Legal

Privacy notice

Last updated 23 August 2026

This notice explains what we do with personal data when you use this website, when you enquire about a search, when you apply for a role through us, and when we approach you about work. It applies to people in the United Kingdom, the European Economic Area and the United States.

Who we are

GTCO Ltd is the data controller. Generative Talent Co is a trading name of GTCO Ltd.

Where we get your data

We collect personal data in three ways.

Directly from you

When you complete the enquiry form on this site, apply for a role, send us a CV, create an account in our candidate portal, or correspond with us.

From publicly available sources

We are a search business. A large part of our work involves identifying people who have not applied to us. We collect professional information from sources such as professional networking sites, company websites, public registers, published articles, conference listings and job boards.

From other people

From referrals, from referees you nominate, and from clients who ask us to contact someone.

What data we hold

• Identity and contact details. Name, email address, telephone number, location, and links to public professional profiles.
• Professional information. Employment history, skills, qualifications, salary expectations, notice period, availability, and the contents of your CV.
• Application data. The roles you have applied for, our assessment notes, interview records and feedback.
• Eligibility information. Right to work status where a role requires it.
• Client contact data. Name, company, business email and the details of a search you have asked us to run.
• Technical data. Server logs including IP address, which we keep briefly for security and to prevent abuse of our forms.

We do not seek special category data such as health, ethnicity or religious belief. If you volunteer it, for example in a CV, we will hold it only where it is necessary and lawful to do so, and you may ask us to remove it.

Why we use it, and our lawful basis

Purpose	Lawful basis
Identifying and approaching potential candidates	Legitimate interests. Recruitment cannot function without contacting people who have not applied. We limit ourselves to professional information, we approach you about work only, and you can ask us to stop at any time.
Assessing you for a role and presenting you to a client	Legitimate interests, and taking steps at your request before entering a contract.
Responding to a client enquiry and running a search	Performance of a contract, or steps taken at your request before one.
Sending you opportunities you have opted into	Consent, which you can withdraw at any time.
Keeping records of right to work checks and complying with employment agency law	Legal obligation.
Security, fraud prevention and keeping the site working	Legitimate interests.

How we use AI

We use software, including artificial intelligence, throughout our process. We think you are entitled to know exactly where.

• We monitor public sources continuously for signals about companies, such as funding, expansion and leadership changes.
• We use automated parsing to read CVs and extract structured information.
• We use large language models to summarise a profile against a role brief, and to draft outbound messages, which a person reviews before anything is sent.

We do not make decisions about you by automated means alone. A person decides whether you are put forward for a role. If you believe an automated process has affected you and you want a human to look at it again, write to legal@gtco.io and we will review it and tell you the outcome.

Who we share it with

• Our clients. When we present you for a role. We share an anonymised profile first, and we release your name and contact details only once you are being considered and, where practical, once you have agreed.
• Service providers acting on our instructions. Hosting, database and email infrastructure, authentication, document processing, search and language model providers. They act as processors under contract and cannot use your data for their own purposes.
• Professional advisers and authorities. Where we are required to disclose by law.

We do not sell personal data, and we do not share it with advertisers.

International transfers

We operate across the United Kingdom, the European Economic Area and the United States. Some of our service providers are established in the United States, so your data may be transferred there.

Where we transfer personal data outside the UK or the EEA, we rely on one or more of the following: an adequacy decision or adequacy regulations covering the destination, the UK International Data Transfer Addendum, or the European Commission's Standard Contractual Clauses, together with an assessment of the safeguards in place. You can ask us for details of the mechanism used for a particular transfer.

How long we keep it

• Candidate records. Up to two years from our last meaningful contact with you, after which we delete or anonymise them, unless you ask us to keep them for longer.
• Placed candidates and client records. Six years from the end of the engagement, to meet contractual, tax and legal requirements.
• Right to work records. As required by law.
• Enquiries that do not proceed. Twelve months.
• Server logs. A short period, measured in days, for security purposes.

Your rights

If you are in the United Kingdom or the European Economic Area, you have the right to be told what we hold about you and to receive a copy, to have inaccurate data corrected, to have data erased, to restrict or object to processing, to receive your data in a portable format, and to withdraw consent where we rely on it. Where we rely on legitimate interests, you can object, and if you object to being contacted about work we will stop and record that.

If you are in the United States, your rights depend on your state. Residents of California and other states with comparable laws may have the right to know what personal information we have collected, to request deletion or correction, and to opt out of any sale or sharing of personal information. We do not sell or share personal information as those terms are defined in those laws.

To exercise any right, write to legal@gtco.io. We will respond within one month. We will not charge you, and we will not treat you differently for asking.

Complaints

If you are unhappy with how we have handled your data, please tell us first so we can put it right. You also have the right to complain to a supervisory authority. In the UK that is the Information Commissioner's Office at ico.org.uk. In the EEA it is the authority in your country of residence.

Cookies and tracking

This website sets no cookies, runs no analytics and contains no advertising or third party tracking. Web fonts are loaded from Google Fonts, which means Google receives your IP address in order to serve them.

Changes

If we change this notice we will update the date at the top. Where a change materially affects you and we hold your contact details, we will tell you.