Privacy Policy

Version 1.1 Pegaz Recruitment Ltd t/a Joanna Black Recruitment · Co. No. 09521939 Last updated: June 2026

1. Who we are

This Privacy Policy explains how Pegaz Recruitment Ltd, trading as Joanna Black Recruitment ("we", "us", "our") collects, stores, uses and protects your personal data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

Data Controller: Pegaz Recruitment Ltd t/a Joanna Black Recruitment
Company No. 09521939 · Registered in England and Wales
Contact: hire@joannablack.co.uk · 020 7060 2760

2. What data we collect

2.1 Candidate data

Identity: name, email address, phone number
Professional: CV, work history, qualifications, language certifications
Application notes: interview notes, language assessment results, references
Right to work: nationality, visa status (where legally required)
Preferences: salary expectations, preferred location, availability
Technical: IP address (collected automatically via website hosting infrastructure)

2.2 Client (employer) data

Contact details: name, job title, work email, phone number
Company information: company name, address, industry, recruitment requirements

We do not knowingly collect special category data (health, religion, sexual orientation, ethnicity, etc.) unless strictly necessary for the role and you have given explicit, informed consent.

3. How we collect data

Directly from you — via website enquiry form, email, telephone, or video call
From public sources — LinkedIn, job boards (Indeed, CV-Library, StepStone, Pracuj.pl, etc.)
From third parties — professional references or other agencies (only with your prior consent)
Via website infrastructure — basic server logs (IP address, browser type) handled by our hosting provider

4. Legal basis for processing

Basis	Applies to	Examples
Legitimate Interest	Candidates, Clients	Retaining CVs in our database; contacting candidates about relevant new roles
Contract	Candidates, Clients	Providing recruitment services; fulfilling a search assignment
Consent	Candidates	Sharing a CV with a client for the first time; sending our Journal newsletter
Legal Obligation	Both	Right-to-work verification; legally required record-keeping

5. How we use your data

Candidates

Matching your profile to suitable roles with our employer clients
Contacting you about relevant positions
Sharing your CV with a client — only with your explicit consent each time
Conducting language assessments and recruitment interviews
Verifying your right to work in the UK

Clients (employers)

Delivering the agreed recruitment services
Business communication and contract administration
Invoicing and payment management

6. Sharing your data

Employer clients — candidates only, always with your explicit prior consent
Employer of Record (EOR) providers — where a candidate is being engaged via an EOR in their country of residence
IT service providers — email, CRM and website hosting systems that process data solely on our instruction
Regulatory and legal bodies — where required by applicable law

We never sell your personal data to third parties for marketing or any other purpose.

Where data is transferred outside the UK, we ensure appropriate safeguards are in place (e.g. UK International Data Transfer Agreements / Standard Contractual Clauses).

7. How long we keep your data

Data type	Retention period	Reason
Active candidate CV & profile	2 years from last contact	Legitimate interest — potential future opportunities
Inactive candidate data	12 months from last contact	Potential future enquiries
Placed candidate data	6 years from end of placement	Legal and tax record-keeping requirement
Client data	6 years from last transaction	Legal and tax record-keeping requirement
Server logs (IP etc.)	Up to 90 days	Security and hosting infrastructure standard

8. Your rights under UK GDPR

Right of access — request a copy of the personal data we hold about you
Right to rectification — ask us to correct inaccurate or incomplete data
Right to erasure — ask us to delete your data ("right to be forgotten"), where no legal obligation requires us to retain it
Right to object — object to processing based on legitimate interest
Right to restrict processing — ask us to limit how we use your data while a dispute is resolved
Right to data portability — request your data in a structured, machine-readable format
Right to withdraw consent — at any time, without affecting the lawfulness of prior processing

To exercise any of these rights, contact us at: hire@joannablack.co.uk. We will respond within 30 calendar days. You also have the right to lodge a complaint with the Information Commissioner's Office (ICO): ico.org.uk · 0303 123 1113.

9. Data security

Data stored on secure, access-controlled cloud services (e.g. Microsoft 365 / Google Workspace)
Access restricted to authorised personnel only, protected by strong passwords and two-factor authentication (2FA)
Regular review and update of security measures
All IT suppliers vetted for UK GDPR compliance and subject to Data Processing Agreements

In the event of a data breach that is likely to affect your rights and freedoms, we will notify the ICO within 72 hours and inform you directly where the risk is high.

10. Cookies

Our website joannablack.co.uk uses only technically necessary cookies essential for the site to function (e.g. server session management). We do not currently use analytics, advertising or tracking cookies. Full details are available in our Cookie Policy.

11. Changes to this policy

We reserve the right to update this Privacy Policy at any time. We will notify you of material changes by email or via a notice on our website. The version number and date of the last update are always shown at the top of this document.

Next scheduled review: June 2027