Privacy notice

Who is responsible for your information?

Elmbrook Talent is a trading name of E&V Media Ltd, registered in England and Wales under company number 15911830. E&V Media Ltd is the controller of the information described here.

Our registered office is 128 City Road, London, EC1V 2NX, United Kingdom. For privacy questions or requests, email anca@elmbrooktalent.co.uk or write to the registered office, marked for Elmbrook Talent.

What we collect

If you send an enquiry, we collect your name, email address, enquiry type and message. A telephone number is optional. Employers may also provide a company name. We record when you submit the enquiry, your request to be contacted, the privacy notice shown and the message-delivery status.

The form does not accept CVs or attachments. Please leave identification documents, health information and other sensitive personal details out of this first message.

Website and security services also process technical information, such as IP addresses, browser or device information and requests made to the site, to operate and protect the service.

Why we use it

We use the information to understand and respond to your enquiry, arrange an initial conversation and keep the form working securely. Our lawful basis is legitimate interests under Article 6(1)(f) of the UK GDPR: responding to messages people choose to send us and protecting the website and its users from misuse.

You do not have to send an enquiry. If you do, the required contact details and message allow us to respond. Asking us to contact you is not permission for unrelated marketing.

The form does not subscribe you to marketing, automatically add you to a candidate pool or send your details to a prospective employer. We do not use it to make automated recruitment decisions.

Your right to object

You can object to our use of your information on the basis of legitimate interests for reasons connected with your particular situation. Contact anca@elmbrooktalent.co.uk and tell us what you would like us to consider.

Who receives the information

Our authorised team handles enquiries. We use 123 Reg for website hosting, Google Workspace for email, Brevo to deliver website notifications, and Cloudflare Turnstile to help distinguish people from automated traffic.

Brevo also receives email-authentication reports used to protect our sending domain. These reports concern sending systems and authentication results; they are separate from your enquiry.

Turnstile processes security signals, including IP address and browser information. Cloudflare acts on our behalf to secure the form and also as a separate controller when improving its bot-detection service. Its Turnstile Privacy Addendum explains this use and your rights.

Processing outside the UK

Our providers operate internationally, so information may be processed outside the UK. Brevo states that its database hosting is in the European Union; Google and Cloudflare use international infrastructure. We do not promise UK-only storage.

The applicable provider data-processing terms set out safeguards for international transfers, including UK-recognised adequacy arrangements or approved contractual clauses where required. You can ask us for details or a copy of the relevant safeguards.

Provider information: 123 Reg data-processing terms, Google Workspace data-processing terms, Brevo storage information and Cloudflare data-processing terms.

How long we keep information

The website enquiry record, including its delivery status, is retained for 30 days. It is scheduled for deletion after that period. This does not mean every copy of a message is deleted at the same time.

We review enquiry correspondence in the mailbox and remove information when it is no longer needed to answer the enquiry, continue an active discussion, resolve an issue or meet a specific legal obligation. An enquiry that does not progress is not kept as an indefinite candidate record.

Service-provider security logs and backup or recovery copies have separate retention arrangements. Their retention depends on the security, troubleshooting and recovery purposes involved; they are not covered by the website queue’s 30-day period. Deleted mailbox messages may also remain temporarily in the Bin or recovery systems.

Browser storage and security

The form uses session storage to recognise a repeat attempt and check a submission’s status. It stores a reference and a hash of the submitted fields, not the contact details or message in readable form. This normally lasts for the browser session, although browser restore settings can preserve it.

Short-lived rate-limit records use a protected version of the connecting IP address and expire within two hours. The enquiry record does not retain the raw IP address or Turnstile token. Hosting and security-provider logs are separate.

We use these controls to operate and protect the enquiry service. This website does not run advertising or analytics trackers.

Your other rights and concerns

You can ask for a copy of your information and ask us to correct it. Depending on the circumstances, you can also ask for deletion or restriction of its use. Contact anca@elmbrooktalent.co.uk to make a request or raise a concern.

You also have the right to complain to the Information Commissioner’s Office about how your information is handled.

If an enquiry becomes recruitment work

This notice covers the website and your first enquiry. If we go on to collect a CV, assess you for a role, share details with a client or arrange a placement, we will provide the privacy information relevant to that work before it starts.