01Who we are
Retain Talent Ltd is a specialist recruitment business working with high-growth AI, data and technology companies across the UK, US and Europe. We are the data controller for the personal data described in this policy.
We are registered in England and Wales, company number 17389618, registered office 32 Codicote Road, Welwyn, Hertfordshire, AL6 9NQ. We are registered with the Information Commissioner's Office under reference ZC218475.
Questions about this policy, or about the data we hold on you, go to [email protected].
02The data we collect
If you are a candidate
- Name, email address, phone number and general location
- CV, employment history, education, skills and qualifications
- Links to public professional profiles such as LinkedIn or GitHub
- Current and expected salary, notice period, and what you are looking for
- Our notes from conversations, interviews and market discussions
- Feedback from clients about your application
- References, where you have agreed to us taking them
- Right to work documentation, where a role requires it
If you are a client contact
- Name, job title, business email and business phone number
- The company you work for and your role in the hiring process
- Records of our correspondence, briefs, and hiring requirements
- Billing and payment contact details
If you use this website
- Anything you enter into our contact form: name, email, company, whether you are hiring or a candidate, and your message
- Basic technical data such as IP address and browser type, processed by our hosting provider for security and performance
03Where we get your data
Most of the time you give it to us directly, by sending your CV, filling in our contact form, or talking to us about a role.
We also source candidate data from other places, which is normal in executive search. That includes:
- Professional networking sites and publicly available professional profiles
- Job boards and CV databases you have chosen to publish on
- Referrals and introductions from people in our network
- Company websites, public announcements and industry press
- Your named referees, where you have agreed to a reference
If we have collected your data from somewhere other than you, we will tell you within one month of getting it, or when we first contact you, whichever comes first.
04Why we use it, and our legal basis
Under UK GDPR we need a lawful basis for everything we do with your data. Here is ours.
| What we do | Lawful basis |
|---|
| Identify and approach candidates who may fit a role | Legitimate interests. Running a recruitment business and connecting people with relevant opportunities, using professional data in a professional context. |
| Assess your suitability and represent you to a client | Legitimate interests, and steps taken at your request before entering into a contract. |
| Keep you on file for future roles | Legitimate interests, and your consent where we have asked for it. You can opt out at any time. |
| Deliver recruitment services to a client company | Performance of our contract with that client, and legitimate interests for contacts at the client. |
| Send occasional market updates or role alerts | Consent, or legitimate interests for existing business contacts. Every message has an unsubscribe. |
| Invoicing, accounting and tax records | Legal obligation, and performance of contract. |
| Right to work and compliance checks | Legal obligation. |
Where we rely on legitimate interests, we have weighed our interest in operating a search business against your rights and freedoms. You can object at any time and we will stop unless we have a compelling reason not to. In practice, if you tell us to stop, we stop.
05Sensitive data
We do not seek out special category data, which means information about health, ethnicity, religion, sexual orientation, political opinions, trade union membership, genetic or biometric data.
Occasionally it comes up. You might tell us about a health condition so we can arrange adjustments for an interview, or a right to work check might reveal nationality. When that happens we only use it for the specific reason you shared it, we only pass it on with your agreement, and we rely on your explicit consent or on our legal obligations as the basis for handling it.
We do not ask about criminal convictions unless a role has a specific legal requirement for it.
06Who we share it with
Client companies
If we are putting you forward for a role, we share your CV and relevant details with that client. We always tell you which company before we send anything, and we do not submit you anywhere without your agreement.
Candidates
If you are a client contact, we may share your name and role with candidates so they know who they are meeting.
Service providers
We use a small number of trusted providers who process data on our behalf under written agreements. These include our email and document platform, our website host, our form handling service, our accountant, and any applicant tracking or CRM system we operate. They can only use your data to provide their service to us.
Others
We may share data with professional advisers such as our solicitor or insurer, and with regulators, HMRC or law enforcement where we are legally required to.
We never sell your personal data.
07International transfers
We work with clients and candidates in the UK, the US and Europe, so your data may be transferred outside the UK. Some of our service providers are also based outside the UK.
Where that happens we make sure appropriate safeguards are in place, which means one of the following: the country has UK adequacy status, the transfer is covered by the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, or you have explicitly consented after being told about the risks.
If you want details of the safeguards covering a specific transfer, ask us and we will tell you.
08How long we keep it
- Candidate records: up to two years from our last meaningful contact with you, after which we delete or anonymise them. If we place you, we keep the relevant records for six years to cover our contractual and tax obligations.
- Client records: for the length of the relationship, then six years from the end of it.
- Financial and invoicing records: six years after the end of the relevant accounting period, as required by law.
- Website enquiries that go nowhere: twelve months.
You can ask us to delete your data sooner and we will, unless we have a legal reason to keep it.
09Security
We keep your data on access-controlled business systems protected by multi-factor authentication and encryption in transit. Access is limited to people who need it to do the work. We review our providers and our practices as the business grows.
No system is completely secure, but if a breach happens that is likely to risk your rights, we will notify the ICO within 72 hours and tell you directly where required.
10Your rights
Under UK GDPR you have the right to:
- Access a copy of the personal data we hold about you
- Correct anything inaccurate or incomplete
- Erase your data, where we have no overriding reason to keep it
- Restrict how we use it while a query is being resolved
- Object to processing based on legitimate interests, including any direct marketing
- Portability, receiving your data in a structured, machine-readable format
- Withdraw consent at any time, where consent is what we relied on
Email [email protected] and we will respond within one month. There is no charge. We may ask you to confirm your identity first.
11Automated decision making
We do not make decisions about you by automated means alone, and we do not profile you in any way that produces legal or similarly significant effects. We may use software to search or organise data, but a person always makes the judgement about whether to approach you or put you forward.
12Cookies
This site does not use advertising or analytics cookies and does not track you across other websites.
Our hosting provider may set strictly necessary cookies to keep the site secure and running, for example to manage traffic and block malicious requests. These do not identify you personally and are exempt from consent requirements under the UK's PECR rules.
13Changes to this policy
We update this policy as the business changes. The date at the top of the page tells you the current version. If we make a significant change to how we use your data, we will contact you directly where we can.
14Contact and complaints
For anything to do with your data, email [email protected] or write to Retain Talent Ltd, 32 Codicote Road, Welwyn, Hertfordshire, AL6 9NQ.
If you are not happy with our response, you can complain to the Information Commissioner's Office at ico.org.uk/make-a-complaint or on 0303 123 1113. We would rather you came to us first so we can put it right.
