Privacy policy.
Last updated 18/9/2026
GWV Talent Solutions Limited
At GWV Talent Solutions Limited (“we”, “our”, “us”), we are committed to protecting your privacy and handling your personal data responsibly. As a Data Controller and in some cases, a Data Processor or Joint Controller - we process your data in accordance with applicable data protection laws, including the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
This Privacy Policy explains how we collect, use, store, share, and protect your personal information. It applies to all our business activities and trading names, including Gerrard White Consulting, Vermelo RPO and FlarePeople Limited (our Group).
This Privacy Policy explains how we process your personal data and the rights available to you.
If you have any concerns or queries, contact us at:
Please read the following carefully to understand our views and practices regarding your personal data and how we will treat it. It is important to note that we reserve the right to amend this Privacy Policy from time to time. Please visit our Privacy Policy Page on our website if you want to stay up-to-date; we will post any changes here.
Data Controller and Contact Details
Data Controller: GWV Talent Solutions Limited
Registered Address: 16 Lonsdale Gardens, Tunbridge Wells, Kent TN1 1NU
Data Protection Officer (DPO): Kathryn Hunt – kathryn.hunt@vermelorpo.com
Director Oversight: Anthony Butler, Managing Director – anthony.butler@vermelorpo.com
Who we are and what we do
We are a recruitment agency and recruitment business as defined in the Employment Agencies and Employment Businesses Regulations 2003 (“our business”). We also provide the following other services: outsourcing, consultancy, managed service provider, recruitment process outsourcer and/or recruit, train, and deploy models. We collect the personal data of the following types of people to allow us to undertake our business;
Prospective and placed candidates for permanent, contract, or temporary roles;
Prospective and live client contacts;
Supplier contacts to support our services;
Employees, contingent workers, consultants, temporary workers;
We collect information about you to carry out our core business and ancillary activities. We apply data minimisation principles and only collect personal data that is necessary for our stated purposes.
Candidates include individuals with whom we have not had prior contact but whom we reasonably consider would benefit from or would be interested in our services and/or to be considered for any roles being recruited for by GWV Talent Solutions, including permanent, contract and temporary positions.
Candidates also include applicants to any role being advertised or promoted by GWV Talent Solutions by our group or under a client’s branding as well as those parties who have supplied a speculative CV not in relation to a specific job or those that have engaged with GWV Talent Solutions about our services. Contractors, temporary workers, and any applicants supplied by third parties put forward for roles with clients of GWV Talent Solutions (via Vermelo RPO) as part of an MSP / RPO offering will also be treated as candidates for the purposes of this policy.
Privacy Information for Candidates
The section of this Privacy Policy applies to candidates.
This is information about you that you give us by providing a CV, filling in forms on our website or email, www.gerrardwhite.com, www.vermelorpo.com, www.flarepeople.com or a client’s career page managed by us or by corresponding with us by phone, e-mail or otherwise. It includes information you provide when you register to use our website, apply for a role via our own website or a client’s career page managed by us, enter our database, subscribe to our services, attend our events, participate in discussion boards or other social media functions on our site, enter a competition, promotion or survey or when you report a problem with our site.
The information you give us or we collect about you may include:
your name
address
private and corporate e-mail address
phone number
financial information
compliance documentation
references verifying your qualifications and experience
your right to work in the United Kingdom
your driving license and/or passport/identity card
national insurance number
curriculum vitae and photograph
links to your professional profiles available in the public domain
emergency contacts / next of kin information
education details
employment history
referee details and references
renumeration details (current and past)
personal interests
bank details
criminal conviction data
media searches
fitness and proprietary information
FCA register validation
FCA disciplinary validation
Special category information includes:
personal data revealing racial or ethnic origin;
personal data revealing political opinions;
personal data revealing religious or philosophical beliefs;
personal data revealing trade union membership;
genetic data;
biometric data (where used for identification purposes);
data concerning health;
data concerning a person’s sex life; and
data concerning a person’s sexual orientation.
We will only request special category data where it is necessary for the specific role or legal requirement. For example, health information will only be requested where reasonable adjustments are needed or where health screening is a requirement of the role.
How do we collect your personal data?
We collect your personal data in the following ways:
Personal data that you give to us;
Personal data we receive from other sources; and
Personal data that we collect automatically
Information we collect about you automatically when you visit our website
With regard to each of your visits to our site, we will automatically collect the following information:
IP address
user reports
login information (if applicable)
browser type and version
browser plug-in types and versions, operating system and platform
email engagement history
Information we obtain from other sources.
This is the information we may obtain about you from other sources such as LinkedIn, corporate websites, job board websites, online CV libraries, client’s career pages managed by us. your business card and personal recommendations or extra information that your referees or our clients may tell us about you.
We work closely with third parties, including companies and brands within our group, business partners, sub-contractors in technical, professional, payment and other services, advertising networks, analytics providers, search information providers, credit reference agencies, and professional advisors. We may receive information about you from them for the purposes of our recruitment services and ancillary support services.
Technology and tools we use
We use the following technology and service providers to support our recruitment and workforce management processes:
Talos360 (Applicant Tracking System) – to manage candidate applications, track recruiting progress, and maintain candidate records;
Vincere (Customer Relationship Management) – to manage candidate and client relationships, communications, and pipeline data;
Zinc/Certn (background screening provider) – to conduct employment history, qualification, reference, and criminal record checks where required;
HubSpot (CRM) – to manage client relationships, communications, and account data;
Xero (accounting software) and Telleroo (payment platform) – to process contractor invoices, timesheets, and payments;
Claude for Work (Anthropic) – for administrative purposes, including CV formatting, summarising contractor timesheets and payment records for payroll processing, and drafting routine communications.
All providers are bound by Data Processing Agreements compliant with UK GDPR Article 28.
Purposes of the processing and the legal basis for the processing
We will only process your personal data where we have a lawful basis for doing so. The lawful basis we rely upon will depend on the purpose for which we are processing your information and our relationship with you.
We may process your personal data for the following purposes:
Pre-hire and recruitment activities;
Identifying and matching candidates with suitable permanent, contract, or temporary opportunities;
Introducing candidates to clients and managing applications;
Pre-employment and background screening activities;
Verifying identity, right to work, qualifications, employment history and other information relevant to a role;
Assessment and suitability activities;
Managing contractor and temporary worker assignments;
Facilitating payroll, invoicing, and other financial processes;
Managing relationships with candidates, clients, suppliers, and other business contacts;
Marketing, business development, and customer satisfaction activities;
Operating, securing, and improving our websites and systems;
Meeting legal, regulatory, audit and compliance requirements;
Establishing, exercising, or defending legal claims; and
Using approved technology, including AI-assisted tools, to support our recruitment and related activities.
The table below explains the principal purposes for which we process personal data and the lawful bases upon which we rely.
| Purpose | Categories of personal data | Article 6 lawful basis | Article 9 / Article 10 condition, where applicable | Legitimate interest, where relied upon |
|---|---|---|---|---|
| Recruitment, candidate sourcing and matching | Name, contact details, CV, employment history, qualifications, skills, professional profiles, remuneration information, career and role preferences | Article 6(1)(f) – Legitimate interests and, where applicable, Article 6(1)(b) – Contract or steps prior to entering into a contract | Normally not applicable. Where special category or criminal offence data is necessary, the appropriate additional condition will be identified | Providing recruitment services; identifying suitable candidates; matching individuals with relevant career opportunities; and meeting clients' resourcing requirements |
| Candidate applications and introductions to clients | CV, contact information, employment history, qualifications, experience, interview information and other information relevant to an application | Article 6(1)(f) – Legitimate interests and, where applicable, Article 6(1)(b) – Contract or steps prior to entering into a contract | Where special category or criminal offence data is necessary, the appropriate additional condition will be identified | Facilitating recruitment processes and providing recruitment services to candidates and clients |
| Pre-employment and background screening | Identity information, right-to-work information, employment and education history, references, professional and regulatory information, screening results and, where appropriate, criminal offence information | Article 6(1)(b) – Contract, Article 6(1)(c) – Legal obligation and/or Article 6(1)(f) – Legitimate interests, depending upon the check and circumstances | Where special category data is processed, an appropriate Article 9 condition and, where required, Schedule 1 DPA 2018 condition will apply. Criminal offence data will only be processed in accordance with Article 10 UK GDPR and the DPA 2018, including an appropriate Schedule 1 condition where required | Ensuring candidates meet relevant role, client, regulatory, compliance and risk requirements |
| Identity, right-to-work, legal and regulatory compliance | Identity documents, right-to-work information, immigration information, professional registration and other compliance information | Article 6(1)(c) – Legal obligation and/or Article 6(1)(f) – Legitimate interests, depending upon the requirement | Appropriate Article 9 or Article 10 and DPA 2018 conditions will be identified where applicable | Meeting regulatory and compliance requirements and protecting GWV, our clients and candidates from legal and regulatory risk |
| Equality of opportunity and diversity monitoring | Information including racial or ethnic origin, health or disability information and other diversity information | An appropriate Article 6 lawful basis, which may include Article 6(1)(f) – Legitimate interests | Where applicable, Article 9(2)(g) – substantial public interest, together with the relevant Schedule 1 DPA 2018 condition, including equality of opportunity or treatment | Monitoring equality of opportunity and identifying potential disadvantage or under-representation |
| Reasonable adjustments and candidate support | Health, disability and reasonable-adjustment information | An appropriate Article 6 lawful basis depending upon the circumstances, including Article 6(1)(c) – Legal obligation or Article 6(1)(f) – Legitimate interests | An appropriate Article 9 condition and, where required, corresponding Schedule 1 DPA 2018 condition will be identified | Supporting candidates during recruitment processes and facilitating appropriate adjustments |
| Contractor and temporary worker administration | Contact details, assignment details, timesheets, payment information, bank details, tax information and compliance documentation | Article 6(1)(b) – Contract, Article 6(1)(c) – Legal obligation and, where applicable, Article 6(1)(f) – Legitimate interests | Appropriate Article 9 or Article 10 and DPA 2018 conditions will apply where relevant | Administering assignments and delivering our recruitment and workforce services effectively |
| Payroll, invoicing and financial administration | Bank details, payment information, tax information, timesheets, invoices and financial records | Article 6(1)(b) – Contract and Article 6(1)(c) – Legal obligation | Normally not applicable | Effective administration and financial management of our services, where legitimate interests apply |
| Client and supplier relationship management | Name, job title, business contact details, correspondence, account information and information relating to services provided or received | Article 6(1)(b) – Contract and/or Article 6(1)(f) – Legitimate interests | Normally not applicable | Managing existing and prospective business relationships and delivering our services |
| Marketing, business development and customer satisfaction | Name, job title, contact information, professional interests, marketing preferences and engagement information | Article 6(1)(f) – Legitimate interests or Article 6(1)(a) – Consent, where appropriate | Normally not applicable | Promoting relevant recruitment, talent and related services; maintaining candidate and client relationships; and understanding satisfaction with our services. Electronic marketing is also undertaken in accordance with PECR |
| Website operation, analytics and security | IP address, device and browser information, website activity, login information and cookie information | Article 6(1)(f) – Legitimate interests and Article 6(1)(a) – Consent where required for cookies or similar technologies | Normally not applicable | Operating, protecting and improving our websites, systems and services and understanding how they are used |
| AI-assisted recruitment and administrative activities | CV information, employment history, qualifications, skills and other information relevant to the underlying activity | The appropriate Article 6 lawful basis for the underlying processing activity, including Article 6(1)(f) – Legitimate interests or, where applicable, Article 6(1)(b) – Contract | Special category or criminal offence data will only be processed using AI or automated tools where an appropriate Article 9 or Article 10 condition and any required DPA 2018 Schedule 1 condition have been identified | Supporting the efficient and effective delivery of recruitment and related services while maintaining appropriate safeguards and human oversight |
| Establishing, exercising or defending legal claims | Any personal data reasonably necessary in connection with the relevant claim, dispute or proceedings | Article 6(1)(f) – Legitimate interests and/or Article 6(1)(c) – Legal obligation, depending upon the circumstances | Where special category data is involved, Article 9(2)(f) – establishment, exercise or defence of legal claims may apply. Appropriate provisions will apply to criminal offence data | Establishing, protecting and enforcing our legal rights and responding to claims or proceedings |
| Compliance with legal, regulatory, law enforcement and audit requirements | Personal data relevant and proportionate to the particular legal, regulatory or audit requirement | Article 6(1)(c) – Legal obligation and, where applicable, Article 6(1)(f) – Legitimate interests | Appropriate Article 9 or Article 10 conditions will be identified where applicable | Complying with legitimate regulatory, audit and compliance requirements and protecting our legal interests |
Our Legitimate Interests
Where we rely on Article 6(1)(f) – legitimate interests, we will only process personal data where we have identified a legitimate purpose, consider that the processing is necessary to achieve that purpose and have balanced our interests against the interests, rights and freedoms of the individual.
As a recruitment business and recruitment agency, our legitimate interests include introducing candidates to clients for permanent employment, temporary worker placements and independent professional contracts; maintaining relationships with candidates and clients; identifying relevant career opportunities; understanding and meeting clients' resourcing requirements; developing our services; protecting our systems and business; and maintaining appropriate business records.
The exchange of relevant personal data between candidates, GWV and our clients is a fundamental part of providing recruitment services. We also maintain candidate and client information so that we can support candidates' career aspirations and our clients' current and future resourcing requirements.
Where appropriate, we undertake and document a Legitimate Interests Assessment (LIA) to assess the purpose and necessity of the processing and balance our interests against the rights and interests of the individuals concerned.
You have the right to object to processing based on legitimate interests. Where you object, we will consider your request in accordance with applicable data protection law. You have an absolute right to object to the use of your personal data for direct marketing.
Our legitimate interests assessments are reviewed annually and updated if processing purposes or methods change materially.
Special Category Data
We may process special category personal data where this is necessary in connection with our recruitment, employment, background screening, equality monitoring or related services. This may include information concerning health, racial or ethnic origin, religious or philosophical beliefs, trade union membership, biometric data used for identification purposes, or sexual orientation.
We will only process special category personal data where we have identified:
an appropriate lawful basis under Article 6 of the UK GDPR; and
a separate condition for processing under Article 9 of the UK GDPR.
Where the processing also requires a condition under Schedule 1 of the Data Protection Act 2018, we will identify and document the applicable condition. Depending on the circumstances, this may include processing that is necessary for employment, social security and social protection purposes, equality of opportunity or treatment, or other substantial public interest conditions permitted by law.
Where required by the Data Protection Act 2018, we maintain an Appropriate Policy Document setting out how we comply with the data protection principles and our policies regarding the retention and erasure of this information. Our Appropriate Policy Document (covering processing of special category and criminal conviction data) is available to data subjects on request from our Data Protection Officer.
We will only rely on explicit consent as our Article 9 condition where it is appropriate to do so. Where we rely on explicit consent, you may withdraw your consent at any time. Withdrawal will not affect the lawfulness of processing undertaken before your consent was withdrawn.
Criminal Conviction and Offence Data
Information relating to criminal convictions and offences is not special category personal data and is subject to separate requirements under Article 10 of the UK GDPR and the Data Protection Act 2018.
We may process criminal conviction and offence data where this is necessary and lawful, including where criminal record or regulatory screening is required or appropriate for a particular role.
We will only process criminal conviction and offence data where we have:
identified an appropriate lawful basis under Article 6 of the UK GDPR; and
met the requirements of Article 10 of the UK GDPR, including identifying an appropriate condition under Schedule 1 of the Data Protection Act 2018 where required.
Where applicable, we maintain an Appropriate Policy Document covering our processing of criminal conviction and offence data, including how we comply with the data protection principles and our retention and erasure arrangements.
We will only collect and retain special category or criminal offence data where it is necessary and proportionate for the relevant purpose and will apply appropriate technical and organisational measures to protect this information.
Criminal conviction data is securely destroyed within six months of a hiring decision, unless retention is required by law, we are defending a legal claim, or you have consented to longer retention. Destruction is documented and verified.
Consent
Should we want or need to rely on consent to lawfully process your data, we will request your consent in writing by email or by an online process for the specific activity we require consent for and record your response on our system. Where consent is the lawful basis for our processing, you have the right to withdraw your consent to this particular processing at any time.
Consent withdrawal takes effect immediately upon receipt of your request. Processing that was conducted before your withdrawal remains lawful, as it was consented to at the time.
Other uses we will make of your data:
We will also use your data:
To administer our site and for internal operations, including troubleshooting, data analysis, testing, research, statistical and survey purposes;
To improve our site to ensure that content is presented in the most effective manner for you when you are using your computer or other devices;
To notify you about changes to our service;
To allow you to participate in interactive features of our service, when you choose to do so;
As part of our efforts to keep our site safe and secure;
To measure or understand the effectiveness of advertising we serve to you and others and to deliver relevant advertising to you;
To make suggestions and recommendations to you and other users of our site about goods or services that may interest you or them.
Data (Use and Access) Act 2025 (DUAA) Compliance
We use Claude for Work (Anthropic) exclusively for administrative purposes specifically CV formatting, to standardise presentation and improve readability for internal review and drafting routine correspondence and reports.
All recruitment decisions affecting candidates, including screening, shortlisting, candidate matching, suitability assessment, and interview selection, are made by human recruiters following manual review of candidate information. We do not rely on automated decision-making or algorithmic processing for any outcome affecting candidates. Our CRM may automatically flag candidates matching specific criteria as a search aid, but all decisions remain with human recruiters.
GWV’s approved generative AI platform is Claude for Work (Anthropic), provided through a company-managed business account and administered by GWV for work purposes.
Prior Approval: We require prior written approval from our Data Protection Officer before processing special category data or identity ocuments via any automated system.
Your Rights: You have the right to request human review of any decision made about you using only automated means. Contact compliance@vermelorpo.com.
It may become necessary for us to process your data in reliance on the legitimate interests basis and in accordance with law in connection with defending legal claims or to comply with legal obligations at the request of a law enforcement agency or regulator. Article 9(2)(f) of the GDPR allows this where the processing “is necessary for the establishment, exercise, or defence of legal claims or whenever courts are acting in their judicial capacity”. This may become necessary if we need to take legal advice in relation to legal proceedings or are required by law to disclose certain information as part of a legal process.
Do you have to provide us with personal data?
You may refuse to give us your personal and sensitive personal data. Furthermore, you have the right to ask us to delete, change, or stop processing your data that we have already received or collected. If you do not provide us with personal or sensitive personal data, or if you request a restriction of processing however, we may not be able to provide you with the services that you have requested and that are stated in this policy.
Privacy Information for Clients
The section of this Privacy Policy applies to clients only.
Clients include our customers, clients and others to whom GWV Talent Solutions Limited provides services to or whom we reasonably consider would be interested in our services.
This data may include:
name
job title
telephone number
corporate email address
information relating to your engagement with candidates
IP address
website browsing data
email engagement with GWV Talent Solutions Limited
account access information
user reports
device information
information that a candidate or your organisation may tell us about you
We collect personal data that we receive from you, that we collect and receive from other sources and personal data that we collect automatically.
We may use your personal information and client data to:
provide services
to offer services
marketing activities
defend legal claims
Our services consist of (i) providing you with candidates on a permanent, contract, or temporary basis; ii) RPO services; iii) MSP services and/or iv) advisory, consultancy, and talent insight services.
Article 6(1)(f) of the GDPR says that we can process your data where it “is necessary for the purposes of the legitimate interests pursued by us or by a third party, except where such interests are overridden by the interests or fundamental rights or freedoms of you which require protection of personal data.”
For marketing emails to corporate work addresses, we rely on the corporate exemption under PECR Regulation 22(3), provided the recipient is a decision-maker at the organisation. For all other recipients, we will obtain prior consent in accordance with PECR.
You can opt out at any time by emailing compliance@vermelorpo.com.
Third-Party Suppliers
This section of the Privacy Policy applies to third-party suppliers including partnerships, companies, sole traders and independent contractors and freelance workers.
In certain circumstances, we may engage third-party suppliers and, in this context, suppliers who are individual contractors, freelance workers or employees of suppliers or umbrella companies, will be treated as Candidates for data protection purposes and they should refer to the Candidates section of this policy. Please note that in such circumstances, we require that the third party supplier communicates this Privacy Policy to all its employees.
Although third parties rely on their own lawful bases, GWV Talent Solutions Limited remains responsible for ensuring all processors comply with UK GDPR requirements. Data Protection Agreements specify these obligations.
Website Users
This section of the Privacy Policy applies to anyone who uses/accesses any of the GWV Talent Solutions website including www.gerrardwhite.com, www.vermelorpo.com and www.flarepeople.com.
We collect a limited amount of data from our website users or when you register for one of our newsletters or webinars, which we use to help us to improve your experience when using our website and to help us manage or offer the services we provide.
This may include:
names
telephone number
email address
IP address
user choices
user reports
device information
account access information
any information that you may provide to us
When you visit our website, there is certain information that we will automatically collect, whether or not you decide to use our services namely your IP address, the date and the times and frequency with which you access the website, the way you browse its content and other technical information. We may also collect data from you when you contact us via the website, for example if you register for one of our newsletters, webinars, or participate in any further offer of our website. We collect your data automatically via cookies or similar technology.
We may use the data collected from our website to provide you with the service you registered for or the services you participated in or to help protect our systems from attacks and other illegal activities.
Cookies
Our website uses cookies to distinguish you from other users of our website. This helps us to provide you with a good experience when you browse our website and also allows us to improve our site. For detailed information on the cookies we use and the purposes for which we use them see our Cookie policy notice.
Disclosure of your information inside and outside of the UK and the EEA
Where appropriate and in accordance with legislation, we may share your personal information with:
Any member of our group both in the UK, the EEA and outside of the EEA;
Appropriate colleagues within group;
Individuals and organisations who hold information related to your reference or application such as past employers, educators or examining bodies or employment and recruitment agencies with your permission;
Tax, audit or other authorities where we believe in good faith that the law requires us to share this data;
Service providers (whether third parties or a group company) who perform functions on our behalf such as external consultants, professional advisors, lawyers, auditors or accountants or technical support.
Selected third parties including:
Clients for the purpose of introducing candidates to them;
Candidates for the purpose of arranging interviews and engagements;
Clients, business partners, service providers, suppliers and sub-contractors for the performance and compliance obligations of any contract we enter into with them or you;
Subcontractors including email marketing specialists, event organisers, payment and other financial service providers;
Outsourced IT and document storage providers where we have an appropriate processing agreement (or similar protection in place);
Marketing technology platforms;
Analytics and search engine providers that assist us in the improvement and optimisation of our site;
Credit reference agencies, our insurance broker, background screening partner, compliance partners and other sub-contractors for the purpose of assessing your suitability for a role where this is a condition of us entering into a contract with you;
MSP/RPO suppliers as part of our clients’ programmes;
Internal and external auditors of our clients where we are required to in order to meet our compliance and regulatory obligations.
We will disclose your personal information to third parties:
In the event that we sell or buy any business or assets, in which case we will disclose your personal data to the prospective seller or buyer of such business or assets;
If GWV Talent Solutions Limited or substantially all of its assets are acquired by a third party, in which case personal data held by it about its customers will be one of the transferred assets;
If we are under a duty to disclose or share your personal data in order to comply with any legal obligation, or in order to enforce or apply our terms of use or terms and conditions of supply of services [and other agreements; or to protect the rights, property, or safety of GWV Talent Solutions Limited, our customers, or others. This includes exchanging information with other companies and organisations for the purposes of fraud protection and credit risk reduction.
If you are a referee of one of our candidates, we may share the information provided with:
Clients;
Internal and external auditors of our clients where we are required to in order to meet our compliance and regulatory obligations.
The lawful basis for the third-party processing will include:
Their own legitimate interests in processing your personal data, in most cases to fulfil their internal resourcing needs;
Satisfaction of their contractual obligations to us as our data processor;
For the purpose of a contract in place or in contemplation;
To fulfil their legal obligations.
International Data Transfers
Where we transfer data outside the UK/EEA, we use:
Standard Contractual Clauses (SCCs) for processors and third parties in non-adequate jurisdictions
UK International Data Transfer Agreements (IDTA) where applicable
Adequacy decisions recognised by UK government
Supplementary technical safeguards (encryption, pseudonymisation) where standard mechanisms are insufficient
We transfer personal data to the United States (including via Claude for Work, our approved generative AI platform) and to other locations within the UK and EEA. A current list of countries, processors, and transfer mechanisms is available on request at compliance@vermelorpo.com.
All information you provide to us is stored on our secure servers. Any payment transactions will be encrypted. Where we have given you (or where you have chosen) a password that enables you to access certain parts of our site, you are responsible for keeping this password confidential. We ask you not to share a password with anyone.
Unfortunately, the transmission of information via the Internet is not completely secure. Although we will do our best to protect your personal data, we cannot guarantee the security of your data transmitted to our site; any transmission is at your own risk. Once we have received your information, we will use strict procedures and security features to try to prevent unauthorised access.
Retention of your data
We understand our legal duty to retain accurate data and only retain personal data for as long as we need it for our legitimate interests and that you are happy for us to do so. We also consider the amount, nature and sensitivity of the personal data in question. Accordingly, we have a data retention policy, a copy of which is available upon request at compliance@vermelorpo.com.
We do the following to try to ensure that the data we hold is accurate:
prior to making an introduction, we check that we have accurate information about you;
we keep in touch with you so you can let us know of changes to your personal data.
We segregate our data so that we keep different types of data for different time periods. The criteria we use to determine whether we should retain your personal data include:
the nature of the personal data;
its perceived accuracy;
our legal obligations;
whether an interview or placement has been arranged; and
our recruitment expertise and knowledge of the industry by country, sector and job role.
We may store and handle your data in the following ways:
We may archive part or all of your personal data, retain it on our financial systems only or delete all or part of the data from our main Customer Relationship Manager (CRM) system.
We may pseudonymise parts of your data, particularly following a request for restriction or erasure of your data, to ensure that we do not re-enter your personal data onto our database, unless requested to do so.
For your information, Pseudonymised data is created by taking identifying fields within a database and replacing them with artificial identifiers, or pseudonyms.
You may request our Data Retention Policy at compliance@vermelorpo.com.
Contractor and temporary worker data following end of assignment
Following the end of a contractor or temporary worker assignment, your personal data (including timesheets, payment records, and assignment details) is retained in accordance with our Data Retention Policy. We retain certain data for statutory and compliance purposes (typically 6 years for financial records) unless a shorter retention period applies.
You may request erasure of your personal data where there is no legal obligation to retain it and no legal claim is pending. Please contact compliance@vermelorpo.com with erasure requests. We will respond within 30 calendar days and explain any reasons we cannot comply.
Referee data retention
Referee contact details provided as part of your application or employment process are retained with your application record. Following the conclusion of recruitment or the end of employment, referee details are deleted or archived in accordance with our Data Retention Policy [link]. If you wish to request erasure of referee information held about you, please contact compliance@vermelorpo.com.
Marketing and direct communications
We may contact you with information about relevant roles, services, and industry content. The rules that apply to how we do this depend on who you are and how we contact you. The below sets out the framework we follow.
Legal basis for marketing
We rely on legitimate interests (Article 6(1)(f) of the UK GDPR) as our lawful basis for direct marketing. The Data (Use and Access) Act 2025 (DUAA) formally recognises direct marketing as a legitimate interest. We have completed a Legitimate Interests Assessment (LIA) documenting this basis, which is available on request at compliance@vermelorpo.com.
Where we rely on consent for marketing - for example, for certain electronic communications to individuals - we will ask for your express consent and keep a record of it. You can withdraw consent at any time by contacting us at compliance@vermelorpo.com or by using the unsubscribe link in any marketing email.
Marketing rules by contact type
Different rules apply depending on who we are contacting and how. We apply the following framework:
1.Individuals, sole traders and partnerships
Both UK GDPR and the Privacy and Electronic Communications Regulations (PECR) apply.
We require your prior consent before sending marketing emails, SMS or automated calls, unless the soft opt-in exemption applies (see below). Every marketing message will include a clear and easy way to opt out.
2.Named individuals at limited companies and LLPs
For example: john.smith@company.com. PECR’s consent requirement does not usually apply to corporate subscribers. We rely on legitimate interests under UK GDPR as our lawful basis, supported by our completed LIA. Every marketing message includes an easy opt-out, and we will stop contacting you promptly if you object.
3.Generic business addresses
For example: info@, hello@, accounts@. Generic addresses are not personal data and are not subject to UK GDPR or PECR. Consent is not required. However, we will always respect any opt-out request associated with that address.
4.Existing and previous contacts - soft opt-in
Where we have collected your contact details in the course of a sale or negotiation of a sale, we may market similar services to you without obtaining fresh consent, provided: (a) you were given a clear opportunity to opt out when your details were collected; (b) every subsequent marketing message includes an easy opt-out; and (c) the marketing relates to similar or related services. This is known as the soft opt-in exemption under PECR.
Your right to opt out
Regardless of which category applies to you, you have the right to object to direct marketing at any time.
You can do this by:
Using the unsubscribe link in any marketing email we send you
Emailing compliance@vermelorpo.com
Calling or writing to us at the address in the Contact section of this policy
We will action your request promptly and update our records to ensure you are not contacted again for marketing purposes.
Photography, testimonials and case studies
If we wish to use your image, name, testimonial or information about your case for marketing materials, events, publications, case studies, or our website, we will request your separate prior written consent. This consent is separate from any other consent you may have given. You may withdraw this consent at any time by contacting us at compliance@vermelorpo.com. Withdrawal will prevent future use of your image or testimonial, though previously published or distributed materials may remain in circulation.
Your rights
Under GDPR, you have the right to:
Access your data
Rectify inaccurate or incomplete data
Request erasure (“right to be forgotten”)
Restrict or object to processing
Data portability (in some circumstances)
Withdraw consent (where consent is used)
Make a complaint to a supervisory body which in the United Kingdom is the Information Commissioner’s Office. The ICO can be contacted through this link: https://ico.org.uk/concerns/.
You can request that we limit the processing of your data, for example, using it for specific purposes only pending resolution of a dispute about its accuracy or the lawfulness of our processing. During the restriction period, we will store your data but will not actively process it except with your consent, for legal claims or to protect your or others' rights and freedoms.
If you have restricted processing of your data, we will notify you before we remove the restriction.
Data protection complaints
We take data protection seriously and are committed to handling any concerns about our use of your personal data promptly, fairly, and transparently.
Your right to complain directly to us
You have the right to bring a data protection complaint directly to us. You do not need to contact the Information Commissioner’s Office (ICO) first - you can come to us at any time, and we encourage you to do so.
A data protection complaint is any concern about how GWV Talent Solutions Limited, or any of our brands (Gerrard White Consulting, Vermelo RPO or FlarePeople), has collected, used, stored, shared, or otherwise handled your personal data.
How to raise a data protection complaint
You can submit a data protection complaint by email at compliance@vermelorpo.com or by post to: Data Protection Officer, GWV Talent Solutions Limited, 16 Lonsdale Gardens, Tunbridge Wells, Kent TN1 1NU. Please include your name and contact details, the nature of your concern, relevant dates, and details of anyone you have already spoken to at GWV.
What happens next
We will acknowledge your complaint within 24 hours of receipt (we are legally required to do so within 30 days). We will conduct a thorough and impartial investigation, keep you informed of progress, and write to you with the outcome and any steps taken. If the complaint cannot be resolved by our DPO it will be escalated to our managing director. Our Data Protection Complaint Procedure is available on request at compliance@vermelorpo.com.
Your right to go to the ICO
If you are not satisfied with our response or prefer not to raise your complaint with us first, you can contact the ICO at ico.org.uk/concerns. We encourage you to contact us in the first instance as we may be able to resolve your concern more quickly.
Access to information
The Data Protection Act 2018 and the UK GDPR give you the right to access information held about you. We also encourage you to contact us to ensure your data is accurate and complete. Your right of access can be exercised in accordance with the Act and the UK GDPR.
A subject access request should be submitted to compliance@vermelorpo.com. No fee will apply and will be managed in accordance with our Data Subject Rights Procedure.
Data Security
We store your data securely on our servers and protect it using appropriate technical and organisational measures. However, transmission over the internet is never completely secure.
Data Breach Notification
In the event of a data breach that affects your personal data, we will notify you without undue delay in accordance with UK GDPR Article 33. Where a breach poses a high risk to your rights and freedoms, we will notify you without undue delay. We will also notify the Information Commissioner's Office where legally required by law. Our notification will describe the nature of the breach, the likely consequences, and the measures we have taken or will take to address it and mitigate harm.
Internal Access Controls
Candidate and client personal data is accessible only to recruitment staff, relevant managers, and compliance personnel who need it to perform their roles. All staff with access to personal data are bound by confidentiality agreements and data protection obligations. Access is restricted on a role-basis and staff receive data protection training.
Third Party Services
In the course of offering and providing services, candidates, temporary workers, contractors or third-party suppliers may wish to access independent websites and third party services which are not operated by us. Such sites are not under our control and we are not responsible for their privacy policies. You will therefore need to make your own independent judgement about whether to use such sites, including whether to use their services or
Occasionally, a third-party service provider that has been engaged by us, may process personal data that we have given to them as a data controller in their own right. Third-party service providers are not under our control and we are not responsible for their privacy policies. You will therefore need to make your own independent judgement.
We may update this policy from time to time. Changes will be posted on this page and, where appropriate, communicated via email.
Contact
GWV Talent Solutions Limited, 16 Lonsdale Gardens, Tunbridge Wells, Kent TN1 1NU. Email: compliance@vermelorpo.com or info@FlarePeople.com.