Privacy Policy.
How we collect, use, share and protect personal data. Plain English where we can; legally precise where we must.
Effective date: 24 May 2026 · Last updated: 24 May 2026
Controller: Talent Hub Intelligence Limited, Isle of Man.
Who we are.
Talent Hub Intelligence Limited ("THI", "we", "us") is a recruitment-technology company registered in the Isle of Man. We operate the website at talenthubi.com and the white-label recruitment platform we license to our clients.
This Privacy Policy explains how we handle personal data in two distinct roles:
- As a Data Controller — for visitors to talenthubi.com, prospective clients, our employees, suppliers, and the named users on our client accounts. We decide why and how this data is processed.
- As a Data Processor — for candidate data held inside a client's THI-powered recruitment platform. In this case the recruitment agency or employer (our client) is the Data Controller; THI processes the data on their instructions under a separate Data Processing Agreement.
If you applied for a job through a THI-powered platform and your question relates to your candidate profile, please contact the recruitment agency or employer whose branded site you registered on. Their own privacy notice governs your data; we cannot disclose, amend or delete it on their behalf.
This policy is governed by the Isle of Man Data Protection Act 2018 (incorporating the UK GDPR by reference) and, where applicable, the EU General Data Protection Regulation (GDPR).
What we collect — and why.
Website visitors (talenthubi.com)
- Contact details you submit — name, email address, company name, telephone (if provided), and the contents of any message — when you complete an enquiry form, request a demo, or otherwise contact us.
- Technical data — IP address, browser type and version, operating system, referring page, pages visited, and time of visit. Collected automatically in standard web server logs.
- Strictly necessary cookies — small text files used only to make the site work (see Section 08).
Lawful basis: our legitimate interests in operating, securing and improving our website and in responding to enquiries (UK GDPR Article 6(1)(f)). Where you submit an enquiry, we also rely on the necessity to take steps at your request prior to entering into a contract (Article 6(1)(b)).
Client accounts
- Account-holder details — name, work email, role, telephone number — of the individuals at our client organisations who hold accounts on the management side of the THI platform.
- Billing details — billing contact, billing address, payment reference (we do not store full card details; payment is handled by our payment processor).
- Account activity — logins, configuration changes, support correspondence.
Lawful basis: performance of our contract with the client organisation (Article 6(1)(b)) and our legitimate interests in operating the platform and providing support (Article 6(1)(f)).
Candidate data inside client platforms
When candidates register on a THI-powered platform operated by one of our clients, the data they submit (CV, contact details, profile information, application history) is held inside that client's dedicated instance.
THI's role: Data Processor. Our client is the Data Controller. We process candidate data only on documented instructions from the client, under the terms of our Data Processing Agreement, and only to provide and secure the platform service. We do not use candidate data for any other purpose, including our own marketing.
What we do with it.
We process personal data only for the following purposes:
- To respond to enquiries sent through this website or by email.
- To deliver the service to our clients — provisioning, supporting, securing and maintaining the THI platform.
- To bill and account — invoicing, payment collection, tax and statutory records.
- To communicate operationally — service updates, security notices, contract renewals.
- To comply with our legal obligations — anti-money-laundering, statutory record retention, responding to lawful regulator or court requests.
- To improve our service — analysing aggregated, anonymised usage patterns. We do not profile individuals.
We do not sell personal data. We do not share personal data with any third party for that third party's own marketing or other independent use, except as described in Section 04 (Sub-processors) below.
Who else handles your data.
We engage a small number of carefully-selected third-party service providers ("sub-processors") to deliver the THI service. Each is bound by a Data Processing Agreement that mirrors our obligations to you, restricts processing to documented purposes, and requires equivalent technical and organisational security measures.
Server hosting & data storage
UK / EU regions
Transactional email delivery
Current provider in DPA
Card & subscription billing
Current provider in DPA
Model inference for matching & analysis
Current provider in DPA
An up-to-date list of sub-processors, including each provider's data-processing region and the categories of data shared, is maintained in our Data Processing Agreement and is available to clients on request. Clients are notified in advance of any material change to this list, with a reasonable opportunity to object before the change takes effect.
Where your data lives.
Primary processing occurs on dedicated servers located in the United Kingdom or the European Union, operated by OVHcloud.
Where any transfer of personal data to a third country outside the UK or EEA is necessary, that transfer takes place only under one of the lawful mechanisms permitted by the Isle of Man Data Protection Act 2018, UK GDPR or EU GDPR — typically the UK International Data Transfer Agreement, the EU Standard Contractual Clauses, or an adequacy decision in force at the time of transfer.
We do not transfer personal data to jurisdictions without an adequate level of protection unless one of these safeguards is in place. A current list of cross-border transfers is available on request.
How long we keep it.
We retain personal data only for as long as we need it for the purpose it was collected, plus any period required by law.
- Enquiry-form submissions — kept for up to 24 months from last contact, unless the enquiry becomes a client relationship.
- Client account records — held for the duration of the contract and for 7 years afterwards to meet statutory record-keeping obligations (tax, audit).
- Billing records — held for 7 years to comply with tax legislation.
- Web server logs — held for up to 90 days for security and troubleshooting, after which they are aggregated or deleted.
- Marketing opt-outs — held indefinitely (we are obliged to remember that you have opted out).
- Candidate data inside client platforms — retained per the client's documented retention policy. The client controls when this data is deleted; we honour their instructions.
When the retention period for a record ends, that record is securely deleted from our systems and, on the next backup-rotation cycle, from our backups.
What you can ask us to do.
Under the UK GDPR and the Isle of Man Data Protection Act 2018, you have the following rights in relation to your personal data:
- The right to be informed — to know how your data is being used (this policy).
- The right of access — to obtain a copy of the personal data we hold about you (a "Subject Access Request").
- The right to rectification — to have inaccurate or incomplete data corrected.
- The right to erasure — to have your data deleted, where there is no overriding legal basis for us to keep it.
- The right to restrict processing — to pause processing while an issue is investigated.
- The right to data portability — to receive your data in a structured, commonly-used, machine-readable format and, where technically feasible, have it transmitted to another controller.
- The right to object — to certain types of processing, including direct marketing.
- Rights in relation to automated decision-making and profiling — to ensure that significant decisions affecting you are not made solely by automated means without your involvement.
- The right to withdraw consent — where consent is our lawful basis for processing, you can withdraw it at any time.
To exercise any of these rights, please email privacy@talenthubi.com or write to us at the address in Section 12. We will respond within one calendar month. If we cannot meet that deadline (for example because the request is particularly complex), we will let you know and explain why.
Exercising any of these rights is free of charge in normal circumstances. We may charge a reasonable fee, or refuse, if a request is manifestly unfounded or excessive — but only in the circumstances permitted by law, and we will always explain why.
For candidate data held inside a client platform: please contact the recruitment agency or employer whose platform you registered on. They are the Data Controller and the legal addressee of your request. If they need our help to action it, we will provide reasonable assistance.
Cookies on this website.
talenthubi.com uses only strictly-necessary cookies — small text files that make the site work, remember your form input, or maintain security. We do not use tracking, advertising or third-party analytics cookies, and we do not require a cookie banner because no consent-requiring cookies are set.
If we ever introduce optional cookies, we will update this policy and request your consent first.
Under-16s.
This website is not intended for children. We do not knowingly collect personal data from anyone under the age of 16 through talenthubi.com.
Where a THI-powered recruitment platform processes data about applicants under 16 (for example, apprenticeship schemes or work-experience programmes), the client operating that platform is responsible for obtaining the consents and applying the safeguards required by law.
How we protect your data.
We implement appropriate technical and organisational measures to protect personal data against accidental loss, unauthorised access, disclosure, alteration or destruction. These measures include:
- Encryption of data in transit (TLS 1.3) and at rest (AES-256).
- Single-tenant dedicated infrastructure — no shared database between clients.
- Role-based access controls and multi-factor authentication for all administrative access.
- Daily automated backups, geographically redundant, restore-tested on a defined cadence.
- An immutable audit log of administrative and processing activity.
- A documented incident-response process, including statutory 72-hour breach notification to data controllers and the supervisory authority where required.
A fuller description is available in our Trust Centre.
When we update this notice.
We may update this Privacy Policy from time to time to reflect changes in our practices, our service, or the law. The "Effective date" and "Last updated" date at the top of this page will always show when the current version came into effect.
Material changes will be communicated to client account-holders in advance by email. Continued use of the THI service after the effective date of a change constitutes acceptance of the updated policy.
Previous versions of this policy are available on request.
How to reach us.
For any question, request or concern about this Privacy Policy or how we handle your data:
Data Protection Lead
Talent Hub Intelligence Limited
Registered Office, Isle of Man
Email: privacy@talenthubi.com
If you remain unhappy with our response, you have the right to lodge a complaint with the relevant supervisory authority:
- For Isle of Man residents: the Isle of Man Information Commissioner — inforights.im
- For UK residents: the Information Commissioner's Office (ICO) — ico.org.uk
- For EU residents: the supervisory authority in your country of residence — find yours via the European Data Protection Board
We would, however, appreciate the chance to deal with your concerns directly first — please contact us before escalating.
Reviewing our policies for a procurement check? Talk to us.
We're happy to share our Data Processing Agreement, our current sub-processor list, our security overview, or answer any specific compliance question you have. No salesperson — just a direct conversation.