We collect only what we need to answer your enquiry, run a search or fill a seat. We never sell your data, we never send a candidate's details to a client without that candidate's agreement, and you can ask us to delete your data at any time by emailing faraz@athertalent.com.
1. Who we are
AtherTalent is a founder-led HR consulting and recruitment firm operated by Faraz Ather from Pakistan. For the purposes of the EU General Data Protection Regulation (GDPR), the UK GDPR and similar laws, AtherTalent is the controller of the personal data described in this policy.
Contact for anything in this policy: faraz@athertalent.com. AtherTalent, Pakistan.
If you are a candidate, the candidate privacy notice adds detail on how we handle CVs, interview notes and references. Where the two documents differ, the candidate notice applies to candidate data.
2. What we collect and where it comes from
| When | What we collect |
|---|---|
| You send the contact or hiring form | Your name, work email, company, what you need, the role or team details you type, and how you heard about us if you tell us. The form runs on Netlify Forms. |
| You send a CV through the candidates page | Your name, email, phone if given, your CV file and anything you add. The candidate privacy notice has the full list. |
| You email us | Your email address, the content of the message and any attachments. Our email runs on Google Workspace. |
| You book a call | Your name, email, the time you choose and any notes you add. Booking runs on Calendly, on Calendly's own site. |
| You visit the site | Netlify, our host, records standard server logs: IP address, browser user agent, timestamp and the page requested. The site itself sets no cookies and runs no analytics. See the cookie notice. |
| We work with you as a client | Contact details of the people we deal with, role briefs, feedback on candidates, contract and invoice records. |
We do not buy marketing lists and we do not run advertising trackers.
3. Why we use it and the lawful basis
| Purpose | Lawful basis |
|---|---|
| Answering your enquiry and scoping work before an engagement | Steps taken at your request before entering a contract, and our legitimate interest in running the business |
| Delivering a search, seat, fractional or consulting engagement to a client | Performance of the contract with the client |
| Assessing a candidate for a specific role and introducing them to a client | Our legitimate interest in running a recruitment service, and steps taken at the candidate's request. The introduction itself happens only with the candidate's agreement |
| Keeping a candidate in our talent pool for future roles | Consent, renewed every 24 months |
| Invoicing, accounting and tax records | Legal obligation and performance of the contract |
| Keeping the site secure and detecting abuse | Legitimate interest in security (server logs held by Netlify) |
| Responding to a legal request or defending a claim | Legal obligation and legitimate interest |
Where we rely on legitimate interests we have checked that the interest is real, that the processing is necessary for it, and that it does not override your rights. You can object at any time. Section 7 explains how.
We do not use your data for marketing emails and we do not send a newsletter. Every email you get from us is about your enquiry, your role or your engagement.
4. Who receives your data
- Clients. If you are a candidate, we send your details to a client only after you have agreed to be put forward for that specific role. If you are a client, we do not share your role details or your company name with candidates or anyone else without your written go-ahead.
- Netlify (hosting and form handling, United States). Form submissions are stored in Netlify's dashboard and emailed to us. Netlify runs submissions through its spam filter.
- Google Workspace (email, calendar and document storage, United States). Everything you email us, and our working files, live here.
- Calendly (bookings, United States). If you book a call, Calendly processes the booking under its own privacy policy and sends us the details.
- Supabase (our recruitment database and sign-in, United States). Candidate files, applications, client roles and the accounts people use to sign in to app.athertalent.com are stored here.
- Resend (email delivery, United States). Sign-in links and status emails from app.athertalent.com are sent through Resend from our own domain.
- Anthropic (AI processing, United States). When we use AI to organise a CV or pre-score it against a role's written rubric, the text is processed by Anthropic's Claude models. A person reviews every result.
- Sourcing tools. When we search for candidates we use LinkedIn Recruiter and contact-finding databases such as ZoomInfo, SignalHire and Apollo. We use them to find and contact people. They hold their own data under their own policies.
- Professional advisers and authorities, where the law requires it or where we need advice to defend a claim.
Each provider acts under its own data processing terms. We do not sell personal data to anyone.
5. International transfers
AtherTalent is based in Pakistan and uses providers in the United States. Your data is accessed and worked on from Pakistan. If you are in the EU, the UK or elsewhere, your data will leave your country. Pakistan does not hold an adequacy decision from the European Commission or the UK government.
We protect data in three ways. First, the providers we use publish data processing terms that include standard contractual clauses for transfers out of the EU and UK. Second, we collect the minimum needed and share it only as described above. Third, we apply the rights in sections 7 and 8 to everyone we hold data on, wherever they live. If you want to see the safeguards a provider relies on, email us and we will point you to them.
6. How long we keep it
| Data | Retention |
|---|---|
| Enquiries that do not become an engagement | 24 months from our last contact, then deleted |
| Candidate data | As set out in the candidate privacy notice: 12 months if not placed, 12 months after the start date if placed, 24 months in the talent pool with renewed consent |
| Client contracts, invoices and the records needed to support them | For the life of the engagement, then for the period tax and accounting law requires |
| Email correspondence | Reviewed against the periods above and deleted when no longer needed |
| Server logs | Held by Netlify under its own short retention schedule. We do not export them |
If you ask us to delete your data sooner we will, unless we have to keep a specific record to meet a legal duty or defend a claim. In that case we tell you what we are keeping and why.
7. Your rights under GDPR and UK GDPR
If you are in the EU, the EEA or the UK, you have the right to:
- Access the personal data we hold about you and receive a copy.
- Rectification of anything inaccurate or incomplete.
- Erasure, where we no longer need the data or you withdraw consent.
- Restriction of processing while a question about accuracy or lawfulness is resolved.
- Portability: a copy of the data you gave us, in a common machine-readable format.
- Object to processing based on legitimate interests, and to any direct marketing.
- Withdraw consent at any time where consent is the basis, for example for the talent pool. This does not affect what was done before you withdrew.
- Complain to a supervisory authority. In the UK that is the Information Commissioner's Office. In the EU it is the data protection authority of the country where you live or work. We would rather hear from you first, but you do not have to contact us before complaining.
We extend these rights to everyone we hold data on, wherever you live. It is simpler and fairer than running two systems.
8. Your rights under the CCPA and CPRA (California)
We do not believe AtherTalent meets the thresholds that make a business subject to the California Consumer Privacy Act as amended by the CPRA. We honour the same rights anyway. If you are a California resident you can ask us to:
- Know what personal information we have collected about you, where it came from, why, and who we have shared it with.
- Delete your personal information.
- Correct inaccurate personal information.
- Opt out of sale or sharing. AtherTalent does not sell personal information and does not share it for cross-context behavioural advertising, and has not done so in the last 12 months. There is nothing to opt out of. We will not start without updating this policy and giving you an opt-out first.
- Non-discrimination. We will not treat you differently for exercising any of these rights.
You can use an authorised agent to make a request. We will ask for enough information to confirm that the request genuinely comes from you or on your behalf.
9. EU and UK representative
Article 27 of the GDPR and UK GDPR asks controllers outside the EU and UK to appoint a local representative unless their processing is occasional, small in scale, low risk and does not involve large-scale special category data. We have assessed our processing against that test and do not currently appoint an EU or UK representative. We will revisit this at each review of this policy. Any request or question, from anywhere, goes to faraz@athertalent.com and is handled by the founder.
10. Security
Your data lives in Google Workspace, Netlify and Supabase. Google Workspace and Netlify encrypt data in transit and at rest; Supabase is reached only over encrypted connections, and its database rules limit each person to the roles they work on. Access is limited to the founder and anyone working on your engagement. If a breach ever affects your data we will tell you and, where required, the relevant authority without undue delay.
11. Children
Our services are for employers and working adults. They are not directed at anyone under 18 and we do not knowingly collect data from anyone under 18. If you think we have, email us and we will delete it.
12. Changes to this policy
We review this policy at least every six months and whenever our tools or services change. The dates at the top show the last update and the next scheduled review. If a change affects how we use data you have already given us, we will tell you by email before it takes effect.
13. How to make a request or contact us
Email faraz@athertalent.com with "privacy request" in the subject line, or use the contact page. Tell us which right you are exercising and, if it helps, which form or email you originally sent. We reply within one business day to confirm receipt and complete requests within one month. There is no charge. We may ask you to confirm your identity before releasing or deleting data, and we will only ask for what we need to do that.
Postal contact: AtherTalent, Pakistan. Email is faster.
This document is written in plain English and is not a substitute for legal advice on your specific situation.