1. Who we are
Global Recruitment Consulting Ltd, trading as Global Retail Recruitment, is the controller. Company number 06612799. Registered office: 33–35 Daws Lane, London, NW7 4SD. Privacy contact: Neil Oviatt, director@globalretailrecruitment.com, +44 (0)20 7101 9416.
We process information under the UK GDPR, Data Protection Act 2018 and PECR, as amended by the Data (Use and Access) Act 2025.
2. Information we collect
Depending on your relationship with us, this may include identity and contact details; CV, employment, education and qualification information; remuneration, location, nationality, language, mobility and right-to-work information; references, interview notes and assessments; career preferences; publicly available professional information; client, vacancy, contract and invoicing records; correspondence; and website, security, consent and analytics information.
3. How we obtain it
We receive information directly from you and from clients, referees, professional networks, job boards, publicly available sources, authorised checking services and our website and technology providers.
4. Why we use it
We use information to identify and assess candidates; discuss and manage opportunities; prepare agreed profiles and shortlists; deliver recruitment assignments; manage client relationships, contracts and payments; operate and secure our website; communicate professionally relevant services; meet legal obligations; prevent misuse; and establish or defend legal claims.
Our lawful bases may include legitimate interests, steps requested before a contract, performance of a contract, legal obligation and consent where appropriate. We normally discuss an opportunity before sending identifiable candidate information to an employer.
5. Sensitive information
Where special-category or criminal-offence information is genuinely necessary, we identify an Article 6 lawful basis and the additional UK GDPR or Data Protection Act condition required. Please do not include sensitive information unless it is relevant and necessary.
6. Sharing and international transfers
We may share relevant information with clients and prospective employers, authorised recruitment partners, referees, checking services, hosting, email, recruitment-database, security, analytics and IT providers, professional advisers and authorities where required. Recipients may act as processors or separate controllers.
International recruitment may require transfers outside the UK. We use applicable UK adequacy regulations, the UK International Data Transfer Agreement, the UK Addendum to EU Standard Contractual Clauses or another lawful safeguard, and assess additional destination risks where required.
7. Cookies and website technology
Cookiebot, provided by Usercentrics, manages cookie choices. Our optional enquiry preference cookie is set only after explicit preference consent and lasts up to 24 hours. Withdrawing preference consent removes it. To limit repeated enquiry prompts, a one-way hash derived from the network address is held in temporary server memory for up to 24 hours; the raw address is not retained for that purpose.
The website is hosted through OpenAI Sites on Cloudflare infrastructure. Its forms use Cloudflare Turnstile to check for automated submissions, alongside server-side validation, submission limits and spam checks. Turnstile processes browser and device signals for this security check; see the Cloudflare Privacy Policy. Google reCAPTCHA is not embedded. There are currently no analytics, advertising or embedded social-media tracking services. LinkedIn and WhatsApp are external links. The shared Gulf pages serve their fonts directly from this website without contacting Google’s font servers. See the Cookie Policy for the website's cookie inventory and consent controls.
8. Retention
Candidate records are normally retained for up to 36 months after the last meaningful contact or recruitment activity, unless an active relationship or legal reason requires longer. Website enquiries are normally retained for up to 24 months. Contracts, invoices and accounting records are normally retained for at least six years. Marketing records are retained until no longer relevant or you object; a minimal suppression record may remain. Technical and cookie information follows the periods stated in the current declaration.
Website CV registrations and vacancy applications are normally transferred into eBoss without keeping a separate website copy. Returning candidates are matched using their verified email address, even if their name has changed. When a registration is rejected or a transfer cannot be confirmed, the CV, details and application answers are retained in a private review queue on our website hosting infrastructure. Some details may already have reached eBoss during an interrupted transfer. Neil checks the earlier attempt before completing it. Access to the queue is restricted to Neil; direct download of retained CVs is disabled while their malware scan is unverified. Pending review copies are retained for up to 30 days; handled copies for up to seven further days within that same 30-day limit. Expired copies are removed during subsequent application or review-queue activity. Review alerts contain references and a private review link rather than CV attachments or application answers. Verification emails necessarily use your email address and are processed by our email provider.
The website retains one-way email identifiers, submission fingerprints, eBoss references and processing status to prevent duplicates and investigate delivery problems. These are pseudonymous records, not anonymous data. Submission receipts and related locks expire after 30 days; email verification records expire after 15 minutes and rate-limit records after their applicable one-hour window. Expired records are removed during subsequent website activity; removal is not a timed background service when the site is idle. Hosting and email providers may separately retain delivery logs and backups under their own retention arrangements. Client and general contact enquiries are separate email-based workflows.
9. Security and technology
We use proportionate access controls, authentication, encryption where appropriate, secure providers, confidentiality measures, backups and retention reviews. Technology may assist research, administration, matching and document review, but we do not make legally or similarly significant candidate decisions solely by automated processing.
10. Your rights
Depending on the circumstances, you may request access, correction, erasure, restriction or portability; object to legitimate-interest processing or direct marketing; withdraw consent; challenge certain automated decisions; and complain about our use of your information. Rights are not absolute and we may verify identity.
Contact director@globalretailrecruitment.com. You may also complain to the Information Commission’s Office (ICO) at ico.org.uk.
Information Commission’s Office (ICO)
4th Floor, No.3 Circle Square
5 Hawkshaw Street
Manchester
M1 7BL
11. Changes and regulatory monitoring
We review this notice when our services, technology, suppliers or legal obligations change. Official UK and relevant Saudi regulatory sources are monitored for material changes. A monitoring alert does not replace legal review: substantive wording is only changed after its operational effect has been checked.