Legal
Privacy Policy
Last updated: 15/10/2026
1. Who we are
RECSPHERE LTD, company number 15931463, provides the RecSphere recruitment software platform. Our registered office is 128 City Road, London, United Kingdom, EC1V 2NX. In this policy, “RecSphere”, “we” and “us” mean RECSPHERE LTD.
For privacy questions, requests or complaints, email legal@recsphere.co.uk with “Privacy” in the subject line, or write to our registered office marked for the attention of the Privacy Lead.
2. The information this policy covers
We are responsible as a controller for personal information used to run our own business, including website enquiries, demo requests, customer business contacts, account administration, billing, support, marketing and our own security records.
When a recruitment agency or other business uses RecSphere to manage candidates, clients, referees, compliance documents, bookings or timesheets, that business is normally the controller of those records. We process them on its instructions under a data-processing agreement, and its privacy notice explains its purposes, lawful bases, recipients and retention periods. Where our customer itself acts for another controller, we may act as a subprocessor.
If you received a candidate portal invitation, reference request or upload link, please contact the agency named in that message about its use of your information. You can also contact us and we will help route your request. We do not change an agency's records without its instructions, except where the law requires it.
3. Information we collect and where it comes from
Depending on how you deal with us, we collect:
- Contact and professional details: name, business email, phone number, employer, role and the details of your enquiry or demo.
- Account information: user identifiers, access permissions, sign-in events and account settings.
- Commercial information: subscription, invoicing and payment status. We invoice through Xero. We do not receive or store card details.
- Communications: messages, support requests, feedback and attachments. Please do not send candidate medical records or identity documents through the website enquiry form or chat.
- Call and demo recordings: we may record demos and support calls, and transcribe them, to keep an accurate record, train our team and improve our service. We tell you at the start of the call, and you can ask us not to record.
- Technical information: IP address, device and browser information, access logs, timestamps and security events. Cookies and similar technologies are explained in our Cookie Policy.
- Marketing preferences and records of consent, objections and unsubscribe requests.
We receive this information directly from you, from your organisation's administrator or colleagues, and from the devices you use. Where we obtain information indirectly, we give you privacy information when the law requires it.
Records our customers control may include CVs, employment history, professional registrations, references, identity and right-to-work evidence, timesheets, bank and payment details and communications. Where an agency has set up an appropriate workflow, they may also include health or immunisation records and criminal-record information. This describes what customers can instruct us to process; it does not mean every category is collected by default.
4. Why we use information and our lawful bases
| Purpose | Information involved | Lawful basis where we are the controller |
|---|---|---|
| Answer enquiries and arrange demos | Contact details and correspondence | Legitimate interests in responding to business enquiries; steps before a contract where you personally will be the contracting party. |
| Administer customer accounts and support | Business contacts, user records and service communications | Legitimate interests in delivering and administering our services; contract where you are the contracting customer. |
| Record demos and support calls | Recordings and transcripts | Legitimate interests in keeping an accurate record, training our team and improving our service. |
| Billing, accounting and legal records | Business contact, transaction and invoice records | Legal obligation where tax or accounting rules require it; otherwise legitimate interests in managing payments and disputes. |
| Protect the service and investigate misuse | Access, technical and security records | Legitimate interests in safeguarding accounts, people and systems; legal obligation where a specific duty applies. |
| Send optional marketing | Contact details and preferences | Consent. You can withdraw it at any time. |
| Measure website use | Pages viewed, referring site, device and browser type, approximate location and events such as demo requests, linked to a pseudonymous Google Analytics identifier | Consent, given through “Accept analytics” in our cookie banner. |
| Handle privacy requests, complaints and legal claims | Identity-verification details, the request and the relevant records | Legal obligation for statutory rights and complaints; legitimate interests in resolving other complaints and establishing or defending legal claims. |
Where we rely on legitimate interests, we consider the impact on you and apply safeguards. You can object to that use, and you have an absolute right to object to direct marketing.
You do not have to agree to marketing to request a demo or buy the service. You can unsubscribe using the link in any marketing email or by emailing us. If information is needed to answer your request, run an account or meet a legal duty and you do not provide it, we may not be able to complete that action. We mark required fields where we collect information.
5. AI features and recruitment information
Depending on a customer's plan and settings, RecSphere's AI features can parse CVs, capture vacancies from connected client emails, read submitted timesheets and suggest record updates from call transcripts. These involve analysing candidate information. Separately, candidate matching ranks potential matches using scoring rules each agency configures. Matching does not use AI, but ranking candidates is still a form of profiling.
Our AI features run on Microsoft's Azure OpenAI Service, deployed in the Azure region of the customer's own country. Customer records, prompts and outputs are never used to train AI models. Under Microsoft's standard terms, Microsoft may keep inputs and outputs for a limited period to detect and prevent abuse of its service.
The agency decides how it uses these features for recruitment and must explain that use to the people affected. Our service is designed for meaningful human review of candidate selection, compliance evidence and significant record changes: AI output can be wrong, incomplete or biased, and a match score is not a guarantee of suitability. You can ask the relevant agency to review information and decisions about you. RecSphere does not make solely automated decisions with legal or similarly significant effects about you as a controller.
6. Sharing information
We share information only where it is relevant to the purpose concerned, with authorised staff and with suppliers who provide services to us:
- Microsoft: hosting on Microsoft Azure, our AI features through the Azure OpenAI Service, and email.
- Google: Google Analytics, only if you accept analytics cookies.
- Tidio: our website chat, only when you open it.
- Xero: invoicing and accounting.
Authorised people in your organisation can see account and activity information according to their permissions. Customer recruitment records are shared as the customer instructs and configures, for example with its users, clients, referees and connected service providers.
We may disclose relevant information to professional advisers, insurers, courts, regulators or authorities where necessary and lawful, or in a business sale or reorganisation with appropriate protections. We do not sell personal information or share it for advertising.
7. Where information is held and international transfers
Our website, internal administration systems and enquiry records are hosted on Microsoft Azure in the UK (UK South). Each customer's platform data is hosted in the Azure region for that customer's country; for Australian customers this is Australia East, and our AI processing runs in the same region.
Some suppliers, such as Google and Tidio, may process information outside the UK. Where personal information is transferred outside the UK, we rely on the safeguards UK law requires, such as UK adequacy regulations or the UK International Data Transfer Agreement or Addendum in our suppliers' data-processing terms. Email legal@recsphere.co.uk for information about the safeguards that apply to your information.
8. How long we keep information
We keep personal information only for as long as needed for the purpose and our legal duties:
| Category | How long we keep it |
|---|---|
| Enquiries and demo requests | 24 months after the enquiry, unless a customer relationship begins. |
| Business contact and account records | During the customer relationship, then 24 months after it ends. |
| Invoices and accounting records | 6 years from the end of the financial year they relate to, as UK law requires. |
| Support tickets and attachments | 24 months after the ticket is closed. |
| Call and demo recordings | 24 months after the call. |
| Security and access logs | 24 months, or longer where an incident or legal claim requires it. |
| Marketing records | Until you withdraw consent or we stop the activity, reviewed after 24 months without contact. We keep a minimal record of objections so we can respect them. |
| Recruitment records held for customers | As the customer instructs and as agreed in our data-processing agreement, including return or deletion at the end of the contract. |
| Privacy requests and complaints | 24 months after the request or complaint is closed. |
Where a legal duty or dispute requires longer preservation, we restrict the affected records and review them regularly.
9. Security
We use technical and organisational safeguards appropriate to the risk, including encrypted connections, encryption of our Azure databases and storage at rest, role-based access controls and single sign-on for our staff. No system can remove every risk.
10. Your rights and complaints
Depending on the law that applies and the circumstances, you can ask to access, correct, delete, restrict or move your information, and object to some uses. Where we rely on consent, you can withdraw it at any time without affecting earlier lawful processing.
Email legal@recsphere.co.uk to make a request. We may ask for proportionate information to confirm your identity and find the records. We normally respond within one month, and we will tell you if a lawful extension applies. For records an agency controls, we help that agency handle your request.
You can raise a data-protection complaint by email or post using the details above. We acknowledge complaints within 30 days, investigate them appropriately, keep you updated and tell you the outcome without undue delay. You can also complain to the UK Information Commissioner's Office at ico.org.uk/make-a-complaint, or to the data-protection authority where you live. Contacting us does not affect your statutory rights.
11. Children, other websites and changes
Our website is intended for adult business users. If a customer processes records about people under 18, it must set up an appropriate lawful and safeguarded workflow; this policy does not limit those people's rights. Other websites we link to have their own privacy information.
We update this policy when our processing changes and show the date of the latest version above. Earlier versions are available on request. Cookies and similar technologies are covered in our Cookie Policy.