Privacy Policy

1 Who We Are

Cambridge Talent Consultancy Ltd ("CTC", "we", "us", "our") is a specialist medical recruitment company registered in England and Wales.

• Registered Address: 124 City Road, London EC1V 2NX, United Kingdom
• Data Controller: Cambridge Talent Consultancy Ltd
• Contact: jawad@cambridgetalentconsultancy.co.uk
• Phone: +44 773 530 0393
• Website: cambridgetalentconsultancy.co.uk

We specialise exclusively in placing GMC-registered Consultant Physicians and NMC-registered Specialist Nurses from the United Kingdom, United States, Australia and Canada into leading hospitals across Saudi Arabia and the Gulf Cooperation Council (GCC) region.

This Privacy Policy explains how we collect, use, store, protect and share your personal data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

2 Data We Collect

2.1 From Candidates (Physicians and Nurses)

When you register your medical profile with us, we collect:

• Full name, email address, phone number and location
• Current job title, medical speciality and years of experience
• Professional registration details (GMC number, NMC PIN, AHPRA number, licence type)
• Curriculum Vitae (CV) and professional qualifications
• LinkedIn profile URL and professional online presence
• Availability, GCC country preference, and salary expectations
• Career summary and any specific requirements you provide
• Consent records (date and time you gave consent)

2.2 From Employers (Hospitals and Healthcare Organisations)

When a hospital or healthcare organisation submits a hiring brief, we collect:

• Organisation name, address and accreditation details
• Contact person's name, job title and email address
• Role requirements, speciality needed, and salary budget
• Hiring timeline and specific requirements

2.3 From Website Visitors

• IP address and browser information (via standard server logs)
• Pages visited and time spent on our website
• Any information submitted through our contact or enquiry forms

3 How We Use Your Data

3.1 For Candidates

• To assess your suitability for GCC hospital vacancies
• To match your profile with appropriate employer opportunities
• To present your profile to prospective employers — only with your explicit prior consent for each introduction
• To provide guidance on SCFHS registration, Dataflow verification and MOH licensing
• To communicate with you about relevant opportunities, updates and your application status
• To maintain accurate records of our recruitment activities

3.2 For Employers

• To source and present verified candidate profiles for your vacancies
• To manage our service relationship with your organisation
• To communicate regarding placements, timelines and candidate introductions

3.3 For All Users

• To comply with our legal obligations under UK law
• To improve our website and services
• To respond to enquiries submitted through our website

4 Legal Basis for Processing

Under UK GDPR, we process your personal data on the following legal bases:

• Consent (Article 6(1)(a)): For all candidate registrations and for sharing candidate profiles with employers. You may withdraw consent at any time.
• Legitimate Interests (Article 6(1)(f)): For operating our recruitment service and communicating with employers. We have assessed that our legitimate interests do not override your rights.
• Contractual Necessity (Article 6(1)(b)): Where we have entered into a placement agreement, to fulfil our contractual obligations.
• Legal Obligation (Article 6(1)(c)): Where we are required to process data to comply with UK law.

5 Data Sharing

We may share your data only in the following limited circumstances:

• Prospective Employers: Candidate profiles are shared with GCC hospitals only with your explicit, specific consent for each individual introduction. We will always tell you which hospital we are introducing you to before sharing any information.
• Verification Bodies: With your consent, we may share information with SCFHS (Saudi Commission for Health Specialities), Dataflow Group, GMC, NMC or other professional bodies for the purpose of credential verification.
• IT Service Providers: We use trusted third-party services for website hosting (Hostinger), email and form processing. These providers are contractually bound to protect your data and process it only on our instructions.
• Legal Requirements: Where required by UK law, court order or regulatory authority, we may be required to disclose personal data.

All third parties with whom we share data are required to implement appropriate technical and organisational security measures and to use your data only for the purposes we specify.

6 International Data Transfers

Our core recruitment activity involves connecting candidates with employers in Saudi Arabia, UAE, Qatar, Bahrain and Kuwait. This requires transferring candidate information to organisations outside the UK and the European Economic Area (EEA).

Where we transfer data internationally, we ensure appropriate safeguards are in place, including:

• Obtaining your explicit, informed consent before any international transfer of your personal data
• Ensuring receiving organisations implement appropriate data protection measures
• Providing you with clear information about which organisation and country your data is being transferred to before we share it

We will never transfer your data internationally without your prior knowledge and consent.

7 Data Retention

We retain personal data only for as long as necessary for the purpose it was collected, subject to applicable legal requirements:

• Active Candidates: We retain your profile for up to 2 years from your last active engagement with us. We will contact you before this period expires to ask whether you wish to remain registered.
• Successfully Placed Candidates: Employment records retained for 6 years from the date of placement for legal and contractual compliance purposes.
• Unsuccessful or Withdrawn Candidates: Data deleted within 12 months of the last contact, unless you request earlier deletion.
• Employer Records: Retained for 6 years from the end of our business relationship for legal compliance.
• Website Enquiries: Retained for 12 months from date of submission.

You may request deletion of your data at any time, subject to any overriding legal obligations we may have to retain certain records.

8 Your Rights Under UK GDPR

You have the following rights regarding your personal data:

• Right of Access: You can request a copy of all personal data we hold about you (Subject Access Request).
• Right to Rectification: You can ask us to correct any inaccurate or incomplete personal data.
• Right to Erasure ("Right to be Forgotten"): You can ask us to delete your personal data where there is no compelling reason for us to continue processing it.
• Right to Restrict Processing: You can ask us to limit how we use your data in certain circumstances.
• Right to Data Portability: You can request your data in a structured, commonly used, machine-readable format.
• Right to Object: You can object to processing based on our legitimate interests.
• Right to Withdraw Consent: Where processing is based on consent, you can withdraw it at any time. Withdrawal does not affect the lawfulness of processing before withdrawal.

To exercise any of these rights, please contact us at: jawad@cambridgetalentconsultancy.co.uk

We will respond to all valid requests within one calendar month. There is no charge for making a request.

9 Data Security

We take the security of your personal data seriously and implement appropriate technical and organisational measures to protect it against unauthorised access, alteration, disclosure or destruction.

Our security measures include:

• SSL/TLS encryption on our website (https://)
• Password-protected candidate database access
• Secure email communications
• Restricted access to personal data on a need-to-know basis
• Regular review of our data protection practices

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the ICO within 72 hours and notify you directly where required by law.

10 Cookies

Our website uses minimal cookies necessary for the website to function correctly. We do not use tracking cookies, advertising cookies or third-party analytics cookies.

The cookies we use include:

• Session cookies: Temporary cookies that expire when you close your browser, used to maintain your session on the website.
• Functional cookies: Used to remember your preferences during your visit.

You can control and delete cookies through your browser settings. Disabling cookies may affect the functionality of our website.

11 Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology or legal requirements. When we make material changes, we will update the "Last Updated" date at the top of this page.

We encourage you to review this policy periodically. Continued use of our website or services after any changes constitutes acceptance of the updated policy.

12 Contact Us

For any data protection queries, subject access requests, complaints or to exercise any of your rights:

We aim to respond to all data protection enquiries within 5 working days and all Subject Access Requests within one calendar month.