Book a demoTry Templace
Home / Policies / Your data

How we use your data and your rights

Your rights over personal data, how to make a request, the one-month time limit and extensions, identity checks, and what happens when an agency holds your data.

Start here: who holds your data

Most personal data in the Service belongs to the recruitment agencies that use it. If you have registered with, worked through or hired from an agency, that agency is the controller of your data. You will see its name and brand, not ours. We are its processor: we run the system it uses.

Templace is the controller only for its own business data: agency customer contacts, users' sign-in details, website enquiries, billing records and our suppliers. For that data, make your request to us. For anything else, make it to the agency. If you are not sure which applies, write to us and we will make sure your request reaches the right place.

Your rights

Under the UK GDPR you have the right to:

  • be told how your data is used (our Privacy notice does this for the data we control);
  • get a copy of your personal data and information about how it is used (a subject access request);
  • have inaccurate data corrected and incomplete data completed;
  • have your data deleted where there is no good reason to keep it;
  • restrict how your data is used, for example while a correction is checked;
  • object to use based on legitimate interests, and to direct marketing at any time;
  • receive data you gave us in a machine-readable form, or have it sent to another organisation, where the use is automated and based on your consent or a contract;
  • where a significant decision about you is taken solely by automated means, be told about it, give your view, have a person look at it again and challenge it;
  • withdraw your consent at any time where consent is the basis we rely on;
  • complain to us and to the Information Commission (the ICO).

How to make a request to Templace

Ask by email to terry@hilliernet.co.uk, by phone on 07789 938284, by post to Meadway, Mill Road, Writhlington, Radstock, BA3 5TY, or through the contact form on our website. You do not need a form or any particular words. A request made by phone counts; we write it down and send you a copy to check.

Tell us who you are, how we know you (for example, the agency you work at) and what you want. The more you can tell us, the sooner we can find it. Someone else, such as a solicitor, can ask for you if they show us you have authorised them.

We do not charge for a request. We may charge a reasonable fee, based on our costs, for further copies of the same data.

Checking your identity

We must not give your data to the wrong person, so we may need to confirm who you are. We ask only for what is reasonable. If you write from the email address we already hold for you, that is often enough. If it is not, we may ask you a question only you could answer, or for a copy of a document. We use anything you send only to check your identity, and then delete it.

If we need more to confirm your identity, we ask within five working days of receiving your request. The time limit does not start until we have what we asked for.

Time limits

We reply without undue delay and at the latest within one month. The month starts on the day we receive your request or, if later, the day we receive what we asked for to confirm your identity, or a fee we are allowed to charge. If the following month has no matching date, the deadline is the last day of that month.

We can extend the time by up to two further months if your request is complex, or because of the number of requests you have made. If we do, we tell you within the first month and explain why.

Since 5 February 2026, under changes made by the Data (Use and Access) Act 2025, the clock can stop. If we hold a large amount of information about you and genuinely need you to tell us which information or which activities your request is about, we will ask. The clock pauses on the day we ask and restarts the day after we receive your answer. A question only about the format you would like does not stop the clock.

The same Act confirms that we must make reasonable and proportionate searches for your data; that part has been law since 19 June 2025. We search every place your data is likely to be, not just the easy ones, but not with effort out of all proportion to what a search could find. If we limit a search, we tell you what we did and did not search.

What we do with your request

We follow these steps for every request made to Templace as controller.

  • Day 1: we log the request with the date received and the deadline, and acknowledge it within two working days.
  • Within five working days: we ask for anything we need to confirm your identity or to clarify the request.
  • We search, in a reasonable and proportionate way, the data we control in the Service, our email, our billing records and our files.
  • We remove other people's personal data unless they agree or it is reasonable to share it, and apply an exemption in the Data Protection Act 2018 only where it truly applies.
  • We reply in the form you asked for, or electronically if you asked electronically. A copy of your data comes with what the law requires: why we use it, who we share it with, how long we keep it, where it came from and your rights.
  • For a correction, deletion, restriction or objection, we act on it, tell you what we did, and tell anyone we shared the data with unless that is impossible or would take disproportionate effort.
  • If we refuse all or part of a request, we say why and how you can complain to us, to the ICO or to a court.
  • We keep a record of the request and our reply.

When the request is about an agency's data

If you send us a request about data an agency holds in the Service, the agency is the controller and the decision is its own. We do not answer the request ourselves unless the agency tells us to.

We pass your request to the agency without delay, and within two working days at the latest, with everything you sent us, so that the agency has as much of its own one-month limit as possible. We tell you that we have done so and that the agency will reply to you.

We then help the agency answer. The agency can search, export, correct and delete its own records in the Service. Where it needs more, we help on its written instructions, for example by searching records it cannot reach itself or confirming what the audit trail shows. We aim to do what it asks within five working days so that it can meet its deadline.

Agencies: if one of your people asks you directly, you can answer without us. If you need our help, email terry@hilliernet.co.uk with the date the request was received and what you need.

Refusals and complaints

We can refuse, or charge a reasonable fee for, a request that is manifestly unfounded or excessive, for example one made only to cause disruption. We give our reasons within the time limit.

If you are unhappy with how we handled your request, tell us and our Complaints procedure applies. As the Data Protection Act 2018 has required since 19 June 2026, we acknowledge a data protection complaint within 30 days, look into it without undue delay, keep you told of progress and tell you the outcome.

You can also complain to the Information Commission (the ICO) at ico.org.uk or on 0303 123 1113, or ask a court to enforce your rights.

How we use your data and your rights · version 1.0 · approved 27/10/2026 · next review 27/10/2027. Templace is a trading name of TWH Holdings Limited, company number 10663539, Meadway, Mill Road, Writhlington, Radstock, BA3 5TY.