Privacy Policy

The controller responsible for your personal data is Recruitment Group International LTD, operating under the brand Bartesa:

• Legal name: Recruitment Group International LTD
• Registered address: 5 St. Philips Place, Birmingham B3 2PW
• Country of registration: United Kingdom
• Registration number: 13931947
• Email: careers@bartesa.co
• Phone: +44 20 0946 2246

For any question about this policy or your personal data, contact us via our contact page or at careers@bartesa.co.

Depending on how you interact with us, we process the following categories of data:

• Application details — your name, email address, phone number, country, time zone, availability, preferred language and, if you provide them, your LinkedIn profile and a note to our team.
• Your CV and any information you choose to include in it.
• Assessment answers and match score — your answers to the matching assessment, the position recommended to you and the match score calculated from your answers.
• Application status — where your application stands, for example new, in review, qualified, on the waiting list, hired or not selected.
• Referral attribution — if you arrived through a referral link, the code of that link and the recruiter it belongs to. Referral links themselves contain no personal information about you.
• Anonymous assessment statistics — which steps of the assessment were reached, linked to a random identifier for your browser tab, not to your name or contact details.
• Contact form messages — your name, email address, subject and message, plus a one-way hashed (irreversibly scrambled) version of your IP address that we use only to limit spam.
• Error logs — when something goes wrong, the error message, the page where it happened, your browser's user agent and, if you are signed in, your user ID.
• For team members: account and profile details, sign-in and security settings, tasks, messages, targets, performance, earnings the payment details needed to pay you, and a photo of your identity document, which is used only to check who is being paid.

We do not ask for sensitive data, such as health information, religious beliefs or political opinions, and ask you not to include it in your CV. If you tell us about adjustments you need for the application process, we use that information only to provide them.

We use personal data only for the purposes below. Where data protection laws such as the EU or UK General Data Protection Regulation (GDPR) apply, each purpose relies on the legal basis shown:

• Matching you with a position, assessing your application, arranging next steps and keeping you informed — to take steps at your request before entering into an agreement, and our legitimate interest in recruiting suitable people efficiently and fairly.
• Onboarding, training, managing and paying team members — to perform the agreement with you and to comply with legal obligations.
• Attributing referrals and calculating recruiter bonuses — to perform our agreements with recruiters, and our legitimate interest in rewarding referrals accurately.
• Answering messages sent through the contact form and limiting spam — our legitimate interest in responding to enquiries and protecting the form from abuse.
• Keeping the website and portal secure, fixing errors and understanding in aggregate how the website is used — our legitimate interest in running a secure, reliable service.
• Complying with the law and establishing, exercising or defending legal claims — legal obligations and our legitimate interests.

Where the law of your country requires your consent for a particular use, we ask for it, and you can withdraw it at any time without affecting processing that took place before. You can object to processing based on our legitimate interests at any time (see "Your rights").

Providing your contact details and CV is necessary for us to consider your application. Everything else, such as your LinkedIn profile or a note to our team, is optional.

The matching assessment uses your answers to recommend a position and calculate a match score. This recommendation is advisory only. It helps our team, but it does not decide whether you are shortlisted or hired.

A member of our team reviews every application, and no decision with legal or similarly significant effects on you is made solely by automated means. If you believe the recommendation does not reflect your skills, tell us via our contact page — we will take that into account and can explain how the recommendation was reached.

• Our hiring team — the managers and supervisors involved in recruiting see your full application, including your CV.
• Recruiters — if you applied through a referral link, the recruiter who shared it sees only masked information about you: your initials, country and application status. They do not see your contact details, CV or assessment answers.
• Service providers — companies that host and operate our systems on our behalf (see "Service providers").
• Authorities, courts or advisers — when the law requires it, or when needed to establish, exercise or defend legal claims.
• A successor — if our business, or part of it, is reorganised or transferred, under the same protections as described in this policy.

We never sell your personal data or use it for advertising.

We use carefully selected providers that process data on our behalf, under our instructions and under contracts that require them to protect it. Currently these are:

• Vercel — hosting and delivery of the website and portal, and cookie-less web analytics. Vercel is based in the USA and serves the website through data centres in the USA and a global edge network, including in the EU.
• Supabase — database, sign-in and file storage, hosted in the European Union (Frankfurt, Germany).
• S3-compatible object storage — where enabled, CVs are stored with an S3-compatible provider, currently Scaleway in France.
• Email delivery — Resend or an SMTP email provider, used to send confirmations, status updates and replies.

Providers may change over time. We will update this list when they do, and you can ask us for the current list at any time.

We are a remote company: our team members and some of our providers are located in different countries, so your data may be accessed from or transferred to countries other than your own, including countries whose data protection laws differ from yours.

When we transfer personal data from the European Economic Area, the United Kingdom or Switzerland to a country that is not recognised as providing an adequate level of protection, we use appropriate safeguards, such as the European Commission's Standard Contractual Clauses (with the UK Addendum where relevant) or, where available, a recipient's certification under a recognised framework. Team members who access personal data do so under confidentiality obligations and role-based access controls, and only to the extent needed for their work.

You can ask us for more information about these safeguards, or for a copy of them, via our contact page.

• Applications — including your CV, assessment answers and match score — are deleted automatically 12 months after the application date. Deletion runs nightly.
• If you are hired, your application becomes part of your record with us. It is kept for as long as you work with us and afterwards for as long as the law requires (for example for tax and accounting) or as needed for legal claims.
• Referral information in your browser expires after 30 days, or earlier once you apply. The referral recorded with an application is deleted together with the application.
• Contact form messages are deleted automatically after 12 months. Error logs are deleted 90 days after the problem is fixed.
• Team account data is kept for the duration of the working relationship and then for as long as required by law.

You can ask us to delete your data earlier at any time via our contact page. When we receive a valid deletion request, an administrator permanently deletes your application, including your CV, unless we are legally required to keep certain information. Anonymous statistics that cannot identify you may be kept longer.

We protect personal data with technical and organisational measures appropriate to the risk, including:

• Encryption in transit (HTTPS) and encryption at rest by our hosting and storage providers.
• Role-based access: only people who need your data for their work can see it, and recruiters only see masked applicant data.
• Private storage for CVs, which are never publicly accessible.
• Optional two-step sign-in for team accounts.
• Error monitoring, so that problems can be detected and fixed quickly.

No system is completely secure. If a personal data breach is likely to put your rights at risk, we will inform you and the competent authorities where the law requires it.

Depending on the law that applies to you, you have the right to:

• Access — obtain confirmation of whether we process your data and a copy of it.
• Rectification — have inaccurate or incomplete data corrected.
• Erasure — ask us to delete your data.
• Restriction — ask us to limit how we use your data, for example while we check its accuracy.
• Portability — receive the data you gave us in a structured, machine-readable format.
• Objection — object to processing based on our legitimate interests.
• Human review — not to be subject to a decision based solely on automated processing that significantly affects you, and to obtain human intervention and contest such a decision. As explained above, we do not make such decisions.
• Withdraw consent — at any time, where we rely on your consent.

To exercise your rights, use our contact page or write to careers@bartesa.co. We may ask you to confirm your identity. We respond within one month; where the law allows it and a request is complex, we may extend this period and will tell you why. Requests are free of charge unless they are manifestly unfounded or excessive.

You also have the right to lodge a complaint with a data protection supervisory authority — in particular in the country where you live or work, or where you believe your rights were infringed. We would appreciate the chance to address your concern first.

We use only essential cookies (for example to keep team members signed in and to remember your language), browser storage for referral credit and the assessment, and web analytics that do not use cookies. We use no advertising or tracking cookies. Details are in our Cookie Notice.

You must be at least 18 years old to apply. We do not knowingly collect personal data from anyone under 18; if we learn that we have, we delete it.

Employment or contractor agreements are concluded individually with each person and are governed by the laws of the country where that person lives and works, including its tax, social security and labour rules. We process team members' data as needed to perform that agreement and to meet the obligations of that law, and we may give you additional information about this when you join.

When time tracking is turned on, team members clock in and out in the portal. We record the start and end of each working session (set by our server), periods when you were away from the computer (no keyboard or mouse activity for a set number of minutes) and how away time was detected. We never record what you type, which apps or websites you use, or your screen. Your supervisor and administrators can see these times; you can see your own timesheet in the portal. We use them to organise work and for activity statistics, never to calculate your fee, as set out in your agreement, and keep them for as long as needed for that and for your country's record-keeping rules.

We may update this policy when our processes, providers or legal requirements change. The date at the top shows the latest version. If we make significant changes, we will highlight them on this page and, where appropriate, inform the people concerned.