Back to Home

    Privacy Policy

    Last updated: 28 April 2026

    1. Introduction

    Velo North Consulting Ltd ("Velo North", "we", "us", "our") is a UK-based talent acquisition consultancy. We are committed to protecting and respecting your privacy. This Privacy Policy explains how we collect, use, store, and protect your personal information when you use our website, engage with our recruitment services, or communicate with us in any way.

    This policy is in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. We may update this policy from time to time - any changes will be posted on this page with an updated "Last updated" date.

    If you have any questions about this policy, please contact us at [email protected].

    2. Who We Are (Data Controller)

    Velo North Consulting Ltd is the data controller responsible for your personal data. This means we determine the purposes and means of processing your personal information.

    Registered Office: 66 Paul Street, London, United Kingdom, EC2A 4NA

    Company Registration Number: 16568521 (England & Wales)

    ICO Registration Number: ZC122895

    Data Protection Contact: [email protected]

    3. What Personal Data We Collect

    We only collect personal data that is necessary to fulfil our legitimate business purposes and deliver our recruitment services. The types of data we collect depend on how you interact with us.

    3.1 Candidate Data

    If you are a candidate or prospective candidate, we may collect:

    • First name and last name
    • Email address and phone number
    • LinkedIn profile URL
    • Desired role and location preferences
    • CV/resume (PDF or DOCX format, via our candidate registration form)
    • Employment history and education details
    • Skills, qualifications, and professional certifications
    • Right to work / immigration status
    • Information provided by referees
    • GDPR consent status and timestamp
    • Any other information you choose to provide

    3.2 Client Data

    If you are a client or prospective client, we may collect:

    • Contact details of key personnel (name, email, phone number)
    • Organisation name and structure
    • Hiring requirements and role specifications
    • Contractual and billing information
    • Records of conversations and meetings

    3.3 Website Visitor Data

    When you visit our website, we may automatically collect:

    • IP address, browser type and version, operating system
    • Pages visited, referral source, and visit duration
    • Device information

    3.4 Candidate Registration Form

    When you submit our candidate registration form, we collect:

    • First name, last name, email address, and phone number
    • LinkedIn URL, desired role, and location
    • CV upload (PDF or DOCX, max 5MB)
    • GDPR consent confirmation and timestamp
    • A security token (Cloudflare Turnstile) to verify you are human - no personal data is stored from this

    By ticking the consent checkbox, you agree to Velo North Consulting Ltd storing and processing your personal data and CV for recruitment purposes for up to 12 months. You may withdraw consent at any time by contacting [email protected].

    3.5 Contact Form Submissions

    When you submit our business enquiry form, we collect:

    • Name, email address, company name, and message content
    • A security token (Cloudflare Turnstile) to verify you are human - no personal data is stored from this

    By submitting the contact form, your data will be processed in accordance with this Privacy Policy.

    3.6 Sensitive / Special Category Data

    We do not routinely collect sensitive personal data (such as health information, racial or ethnic origin, or criminal records). Where a client requires such information as part of their recruitment process, we will only collect it with your explicit consent and in accordance with applicable law.

    4. How We Collect Your Data

    We collect personal data from the following sources:

    • Directly from you - via our contact form, email, phone, video calls, in-person meetings, or job applications.
    • Third-party sources - such as LinkedIn, job boards, online CV databases, and professional networking platforms. Where we source your data from a third party, we will inform you within 30 days.
    • Referrals - from colleagues, contacts, or referees who provide your details.
    • Our website - via cookies and similar technologies (see Section 11).

    5. Legal Bases for Processing

    Under the UK GDPR, we must have a lawful basis for processing your personal data. We rely on the following:

    • Legitimate Interest (Article 6(1)(f)) - our primary basis. We have a legitimate interest in processing candidate and client data to provide our recruitment services, respond to enquiries, and manage business relationships. We ensure our interests do not override your rights and freedoms.
    • Contract (Article 6(1)(b)) - where processing is necessary for a contract we have with you or to take steps at your request before entering into a contract (e.g., placing you in a role, processing an engagement).
    • Consent (Article 6(1)(a)) - in some cases we rely on your explicit consent, for example when collecting sensitive personal data or sending marketing communications. You may withdraw consent at any time.
    • Legal Obligation (Article 6(1)(c)) - where we are required by law to process your data (e.g., tax reporting, right to work checks, regulatory compliance).

    We do not undertake automated decision-making or profiling. A person is always involved in recruitment decisions.

    6. How We Use Your Data

    6.1 Candidate Data

    • To identify suitable employment opportunities for you
    • To submit your details to prospective employers (only with your knowledge or consent)
    • To arrange interviews and manage the recruitment process
    • To carry out reference checks and verify qualifications
    • To communicate with you about roles, your application status, and relevant opportunities
    • To comply with legal or regulatory obligations

    6.2 Client Data

    • To identify and introduce candidates best suited to your organisation
    • To manage contractual arrangements and perform our recruitment services
    • To communicate about roles, candidate progress, and invoicing
    • To improve the services we offer

    6.3 Website & Contact Form Data

    • To respond to your enquiry
    • To improve our website and user experience
    • To ensure website security and prevent abuse

    6.4 Candidate Registration Data

    • To identify and match you with suitable employment opportunities
    • To store your details and CV in our CRM for recruitment purposes
    • To contact you about relevant roles within the consent period (up to 12 months)
    • To send you an internal notification email with your submitted details and CV

    7. Who We Share Your Data With

    We do not sell your personal data. We will never share your data with any third party for their own marketing purposes.

    We may share your data with:

    • Prospective employers / clients - to introduce you for roles. We will not share your CV or personal details with any employer without first discussing the opportunity with you.
    • Service providers - who process data on our behalf under appropriate data processing agreements. These include:
      • HubSpot - customer relationship management (CRM). Contact form submissions and candidate registrations (including name, email, phone, LinkedIn, desired role, location, GDPR consent status, and consent timestamp) are stored in HubSpot to manage enquiries, candidate records, and business relationships.
      • RecruitCRM - applicant tracking system (ATS). Candidate registrations and uploaded CVs (PDF or DOCX) are stored in RecruitCRM so we can match you with suitable roles and manage the recruitment process.
      • AI processing providers - when you use our optional CV Builder tools (such as the AI assistant or job-tailoring features), the CV content you provide is sent to third-party AI providers in order to generate suggestions back to you. These providers operate under their own terms and privacy policies, and we cannot guarantee that the content you submit will not be retained, logged, or used by them (including for the purpose of training or improving their models). You should therefore avoid including information you would not want shared with a third-party AI provider, and you can choose not to use these optional tools at all. Please also be aware that AI-generated content can be inaccurate, incomplete, or misleading - you should always review and verify any output before using it (for example, before sending a CV or cover letter to an employer).
      • Resend - email delivery. Used to send enquiry confirmation emails, candidate registration notifications (with CV attached), and internal alerts.
      • Cloudflare - website security and performance. Cloudflare Turnstile is used on our contact and candidate registration forms to prevent spam and abuse. No personal data is stored by Cloudflare from this process.
      • Contentful - content management system (CMS). Used to manage and deliver blog content. No personal data is collected or stored by Contentful through our blog.
      • Google Analytics (GA4) - website analytics. Used to collect anonymised data about how visitors use our website (pages visited, session duration, referral source). Google Analytics cookies are only activated after you provide consent via our cookie consent banner. Google may process data in the United States.
      • Cookiebot (Cybot A/S) - cookie consent management. Used to display our cookie consent banner and record your cookie preferences. Cookiebot stores your consent state so we can respect your choices on future visits.
      • Hosting providers - our website and backend services are hosted on secure, access-controlled cloud infrastructure.
    • Professional advisors - such as accountants, lawyers, or insurers where necessary.
    • Regulatory or law enforcement bodies - where required by law, regulation, or legal process.

    8. International Data Transfers

    Some of our service providers process data outside the United Kingdom, primarily in the United States. This includes HubSpot (CRM), RecruitCRM (applicant tracking), Resend (email delivery), Cloudflare (security), Contentful (CMS), Google Analytics (analytics), Cookiebot (consent management), AI processing providers used by our CV Builder tools, and our hosting infrastructure. Where this occurs, we ensure appropriate safeguards are in place, including:

    • Standard Contractual Clauses (SCCs) approved by the UK Information Commissioner's Office (ICO)
    • The UK-US Data Bridge under the UK Extension to the EU-US Data Privacy Framework, where applicable
    • Adequacy decisions by the UK government
    • Binding corporate rules or equivalent safeguards

    We will only transfer data internationally where we are satisfied that adequate protections are in place to safeguard your data in accordance with UK data protection law.

    9. Data Retention

    We retain your personal data only for as long as necessary and in accordance with our data retention policy. Our typical retention periods are:

    • Candidate registration data: retained for up to 12 months from the date of consent, as specified in the consent notice, unless you ask us to delete it sooner or we have a legal reason to retain it longer.
    • Candidate data (general): retained for up to 24 months from our last meaningful interaction, unless you ask us to delete it sooner or we have a legal reason to retain it longer.
    • Client data: retained for the duration of the business relationship plus up to 6 years for contractual and financial record-keeping.
    • Contact form data: retained for up to 24 months from submission.
    • Website technical/log data: retained for up to 12 months.
    • CV Builder uploads & content: CVs you upload or build using our CV Builder tool are processed entirely in your browser and are not stored on our servers. When you use the optional AI assistant or job-tailoring features, the CV content is sent to a third-party AI provider in real time to generate suggestions and is not retained by Velo North. CV data persists only in your browser's local storage on your own device until you clear it, and is automatically discarded if you close or refresh the page without saving locally. We do not back up, log, or have any ability to recover CV Builder content.

    After these periods, data is securely deleted or anonymised. We run regular data clean-up processes to ensure we do not hold data longer than necessary.

    10. Your Rights Under the UK GDPR

    You have the following rights in relation to your personal data:

    • Right of access - request a copy of the personal data we hold about you (a "Subject Access Request"). No fee applies and we will respond within 30 days.
    • Right to rectification - request correction of inaccurate or incomplete data. We encourage you to contact us if your details change.
    • Right to erasure ("right to be forgotten") - request deletion of your data where there is no compelling reason for continued processing.
    • Right to restrict processing - request that we suspend the processing of your data (e.g., while we verify its accuracy).
    • Right to data portability - request a machine-readable copy of the data you provided to us, where technically feasible.
    • Right to object - object to processing based on legitimate interests, or object to direct marketing at any time.
    • Right to withdraw consent - where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of processing carried out before withdrawal.
    • Right not to be subject to automated decision-making - we do not carry out automated decision-making or profiling.

    To exercise any of these rights, please contact us at [email protected]. We will respond within one month. In exceptional circumstances, we may extend this by a further two months, in which case we will inform you.

    11. Cookies & Similar Technologies

    Our website uses cookies and similar technologies. We use Cookiebot to manage your cookie preferences and ensure compliance with data protection regulations. When you first visit our website, a consent banner will appear allowing you to accept or decline different categories of cookies.

    Strictly Necessary Cookies

    These cookies are essential for the website to function and cannot be switched off. They include:

    • Cookiebot consent state cookies (to remember your cookie preferences)
    • Security tokens used by Cloudflare Turnstile on our forms
    • Essential session cookies required for site functionality

    Statistics / Analytics Cookies

    With your consent, we use Google Analytics (GA4) to understand how visitors interact with our website. These cookies collect information such as pages visited, time spent on the site, and referral sources. This data is anonymised and used solely to improve our website and services. Google Analytics cookies are only activated after you provide consent via the Cookiebot banner.

    You can change your cookie preferences at any time by clicking the Cookiebot icon on our website or by adjusting your browser settings. Please note that declining essential cookies may affect your ability to use certain features of our website.

    For more information about cookies, visit allaboutcookies.org.

    12. Data Security

    We implement appropriate technical and organisational measures to protect your personal data against accidental, unlawful, or unauthorised destruction, loss, alteration, access, or disclosure. These include:

    • Encryption in transit (TLS/HTTPS) for all data transmitted via our website
    • Secure, access-controlled hosting infrastructure
    • Spam and abuse prevention (Cloudflare Turnstile) on our contact form
    • Regular security reviews and updates
    • Limiting access to personal data to authorised personnel only

    While we take all reasonable steps to protect your data, the transmission of information over the internet is not completely secure. Any transmission is at your own risk.

    13. Third-Party Links

    Our website and communications may contain links to third-party websites (e.g., LinkedIn, YouTube, Instagram). These websites have their own privacy policies, and we do not accept any responsibility or liability for their content or practices. Please review their policies before submitting any personal data.

    14. Marketing Communications

    We will only send you marketing communications if you have given your explicit consent via the opt-in checkbox on our contact or candidate registration forms. Marketing communications may include newsletters, job market insights, event invitations, and promotional content via email.

    We do not rely on legitimate interest for marketing. Your consent is recorded at the time of form submission, including the specific wording you agreed to and the date and time of consent.

    You have the right to withdraw your marketing consent at any time by:

    Withdrawing marketing consent will not affect communications related to an active recruitment process or contractual relationship, nor the lawfulness of processing carried out before withdrawal.

    15. Children's Privacy

    Our services are not directed at individuals under 18 years of age. We do not knowingly collect personal data from children. If you believe we have inadvertently collected data from a minor, please contact us immediately and we will take steps to delete it.

    16. Data Accuracy

    We take reasonable steps to ensure your personal data is accurate and up to date. We encourage you to inform us of any changes to your details. Before introducing a candidate to a client, we will verify that we hold accurate, current information.

    17. Complaints

    If you are unhappy with how we have handled your personal data, we would appreciate the opportunity to resolve it directly. Please contact us at [email protected].

    You also have the right to lodge a complaint with the UK Information Commissioner's Office (ICO):

    18. Contact Us

    If you have any questions about this Privacy Policy, wish to exercise your data protection rights, or want to discuss how we handle your personal information, please contact us:

    Email: [email protected]
    General enquiries: [email protected]