Privacy
policy.

FinPay Talent is the trading name of Sourcific Talent Limited (company number 11650642), registered in England and Wales. Our registered office is 203 West Street, Fareham, United Kingdom, PO16 0EN. We are the controller of the personal information described in this policy unless we explain otherwise.

For privacy requests or questions, email privacy@finpay-talent.co.uk. Our website is https://finpay-talent.co.uk.

This policy applies to people who apply for roles, join our candidate network, are introduced to employers or placed in roles; client contacts and people using our client portal; prospective business contacts; suppliers; and visitors who use our website, booking links or contact forms. It covers recruitment and business activity in the UK and internationally, including work involving Europe and the United States.

For candidates we may hold your name, contact details, CVs and previous versions, publicly available professional profile links, location, employment and education history, experience, skills, qualifications, work authorisation, salary expectations, availability, job preferences and professional communications.

Our recruitment records can also include the source and date of an application, a record of when our recruitment relationship began or was renewed, recruiter notes about career-related conversations, AI-assisted summaries, applications, vacancy matches, introductions, interview arrangements, employer feedback, offers, placements, permissions and company exclusions.

For client contacts, business prospects and suppliers, we may hold names, employers, job titles, professional email addresses and telephone numbers, contact sources, business interests, hiring requirements, notes of conversations, meetings, contracts, account and invoice information, communication preferences and records of objections to contact.

When you use our website or portal, we may process form submissions and attachments, account information, access permissions, technical and security logs, IP addresses, browser or device information, and cookie or analytics information where applicable.

We do not seek sensitive personal information for ordinary candidate matching. If health, disability, criminal-offence or other specially protected information is provided or genuinely necessary, we assess whether there is a lawful basis, any additional legal condition and an appropriate reason to keep it. We limit access and do not use such information to make speculative AI matching decisions.

We receive information directly from you, including by telephone, email, website form, meetings or CV submission; through Manatal or other job applications; from employers, recruiters and professional referrals; and from publicly accessible professional and company sources.

For business contact research we may use publicly available company websites and professional information, human-reviewed LinkedIn profiles, and services such as Apollo and ContactOut. We may also use verified company information, event or directory information and other licensed sources for research. We do not treat being publicly visible as permission to use information for every purpose.

Where we obtain your personal information from another source, we provide the privacy information required by law within the applicable timeframe, and you can ask where particular details came from.

• Recruitment and candidate support: to discuss suitable roles, assess professional experience, match you with vacancies, arrange interviews and manage offers and placements. We commonly rely on legitimate interests, steps requested before entering a contract, or legal obligations, depending on the activity.
• Maintaining professional relationships: to keep a relevant candidate network, understand career preferences and contact you about suitable opportunities. We rely on an appropriate lawful basis, generally legitimate interests or consent where required.
• Candidate permissions and speculative approaches: to record your choices about future opportunities, anonymised speculative representation and employers you do not wish us to approach. We respect the separate choices you make and the permission required before any identifiable introduction.
• Client services and commercial administration: to deliver recruitment assignments, manage client portal access, correspondence, contracts, invoices and disputes. We rely on contracts where applicable, legitimate interests and legal obligations.
• Business development and market research: to identify relevant businesses and professional decision-makers, research hiring needs and make lawful business contact. We rely on legitimate interests for appropriate research and comply separately with applicable electronic marketing and calling rules.
• Meeting administration and optional recording: to organise calls, create agreed recordings and transcripts, take accurate notes and follow up on agreed tasks. We explain recording before it starts and ask for permission.
• Security, legal compliance and rights: to control access, protect information, maintain necessary audit and suppression records, respond to requests and comply with legal duties. We rely on legitimate interests and legal obligations as applicable.
• Website analytics and preferences: to understand use of the site and remember privacy choices, on the appropriate consent or legal basis described in our Cookie Policy.

Our legitimate interests include running a specialist recruitment service, maintaining accurate professional relationships, identifying relevant opportunities, providing clients with recruitment support and protecting our systems. We assess those interests against the rights and reasonable expectations of the people involved.

We do not send your identifiable CV or profile to a named employer for a specific vacancy without first discussing the opportunity and obtaining your permission. Permission may be provided verbally and documented in our dated recruitment notes.

We offer separate choices about receiving future recruitment opportunities and whether we may represent your experience in a genuinely anonymised speculative approach. Agreeing to one does not automatically mean agreeing to the other. You can update your choices and tell us which employers must be excluded. Where your exclusions are unresolved, we do not make speculative approaches on your behalf.

We do not share an identifiable CV through speculative outreach without specific permission. Genuinely anonymised information is used only where a person cannot reasonably be identified; where identification is reasonably possible, we treat the information as personal data.

After an authorised introduction, we share relevant recruitment information with the employer and authorised people involved in their hiring process. The employer will normally handle the information as an independent controller under its own privacy arrangements.

We use our FinPay Talent ATS, CRM, client portal and Intelligence tools, together with Manatal and supporting services, to manage recruitment and professional contacts. Client administrators manage permissions for their own organisation; they do not have access to our internal recruitment database, private notes, wider CRM or Intelligence tools.

AI-assisted tools may help us identify company hiring signals, organise professional research, summarise candidate conversations, suggest relevant vacancies or candidates, compare role requirements with professional experience and prepare communications for human review.

These suggestions may use CV information, career-related recruiter notes, vacancies, availability and professional profile data where relevant. Automated suggestions can be inaccurate or incomplete. The recruiter reviews them and makes the decision: we do not solely rely on AI to reject or exclude candidates, send identifiable CVs, contact prospective employers or make decisions with legal or similarly significant effects.

We do not automatically send recruitment or business development emails simply because an AI system has produced a recommendation. Necessary contact permissions and suppression checks still apply.

Some Zoom or other calls may be recorded or transcribed, including through Fireflies. We tell participants and ask before recording starts. If someone declines, we do not record that conversation.

Original recordings and raw transcripts are normally deleted within 30 days once the relevant recruitment summary and tasks have been checked, unless a specific legal or other justified need requires a longer period. Appropriate career-related summaries and notes may remain as part of the relevant recruitment record and are subject to the retention review described below.

We use specialist providers to operate our services. The main providers include Neon for our live database (London, UK); Render for the portal application (Frankfurt, Germany); Cloudinary for candidate document storage (UK storage region); and 20i for our WordPress website (London, UK).

Other service providers include Microsoft 365 for email and business documents; Manatal for job applications and candidate sourcing; Web3Forms for website form processing and attachments; Resend for portal email sending and delivery information; Zoom and Fireflies for meetings, optional recordings and transcriptions; Calendly for meeting bookings; Google Analytics for website usage information; and Apollo and ContactOut for professional research. Appropriate AI providers, including Anthropic where used to process relevant information, may also assist our work.

Not all providers receive all information. For example, a website enquiry is not the same as an ATS record, and a supplier used for professional contact research does not need access to all candidate CVs. We limit information shared to the service being provided and assess provider access and security arrangements.

We may also disclose relevant information to the authorised employer for an agreed candidate introduction, professional advisers, insurers, payment or accounting services, regulators or authorities where lawful or necessary.

Although our live database and several main services are hosted in the UK or European Union, some suppliers process information elsewhere. In particular, Manatal and certain email and AI services may process information in the United States; Fireflies states that it processes meeting information in the United States to produce transcripts and AI summaries; and website form or other suppliers may use infrastructure in more than one country.

Where personal information is transferred outside the UK, we use a lawful transfer arrangement appropriate to the supplier and destination. Depending on the circumstances, this may involve UK adequacy regulations (including an applicable UK-US data framework certification), the UK International Data Transfer Agreement, the UK Addendum to EU standard contractual clauses, or another permitted mechanism. We can provide information about the relevant safeguards on request.

For our candidate network, the standard review cycle is measured from the start of an established recruitment relationship or from the latest positive renewal of that relationship. We contact candidates around month 35 to invite them to renew their relationship and preferences. At month 36, we review whether continued retention is justified. The review is not automatic deletion.

A routine database edit, CV import, unanswered message, AI search or other administrative activity does not by itself restart the period. A new qualifying positive renewal can start a new review cycle. Earlier job application dates may be recorded separately from the date our relationship was established.

If we no longer have a lawful reason to retain personal recruitment information, we delete or anonymise it appropriately. Some placement, contract, accounting, compliance, suppression or legal-claim records may need to be retained longer. Client and business records are assessed under their own purpose-specific periods rather than applying the candidate cycle automatically.

Manatal and FinPay can contain separate copies of a candidate record because transfers between them are manual. Our privacy and deletion reviews therefore consider relevant copies and documents in those systems and in the services that store them.

Website form providers and email or recording services may also maintain their own operational copies for defined periods. We review these arrangements and seek deletion where required and feasible in accordance with applicable contracts and law.

Depending on the circumstances, you can ask to access your personal information, correct inaccurate details, request erasure or restriction, object to processing, and receive applicable information in a portable form. You can withdraw consent where we rely on it, without affecting earlier lawful processing.

You can object to the use of your personal information for direct marketing at any time. We will stop processing it for that purpose and may keep a minimum suppression record to make sure we respect your request.

Contact privacy@finpay-talent.co.uk to make a request. You can also make a request verbally. We may check your identity where reasonably necessary and will normally respond within one calendar month, subject to the rules on permissible extensions. We may need to retain some records where a legal exception applies, and we will explain the outcome.

We maintain an internal process for reviewing information held about candidates and professional contacts, assessing erasure requests and checking linked records before information is removed. We do not automatically erase important accounting or placement evidence solely because a recruitment record is deleted.

We use proportionate safeguards such as account authentication, role-based access permissions, restricted client views, security controls, supplier oversight and procedures for handling incidents and privacy requests. Access to our internal recruitment systems is limited to authorised personnel. No internet-based system can be guaranteed completely secure.

Website enquiries, CVs and vacancy information sent through our forms are handled using Web3Forms and delivered to our business email. This can involve processing or temporary storage of form contents and attachments by the service provider. We use Google Analytics 4 to understand how the website is used, subject to the applicable cookie and privacy choices.

We use a cookie preferences interface to let visitors accept, refuse or customise non-essential tracking. For information about the categories of technologies used and how to manage them, see our Cookie Policy at https://finpay-talent.co.uk/cookie-policy/.

Our recruitment services and client portal are intended for adults and professional users. We do not intentionally solicit personal information from children. Our website may contain links to third-party websites and booking services, which operate under their own privacy policies.

If you have a concern about how we handle personal information, please contact privacy@finpay-talent.co.uk. You can also complain to the UK Information Commissioner's Office at https://ico.org.uk/make-a-complaint/. Where relevant, you may have rights to contact an appropriate supervisory authority in another country.

We update this policy as our services, suppliers, legal requirements and data-handling practices change. The date at the top tells you when it was last updated.