Privacy Policy
This policy explains what personal information The British Institute of Recruiters collects, why we collect it, who we share it with, how long we keep it and the rights you have over it. It is written under the UK General Data Protection Regulation and the Data Protection Act 2018. It replaces the policy dated 14 April 2011.
Who we are
The British Institute of Recruiters (BIOR, formerly the Institute of Recruiters) is a company limited by guarantee registered in England and Wales, company number 07575583. Our registered office is Suite 7, First Floor, Parkway 2, Princess Road, Manchester M14 7LU. We are the controller of the personal information described here. You can reach us about anything in this policy at support@ior.org, by telephone on +44 (0)161 232 0991, or by post to the address above.
What we collect, and where it comes from
From members and applicants. Your name, job title, the recruitment business or employer you work for, business address, email address and telephone number, your membership type and number, the dates of your membership, the information you give us for the certification assessment and your assessment answers and result, your login email address and your password (stored in a scrambled form that we cannot read back), and the record of your payments.
From the staff of an Agency Member. If your employer holds Agency Membership and adds you as a member of its staff, we hold the name, job title and email address it gives us, so that you have your own login, membership number, verification page and badge.
From anyone who contacts us or uses a service on the site. What you write in the contact form, a callback request, a question to Ask BIOR, a resource request, a posting or expression of interest on the Split-Fee Network and your answer to the question of how you found us.
When you pay. Membership fees are taken by PayPal, whether you pay with a PayPal account or with a card. Card details you enter are passed to PayPal to set up and take the payment and are not kept by us. PayPal's own privacy statement applies to the payment itself.
Automatically. Our web server records the internet address, browser type and pages requested of every visit, as every web server does. Within your account we record when you log in and which library documents you download. For the live membership badge we count how often each badge is displayed and the address of the website it was displayed on, not who looked at it. Our analytics tools are described under Cookies and analytics below.
From our emails. Our email system records whether an email we send you was opened and which links in it were followed, and it records delivery failures so that we stop writing to addresses that no longer work.
What we use it for, and our lawful basis
To run your membership, which is our contract with you. The assessment, your certificate and the letters after your name, your login and dashboard, your verification page and badge, your directory entry, renewals, receipts and the service emails about your membership.
To let clients, candidates and the public check that you are a member, which is the purpose of a professional body and is in the legitimate interests of members and of the people who rely on them. Your verification page shows your name, membership type and number and whether your membership is current. You manage your directory entry from your dashboard.
To provide the member services you choose to use, which is also our contract with you. Ask BIOR, resource requests, the resource library and the Split-Fee Network. On the Split-Fee Network the postings you make are shown to other members under its Terms of Use, and we keep a record of the date and time you accepted those terms.
To tell members and former members about resources, services and renewal, which is in our legitimate interests as a membership body and in yours as a member. Every such email carries an unsubscribe link. If you unsubscribe we still send the emails your membership itself needs, such as a renewal notice or a receipt.
To invite reviews. If you join or renew, we may give your name and email address to Trustpilot so that it can invite you to review us. You can ignore the invitation. Trustpilot's privacy policy applies to what you write there.
To keep our accounts and meet our legal duties, which the law requires of us. Payment records are kept for the periods tax and company law set.
To keep the site secure and improve it, which is in our legitimate interests. Server logs, the protections on our forms, and analytics that tell us which pages are read and where visitors come from.
Who we share it with
The companies that work for us. The provider that hosts our website and its database, Microsoft (our email and office systems run on Microsoft 365), PayPal (payments), Google (Google Analytics 4, in aggregate), LinkedIn (the Insight Tag, in aggregate), Trustpilot (review invitations) and the developer who maintains the website under our instructions. Each may use your information only to provide its service to us.
Other members and the public. Your directory entry and verification page are public. On the Split-Fee Network your postings are seen by other members. If your employer added you as its member of staff, it can see whether your membership is current.
Authorities, where the law requires it. We do not sell personal information and we do not share it for anyone else's marketing.
Some of these companies process information outside the United Kingdom. Where they do, the transfer is covered by the safeguards UK data protection law allows, such as the UK's adequacy regulations, the UK Extension to the EU-US Data Privacy Framework, or contract terms approved for use in the UK.
Audits. When an Agency Member is audited by BIOR, it uploads copies of documents from a sample of its placement or worker files, redacted as our standard requires. We process that data as the member's processor, only to conduct the audit and issue the outcome; our named reviewers read it, with the sub-processors listed at ior.org/sub-processors (hosting, email and the help panel's answering service) acting on our instructions; members are asked not to enter personal data into the portal's help panel; we delete the uploaded copies ninety days after the outcome and keep the checklist, the findings and the outcome for the life of the status plus one year. The member is responsible for telling the people concerned. The audit terms and data processing agreement set this out in full.
How long we keep it
Membership records, including your assessment result and payment history, for as long as you are a member and for six years after your membership ends, because our accounting and legal records need them and because clients and employers ask us to confirm past membership.
Enquiries, Ask BIOR questions, resource requests and Split-Fee Network postings, for two years after they are closed, then deleted or made anonymous.
Addresses that have failed, for as long as we need them to make sure we do not write to them again.
Server logs and analytics, in summary form only once their security purpose has passed.
Your rights
You can ask for a copy of the personal information we hold about you, free of charge. You can ask us to correct it, to delete it, to limit what we do with it, to give it to you in a form you can take elsewhere, and you can object to how we use it, including to any marketing, which we always stop. We answer within one month. If we need to keep something you have asked us to delete, for example a payment record the law requires, we will tell you why. To use any of these rights, email support@ior.org or write to the registered office above. We may ask you to confirm who you are first.
If you are unhappy with how we have handled your information, please tell us first so that we can put it right. You also have the right to complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.
Security
The website runs over an encrypted connection. Passwords are stored in a scrambled form. The administration area is open only to our staff and our developer, each with their own login. If a security breach ever put you at risk, we would tell you and the Information Commissioner's Office as the law requires.
Cookies and analytics
The site sets a session cookie so that you stay logged in while you use it, and a further cookie if you tick Stay signed in, which keeps you logged in on that device. It also uses Google Analytics 4, which records the pages visited and the source of each visit, and the LinkedIn Insight Tag, which lets LinkedIn report to us, in aggregate only, the job titles, industries, seniorities and company sizes of LinkedIn members who visit the site. Neither tool identifies you to us. Both set cookies. Google Analytics runs as site statistics only and you can switch it off with Essential only on the cookie bar or the Cookie settings link in the footer; the LinkedIn tag runs only if you choose Accept all, and never on the checkout, renewal and account pages. LinkedIn members can also control LinkedIn's use of their data in their LinkedIn settings. Our Cookie Policy lists the cookies and the choice.
Children
Our membership and this website are for people who work in recruitment. We do not knowingly collect information about anyone under 16.
Links to other websites
Our pages link to other websites, including GOV.UK, LinkedIn and Companies House. This policy does not cover them. Read the privacy statement of any site you visit.
Changes to this policy
When we change this policy we change the date below. Last reviewed 22 October 2026 (the audits paragraph). The versions before that were 21 October 2026 (the cookie choice) and 6 October 2026; the previous one was dated 14 April 2011.