Oxygen Digital Recruitment Limited

Oxygen Digital Recruitment Limited is a specialist AI and Data recruitment company registered in England and Wales (company number 11062595), whose registered office is at Criterion House, 40 Parkway, Chelmsford, United Kingdom. We operate across Europe and the USA.

We process personal data in line with the UK GDPR, the Data Protection Act 2018, and the EU GDPR where it applies to candidates and clients based in the EU. We are the "controller" of the personal data described in this notice.

Where you're a candidate applying for a permanent role through us, we collect: your name, email address, phone number, home address, current salary, job title, current employer, and full CV.

Where you're a freelance or contract candidate — reflecting our Freelance/Contract placement service — we also collect additional information needed to place and pay you compliantly, including:

• Proof of address (utility bill and/or driving licence)
• Passport or other proof of identity
• VAT number/certificate, where applicable
• Certificate of Incorporation, where you operate through a limited company
• National Insurance number
• Insurance documents
• Company bank details and supporting proof (e.g. a bank statement)

Where you're a client contact, we collect business contact information (name, job title, professional email and phone number, office address) and information about the roles you're hiring for.

We don't generally collect information about clients from other sources, but occasionally we may, such as from publicly available professional profiles (e.g. LinkedIn), your company's own published materials, or from industry events and networking.

For candidates, once an offer is close or made, we may collect information from third parties such as previous employers, academic institutions, or professional bodies — but only where your prospective employer requires it and only based on details you've already provided to us. This can include:

• References from previous employers or your academic institution
• Right-to-work or immigration status checks, where required by a client or by law
• Verification of professional qualifications or certifications, where relevant to the role

We may also come across candidate information via job boards or professional networking sites — for example, if we identify that your public profile or job board CV matches a role we're recruiting for, we may collect that information in order to reach out to you.

• Matching you to opportunities — assessing your suitability for roles and, where there's a good fit, sharing your data with clients who are hiring.
• Ongoing career support — where we've placed you, staying in touch to check in on how the placement is going and offering further support.
• Fulfilling client contracts — using client contact and role information to deliver our recruitment services and manage billing.
• Marketing — sending updates we think may be of interest, if you've opted in. You can opt out any time via the unsubscribe link or by emailing dataprivacy@oxygendigital.ai.
• Website interaction — when you submit your CV or contact details via oxygendigital.ai, our team will follow up to discuss opportunities.
• Legal and compliance obligations — including responding to statutory bodies, law enforcement, or our external legal advisers where required.

For candidates: we share your data with clients who are hiring for roles matching your skillset, so they can consider you for opportunities. We will not forward your CV or share your details with any client without your consent, except where we're under a legal obligation to do so.

For clients: we share limited role and company information with candidates we think are a strong fit — but only once you've confirmed to us that you're happy for us to make the introduction.

For clients, the contact and role details you provide let us properly set up and administer our services to you — agreeing terms, arranging billing, and understanding your hiring needs.

For candidates, we ask for certain information because it's required by law (e.g. right-to-work checks), because a client requires it as part of their hiring process, or because it's needed for us to properly represent you and match you to the right opportunities.

Client contacts: we keep client contact information on file for up to 10 years following our last meaningful contact, unless you tell us otherwise sooner, reflecting typical commercial and fiscal record-keeping needs.

Candidates: All candidate data will be stored for an indefinite time period unless

a. it is felt that the candidate's data is not of use to Oxygen Digital based on relevant experience within the markets we operate in or

b. we have received a formal request to remove a candidate's data from our CRM. We have chosen to not have a time limit on how long we store candidate's data due to the fact that opportunities in the market remain relevant throughout a candidate's career and intent to provide long term guidance & support to all candidates supported.

• Contract — to enter into or perform a contract with clients, or to take steps at your request before entering one.
• Legitimate interests — for matching candidates to roles, maintaining relationships for future opportunities, and running our business efficiently, balanced against your rights.
• Legal obligation — e.g. accounting, tax, and right-to-work requirements.
• Consent — for optional marketing communications, which you can withdraw at any time.

• Be informed about how and why we use your data
• Access a copy of the data we hold about you
• Rectification of inaccurate or incomplete data
• Erasure of your data in certain circumstances
• Portability — receive your data in a structured format and transfer it elsewhere
• Object to processing for direct marketing, or to processing based on legitimate interests
• Object to solely automated decisions that produce legal or similarly significant effects on you
• Restrict our processing of your data in certain circumstances

To exercise any of these rights, email dataprivacy@oxygendigital.ai with enough information for us to identify you, along with proof of identity and address. We aim to confirm receipt within 72 hours and will respond within the timeframe required by law (usually one month).

You can unsubscribe from marketing emails at any time using the link at the bottom of the email; this may take up to 30 days to take full effect.

All data stored in our CRM is encrypted and protected by security measures maintained in conjunction with Bullhorn International. We limit access to personal data to those with a genuine business need for it, and anyone processing your data on our behalf is bound by confidentiality obligations. We have procedures in place to identify and respond to any suspected data security breach, and we will notify you and any applicable regulator where we're legally required to.

This notice was last updated on the date shown at the top of this page. We'll review it periodically and will let you know of any significant changes.

If you have any questions about this notice or how we handle your data, please email dataprivacy@oxygendigital.ai, marking your message for the attention of our Data Protection Officer.