifications

• IT systems and software providers — including our CRM, applicant tracking system, and booking platforms, who act as data processors on our behalf

• Professional advisers — including legal, financial, and HR consultants, under strict confidentiality

Where we engage third-party processors, we ensure appropriate Data Processing Agreements are in place in accordance with UK GDPR Article 28. All third parties are required to implement appropriate technical and organisational measures to protect your data.

7. How We Protect Your Personal Data

AVTAV Ltd takes the security of personal data extremely seriously. We have implemented a range of technical and organisational measures to protect your data against unauthorised access, loss, destruction, or disclosure, including:

• SSL/TLS encryption on our website to protect data in transit

• Encrypted storage systems for data at rest

• Role-based access controls — staff can only access data that is necessary for their role

• Password-protected systems with multi-factor authentication where available

• Secure handling and storage of physical documents containing personal data

• Regular access reviews and internal audits

• Secure file transfer protocols for sharing sensitive data with authorised third parties

• Staff training on data protection and information security

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the Information Commissioner’s Office (ICO) within 72 hours of becoming aware of it, and will inform affected individuals without undue delay where required.

8. How Long We Keep Your Data

We retain personal data only for as long as is necessary for the purposes for which it was collected, or as required by law or regulation. Our retention periods are guided by legal obligations, accreditation requirements, and operational necessity. Examples include:

• Candidate and worker records — retained for the duration of the working relationship and for up to 6 years thereafter, in line with limitation periods under the Limitation Act 1980

• Payroll and financial records — retained for 6 years as required by HMRC

• DBS check records — retained only as long as necessary for vetting purposes; we do not retain copies of DBS certificates beyond what is permitted

• Training and certification records — retained in accordance with the requirements of the relevant awarding body or regulator

• Unsuccessful candidate records — retained for up to 12 months following the conclusion of a recruitment process, unless you consent to a longer period

• Website enquiry and contact data — retained for up to 2 years from last contact

When personal data is no longer required, it is securely deleted or anonymised using appropriate methods, including digital wiping and physical shredding of paper records.

9. Your Rights Under UK GDPR

As a data subject, you have the following rights in relation to your personal data. We will respond to all valid requests within one calendar month, free of charge.

Right to be Informed: You have the right to be told how your personal data is being used, which is the purpose of this notice.

Right of Access: You have the right to request a copy of the personal data we hold about you (a Subject Access Request).

Right to Rectification: You have the right to request that inaccurate or incomplete personal data is corrected.

Right to Erasure: You have the right to request deletion of your personal data where there is no longer a lawful basis for us to hold it.

Right to Restrict Processing: You have the right to request that we limit the way we use your data in certain circumstances.

Right to Object: You have the right to object to processing based on legitimate interests or for direct marketing purposes.

Right to Data Portability: Where processing is based on consent or contract and carried out by automated means, you have the right to receive your data in a structured, machine-readable format.

Right to Withdraw Consent: Where we rely on consent as our lawful basis, you have the right to withdraw it at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

To exercise any of your rights, please contact our Data Protection Lead at hr@avtav.co.uk. We may need to verify your identity before processing your request.

If you are dissatisfied with how we have handled your personal data, you have the right to lodge a complaint with the Information Commissioner’s Office (ICO) at www.ico.org.uk or by calling 0303 123 1113.

10. Cookies & Website Analytics

Our website uses cookies and similar tracking technologies to enhance your browsing experience and help us understand how our site is used. Cookies are small text files placed on your device when you visit a website.

We use the following types of cookies:

• Essential cookies — necessary for the website to function correctly and cannot be disabled

• Analytics cookies — used to collect anonymised data about how visitors use our site (e.g., via Google Analytics), helping us improve content and functionality

• Preference cookies — used to remember your settings and choices

No personally identifiable browsing data is shared with advertisers. You can control or disable cookies through your browser settings at any time, though this may affect the functionality of our website.

Please refer to our full Cookie Policy for detailed information on the specific cookies we use and how to manage them.

11. Contact Us

If you have any questions about this Privacy Notice, wish to exercise your data subject rights, or have concerns about how your personal data is being handled, please contact our Data Protection Lead:

Email: hr@avtav.co.uk

Tel: 0203 9844197

Post: Data Protection Lead, AVTAV Ltd, Suite A, Ground Floor, Sovereign Court, 625–635 Sipson Road, West Drayton, UB7 0JE

We aim to respond to all data protection enquiries within 5 working days and all formal Subject Access Requests within one calendar month.

12. Updates to This Notice

We may update this Privacy Notice from time to time to reflect changes in our services, data processing activities, or applicable legislation. When we make significant changes, we will update the version date at the top of this document and, where appropriate, notify affected individuals directly.

The most current version of this notice will always be available on our website at www.avtav.co.uk. We encourage you to review it periodically.

‍