Privacy & GDPR Policy

Last updated: July 2026

1. Who we are

Vesta Consulting Limited is the data controller for the personal data described in this policy. We are an independent recruitment agency and software consultancy.

Company

Vesta Consulting Limited, registered in Scotland, company no. SC228736. VAT no. 816 933 021.

Registered office

Titanium 1, King's Inch Place, Renfrew, Scotland, PA4 8WF

Trading office

Trigate, 503, 4th floor, Hagley Road West, Birmingham, B68 0NP

Contact

info@vestaconsulting.co.uk · 0121 838 9696

2. What we collect

If you register a vacancy

Through the form on our contact page we collect your name, company name, email address, telephone number, the job title and type, and any role details you choose to write.

If you send us your CV

We collect your name, email address, telephone number, the type of role you are looking for, any message you write, and the CV file you attach. A CV typically contains your employment history, education, skills and contact details — please do not include information you would rather we did not hold, such as your date of birth, national insurance number, photograph, or details of your health, ethnicity or religion. We do not need any of it.

Automatically, when you use this site

• Anti-spam records. When you submit a form we store a one-way cryptographic hash of your IP address, together with the time, so we can limit how many messages one sender can post. We cannot recover your IP address from the hash. These records are deleted automatically after 24 hours.
• Server logs. Our hosting provider keeps standard web server logs, which include IP addresses, for security and diagnostics.
• Fonts. This site loads its typeface from Google Fonts. That request tells Google your IP address and browser. See section 6.

Cookies

This website sets no cookies and contains no analytics, advertising or social media tracking.

3. Why we use it, and our lawful basis

To respond to your enquiry and provide recruitment services

Lawful basis: legitimate interests — you contacted us about a job or a vacancy, and replying is what you would reasonably expect. Where we are placing you in a role, this may also be steps prior to entering a contract.

To put candidates forward to prospective employers

Lawful basis: legitimate interests. We will always tell you before sending your details to a specific client, and we will not send them if you ask us not to.

To keep your details on file for future opportunities

Lawful basis: consent. You can withdraw it at any time by emailing us, and we will remove you.

To prevent spam and abuse of our forms

Lawful basis: legitimate interests — keeping our systems usable and secure.

4. Who we share it with

• Prospective employers. If you are a candidate, the core of our service is introducing you to companies that are hiring. We tell you first.
• Our hosting provider, who operates the servers this website and our email run on.
• Professional advisers and authorities, where we are required to disclose information by law.

We do not sell personal data, and we do not share it for advertising or marketing by anyone else.

Where we use third-party software to manage recruitment — for example email, file storage or applicant tracking systems — those providers process data on our behalf under written terms, and only on our instructions. We will tell you who they are on request.

5. How long we keep it

Candidate records and CVs

Two years from our last meaningful contact with you, after which we delete them — unless you have asked us to keep them on file for longer, or we are placing you in a role.

Client and vacancy records

For the duration of our working relationship, and afterwards for as long as we need them for legal, tax or accounting purposes.

Anti-spam records

24 hours.

6. Transfers outside the UK

We place candidates with clients across the UK and Europe. Where we send your details to a client in the European Economic Area, that transfer is covered by the UK's adequacy decision for the EEA, which means your data continues to receive equivalent protection. We will tell you before sending your details to any specific client, wherever they are based.

This site also loads fonts from Google, which may involve a transfer of your IP address outside the UK. If you would prefer this not to happen, most browsers and privacy extensions can block third-party font requests; the site remains fully usable without them.

7. How we protect it

This website is served over an encrypted HTTPS connection. Form submissions are validated on our server, attachments are restricted to document formats and size-limited, and our anti-spam records are stored outside the publicly reachable part of the site. Access to enquiries and CVs is limited to those in our team who need it.

No system is perfectly secure, and we cannot guarantee the security of data while it is in transit across the internet.

8. Your rights

Under UK GDPR you have the right to:

• Access the personal data we hold about you, and receive a copy.
• Rectify anything inaccurate or incomplete.
• Erase your data — often called the right to be forgotten.
• Restrict or object to our processing, including any processing based on legitimate interests.
• Data portability — receive your data in a transferable format.
• Withdraw consent at any time, where our basis is consent.

To exercise any of these, email info@vestaconsulting.co.uk. We will respond within one month. There is no charge.

9. Complaints

If you are unhappy with how we have handled your data, please tell us first — we would like the chance to put it right. You also have the right to complain to the UK's data protection regulator:

Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF · ico.org.uk/make-a-complaint · 0303 123 1113

10. Changes to this policy

We may update this policy from time to time. The date at the top shows when it was last changed.