Template — not yet legally reviewed. This document describes the intended practice accurately, but it must be reviewed by a qualified data-protection solicitor and matched against the systems actually in use before launch.
1. Who we are
Staffing Viro LLC (“Staffing Viro”, “we”) is a recruitment intermediary based in Albuquerque, NM. We are the data controller for the personal data described in this policy. You can reach our data protection contact at the Contact page.
2. What we collect
If you are a client company
- Your name, work email, company name and job title
- The roles you are hiring for and the detail in your brief
- Correspondence with us, including call notes
- How you found us, if you tell us
If you are an engineer
- Name, email address and current location
- LinkedIn profile, and optionally a GitHub or portfolio URL
- Current or target title, years of experience, primary technologies
- Employment-type preference, availability and working preferences
- Your CV, if you choose to upload one
- Anything you write in the free-text field, and notes we make during screening and assessment
Everyone
- Standard server logs, including IP address, retained briefly for security and abuse prevention
- Analytics data, but only if you accept cookies — see section 8
3. Why we process it
- To respond to your enquiry and provide recruitment services
- To assess whether an engineer is a fit for a client role, and to present them to that client with their agreement
- To keep records of who we have spoken to and about what
- To detect and prevent spam, fraud and abuse of our forms
- To understand which pages help companies find us, where analytics consent has been given
We do not sell personal data. We do not use it to train machine learning models. We do not run automated decision-making that produces legal or similarly significant effects.
4. Lawful basis
- Consent — engineer profile submissions, and analytics cookies. You can withdraw consent at any time.
- Legitimate interests — responding to a business enquiry you initiated, securing our systems, and contacting engineers about roles matching preferences they gave us.
- Contract — delivering the recruitment services a client has engaged us for.
- Legal obligation — tax, accounting and right-to-work record keeping where applicable.
5. Who we share it with
An engineer's details are shared with a named client company only after that engineer has agreed to that specific role. We never circulate profiles speculatively.
We also use these processors:
- Vercel — website hosting and server logs
- Resend — transactional email delivery
- Calendly — discovery call scheduling, loaded only when you press the button to open it
- Google Analytics 4 — usage analytics, only with your consent, with IP anonymisation enabled
Each is bound by a data processing agreement. We disclose data to law enforcement only where legally compelled.
6. How long we keep it
- Engineer profiles — 24 months from your last interaction with us, then deleted. We will email you before that point to ask whether you want to stay in the pool.
- CVs — deleted with the profile, or immediately on request.
- Client enquiries and engagement records — 6 years after the end of the engagement, for contractual and tax purposes.
- Server logs — 30 days.
- Analytics data — 14 months.
7. Your rights
Under the UK GDPR and EU GDPR you have the right to access, rectify, erase, restrict processing of, and port your personal data, and to object to processing based on legitimate interests. Where processing relies on consent, you may withdraw it at any time without affecting processing already carried out.
To exercise any of these, email the Contact page from the address you registered with. We respond within 30 days and do not charge a fee. There is no retention offer and no exit interview — deletion means deletion.
8. Cookies
The site sets no cookies at all until you make a choice in the banner. Rejecting means no analytics script is ever loaded, and no request is made to Google.
- Strictly necessary — a single browser local storage entry recording your cookie choice, so we do not ask again. No expiry; clear your site data to reset it.
- Analytics (optional) — Google Analytics 4, if you accept. Used to count page views and see which pages lead to enquiries.
We do not use advertising or cross-site tracking cookies. To change your choice, clear this site's data in your browser and the banner will reappear.
9. Security
The site is served over HTTPS with HSTS, a strict Content Security Policy and standard hardening headers. Form endpoints are rate limited and validate all input server-side. Uploaded files are verified by content, not by the filename or the browser-supplied type. Access to candidate data is limited to the recruiters working the relevant search.
No system is perfectly secure. If you believe you have found a vulnerability, please email the Contact page and we will acknowledge within two business days.
10. International transfers
Some processors are based in the United States. Where personal data leaves the UK or EEA, transfers are covered by the UK International Data Transfer Addendum or the EU Standard Contractual Clauses, together with a transfer risk assessment.
11. California residents
Under the CCPA/CPRA you may request disclosure of the categories and specific pieces of personal information we have collected, request deletion or correction, and opt out of “sharing” for cross-context behavioural advertising. We do not sell or share personal information as those terms are defined in the CCPA. We will not discriminate against you for exercising these rights. Send requests to the Contact page.
12. Contact and complaints
Questions or complaints: the Contact page. If you are not satisfied with our response, you may complain to the UK Information Commissioner's Office at ico.org.uk, or to your local supervisory authority in the EEA.
See also our terms of service.