How we collect, use and protect your personal data, including CVs and candidate details submitted through our registration form.
Last updated: 11 August 2026
Garzon Cyber Solutions ("we", "us", "our") provides cybersecurity advisory, compliance services and specialist technology recruitment. We are the data controller for the personal data described in this policy.
If you have any question about this policy, or you want to exercise any of the rights set out below, contact us at jonathan@garzoncybersolutions.com.
Through our registration form we collect your name, email address, telephone number, current or most recent employer, location, seniority, availability, how you heard about us, your LinkedIn profile where you provide it, and your CV.
A CV is written by you, so its contents are your choice. It will normally contain your employment history, qualifications and contact details. Please do not include information you would rather we did not hold, such as your date of birth, marital status, health information, photographs, or your home address. We do not need any of it to represent you, and we would rather not hold it.
We collect your name, work email address, company, the role you are hiring for and any job description you upload. This is business contact information rather than personal information in most cases, but it is still covered by this policy.
We collect the details you give us, typically your name, email address and the content of your message.
Our website uses only what is necessary to serve the site and keep it secure. We do not run advertising trackers or sell analytics data.
| What we do | Lawful basis under UK GDPR |
|---|---|
| Review your CV and consider you for roles | Consent. You give it by ticking the box on the registration form. You can withdraw it at any time. |
| Contact you about a specific opportunity | Consent, and where a process is already under way, legitimate interests in keeping you informed about it. |
| Send your CV to a named client | Consent, obtained separately for each individual role. Your original registration is not consent for this. |
| Respond to a hiring requirement you submitted | Legitimate interests in responding to a business enquiry, and performance of a contract where one follows. |
| Keep records of placements and invoices | Legal obligation, principally tax and accounting requirements. |
| Send occasional research or market updates | Consent, or legitimate interests for existing business contacts. Every message carries an unsubscribe link. |
We will never send your CV to a client without asking you first, for that specific role, and receiving your agreement.
This matters because the alternative, spraying CVs at employers to stake a claim on a candidate, is common in recruitment and damaging to the people it is done to. It can put your current employer on notice that you are looking, and it can block you from applying directly. We do not do it.
If you tell us you do not want to be approached about a particular company, we will record that and honour it.
We share personal data only in these circumstances.
We do not sell personal data, and we do not share candidate details with other recruitment agencies.
Some of our service providers operate infrastructure outside the United Kingdom, including in the United States and the European Economic Area. Where personal data is transferred outside the UK, we rely on UK adequacy regulations or on the International Data Transfer Agreement, together with appropriate technical safeguards.
| Data | Retention period |
|---|---|
| Candidate details and CVs | 24 months from our last meaningful contact with you. We will then either delete them or ask whether you want us to keep them. |
| Records relating to a placement | 6 years from the end of the relevant financial year, to meet tax and contractual record-keeping requirements. |
| Hiring requirements and client contacts | For the duration of the relationship, then 6 years. |
| General enquiries | 12 months, unless they lead to something ongoing. |
| Marketing subscriptions | Until you unsubscribe, plus a suppression record so that we do not contact you again by mistake. |
We are a cybersecurity firm, so we hold ourselves to the standard we advise others to meet. Access to candidate data is restricted to those who need it. Data is encrypted in transit. Accounts holding personal data are protected by multi-factor authentication. We keep the amount of personal data we hold deliberately small, because data you do not hold cannot be lost.
If a personal data breach occurs that is likely to result in a risk to your rights and freedoms, we will notify the Information Commissioner's Office within 72 hours of becoming aware of it, and we will tell you directly where the risk to you is high.
Under UK data protection law you have the right to:
To exercise any of these, email jonathan@garzoncybersolutions.com. We will respond within one month. There is no charge.
We do not make decisions about candidates by automated means. A person reads every CV. No algorithm screens you out.
If you are unhappy with how we have handled your personal data, please tell us first and we will try to put it right.
You also have the right to complain to the UK supervisory authority at any time:
Information Commissioner's Office
Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF
Helpline: 0303 123 1113
ico.org.uk/make-a-complaint
We will update this policy when our practices change. The date at the top shows when it was last revised. Where a change materially affects how we use data we already hold, we will tell affected individuals directly rather than relying on this page alone.