Shivom Consultancy Limited respects your privacy. This notice explains how we collect and use personal information relating to website visitors, business contacts, clients and prospective candidates. We handle personal information in accordance with the UK General Data Protection Regulation, the Data Protection Act 2018 and other applicable data protection and privacy legislation.

1. Who we are

Shivom Consultancy Limited is a UK technology consultancy, registered in England and Wales under company number 04921167. For the activities described in this notice, Shivom is the controller responsible for deciding how personal information is used. Address: Suite B, Part First Floor, Profile West, 950 Great West Road, Brentford, TW8 9ES, United Kingdom Data Protection Officer: Reena Dad Privacy enquiries: theteam@shivom.uk Where we process information on behalf of a client under its instructions, the client’s privacy notice and our contractual arrangements govern that processing.

2. Information we collect

Depending on your interaction with us, we may collect:

• Contact information: your name, email address, telephone number, organisation and job title.
• Business information: enquiries, correspondence, project requirements and information relevant to our business relationship.
• Candidate information: your CV, employment history, qualifications, skills, professional experience, availability, work preferences and information supplied during recruitment.
• Website information: IP address, browser and device information, pages visited and interactions with our website, subject to applicable cookie requirements.

Please avoid including unnecessary sensitive information in enquiries or CVs. Where recruitment requires health information, adjustment requests or other specially protected information, we will explain the purpose and applicable legal conditions before collecting it.

3. Where information comes from

We collect information directly when you contact us, submit an enquiry, apply for a role or provide your details for future opportunities. We may also obtain candidate information from job boards, LinkedIn, recruitment platforms and publicly available professional sources. This can include contact details, skills and employment history. When contacting someone whose information came from another source, we will explain where we obtained it and provide relevant privacy information.

4. Why we use information

We use personal information to:

• Respond to enquiries and discuss potential projects.
• Establish and manage client, supplier and professional relationships.
• Assess applications and identify suitable opportunities.
• Communicate with candidates and manage recruitment records.
• Analyse CVs and match candidate experience to role requirements.
• Operate, protect and improve our website and systems.
• Meet legal obligations and establish, exercise or defend legal claims.

5. Our lawful bases

The lawful basis depends on the activity: When relying on legitimate interests, we consider the necessity of the processing and its impact on your rights and reasonable expectations. If we rely on consent, you can withdraw it by contacting us. Withdrawal does not affect the lawfulness of processing carried out beforehand. Where special category information is necessary, we also identify an appropriate additional condition for processing it.

6. AI-assisted recruitment

We use our bespoke candidate-management tools and AI services from OpenAI, Anthropic (Claude) and Microsoft to assist with CV processing, screening, matching and shortlisting. These tools analyse information such as skills, qualifications and employment experience against role requirements. They may produce summaries and suitability recommendations for our recruitment team. Recruitment decisions involve human review. We do not make decisions to reject or shortlist candidates solely through automated processing. Our team considers the recommendations and can question or override them. Our arrangements prevent candidate CV information from being used to train the providers’ AI models. If you believe information or an AI-assisted assessment is inaccurate, contact our Data Protection Officer. You can request correction and human reconsideration of the assessment.

7. Who receives information

Information may be processed by service providers supporting our operations, including:

• WordPress.com and website-service providers.
• Microsoft 365 and SharePoint.
• Providers supporting our bespoke candidate-management systems.
• OpenAI, Anthropic and Microsoft AI services where used for candidate processing.
• Professional advisers or authorities where necessary for advice, legal obligations or legal claims.

We generally do not share candidate CVs with clients. Where sharing is needed, we confirm with the candidate before sending their CV to the relevant client. Access is limited to what is appropriate for the activity concerned.

8. Hosting and international processing

Our bespoke candidate-management system is hosted in the United Kingdom. External website, cloud, analytics and AI providers may process information outside the UK, including through support services or subprocessors. Where a restricted international transfer takes place, we must ensure an applicable UK adequacy regulation or appropriate transfer safeguard is in place, together with any required assessment. Contact our Data Protection Officer for information about the arrangements relevant to your data and how to obtain details of applicable safeguards.

9. How long we retain information

If an enquiry leads to a contract or an application leads to employment or an assignment, relevant information becomes part of the records for that relationship and is subject to the applicable retention arrangements. Information may be retained longer where necessary to meet a legal obligation or handle an active dispute or legal claim. Where this applies, we limit retention to the information needed for that purpose.

10. Cookies and Google Analytics

Our website uses cookies and similar technologies to support its operation and understand how it is used. We use Google Analytics to analyse website traffic and interactions. This may involve device information, identifiers and usage information. Where consent is required, the relevant technologies should operate only after you give consent. You can manage your preferences through the website’s cookie controls. Our cookie information explains the technologies in use, their purposes and durations. Browser settings also allow you to manage cookies, although disabling necessary cookies may affect website functions.

11. Keeping information secure

We use appropriate technical and organisational measures to protect personal information against unauthorised access, loss, misuse or disclosure. No system can guarantee complete security. Please do not send passwords or unnecessary identity, financial or sensitive information through the general enquiry form.

12. Your rights

Depending on the circumstances and applicable law, you may have the right to:

• Access your personal information.
• Correct inaccurate or incomplete information.
• Request deletion.
• Restrict processing.
• Receive certain information in a portable format.
• Withdraw consent where processing relies on it.
• Obtain applicable safeguards relating to automated decision-making.

You can object to processing based on legitimate interests, including recruitment matching, on grounds relating to your circumstances. You can object to direct marketing at any time. To exercise your rights, contact theteam@shivom.uk. We may need proportionate information to verify your identity. We will explain any applicable limitations or exemptions.

13. Complaints

If you have concerns about our handling of personal information, contact our Data Protection Officer at theteam@shivom.uk. We will acknowledge a data protection complaint within 30 days, investigate without undue delay, keep you informed and explain the outcome. You also have the right to complain to the Information Commissioner’s Office: Website: ico.org.uk Telephone: 0303 123 1113

14. Changes to this notice

We review this notice when our activities or legal requirements change. The date at the top identifies its latest update.