1. Who we are
Nexplex Ltd (“Nexplex”, “we”, “us”) is a specialist life sciences recruitment company and is the data controller for the personal data described in this policy. We are registered in England & Wales under company number 17466859.
Nexplex LtdNexus House, 66 Paul Street
London EC2A 4NA, United Kingdom
Email: admin@nexplex.co.uk
Telephone: +44 (0)20 3916 5198
All privacy questions, rights requests and complaints should be sent to admin@nexplex.co.uk, marked for the attention of the Data Protection Lead, or posted to the address above.
We process personal data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. Where we recruit for roles in the European Economic Area or handle data of individuals located there, we also process that data in accordance with the EU GDPR.
2. Personal data we collect
Candidates
- Identity and contact details — name, email address, telephone number, postal location or region.
- Career information — CV or résumé, employment history, qualifications, publications, professional registrations, skills, references, portfolio or LinkedIn profile.
- Assignment information — roles you are interested in, salary expectations, notice period, availability, interview feedback and placement outcomes.
- Right-to-work and screening information — nationality, visa or sponsorship status and, where a client role requires it, results of background or compliance checks.
Client and prospective client contacts
- Name, job title, business email address, business telephone number and employer.
- Details of your hiring requirements, correspondence with us and records of our engagement.
- Billing and contractual information needed to invoice and service your account.
Website visitors
- Information you submit through our contact form — name, email address, organisation and the content of your message.
- Technical data such as IP address, browser type, device type, referring page and pages viewed, collected by our hosting provider’s security and server logs.
- Cookie and similar technology data, as described in our Cookie Policy. Non-essential cookies are only used with your consent.
We do not knowingly collect personal data from children. Our services are intended for professional adults.
3. Where we get it from
- Directly from you — when you contact us, submit the form on this website, send us your CV, speak to a consultant or attend an interview.
- From your employer or our client — when a client shares interview feedback, or a contact is introduced to us as part of a hiring process.
- From publicly available and professional sources — such as professional networking sites, employer websites, published research, conference listings and industry directories, where we rely on our legitimate interest in identifying suitable candidates for specialist scientific and clinical roles.
- From referees and screening providers — where you have asked us to take up references or a role requires compliance checks.
If we approach you because we sourced your details from a public professional profile, we will tell you where we found them the first time we contact you, and you can ask us to stop at any point.
4. Why we use it and our lawful basis
| What we do | Lawful basis |
|---|---|
| Matching candidates to roles, presenting shortlists to clients and managing an interview and placement process | Legitimate interests — operating a recruitment service that candidates and clients have engaged us for; or contract where we have a placement agreement with you |
| Responding to enquiries submitted through this website, by email or by telephone | Legitimate interests — replying to a request you have made, or consent where you have given it on the form |
| Keeping you on our candidate network so we can tell you about relevant future roles | Consent, which you may withdraw at any time |
| Providing recruitment services to clients, agreeing terms and invoicing | Contract and legitimate interests in running our business |
| Sending market intelligence, compensation reports and other business updates to professional contacts | Legitimate interests in business-to-business marketing, or consent where required; every message includes an unsubscribe option |
| Verifying right to work and completing role-specific compliance checks | Legal obligation and legitimate interests |
| Measuring how this website is used to improve it | Consent — analytics cookies are only set if you accept them |
| Maintaining the security of our systems, preventing fraud and keeping accounting and tax records | Legal obligation and legitimate interests |
Where we rely on legitimate interests, we have assessed that our interest in operating a specialist recruitment service does not override your rights and freedoms. You can object to this processing at any time — see Your rights.
5. Special category data
We try to avoid collecting special category data. Occasionally it is necessary — for example if you tell us about a disability so that we can arrange reasonable adjustments for an interview, or where a client role in a regulated environment requires specific health or eligibility checks.
When that happens we rely on your explicit consent, or on the employment and equal opportunity provisions of the Data Protection Act 2018, and we collect only what is needed for that specific purpose. Please do not include health, ethnicity, religion, political opinion or similar information in your CV or messages to us unless we have asked for it.
7. International transfers
We recruit across more than 40 countries, so your personal data may be transferred outside the UK or EEA — for example when we present you to a client based overseas, or because a technology provider we use hosts data abroad.
Where we transfer personal data to a country without UK or EU “adequacy” status, we put appropriate safeguards in place, normally the International Data Transfer Agreement or the UK Addendum to the European Commission’s Standard Contractual Clauses, together with a transfer risk assessment. You can request details of the safeguards applied to a particular transfer by emailing admin@nexplex.co.uk.
8. How long we keep it
Standard retention period: 12 months. Unless a longer period is required for the reasons set out below, we delete or anonymise personal data 12 months after our last meaningful contact with you.
“Last meaningful contact” means the most recent point at which you engaged with us — for instance you replied to a consultant, applied for a role, attended an interview, updated your details or opened a discussion about a hiring need.
| Record | Retention period |
|---|---|
| Candidate profiles, CVs and interview notes | 12 months from last meaningful contact |
| Client and prospective client contact records | 12 months from last meaningful contact |
| Website contact form submissions | 12 months from submission |
| Marketing subscription and consent records | 12 months from last engagement or until you unsubscribe |
| Cookie consent record | 12 months, after which we ask again |
| Server and security logs | Up to 12 months |
| Placement contracts, invoices and accounting records | 6 years after the end of the relevant financial year, as required by UK tax and company law |
We may keep data for longer than 12 months only where we must — to comply with a legal or regulatory obligation, or to establish, exercise or defend a legal claim. Where we do, we restrict access to the records concerned.
If you ask us to keep you on our network beyond 12 months you are welcome to do so, and we will ask you to confirm your details before the period runs out. You can ask us to delete your data sooner at any time.
9. How we protect it
We use appropriate technical and organisational measures to keep personal data secure, including encryption in transit (HTTPS across this website), access controls on a need-to-know basis, multi-factor authentication on our business systems, supplier due diligence, staff data protection training and a personal data breach response procedure. If a breach is likely to result in a risk to your rights, we will notify the Information Commissioner’s Office and, where required, you.
10. Your rights
Under the UK GDPR you have the right to:
- Be informed about how we use your personal data — this policy.
- Access a copy of the personal data we hold about you.
- Rectification of data that is inaccurate or incomplete.
- Erasure of your data where we no longer have a good reason to keep it.
- Restrict processing while a concern you have raised is resolved.
- Data portability — receive data you provided to us in a structured, commonly used format.
- Object to processing based on legitimate interests, and to direct marketing at any time.
- Withdraw consent where our processing is based on consent, without affecting processing carried out before you withdrew it.
To exercise any of these rights, email admin@nexplex.co.uk or write to us at Nexus House, 66 Paul Street, London EC2A 4NA. We respond within one month and will tell you if we need longer because a request is complex. Exercising your rights is free; we may ask you to verify your identity before we release information.
12. Automated decision-making
We do not make decisions about you by automated means alone, and we do not carry out profiling that produces legal effects for you. Search and keyword tools may help a consultant identify potentially relevant candidates, but a person always makes the decision about who to approach or shortlist.
13. Complaints
If you are unhappy with how we have handled your personal data, please contact us first at admin@nexplex.co.uk so we can put it right. You also have the right to complain to the UK supervisory authority:
Information Commissioner’s OfficeWycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF
Telephone: 0303 123 1113
ico.org.uk/make-a-complaint
If you are in the EEA, you may instead complain to the supervisory authority in your country of residence or work.
14. Changes to this policy
We review this policy at least annually and whenever our processing changes. The version number and date at the top of the page show when it was last updated. If we make a material change we will highlight it on this website, and where the change affects processing based on your consent we will ask for your consent again.