This Policy applies as between Firefish Software Ltd ("Firefish Software", "we", "us" or "our") and individuals whose Personal Data we process in connection with our Website, Services and business operations.
This Policy explains how we collect, use, store, share and protect Personal Data in connection with your use of the Website, our Services and our wider business activities. Please also see our Terms of Service where they apply to your relationship with Firefish.
This Policy sets out our commitment to ensuring that any Personal Data which we process is carried out in compliance with Data Protection Law, including the Data Protection Act 2018, the UK General Data Protection Regulation ("UK GDPR"), and all other applicable data protection legislation in force from time to time.
We are committed to ensuring that good data protection practice is embedded in the culture of our staff and our organisation.
Firefish Software acts in different capacities depending on the nature of the processing activity being undertaken. It is important to distinguish between circumstances where Firefish acts as a Data Controller and those where it acts as a Data Processor.
Firefish Software acts as a Data Processor when providing recruitment software and related services to its customers.
In these circumstances, Firefish processes Personal Data on behalf of and under the instructions of the customer, who determines the purposes and means of processing. This includes candidate, client and contact information and other recruitment-related Personal Data entered into or processed through the Firefish platform.
Customers using the Firefish platform remain the Data Controllers for candidate and recruitment-related Personal Data. The customer is responsible for determining why the information is collected, the lawful basis for processing it, how long it should be retained and how individuals are informed about their rights.
Processing by Firefish is governed by our contractual arrangements with the customer, including our Data Processing Agreement.
Where customers use the Firefish platform to manage candidate information, those customers generally act as Data Controllers and Firefish acts as a Data Processor, processing Personal Data on behalf of and under the instructions of the customer in accordance with the applicable customer agreement and Data Processing Agreement.
Candidate information may include names and contact details, CVs, employment history, qualifications, interview records, salary information, recruitment communications and other information submitted during the recruitment process.
Customers are responsible for providing candidates with appropriate privacy information, which may include a Candidate GDPR Agreement or Candidate Privacy Notice.
Candidates seeking to exercise their rights in relation to candidate or recruitment information should ordinarily contact the recruitment organisation that originally collected their information, as that organisation will generally be acting as the Data Controller. Firefish will assist customers with such requests where required by applicable law and our contractual arrangements.
Where Firefish acts as a Data Processor, retention periods are determined by the relevant customer acting as Data Controller and in accordance with the applicable customer agreement and Data Processing Agreement.
Where Firefish acts as a Data Processor, customers may use the Firefish platform to process Special Category Personal Data. Customers remain responsible for ensuring that an appropriate lawful basis and condition for processing applies.
Firefish Software acts as a Data Controller where it determines the purposes and means of processing Personal Data.
This includes Personal Data relating to:
Firefish may also act as a Data Controller where it collects and uses Personal Data for its own recruitment, business administration, marketing, customer and supplier relationship management, website operation, security, compliance and other legitimate business purposes.
Where Firefish acts as a Data Controller, Firefish is responsible for determining the purposes for which Personal Data is processed, selecting the lawful basis for that processing, providing appropriate privacy information, retaining information only for as long as necessary and responding to data subject rights requests.
This Policy applies to all Personal Data processed by Firefish Software and forms part of our wider approach to data protection compliance.
Our Data Protection team may be contacted regarding any queries or concerns you have regarding your Personal Data or if you wish to exercise your rights:
Last Updated: August 2026
This Policy explains how Firefish Software processes Personal Data when acting as a Data Controller and how it supports customers where Firefish acts as a Data Processor. References to "you" in this Policy should be read according to the relevant relationship, including website visitors, customers, suppliers, applicants, employees, business contacts and users of the Firefish platform.
In this Policy the following terms shall have the following meanings:
"Account" means collectively the personal information, Payment Information and credentials used by Users to access Material and/or any communications System on the Website;
"Cookie" means a small file that resides on your computer's hard drive that often contains an anonymous unique identifier and is accessible only by the website that placed it there, not any other sites.
"Data" means collectively all information that you submit to the Website. This includes, but is not limited to, Personal Data, Account details and information submitted using any of our Services or Systems;
"Data Controller" means the natural or legal person, public authority, agency or other body which determines the purposes and means of the processing of Personal Data.
"Data Processor" means a natural or legal person, public authority, agency or other body which processes Personal Data on behalf of the Data Controller.
"Personal Data" means any information relating to an identified or identifiable natural person;
"Services" means collectively any online facilities, tools, services or information that Firefish Software makes available through the Website either now or in the future;
"Special Category Personal Data" means personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data and biometric data being processed for the purpose of uniquely identifying a natural person, data concerning health, including physical and mental health and data concerning a natural person's sex life or sexual orientation;
"User" / "Users" means any third party that accesses the Website and is not employed by Firefish Software and acting in the course of their employment;
and "Website" means the website that you are currently using and any sub-domains of this site, unless expressly excluded by their own terms and conditions.
The Personal Data processed by Firefish varies depending on our relationship with the individual and the purpose for which the information is being processed.
Where Firefish acts as a Data Controller, the categories of Personal Data we process may include the following. We do not collect every category of information from every individual, and the information processed will depend on the individual's relationship with Firefish and the relevant purpose.
Without limitation, any of the following Data may be collected:
Where Firefish acts as a Data Controller, we may obtain Personal Data from a number of sources, including:
We may collect this information directly from you when you use our online tools or Services, or from third parties including your employer.
Where Firefish acts as a Data Processor, the Personal Data processed through the Firefish platform is determined by the relevant customer acting as Data Controller. This Policy explains Firefish's role, but the customer's own privacy information will usually explain the specific categories of candidate or recruitment information collected, the lawful basis relied upon and the applicable retention period.
Firefish Software provides recruitment software services to recruitment agencies, employers and other recruitment organisations.
Where customers use the Firefish platform to manage candidate information, those customers are generally the Data Controllers and Firefish acts as a Data Processor.
Candidate information may include names and contact details, CVs, employment history, qualifications, interview records, salary information, recruitment communications and other information submitted during the recruitment process.
Customers are responsible for providing candidates with appropriate privacy information, which may include a Candidate GDPR Agreement or Candidate Privacy Notice.
Candidates seeking to exercise their rights should ordinarily contact the recruitment organisation that originally collected their information as that organisation will generally be acting as the Data Controller.
Where an individual applies directly to Firefish Software, Firefish acts as the Data Controller for that applicant's Personal Data.
Such information may include application details, CVs, contact information, interview notes, assessment information, right to work information, references and recruitment communications.
This data is processed for recruitment, selection, compliance and related HR administration purposes. Privacy information may be provided to that individual via our Candidate GDPR Agreement.
Personal Data will be retained only for as long as necessary for the purposes for which it was collected, including satisfying legal, contractual, regulatory, accounting and reporting obligations.
Where Firefish acts as a Data Controller, we generally retain Personal Data for two years from the individual's most recent engagement with Firefish, unless a longer or shorter retention period is required or permitted by law.
For recruitment purposes, we actively use our recruitment database when hiring for positions and retaining information allows us to identify potentially suitable individuals for future opportunities.
Where an individual remains actively engaged with Firefish, the two-year period will generally be considered from the date of their most recent engagement or interaction.
The retention period may be different where:
At the end of the applicable retention period, Personal Data will be securely deleted, anonymised or otherwise disposed of in accordance with applicable legal requirements and our internal retention procedures.
Where Firefish acts as a Data Processor, retention periods are determined by the relevant customer acting as Data Controller and in accordance with the applicable customer agreement and Data Processing Agreement.
Unless we are obliged or permitted by law to do so, and subject to Clause 4, your Data will not be disclosed to third parties for their own purposes or for sending their own marketing communications to you.
Firefish processes Personal Data in accordance with the UK GDPR principles of:
Where Firefish acts as a Data Controller, we will only process Personal Data where we have a lawful basis to do so under applicable Data Protection Law.
The lawful basis we rely upon will depend on the nature and purpose of the processing.
We may process Personal Data where this is necessary to enter into or perform a contract with an individual or organisation.
Examples include:
Where you are an individual or a partner in a non-Scottish Partnership with whom we have a contract, we will process your Personal Data in order to implement our contractual obligations and exercise our rights in relation to that contract.
We may process Personal Data where this is necessary for Firefish to comply with a legal or regulatory obligation.
Examples may include:
We may process Personal Data where this is necessary for our legitimate interests, or the legitimate interests of a third party, provided that those interests are not overridden by the individual's rights and freedoms.
Our legitimate interests may include:
Where we rely on legitimate interests, we will consider the nature of the processing, the reasonable expectations of the individual. the necessity of the processing and the impact that the processing may have on their rights and freedoms.
Where we do not have a contract with you but we use your Personal Data in relation to such a contract, we have a legitimate interest to use your Personal Data relevant to that contract.
We also have a legitimate interest in processing your Personal Data where you are an employee, representative or contact of one of our contractors or suppliers, where this is necessary for managing that relationship, administering contracts, communicating with you, and meeting our legal, security and operational obligations.
We may rely on consent where this is the appropriate lawful basis for processing.
Where we rely on consent, the individual will be informed of what they are consenting to and will generally have the right to withdraw their consent at any time.
Withdrawal of consent will not affect the lawfulness of processing carried out before consent was withdrawn.
Where consent is not the appropriate lawful basis, we will not require an individual to provide consent as a condition of receiving a service or otherwise engaging with Firefish.
| Purpose of Processing | Typical Lawful Basis |
|---|---|
| Providing contracted services | Performance of a contract |
| Managing customer and supplier relationships | Performance of a contract / Legitimate interests |
| Processing payments and billing | Performance of a contract / Legal obligation |
| Recruitment and managing applications | Legitimate interests / Taking steps at the individual's request prior to entering into a contract |
| Retaining candidate information for future recruitment opportunities | Legitimate interests |
| Employee administration | Performance of a contract / Legal obligation |
| Compliance with legal and regulatory requirements | Legal obligation |
| Information and cyber security | Legitimate interests / Legal obligation |
| Fraud prevention and detection | Legitimate interests / Legal obligation |
| Product and service improvement | Legitimate interests |
| Business analysis and reporting | Legitimate interests |
| Marketing communications | Legitimate interests or consent, depending on the circumstances and applicable law |
| Website analytics and non-essential cookies | Consent where required |
| Responding to data subject rights requests | Legal obligation |
| Establishing, exercising or defending legal claims | Legitimate interests / Legal obligation |
The lawful basis stated above is not exhaustive and the appropriate lawful basis will be assessed according to the specific processing activity and circumstances.
Any or all of the above Data may be required by us from time to time in order to provide you with the best possible service and experience when using our Website or the Services.
Specifically, Data may be used by us for the following reasons:
We do not natively store any credit card details or bank details. These are stored on our behalf by Stripe and Go Cardless Inc who are PCI-DSS compliant. (See 4. Third Party Websites and Services).
We have internal policies and controls in place to try to ensure that your Data is not lost, accidentally destroyed, misused or disclosed and is not accessed except by its employees in the performance of their duties. We use appropriate standards for technology and operational security to protect your Personal Data.
We will not transfer Personal Data outside the United Kingdom and/or European Economic Area ("EEA") unless appropriate safeguards required by applicable Data Protection Law have been implemented, or another lawful transfer mechanism applies.
Where Firefish acts as a Data Controller, Special Category Personal Data is generally processed only in relation to employees, workers and job applicants where required by law.
Where Firefish acts as a Data Processor, customers may use the Firefish platform to process Special Category Personal Data and they remain responsible for ensuring an appropriate lawful basis and condition for processing applies.
Firefish Software may, from time to time, employ the services of other parties for dealing with matters that may include, but are not limited to, payment handling, delivery of purchased services, search engine facilities, advertising and marketing.
The providers of such services do not have access to your Personal Data unless it is necessary for them to perform the services that Firefish Software requests. Any data that is shared is limited to what is required for them to provide the service only.
Any use for other purposes is strictly prohibited.
Furthermore, any Data that is processed by third parties must be processed within the terms of this Policy and in accordance with the Data Protection Law. This may include the transfer of data to one or more countries outside the UK, or the European Economic Area.
Where we engage a third party to process Personal Data on our behalf, they only process your Personal Data on the basis of our written instructions, they are under a duty of confidentiality and are obliged to implement appropriate technical and organisational measures to ensure security of data.
They are also not allowed to use your Personal Data for their own purposes.
Where Personal Data is transferred outside the United Kingdom and/or European Economic Area ("EEA"), Firefish will ensure appropriate safeguards are in place, including adequacy regulations, the UK International Data Transfer Agreement (IDTA), the UK Addendum to the EU Standard Contractual Clauses, or other lawful transfer mechanisms recognised under applicable Data Protection Law.
Firefish Software uses Xero, Stripe, Chargebee and GoCardless Inc for payments and subscription handling, HubSpot Inc for its CRM, email delivery service, and for Customer Support & Success, Meta Inc, LinkedIn, X Corp (formerly Twitter) and Google for its web analytics service, Raygun to monitor application performance and User Voice to help us prioritise our roadmap.
Firefish Software uses Microsoft Azure Maps (powered by TomTom) for the purposes of geolocation and mapping to enhance your user experience by providing location-based information.
Azure Maps shares customer provided addresses with a third party (TomTom) for mapping functionality purposes. These addresses are not linked to any end-user when shared with TomTom and cannot be used to identify individuals.
Firefish Software may, from time to time, expand or reduce its business and this may involve the sale of certain divisions or the transfer of control of certain divisions to other parties.
Data provided by Users will, where it is relevant to any division so transferred, be transferred along with that division and the new owner or newly controlling party will, under the terms of this Policy, be permitted to use the Data for the purposes for which it was supplied by you.
In the event that any Data submitted by Users will be transferred in such a manner, you will be contacted in advance and informed of the changes.
When contacted you will be given the choice to have your Data deleted or withheld from the new owner or controller.
Data transferred for this purpose will be subject to confidentiality agreements.
Wherever you are required to submit Data, you will be given options to restrict our use of that Data.
This may include:
You may access certain areas of the Website without providing any Data at all.
However, to use all Services and Systems available on the Website you may be required to submit Account information or other Data.
You may restrict or manage your internet browser's use of Cookies, although some Cookies are essential for the provision of the Services and parts of the Website or Services may not function properly without them. For more information, see Clause 10 below.
Where Personal Data is processed on the basis of our contractual relationship with you, failure to provide that Personal Data may prevent us from fully implementing the contract or giving effect to your rights there under.
Firefish Software will ensure that it has procedures in place to allow data subjects to exercise their rights under applicable Data Protection Law.
Where Firefish acts as a Data Controller, individuals may exercise their rights by contacting our Data Protection team using the contact details provided in this Policy.
Where Firefish acts as a Data Processor on behalf of one of its customers, requests relating to candidate or recruitment information should ordinarily be directed to the relevant customer acting as Data Controller.
Firefish will assist customers in fulfilling such requests where required by law and contractual obligations.
Depending on the circumstances and applicable law, individuals may have the following rights:
You have the right to ask whether we process Personal Data about you and, where we do, to request a copy of that Personal Data together with certain information about how it is being processed.
You have the right to ask us to correct inaccurate or incomplete Personal Data concerning you without undue delay.
You have the right to ask us to delete your Personal Data in certain circumstances. This is sometimes referred to as the "right to be forgotten". This right is not absolute and may not apply where we have a lawful reason to retain or continue processing the information.
You have the right to ask us to restrict the processing of your Personal Data in certain circumstances.
Where applicable, you have the right to receive Personal Data that you have provided to us in a structured, commonly used and machine-readable format and to request that it is transmitted to another Data Controller. This right generally applies where processing is based on consent or a contract and is carried out by automated means.
You have the right to object to certain processing of your Personal Data where we rely on legitimate interests as our lawful basis. You also have an absolute right to object to the processing of your Personal Data for direct marketing purposes.
Where we rely on consent as our lawful basis, you have the right to withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before consent was withdrawn.
You have the right, in certain circumstances, not to be subject to a decision based solely on automated processing, including profiling, where that decision produces legal effects or similarly significantly affects you. Where applicable, you also have rights to obtain information about the processing and request human intervention or challenge the decision.
Requests to exercise your rights should be submitted to our Data Protection team using the contact details provided in this Policy.
When making a request, we may need to verify your identity to ensure that Personal Data is not disclosed to an unauthorised person.
We will respond to valid requests within the timeframes required by applicable Data Protection Law.
In certain circumstances, we may be entitled to refuse a request or charge a reasonable fee where permitted by law. If we refuse a request, we will explain the reason for doing so and provide information about your right to complain to the Information Commissioner's Office.
Firefish Software maintains a register of data breaches and all Personal Data breaches are recorded in this register which will be monitored.
Action will be taken in relation to any issues identified in this register, particularly if any pattern of breaches is identified.
Where Firefish acts as a Data Processor, any Personal Data breach affecting customer-controlled data will be reported to the relevant customer without undue delay in accordance with applicable contractual obligations.
The relevant customer, acting as Data Controller, will normally be responsible for determining whether notifications to supervisory authorities and affected individuals are required unless Firefish is legally required to make such notifications directly.
Where Firefish acts as a Data Controller, we will report Personal Data breaches which are likely to result in a risk to the rights and freedoms of the data subject to the Information Commissioner's Office.
Firefish Software will also communicate any Personal Data breach which is highly likely to result in a risk to the rights and freedoms of the data subject to the data subject or subjects involved.
If we embark on a new project which involves the processing of Personal Data, particularly one using new technologies, we will carry out a data protection impact assessment (DPIA).
The decision to carry out a DPIA will take into account the nature, scope, context and purposes of the processing and determine if there is likely to be high risk to the rights and freedoms of natural persons.
Data security is of great importance to Firefish Software and to protect your Data we have put in place suitable physical, electronic and managerial procedures to safeguard and secure Data collected online.
Please refer to our Trust & Data Security outline.
Firefish uses cookies and similar technologies on its Website and Services to support website functionality, security, analytics and user experience.
Where Firefish determines the purposes and means for which information collected through cookies and similar technologies is processed, Firefish acts as a Data Controller. This includes information collected through cookies and similar technologies used on the Firefish Website for purposes such as website functionality, analytics, performance, marketing and improving the user experience.
Some third-party providers may also process information collected through cookies and similar technologies. Depending on the nature of the processing and the contractual arrangements in place, these providers may act as processors or independent controllers for their own processing activities.
Cookies and similar technologies are subject to the Privacy and Electronic Communications Regulations ("PECR") as well as applicable data protection legislation. Where information collected through cookies constitutes Personal Data, the UK GDPR also applies.
Users may accept, reject or amend their cookie preferences at any time through the cookie settings available on the Website.
Firefish will not use non-essential cookies or similar technologies that require consent until the appropriate consent has been obtained. Consent must be freely given, specific and informed and involve a clear positive action. Continuing to browse the Website does not, by itself, constitute consent.
Strictly necessary cookies may be used without consent where they fall within the applicable PECR exemption, for example where they are necessary to provide a service requested by the user or to enable essential functionality or security.
Cookies used by Firefish fall into the following categories:
| Category | Description |
|---|---|
| Strictly Necessary Cookies | Required for website functionality, security and account access. |
| Functional Cookies | Remember user preferences and improve website experience. |
| Session Cookies | Temporary cookies deleted when the browser session ends. |
| Persistent Cookies | Remain on a device until expiry or deletion. |
| Performance & Analytics Cookies | Help understand and improve website performance and usage. |
Non-essential cookies will only be deployed where appropriate consent has been obtained.
Some browsers support "Do Not Track" settings. At present there is no universally accepted standard for responding to such signals and Firefish does not currently respond differently when such settings are enabled.
| Cookie | Type | Purpose |
|---|---|---|
| .ASPXAUTH | Persistent | Authenticates logged-in users and maintains access to secure areas. |
| ffcookies-dismiss | Persistent | Remembers that the cookie notice has been acknowledged. |
| ff_AdDist | Functional/ Persistent | Identifies visits originating from Firefish email communications. |
| ff_secCheck | Persistent | Maintains security by identifying active website sessions. |
| ASP.NET_SessionId | Session | Maintains functionality during a user's website session. |
| ffIEWarning | Session | Records whether an outdated browser warning has been displayed. |
| __AngularAntiXsrfToken | Session | Protects against cross-site request forgery (CSRF) attacks. |
| __AntiXsrfToken | Session | Provides additional protection against cross-site request forgery (CSRF) attacks. |
| Cookie Provider | Type | Short Purpose |
|---|---|---|
| Functional | Enables LinkedIn sharing functionality and related user interactions. | |
| Meta | Functional | Enables Facebook sharing functionality and related user interactions. |
| X Corp (formerly Twitter) | Functional | Enables X (Twitter) sharing functionality and related user interactions. |
| HubSpot | Performance/ Analytics | Helps analyse website usage and manage customer interactions. |
| Google Analytics | Performance/ Analytics | Collects anonymous information about website usage and visitor behaviour. |
Firefish Software reserves the right to change this Web Privacy & Cookie Policy as we may deem necessary from time to time or as may be required by law.
Any changes will be immediately posted on the Website and we will additionally notify you of any significant changes by sending a notice to your primary email address as specified in your Firefish Software Account, or by a notice on the Website, and you are deemed to have accepted the revised terms of the Policy on your first use of the Website following the alterations.
If you have concerns about how Firefish has collected or used your Personal Data, we encourage you to contact our Data Protection team in the first instance so that we can investigate and attempt to resolve your concern.
You can contact us using the Data Protection contact details page provided above in this policy.
We will acknowledge and investigate your complaint and provide a response within a reasonable period, considering the nature and complexity of the issue.
If you remain dissatisfied with our response, or you believe that your Personal Data has not been handled in accordance with applicable Data Protection Law, you have the right to lodge a complaint with the Information Commissioner's Office (ICO), the UK's independent supervisory authority for data protection.
Where Firefish acts as a Data Processor, complaints relating to candidate or recruitment information should ordinarily be directed to the relevant customer acting as Data Controller in the first instance.
Firefish will cooperate with the customer in responding to complaints where required by law and our contractual arrangements.
The ICO can be contacted at:
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF