GDPR & your data.
Last updated: 8 June 2026
This page is a plain-English summary of your rights under the UK General Data Protection Regulation (UK GDPR) and how to exercise them with Commit Talent. The longer version, with full detail on what we collect and why, is in our privacy policy.
Your eight rights
As an individual whose personal data we hold, UK GDPR gives you eight specific rights. We will honour each of them within one calendar month of your request, free of charge, unless the request is manifestly unfounded or excessive.
1. The right to be informed
You have the right to know what data we hold about you, why we hold it, who we share it with, and how long we keep it. That information is set out in our privacy policy.
2. The right of access (DSAR)
You can ask us for a copy of all the personal data we hold about you. This is called a Data Subject Access Request. Send your request via our contact form; include the email address or name we are likely to hold your record under. We may ask you to verify your identity before responding. We will reply within one calendar month.
3. The right to rectification
If anything we hold about you is wrong or incomplete — a stale phone number, a typo in your CV, an out-of-date job title — tell us and we will correct it. There is no formal process needed; a message via the contact form is enough.
4. The right to erasure ("right to be forgotten")
You can ask us to delete your data entirely. We will do so unless we have a legal obligation to keep specific records (for example, financial records HMRC requires us to retain for seven years). Where we have to keep some records, we will tell you exactly what is being kept and why.
Routine deletion: candidate data is automatically deleted after 24 months of no contact, so you do not need to make a formal request if you simply want us to let your record lapse.
5. The right to restrict processing
You can ask us to stop using your data for specific purposes while a question about it is being resolved — for example, while we investigate a rectification request. We will continue to store the data but will not actively process it.
6. The right to data portability
For data you have given us under a contract or with consent, you can ask for a copy in a structured, commonly used, machine-readable format (typically JSON or CSV) that you can take to another provider.
7. The right to object
You can object to our processing on legitimate-interest grounds. We will stop unless we can show compelling legitimate grounds that override your rights — for example, to defend a legal claim. You can object to direct marketing at any time, no questions asked.
8. Rights related to automated decision-making
We use software to help rank and filter CVs by how well they match a role's brief — it is how we get through volume without missing good people. Two things matter here:
- A person reviews candidates before they are put forward for any role. The software prioritises and shortlists; it does not decide who gets hired.
- Where a CV is clearly irrelevant to a role or does not meet its stated requirements, it may be filtered out automatically before a person reviews it.
UK GDPR gives you the right not to be subject to a decision based solely on automated processing where it has a legal or similarly significant effect. If you believe you were filtered out in error, you can ask us to have a person review your CV, and you can object to automated processing — just use the contact form. On request, a person will always make the final call.
How to exercise these rights
Use the contact form on our website and tell us which right you are exercising. Include enough detail for us to find your record (your full name and the email address you would normally use to contact us is usually sufficient). We may ask for proof of identity if the request is non-trivial.
We will reply within one calendar month. If your request is particularly complex we may extend that by up to two further months and will tell you why.
If you are not satisfied
If you are unhappy with how we have handled your data or your request, please tell us first so we have a chance to put it right. You also have the right to complain to the UK Information Commissioner's Office at any time:
- Online: ico.org.uk/make-a-complaint
- Helpline: 0303 123 1113
Children's data
Our recruitment services are for working-age professionals. We do not knowingly collect data about anyone under 18. If you believe we hold data about a minor, please let us know and we will delete it.
Data breaches
In the unlikely event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will report it to the ICO within 72 hours and notify affected individuals without undue delay, as required by Article 33 and 34 of UK GDPR.