Privacy Policy

Nitrous Group Limited ("we", "us", "our" or the "Company") is a specialist automotive headhunting firm. This Privacy Policy explains how we collect, use, disclose, and protect personal data relating to candidates, clients, and visitors to our website (the "Site").

We are the data controller for personal data we process under the UK GDPR, the EU GDPR, and the Data Protection Act 2018, and we act as a "business" (as that term is defined under US state privacy laws, including the California Consumer Privacy Act as amended by the CPRA) in respect of personal information we collect about US residents.

This Policy is designed to comply with applicable data protection and privacy laws in the United Kingdom, the European Economic Area, and the United States.

Candidates: individuals who submit their details to us for consideration for roles, whether directly, via referral, or through our sourcing activities.

Clients: representatives of businesses who engage, or consider engaging, our recruitment and headhunting services.

Visitors: anyone who browses the Site or contacts us through it.

Identifiers and contact data: name, email address, postal address, telephone number, and business contact details.

Professional data: employment history, current and target roles, qualifications, certifications, salary expectations, references, and right-to-work or immigration information.

Recruitment data: CVs, application materials, interview notes, assessment results, and feedback on introduced candidates.

Client engagement data: company name, role specifications, hiring requirements, and feedback provided to us.

Usage and technical data: IP address, browser and device information, pages visited, and referring URLs, collected through cookies and similar technologies.

Marketing and communications data: your preferences and any correspondence you send us.

Sensitive data (where voluntarily provided): information revealing racial or ethnic origin, health, or trade union membership may be processed only where necessary for compliance with legal obligations (for example, right-to-work or equality-monitoring requirements) and only with appropriate safeguards.

Directly from you when you register as a candidate, submit a CV, complete a form, or correspond with us.

From clients who provide role specifications and feedback on introduced candidates.

From publicly available professional sources, such as LinkedIn and other professional networks, where we have a legitimate interest in identifying potential candidates.

From third-party service providers who assist us in running our business, such as CRM and hosting providers.

To source, assess, and introduce candidates for roles and to deliver our headhunting services to clients.

To communicate with you about roles, engagements, and our services.

To maintain records of introductions and placements and to administer fees and engagements.

To respond to enquiries and to operate, secure, and improve the Site and our services.

To comply with legal, regulatory, and contractual obligations, including right-to-work and anti-money-laundering checks where applicable.

Consent: where you give us consent, for example when you submit your details or subscribe to communications. You may withdraw consent at any time.

Contract: where processing is necessary to take steps before entering into, or to perform, a contract with you (for example, progressing a placement).

Legitimate interests: where we rely on our legitimate interests, or those of a third party, balanced against your rights — for example, sourcing candidates through publicly available professional networks and maintaining records to prevent non-circumvention.

Legal obligation: where processing is necessary to comply with a legal duty, such as right-to-work verification or record-keeping requirements.

With clients, only with your consent and only as necessary to progress a candidate placement.

With service providers who process data on our behalf under contract, such as CRM, hosting, and email providers, located in the UK, EEA, or regions with adequate protection.

With professional advisors, such as lawyers and accountants, where necessary to establish, exercise, or defend legal rights.

Where required by law, court order, or to protect our rights, safety, or the safety of others.

We do not sell your personal data to third parties for monetary consideration.

We may transfer personal data outside the UK and EEA. Where we do, we ensure it is protected by an adequacy decision, the UK International Data Transfer Agreement (IDTA), the EU Standard Contractual Clauses, or another lawful transfer mechanism.

For transfers involving US residents, we process data in accordance with applicable US state privacy laws and, where relevant, recognized transfer frameworks.

We retain personal data only for as long as necessary to fulfil the purposes set out in this Policy, including to meet legal, accounting, or reporting requirements.

Candidate files are generally retained for the duration of your engagement with us and for a reasonable period thereafter to support future opportunities and our non-circumvention obligations, unless you request earlier deletion.

Client engagement records are retained for the term of the engagement and for the period required to administer fees and meet legal obligations.

When data is no longer needed, we delete it or render it permanently anonymous.

We apply appropriate technical and organisational measures, including access controls, encryption where appropriate, and staff training, to protect personal data against unauthorised access, loss, alteration, or disclosure.

Despite these measures, no method of transmission or storage is completely secure, and we cannot guarantee absolute security.

We use cookies and similar technologies to operate the Site, understand how it is used, and improve its performance.

Necessary technologies: the consent banner records your choice so it does not reappear. This record is required for the consent mechanism to function and is stored on your device.

Analytics cookies (set only with your consent): ng_visitor_id — a first-party, anonymous identifier used to recognise returning visitors and aggregate usage trends. It is set in your browser, persists for up to 365 days, and contains no personal information. It is only placed after you accept cookies via the banner.

We do not use third-party analytics, advertising, or cross-site tracking cookies.

You can control or delete cookies through your browser settings, withdraw consent at any time via the banner, or contact us to request deletion. Disabling the visitor-ID cookie does not affect the functionality of the Site.

Under the UK GDPR and EU GDPR you have the right to: access your personal data; rectify inaccurate data; erase your data (the "right to be forgotten"); restrict processing; port your data to another controller; object to processing (including processing for direct marketing); and object to solely automated decision-making, including profiling.

Where we rely on consent, you may withdraw it at any time without affecting the lawfulness of processing carried out before withdrawal.

To exercise any right, contact us using the details in the Contact section. We will respond within the period required by applicable law (generally one month, extendable in limited circumstances).

If you are a resident of California, Virginia, Colorado, Connecticut, Utah, or another US state with an applicable privacy law, you may have the right to: know what personal information we collect and how we use it; access and obtain a copy; correct inaccurate information; delete your personal information; opt out of the "sale" or "sharing" of personal information; and limit the use of sensitive personal information.

Under California law, you also have the right not to receive discriminatory treatment for exercising these rights and to designate an authorised agent to act on your behalf.

You may exercise these rights by contacting us as set out below. We will verify your identity before responding, and we will not discriminate against you for exercising your rights.

We do not sell your personal information for monetary consideration, as "sale" is defined under US state privacy laws.

We do not "share" your personal information for cross-context behavioural advertising purposes as defined under California law.

Where any processing could be considered a "sale" or "share" under US law, you have the right to opt out at any time by contacting us.

We do not use or disclose sensitive personal information (as defined under California law) for purposes of inferring characteristics about you or for cross-context behavioural advertising.

We limit the use and disclosure of sensitive personal information to what is necessary to perform the services or to comply with legal obligations, and we will process it only with your consent or as otherwise permitted by law.

We do not carry out solely automated decision-making that produces legal or similarly significant effects, unless such processing is necessary to enter into or perform a contract, is authorised by law, or is based on your consent.

We may use tools to help match candidates to roles, but all placement decisions involve human review and judgment.

Our services are not directed at individuals under the age of 18, and we do not knowingly collect personal data from children.

If you believe we have collected personal data from a child, please contact us and we will take steps to delete it.

Some browsers transmit a "Do Not Track" signal. We do not currently respond to Do Not Track signals, but we respect the cookie choices you make through your browser settings and any opt-out requests you submit to us directly.

If you are in the UK, you have the right to lodge a complaint with the Information Commissioner's Office (ico.org.uk).

If you are in the EEA, you may lodge a complaint with your local data protection authority.

If you are in the United States, you may contact your state attorney general's office regarding your privacy rights.

We encourage you to contact us first so we can address any concern directly.

We may update this Policy from time to time to reflect changes in our practices, our services, or applicable law. The "last updated" date below indicates the most recent revision. Material changes will be posted on the Site.

If you have any question about this Policy or wish to exercise any right, contact our Data Protection contact at info@nitrous-group.com, or write to: Nitrous Group Limited, James Hall, Parsons Green, St Ives, PE27 4AA, United Kingdom.