PH TALENTS LTD
Company No. 17383205
phtalents.io

Privacy Policy

PH TALENTS LTD · Company No. 17383205 · phtalents.io

1. Who we are

1.1 PH TALENTS LTD ("PH Talents", "we", "us", "our") is a private company limited by shares, incorporated in England and Wales with company number 17383205. Our registered office is at 71–75 Shelton Street, Covent Garden, London WC2H 9JQ, United Kingdom. Our website is https://phtalents.io.

1.2 PH Talents operates an employment agency (an introduction service) within the meaning of the Employment Agencies Act 1973. We introduce verified independent professionals located in the Philippines ("Talent") to business clients ("Clients"). Clients engage Talent directly as independent contractors and pay Talent directly. We never employ Talent, never supervise Talent's work, and are never in the payment chain between a Client and a Talent. We never charge any fee to a work-seeker.

1.3 For the personal data described in this Policy, PH TALENTS LTD is a controller under the UK General Data Protection Regulation ("UK GDPR") and the Data Protection Act 2018 ("DPA 2018"). We are registered with the Information Commissioner's Office ("ICO") under registration number Our ICO registration is in progress; this page will show the registration number once it is issued.

1.4 Because our Talent are located in the Philippines, the Philippine Data Privacy Act of 2012 (Republic Act No. 10173, the "PH DPA") is also relevant to some of our processing. Clause 12 explains the rights of Philippine residents under the PH DPA.

1.5 You can contact us about anything in this Policy by email at [email protected] or by post at 71–75 Shelton Street, Covent Garden, London WC2H 9JQ, United Kingdom. We have not appointed a statutory Data Protection Officer. Privacy queries go to [email protected].

2. Definitions

2.1 In this Policy:

2.2 "Client" means a business (and, where the context requires, its individual representatives) that uses or enquires about our introduction services.

2.3 "Client Contact" means an individual acting for a Client or prospective Client, such as a director, hiring manager or accounts contact.

2.4 "Controller", "processor", "personal data", "special category data" and "processing" have the meanings given in the UK GDPR.

2.5 "Criminal Offence Data" means personal data relating to criminal convictions and offences or related security measures, within Article 10 UK GDPR and section 11(2) DPA 2018, and includes the outcomes of Philippine National Bureau of Investigation ("NBI") clearance checks.

2.6 "Referee" means an individual named by a Talent as a professional reference.

2.7 "Talent" means an independent professional located in the Philippines who registers with us, or is in the process of registering with us, to be introduced to Clients. "Registering Talent" means a person whose application and verification is in progress; "Registered Talent" means a person whose verification is complete and who is available for introduction.

2.8 "Verification Partners" means the third parties we use to verify Talent, currently Didit (identity verification) and Veremark (reference checking), together with the Philippine government portals we consult (NBI, the Professional Regulation Commission ("PRC") and the Technical Education and Skills Development Authority ("TESDA")).

2.9 "you" means any person whose personal data we process as described in this Policy.

3. Who this Policy covers

3.1 This Policy applies to:

Website visitors — anyone who visits https://phtalents.io;
Registering and Registered Talent — independent professionals in the Philippines who apply to join, or have joined, our verified bench;
Client Contacts — individuals at Clients and prospective Clients; and
Referees — individuals named by Talent as professional references.

3.2 This Policy does not cover processing carried out by a Client after a Talent has been introduced to, or engaged by, that Client. Once a Client receives Talent personal data from us it is a separate, independent controller of that data and must comply with its own data protection obligations, which we require it to accept by contract (see clause 7.2).

4. What personal data we collect

4.1 Website visitors. We collect: technical data generated when you visit the website (IP address, browser type and version, device type, pages viewed, timestamps) to the extent captured in server logs; and any information you choose to send us through a contact form or by email (name, email address, company, message content).

4.2 Registering and Registered Talent. We collect:

Identity data — name, date of birth, nationality, photographs and government-issued identity document data captured through our identity Verification Partner (Didit), including the outcome of liveness and document-authenticity checks;
Contact data — email address, telephone number, address, and messaging or video-call handles used for interviews;
Professional data — work history, skills, qualifications, portfolio materials, professional licence and certification details (including PRC licence status and TESDA certification status), expected pay range, and availability;
Verification outcome data — the results of our checks against Philippine government portals (NBI, PRC, TESDA), the outcome of reference checks conducted via Veremark, and our own verification summaries and assessment notes;
Criminal Offence Data — the outcome of NBI clearance checks. This is treated with the additional safeguards described in clause 6;
Account and usage data — login credentials (stored in hashed form), account activity, and communications between the Talent and us; and
Engagement data — records of which Clients a Talent has been introduced to and the status and outcome of each introduction.

4.3 Client Contacts. We collect: name, job title, business email address and telephone number; the organisation's requirements for Talent; records of introductions made, proposals sent and meetings held; contract and invoicing records (invoices are addressed to the Client business, but may contain the names of individual contacts); and communications with us.

4.4 Referees. We collect: name, job title, organisation, business contact details, the referee's relationship to the Talent, and the content of the reference the referee provides. Referees' contact details are given to us by the Talent, with the Talent's confirmation that the referee may be contacted.

4.5 We do not intentionally collect special category data (such as health, religious or biometric data used to uniquely identify a person) except to the extent that identity verification with Didit involves biometric processing (for example, facial matching between a selfie and an identity document).

4.6 We never ask Talent, Clients or Referees to send us payment card numbers, bank passwords or similar credentials. Talent are paid directly by Clients; we do not process Talent payment details for payroll purposes and we operate no payroll for Talent.

5. Where we get personal data from

5.1 We collect personal data from the following sources:

Directly from you — when you register, complete your profile, fill in a form, or communicate with us;
Philippine government portals — NBI (criminal record clearance), PRC (professional licence status) and TESDA (technical certification status), consulted with the Talent's prior consent and, where the portal requires it, using documents or reference numbers supplied by the Talent;
Referees — who provide references about Talent, contacted only after the Talent has consented to the reference check;
Verification Partners — Didit (identity verification results) and Veremark (reference check results); and
Clients — who may give us feedback on introductions and engagements, which can include personal data about Talent.

5.2 Where we receive personal data about you from someone else (for example, a Talent naming you as a Referee), this Policy is the information notice we rely on under Article 14 UK GDPR, and we will bring it to your attention when we first contact you.

6. Why we process personal data and our lawful bases

6.1 The table below sets out each purpose for which we process personal data, the people affected, and our lawful basis under Article 6 UK GDPR. Where the processing involves Criminal Offence Data, clause 6.3 applies in addition.

Purpose	Whose data	Data categories	Lawful basis (Article 6 UK GDPR)
Creating and administering a Talent account; operating the registration process	Registering and Registered Talent	Identity, contact, professional, account data	Article 6(1)(b) — performance of a contract with the Talent (our terms for work-seekers), or steps taken at the Talent's request before entering that contract
Verifying Talent identity via Didit	Registering Talent	Identity data, identity documents, verification outcomes	Article 6(1)(b) — pre-contract steps at the Talent's request; and Article 6(1)(f) — our legitimate interest in operating a verified introduction service and complying with the Conduct of Employment Agencies and Employment Businesses Regulations 2003 (regulation 19 checks).
Checking Talent against Philippine government portals: NBI (criminal record clearance), PRC (licence status), TESDA (certification status)	Registering and Registered Talent	Identity data; verification outcome data; Criminal Offence Data (NBI outcomes)	Article 6(1)(b) and 6(1)(f) as above. For NBI outcomes (Criminal Offence Data), the additional condition in clause 6.3 applies
Conducting reference checks via Veremark	Registered Talent; Referees	Talent professional data; Referee identity, contact and reference content	Article 6(1)(b) (Talent — pre-contract/contract steps) and Article 6(1)(f) (Referees — our legitimate interest in verifying work history, with the Talent's prior consent to the check)
Sharing Talent profiles and verification summaries with prospective Clients for introduction purposes	Registered Talent	Professional data; verification outcome data in summary form; limited identity data	Article 6(1)(b) — this sharing is the core service the Talent has contracted with us to receive; and Article 6(1)(f) — our legitimate interest in making introductions. Talent expressly acknowledge profile sharing when accepting the Talent Registration Terms in the portal. Verification summaries shown to Clients state check outcomes (for example, that an NBI clearance was verified); clause 6.3 applies to that disclosure.
Responding to enquiries; negotiating and performing contracts with Clients; invoicing Clients	Client Contacts	Contact data; contract and invoicing records; communications	Article 6(1)(b) where the Client Contact is a sole trader; otherwise Article 6(1)(f) — our legitimate interest in dealing with our business Clients through their representatives
Sending service communications (introduction updates, verification status, account notices, invoices, changes to terms or this Policy)	Talent; Client Contacts	Contact data; account data	Article 6(1)(b) — necessary to perform our contracts; and Article 6(1)(f) — our legitimate interest in administering the service
Direct marketing (news about the service, newly available Talent categories, offers)	Talent; Client Contacts; website visitors who sign up	Contact data; marketing preferences	Article 6(1)(a) — consent, which you may withdraw at any time; or, for existing Clients only and only for similar services, Article 6(1)(f) legitimate interests within the "soft opt-in" under the Privacy and Electronic Communications Regulations 2003.
Keeping statutory records required of an employment agency (Conduct Regulations regulation 29)	Talent; Client Contacts	Records of applications, introductions, terms and enquiries	Article 6(1)(c) — compliance with a legal obligation
Establishing, exercising or defending legal claims; responding to regulators	All categories	Any relevant categories	Article 6(1)(f) — our legitimate interest in protecting our legal position; Article 6(1)(c) where a legal obligation compels disclosure
Website operation, security, logging and abuse prevention	Website visitors; all account holders	Technical data; account data	Article 6(1)(f) — our legitimate interest in running a secure service

6.2 Where we rely on legitimate interests, we have considered and balanced our interests against your rights and freedoms, and we will provide details of the relevant assessment on request.

6.3 Criminal Offence Data (NBI clearance outcomes). NBI clearance results are Criminal Offence Data under Article 10 UK GDPR. We may only process this data under an Article 6 lawful basis and a condition in Schedule 1 to the DPA 2018, and we must maintain an Appropriate Policy Document for most Schedule 1 conditions. We record the outcome of the NBI check (clear / not clear / requires review) rather than retaining underlying certificate copies wherever practicable, and Clients receive a verification summary only, never a copy of any NBI certificate.

6.4 We do not use automated decision-making that produces legal or similarly significant effects about you without human involvement. Verification outcomes are reviewed by a person before a Talent is accepted, rejected or introduced.

7. Who we share personal data with

7.1 We share personal data with the following categories of recipient, and only to the extent described:

Prospective Clients — Registered Talent profiles and verification summaries are shared with prospective Clients so that the Client can decide whether to interview and engage the Talent. Clients receive verification summaries only; they never receive raw copies of identity documents, NBI certificates or reference transcripts;
Verification Partners — Didit (identity verification) and Veremark (reference checking) process Talent and Referee data to deliver their services to us.;
Hosting and IT providers — providers of hosting, email, database, backup and support services process data on our behalf as processors under contracts containing Article 28(3) UK GDPR terms. Our current providers include IONOS SE (server hosting), Cloudflare, Inc. (network security, DNS and content delivery) and MailerSend, Inc. (transactional email delivery);
Professional advisers — solicitors, accountants, auditors and insurers, where reasonably necessary;
Payment providers — Clients currently pay us by bank transfer against invoice; if we later take card or Direct Debit payments via Stripe, Stripe will process Client Contact payment data and this Policy will be updated first;
Authorities and regulators — the Employment Agency Standards Inspectorate, the ICO, HMRC, courts and other bodies where the law requires or permits disclosure; and
A buyer or investor — if we sell, merge or reorganise the business, personal data may be disclosed to the counterparty and its advisers under confidentiality obligations, and transferred as part of the transaction.

7.2 Sharing with Clients is controller-to-controller. When we share Talent personal data with a prospective Client, the Client receives it as an independent controller. Before receiving Talent personal data, each Client must enter into a contract with us containing data protection obligations, including: purpose limitation (introduction and engagement evaluation only), confidentiality, security, deletion of data relating to Talent it does not engage, and — where the Client is outside the UK — an appropriate international transfer mechanism (see clause 8).

7.3 We do not sell personal data, and we do not share personal data with third parties for their own marketing.

8. International transfers

8.1 Our business is international by design, and personal data crosses borders in two main directions.

8.2 Philippines to the UK. Talent are located in the Philippines and submit their personal data to us in the United Kingdom. Talent consent to this transfer as part of registration, and the PH DPA continues to apply to the collection of their data in the Philippines.

8.3 UK to Client countries. When we share Talent personal data with a Client outside the UK, that is a "restricted transfer" under the UK GDPR unless an exception applies. Our transfer mechanisms are:

Adequacy — where the Client is in a country covered by UK adequacy regulations (for example, the European Economic Area under the current adequacy arrangements), no further safeguard is needed;
IDTA or UK Addendum — where the Client is in a country without UK adequacy, we put in place the ICO's International Data Transfer Agreement ("IDTA") or the UK Addendum to the EU Standard Contractual Clauses, incorporated into or annexed to our Client contract, supported by a transfer risk assessment; and
Exceptions — in limited cases we may rely on an Article 49 UK GDPR derogation, but we treat this as a fallback, not a default.

8.4 UK to the Philippines. Where we send Talent personal data back to recipients in the Philippines (including to the Talent's own portal account, to Verification Partners' Philippine operations, or otherwise), the Philippines is not covered by UK adequacy regulations, so we use the IDTA or UK Addendum plus a transfer risk assessment where the recipient is a third party.

8.5 Details of the safeguard applying to any specific transfer are available on request via [email protected].

9. How long we keep personal data

9.1 We keep personal data only as long as needed for the purposes in clause 6, subject to legal minimums. As an employment agency we must keep certain records for at least one year under regulation 29 of the Conduct of Employment Agencies and Employment Businesses Regulations 2003, and for at least one year after we last provided work-finding services to the person concerned.

9.2 Our default retention periods are set out below. All periods are working defaults and are marked for confirmation.

Data	Retention period	Reason
Talent profile, verification outcome data and introduction records (Registered Talent)	Duration of registration plus 6 years from the end of the calendar year in which we last provided work-finding services	Regulation 29 minimum (1 year from creation and from last work-finding service); limitation period for contract claims
NBI clearance outcomes (Criminal Offence Data)	Outcome flag retained with the verification record; any underlying certificate copy deleted within 30 days of verification decision	Data minimisation for Article 10 data
Unsuccessful or withdrawn Talent applications	12 months from the decision or withdrawal	Regulation 29; responding to queries and complaints
Reference check content (Veremark) and Referee details	Same period as the related Talent verification record	Evidence of the verification performed
Client contracts, introduction records and correspondence	6 years from the end of the contract	Limitation period for contract claims; regulation 29
Invoices and accounting records	6 years from the end of the financial year they relate to	Companies Act 2006 and HMRC requirements
Marketing consents and suppression records	While consent is active; suppression entries kept indefinitely so we do not contact you again	Evidencing and honouring your choices
Website server logs	12 months	Security and abuse investigation
Email correspondence not falling into a category above	3 years from the end of the exchange	General administration

9.3 When a retention period ends we delete the data or irreversibly anonymise it. Backup copies are overwritten on the backup cycle. Backup copies are overwritten in rotation.

10. Security

10.1 We apply technical and organisational measures appropriate to the risk, including encryption of data in transit, hashed storage of passwords, two-factor authentication on portal accounts, role-based access so that verification records are visible only to those who need them, and contracts imposing security obligations on our processors.

10.2 No system is perfectly secure. If a personal data breach occurs that is likely to result in a risk to your rights and freedoms, we will notify the ICO within 72 hours of becoming aware of it and, where the risk is high, we will notify you without undue delay. Where the PH DPA's breach notification rules apply, we will also notify the Philippine National Privacy Commission and affected data subjects within the periods that law requires.

11. Your rights under the UK GDPR

11.1 You have the following rights, subject to the conditions and exemptions in the UK GDPR and DPA 2018:

Access — to obtain a copy of your personal data and information about our processing;
Rectification — to have inaccurate data corrected and incomplete data completed;
Erasure — to have your data deleted in certain circumstances (for example, where it is no longer needed, or you withdraw consent and no other basis applies);
Restriction — to have processing restricted in certain circumstances (for example, while accuracy is contested);
Portability — to receive data you provided to us, processed by automated means under contract or consent, in a structured, commonly used, machine-readable format;
Objection — to object to processing based on legitimate interests, and to object at any time to direct marketing, in which case we will stop marketing to you; and
Consent withdrawal — where processing is based on consent, to withdraw it at any time without affecting processing already carried out.

11.2 To exercise any right, email [email protected] with "Data rights request" in the subject line, or write to us at 71–75 Shelton Street, Covent Garden, London WC2H 9JQ, United Kingdom. We may ask for information to verify your identity. We will respond within one month, extendable by two further months for complex or numerous requests, in which case we will tell you within the first month. Requests are free unless manifestly unfounded or excessive.

11.3 If a Talent asks us to erase data that a prospective Client has already received, we will pass the request to that Client, but the Client is an independent controller and the Talent may also need to contact the Client directly. Our Client contracts require Clients to delete data relating to Talent they do not engage.

11.4 Complaints. You can complain to the UK supervisory authority, the Information Commissioner's Office: ico.org.uk, telephone 0303 123 1113, or Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF. We would appreciate the chance to address your concern first, so please consider contacting us before the ICO, but you are not required to.

12. Rights of Philippine residents under the Data Privacy Act of 2012

12.1 We acknowledge that Talent and other individuals in the Philippines have rights under the PH DPA in respect of processing within that Act's scope, including the rights to be informed, to object, to access, to rectification, to erasure or blocking, to damages, and to data portability, together with the right to lodge a complaint with the Philippine National Privacy Commission ("NPC") — privacy.gov.ph.

12.2 Philippine residents may exercise these rights through the same contact route as clause 11.2 ([email protected]). We will handle the request under whichever of the UK GDPR and the PH DPA gives the stronger protection on the facts.

13. Cookies

13.1 Our website currently uses essential cookies only: cookies strictly necessary to operate the site and the portal, such as session cookies that keep you logged in and security cookies that protect forms against cross-site request forgery. These do not require consent under the Privacy and Electronic Communications Regulations 2003.

13.2 We do not currently use analytics, advertising or other non-essential cookies, and we do not use third-party tracking. If that changes, we will update this Policy and introduce a consent mechanism before any non-essential cookies are set. Our public site sets only strictly necessary cookies (including the Cloudflare security cookie __cf_bm, which protects the site from malicious traffic and lasts up to 30 minutes). Our portals use browser session storage for sign-in, which is not a tracking technology..]

14. Children

14.1 Our services are for businesses and working professionals. We do not knowingly collect personal data from anyone under 18, and Talent must confirm during registration that they are at least 18. If you believe we hold data about a person under 18, contact [email protected] and we will delete it.

15. Changes to this Policy

15.1 We may update this Policy from time to time. The current version will always be available at https://phtalents.io, with its version number and date. For material changes affecting Registered Talent or active Clients, we will give notice by email before the change takes effect.

15.2 This Policy is governed by the law of England and Wales, without affecting any mandatory protections you have under the PH DPA or other applicable local law.

16. Contact

16.1 PH TALENTS LTD, company number 17383205, registered office 71–75 Shelton Street, Covent Garden, London WC2H 9JQ, United Kingdom.

16.2 Email: [email protected] · Website: https://phtalents.io · ICO registration: Our ICO registration is in progress; this page will show the registration number once it is issued.

Version 1.0 · 13 August 2026 · Prepared for solicitor review — not yet published or in use.

PH TALENTS LTD · Company No. 17383205 · phtalents.io · Version 1.0 · 14 August 2026