Privacy Notice

Brighter Consultancy Limited ("Brighter", "we", "us") is a financial crime compliance consultancy. We place associates and contractors with clients, and deliver consultancy services directly.

We are the controller of the personal data described in this notice. Our details are:

• Brighter Consultancy Limited, registered in Scotland, company number SC613175

• Registered office: 6 St. Colme Street, Edinburgh, EH3 6AD

• ICO registration number: ZA718927

• Data protection contact: our Privacy Officer, at dataprotection@brighterconsultancy.com

This notice explains how we use personal data about:

• candidates who apply to us or whose details we receive about possible roles;

• associates and contractors we engage, whether directly or through their own limited company, including the directors and personnel of those companies;

• people at our clients, prospects and suppliers we deal with; and

• visitors to our website.

This notice does not cover Brighter's own employees.

Candidates and associates:

• name, contact details, address and date of birth;

• CV, qualifications, skills, work history and references;

• interview notes and assessments of your suitability for roles;

• identity and right to work documents, such as your passport or visa;

• screening and vetting results where a client requires them, such as credit, sanctions, employment history and criminal record checks;

• your limited company details, bank details, rates, timesheets, invoices and payments;

• your Brighter email account and system access, where we provide them;

• records of your work on an assignment, including feedback, performance and the end of the engagement; and

• references we give about you after an engagement ends.

Client, prospect and supplier contacts: name, job title, organisation, contact details and our record of dealings with you.

Website visitors: information collected through cookies, such as the pages you visit and how you use the site. See section 12.

Most information comes from you directly, or from your limited company. We also receive information from:

• recruitment and placement partners who introduce you to us;

• job boards and professional networking sites such as LinkedIn;

• referees you give us;

• screening and vetting providers;

• our clients, about your work on an assignment; and

• public sources such as Companies House.

We only collect criminal record information where a client requires a check for a role, usually because of financial services regulatory requirements, and only where the Data Protection Act 2018 allows it. We keep the certificate for no longer than 6 months after the check.

We do not ask for information about your health, ethnicity or other special category data. If you tell us about a health condition so that we can make adjustments for you, we will only use it for that purpose.

• clients and end clients, when we put you forward for a role or place you on an assignment;

• recruitment and placement partners involved in your introduction or engagement;

• screening and vetting providers who carry out checks for us;

• referees, when we ask for a reference, and prospective employers or agencies, when you ask us for one;

• professional advisers, such as our lawyers, accountants and insurers;

• technology providers who host our systems, such as Microsoft, HubSpot and Xero; and

• HMRC, regulators, courts or law enforcement, where the law requires it.

We do not sell personal data.

Some of our technology providers may process data outside the UK. Where this happens, we make sure appropriate safeguards are in place, such as a UK adequacy decision or the approved UK international data transfer agreement.

We keep personal data only for as long as we need it, in line with our Data Retention Schedule. In summary:

We use appropriate technical and organisational measures to protect personal data, as set out in our Data Security Policy. Access is limited to those who need it for their work.

You have the right to:

• ask for a copy of your personal data (subject access);

• ask us to correct information that is inaccurate or incomplete;

• ask us to delete your information;

• ask us to restrict how we use it;

• object to how we use it, including for marketing;

• ask us to transfer information you gave us to another organisation; and

• withdraw your consent, where we rely on it.

Some of these rights only apply in certain circumstances. You can make a request in writing or verbally, and there is normally no charge. We will respond within one month, or tell you if we need longer because the request is complex. We may need to confirm your identity first.

To make a request, contact our Privacy Officer at dataprotection@brighterconsultancy.com.

We do not make decisions about you based solely on automated processing.

Our website uses cookies to make it work and to understand how visitors use it, including HubSpot and Google Analytics cookies. Non-essential cookies are only set if you agree to them through the cookie banner, and you can change your choice at any time. You can also block cookies in your browser settings, although some parts of the site may not then work.

We review this notice regularly. The latest version is always on our website. This version was published on 28th/09/2026.