Organisation Elva Talent Ltd
Effective date September 2026
Review At least annually and when material changes occur
1. Purpose and scope
This internal policy sets the minimum standards Elva Talent uses to protect candidate, client and business
information. It applies to information handled through Microsoft 365 / Office, LinkedIn, LinkedIn Recruiter,
SourceWhale, company devices and any approved future systems.
2. Core principles
Process personal information lawfully, fairly and transparently.
Collect and use only information reasonably necessary for legitimate recruitment and business purposes.
Keep information accurate where reasonably possible and avoid retaining it longer than necessary.
Protect confidentiality, integrity and availability through proportionate security measures.
Respect candidate representation preferences and do not ordinarily send identifiable CVs to a client for a
specific role before discussing the opportunity and obtaining agreement.
3. Access and authentication
Use unique strong passwords and multi-factor authentication wherever supported.
Do not share passwords or authentication codes.
Restrict access to systems and information to people who genuinely require it.
Remove or change access promptly when a device, user or supplier no longer requires it.
4. Devices and remote working
Company information should be accessed only on appropriately secured devices.
Devices should use screen locks, current operating-system updates and appropriate anti-malware/security protections.
Take reasonable care when working in public places to prevent unauthorised viewing or disclosure.
Lost or stolen devices containing or capable of accessing business data must be treated as a security
incident.
5. Email, CVs and sharing
Check recipients before sending CVs, salary information or other personal data.
Share only the information reasonably necessary for the recruitment purpose.
Use approved business systems rather than uncontrolled personal storage where practicable.
Do not download or retain unnecessary local copies of candidate data.
Exercise particular care when sending information internationally.
6. SourceWhale and call recordings
SourceWhale is used as a recruitment CRM and communications platform and may record calls. Recording
information must be reflected in candidate/client privacy information and callers should be notified where
required. Access to recordings should be limited and recordings should be deleted when no longer reasonably necessary.
7. Data retention and deletion
Candidate and client information will be retained only for as long as reasonably necessary for recruitment,
relationship management, legal, regulatory, contractual or legitimate business purposes. Records should be periodically reviewed and deleted or anonymised when no longer required.
8. Personal data breaches
Immediately contain the incident where possible, for example by changing credentials, recalling an email or disabling access.
Record what happened, the information involved, affected individuals and likely consequences.
Assess whether notification to the ICO and/or affected individuals is legally required and meet applicable
time limits.
Preserve appropriate evidence and take steps to prevent recurrence.
9. Suppliers and international transfers
Before adopting material new systems that process personal information, Elva Talent should consider the
provider's privacy and security arrangements, processing terms and international data-transfer position.
10. Review and responsibility
The Director is responsible for maintaining proportionate information-security and data-protection arrangements.
This policy will be reviewed at least annually and following material incidents, system changes or legal
developments.