Grey Ring provides permanent and contract recruitment services across SAP, enterprise applications, technology transformation and related specialist markets. This notice explains how we use personal information about candidates and prospective candidates, contractors, client and supplier contacts, referees and visitors to greyring.com. 

Your choices: You can ask us to stop marketing to you at any time. You can also object to processing based on legitimate interests. Contact contact@greyring.com or your usual Grey Ring contact. The rights and any limits that apply are explained below.

1. Who is responsible for your information?

GREY RING LTD., trading as Grey Ring, is a company registered in England and Wales with company number 12855748. Our registered office is 128 City Road, London, EC1V 2NX, United Kingdom.

We are the controller of personal information when we decide why and how it is used for our recruitment, website and business activities. Employers, end clients and some other organisations involved in a placement are separate controllers for their own activities and provide their own privacy information.

For privacy questions, requests or complaints, contact the Director, responsible for data protection, at contact@greyring.com, call +44 (0)20 8178 9660, or write to our registered office marked “Data protection”. You do not need to use a particular form or mention a specific law.

The UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations 2003 apply as relevant, including amendments made by the Data (Use and Access) Act 2025. Where our activities fall within the EU GDPR or other applicable local privacy laws, those laws also govern the affected processing.

2. People in the European Economic Area

If the EU GDPR applies to our processing of your information, you have the rights it provides. You may contact us using the details above and complain to a supervisory authority in the EEA country where you habitually live, work or where an alleged infringement occurred.

3. The information we collect

Candidates and prospective candidates

This may include your name, contact details, location, CV, professional profile links, employment history, qualifications, skills, language ability, experience, work preferences, availability, notice period, salary or rate expectations, interview and assessment information, recruiter notes, references and communications about opportunities.

At an appropriate stage, we may need evidence of identity, the right to work, qualifications or other role-specific eligibility. We explain the relevant requirements when we ask. We do not require passport copies, bank details or criminal-record information simply to browse vacancies or make an initial enquiry. Please avoid including unnecessary sensitive information in your CV.

Contractors and placement administration

Where relevant to the arrangements we administer, we also process contracting-company and engagement details, timesheets, invoice and payment information, tax or employment-status information, compliance documents and records needed to manage the placement. We collect bank and tax identifiers only where needed for the relevant payment or legal purpose.

Clients, suppliers and referees

We process professional contact details, job titles, employer or organisation, hiring requirements, business communications, contract and invoice records. For referees, we also process their relationship to a candidate and the reference they provide. Please give a referee this notice before providing their details to us; we also provide appropriate privacy information when contacting them.

Website and communication information

We process information submitted through our contact, CV and application forms. Technical information can include IP address, browser and device information, access times, pages requested, error and security logs, and cookie preferences. Optional cookies and other device-tracking technologies are addressed in section 10 and our Cookie Policy.

4. Where information comes from

We receive information directly from you through forms, CVs, applications, emails, calls, meetings and professional-network messages. We also obtain relevant professional information from LinkedIn, XING, recruitment platforms and CV databases, publicly available professional or company websites, referrals, clients, referees and providers carrying out agreed checks.

Information from another source may include your professional identity, contact details, career history, qualifications, skills and suitability for a role. Public availability does not remove your privacy rights. We use information relevant to recruitment and do not treat a public profile as permission for unrestricted marketing or disclosure.

When we obtain information indirectly, we provide this notice and appropriate information about its source within the legally required timeframe: normally no later than one month after obtaining it, and earlier if we first contact you or disclose it before then. Any exception must be legally applicable. You can ask us which source we used for your information.

5. Why we use information and our lawful bases

We identify a lawful basis for each use of personal information. “Legitimate interests” means a specific, necessary recruitment or business purpose that is not overridden by your interests, rights or freedoms. We assess that balance and limit the information we use.

Finding candidates and providing recruitment services

We use professional, contact and application information to identify potentially suitable people, discuss roles, assess suitability, arrange interviews, obtain appropriate references and manage introductions. We generally rely on legitimate interests: helping people find suitable work and helping clients fill vacancies. Where we take steps at your request to enter a contract with you, or perform our contract with you, we rely on contractual necessity to the extent that it applies. A contract with a corporate client does not by itself create a contractual lawful basis for processing a candidate’s information.

Future opportunities and professional relationships

We may retain a relevant recruitment profile to consider you for future roles within your experience and preferences. Our legitimate interest is maintaining an appropriate specialist candidate network. We consider our relationship, the recency and relevance of the information and your wishes. Rules for contacting you, including marketing consent where required, still apply. You can ask us to stop considering you for future roles.

Managing engagements and business relationships

We use contact, engagement and financial information to administer assignments, timesheets, invoices, payments, queries and supplier relationships. We rely on contractual necessity where you personally are a party to the relevant contract; legitimate interests for managing corporate relationships and their representatives; and legal obligations for required tax, accounting and employment-related records.

Eligibility, compliance, security and disputes

We process necessary information to meet legal obligations that apply to us, including applicable recruitment, right-to-work, tax and regulatory requirements. For proportionate checks that are not a legal obligation on Grey Ring, and for security, fraud prevention and managing legal claims, we rely on legitimate interests where appropriate. Sensitive information requires an additional condition, as explained in section 6. A client request alone does not make a check lawful.

Enquiries, service improvement and marketing

We use enquiries, communications and relevant service records to respond, maintain relationships, investigate complaints and improve recruitment delivery, relying on legitimate interests or legal obligations as appropriate. Marketing uses consent where required and otherwise legitimate interests, subject to applicable electronic-marketing rules and section 9. We rely on consent for optional website tracking under the approach described in section 10.

Testimonials

Where we publish an identifiable testimonial supplied to us, we obtain permission for the agreed wording and attribution. Where consent is our lawful basis, you can withdraw it by contacting us. Reviews published through independent platforms are also subject to those platforms’ own privacy notices.

6. Sensitive information and background checks

Health information, racial or ethnic origin, religious beliefs and certain other information receive additional protection. We do not seek this information as part of routine CV collection. Where information about a disability or health condition is needed to arrange adjustments or meet employment-law obligations, we use only what is necessary.

In addition to an Article 6 lawful basis, we rely on the relevant additional condition: Article 9(2)(b) where necessary for employment, social-security or social-protection rights or obligations and authorised by law; Article 9(2)(a) where valid explicit consent is appropriate; or Article 9(2)(f) where necessary for legal claims. Under UK law, we also meet the applicable Data Protection Act Schedule 1 requirements and maintain an appropriate policy document where required. We explain the condition relevant to any specific collection.

Criminal-offence information has separate legal restrictions. We only request, obtain or share it where lawful, necessary and relevant to the role, using an Article 6 basis and the authority or condition required by Article 10 and applicable national law. We explain any check and its purpose before it takes place. A requirement for a role to be security-clearable does not authorise indiscriminate collection of conviction or vetting records.

We restrict access to sensitive information, use proportionate safeguards and avoid circulating it with general candidate profiles. Refusing optional consent does not affect unrelated recruitment services.

7. Who receives information

We share information only where necessary for the stated purpose and supported by an appropriate lawful basis.

•         Prospective employers and end clients: relevant CV, professional profile and application information for an opportunity. We discuss the opportunity and confirm that you wish to be put forward before sending an identifiable candidate profile. This submission authorisation is distinct from the data-protection lawful basis for our wider recruitment work.

•         Organisations involved in a placement: relevant managed service providers, client recruitment or onboarding portals, contractor-management businesses, payroll or umbrella providers and other authorised parties, where the engagement requires their involvement.

•         Referees and screening providers: limited information needed for an appropriate reference or check. We discuss reference arrangements with you and do not contact your current employer for a reference without your agreement.

•         Service providers: website hosting and maintenance, form delivery, email and communications, recruitment record systems, document storage, IT support, security, accounting and payment administration. Providers acting as our processors must follow our instructions and appropriate contractual safeguards.

•         Professional advisers and authorities: lawyers, accountants, auditors, insurers, courts, regulators and law-enforcement bodies where disclosure is required or otherwise lawful and necessary.

•         Business transactions: a prospective buyer, successor or adviser where necessary for a genuine transaction involving Grey Ring, subject to confidentiality and data-protection safeguards. We use anonymised or limited information where possible and provide further information when required.

We do not make CVs public or sell candidate contact lists for unrelated third-party marketing. Separate controllers are responsible for their own processing; we can help identify the relevant organisation if you need its privacy notice.

8. International processing and transfers

Grey Ring is based in the UK and recruits internationally. Candidate introductions can involve recipients in the EEA, including the Netherlands, Belgium, Germany and France, as well as Switzerland and the United States, depending on the relevant opportunity. We explain the destination for an overseas client submission when discussing a role, including any other country involved. Our providers may also process information internationally; overseas hosting, support access and onward transfers are considered when arranging safeguards.

For a restricted transfer under the UK GDPR, we rely on applicable UK adequacy regulations covering the destination and recipient, or appropriate safeguards such as the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses. Where appropriate safeguards are used, we carry out the required data protection test or transfer risk assessment and apply supplementary measures where needed.

Where EU GDPR transfer rules also apply, we use the relevant EU adequacy decision or an applicable EU transfer mechanism, including EU Standard Contractual Clauses where suitable, with any required assessment and additional measures. We do not treat a candidate’s general agreement to work overseas as a substitute for transfer safeguards.

Contact us for the countries and safeguards relevant to your information, or a copy of the applicable safeguards, with necessary redactions to protect confidential information and other people’s rights.

9. Recruitment communications and marketing

We contact you about applications, interviews, placements and enquiries you are actively pursuing. We may also contact you about relevant opportunities or recruitment services where we have a lawful basis and the relevant communication rules permit it. We distinguish necessary communications about an active process from promotional contact.

Where emails, texts or professional-network messages amount to direct marketing and consent is required, we obtain valid consent before sending them, unless a specific lawful exception applies. Providing a CV, having spoken to us previously, or making contact details public does not automatically provide marketing consent. Any reliance on an existing-customer exception must satisfy all its conditions.

For relevant marketing to UK corporate business contacts, we may rely on legitimate interests where electronic-marketing rules allow. Different rules apply to sole traders, some partnerships, personal addresses and recipients in other countries. Marketing calls are subject to applicable consent, preference-service and do-not-call requirements.

You have an absolute right to stop use of your personal information for direct marketing, including related profiling. Use the unsubscribe option provided, reply asking us to stop, or contact contact@greyring.com. No explanation is required.

We keep a limited suppression record where needed to honour your choice and prevent accidental recontact. A marketing opt-out does not prevent necessary communication about an active application, engagement, payment or legal matter.

10. Cookies and embedded services

We use cookies and similar technologies to operate the website and remember cookie choices. Under our consent-based approach, optional functionality, analytics and advertising technologies are enabled only after the relevant consent. You can accept optional cookies, reject them or choose categories in the banner, and change or withdraw your choice through the “Consent Preferences” control.

Our Cookie Policy and the cookie settings provide details of the technologies actually used, their providers, purposes and duration. Rejecting optional cookies does not stop you browsing vacancies or contacting us. Some optional embedded features may need separate consent; external services such as maps have their own privacy notices.

Visiting the website, submitting a CV or accepting the Website Terms is not consent to optional tracking or marketing. Browser controls may also help manage stored cookies, but they do not replace the choices offered on our website.

11. How long we keep information

We retain information only for a current, justified purpose. The period depends on the record and the obligations that apply; it is not an automatic lifetime registration on our database.

•         Recruitment profiles and CVs: we consider whether there is an active search or a realistic continuing recruitment relationship, the date of meaningful contact, the accuracy and relevance of the profile, your preferences and any objection. Information that is no longer needed is removed or anonymised. Sending an unanswered message does not by itself justify retaining a profile indefinitely.

•         Application, interview and reference records: we retain what is needed to complete the relevant process, meet applicable recruitment recordkeeping duties and deal with a reasonably foreseeable complaint or claim. We consider the relevant statutory periods and jurisdiction, and retain a limited evidence record where a full CV or sensitive attachment is no longer needed.

•         Engagement, client and financial records: we retain the relevant information for administration and applicable legal requirements. Company accounting records are generally kept for six years from the end of the last company financial year to which they relate, with longer retention where legally required. This does not mean every candidate CV is kept for six years.

•         Sensitive information and check documents: we retain them only for the specific check, adjustment or legal purpose and any applicable retention requirement. Where appropriate, we keep a limited record of a completed check instead of the underlying document.

•         Enquiries, technical logs and cookie records: we consider the time needed to resolve the enquiry, investigate or prevent security issues and demonstrate relevant preferences. Cookie lifetimes are shown in the Cookie Policy or settings.

•         Objections, complaints and legal holds: we retain the minimum information needed to honour your wishes, show how a complaint was handled or preserve relevant evidence for an identified legal matter. We review that need when the matter ends.

Deletion also needs to reach relevant systems and providers. Information in protected backups may remain until the scheduled backup cycle removes it; during that period it is protected from ordinary use, and a restoration must preserve applicable deletion instructions. Ask us for more specific retention information about your records.

12. How we protect information

We apply technical and organisational measures appropriate to the information and risk, including access restrictions, secure systems and confidentiality requirements. We limit access to people who need the information for their work and require appropriate safeguards from providers.

No system can be guaranteed completely secure. If you suspect misuse of information connected with Grey Ring, contact us promptly. We investigate personal-data incidents and notify affected individuals and regulators when the law requires. Nothing in this notice removes our legal responsibilities for security.

13. Technology and recruitment decisions

Our recruitment assessments involve human review. Software may help organise information and identify potentially relevant experience, skills, location, availability and role requirements. A recruiter assesses suitability and any recommendation to submit a candidate.

We do not make recruitment decisions that have legal or similarly significant effects on you based solely on automated processing. You can ask us to explain an assessment, correct inaccurate information or arrange human reconsideration. If we introduce materially different profiling or automated decision-making, we will provide the required information about its purpose, operation, likely effects and safeguards before using it. An employer may operate a separate assessment process explained in its own notice.

14. Your rights

Depending on the applicable law and the processing, you may have the right to:

•         Access your personal information and information about how it is used.

•         Correct inaccurate or incomplete information.

•         Request deletion where there is no overriding lawful reason to retain it.

•         Restrict processing in specified circumstances, including while an accuracy issue or objection is considered.

•         Receive information you provided in a portable format, or have it transferred where technically feasible, when processing is automated and based on consent or a contract with you.

•         Object on grounds relating to your particular situation where we rely on legitimate interests. We must stop unless we demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or processing is needed for legal claims.

•         Withdraw consent at any time where we rely on it, without affecting the lawfulness of earlier processing.

Your separate, unconditional right to object to direct marketing is explained in section 9. Rights are not all absolute. For example, a legal obligation, legal privilege or the rights of another person may limit what we can delete or disclose. We explain any refusal or restriction and how you can challenge it.

Contact us using section 1. Requests are normally free and answered without undue delay and within one calendar month. Where the law permits an extension because of complexity or the number of requests, we may take up to two further months and explain the reason within the applicable initial period. We request identity information only where reasonably needed and explain any lawful adjustment to the response deadline. A fee or refusal is used only where the law permits, with reasons.

15. If you do not provide information

You can browse public vacancies without submitting a CV. If you choose not to provide information needed to assess your application, contact you, arrange an engagement or complete a lawful mandatory check, we may be unable to progress that part of the service. We explain when a requirement comes from law or a contract and the consequences of not providing it. Optional marketing and cookie choices remain separate.

16. Complaints

You can complain about how we handle your personal information by email, phone, post or through your usual Grey Ring contact. We acknowledge a data-protection complaint within 30 days, make appropriate enquiries, keep you informed and explain the outcome without undue delay. We do not require a specific form or legal terminology.

You also have the right to complain to the Information Commissioner’s Office (ICO), the UK supervisory authority, through ico.org.uk/make-a-complaint/ or on 0303 123 1113. We welcome the opportunity to resolve concerns, but nothing here removes your right to approach a competent supervisory authority or seek a remedy through the courts. EEA complaint rights are explained in section 2.

17. Children and changes to this notice

Our services are aimed at professional recruitment and are not designed for children. If you believe a child has provided unnecessary personal information, contact us so we can assess the situation and take appropriate action. We do not treat age alone as removing anyone’s data-protection rights.

We review this notice when our practices or applicable requirements change. We show the latest revision date and bring material changes to your attention where required. We provide further information before using information for a new purpose and obtain fresh consent where necessary. Updating this notice does not itself authorise a new use of your information.