Legal
Privacy policy
Last updated
This policy explains what we do with personal information, and the rights you have over it. It covers this website, our enquiry and download forms, our newsletter, and applications made through EA Talent Hub.
Who is responsible for your information
Hiraya Talent is a trade name of Hiraya Recruitment and Staffing LLC, a Wyoming limited liability company. The company decides how the information described here is used. Under UK and EU law it is the controller, and under California law it is the business.
Hiraya Talent is the remote-staffing brand of EA Recruitment Group. Applications are handled on the group's platform, EA Talent Hub. The section on applicants and professionals explains what that means in practice.
What we collect, and where it comes from
Most of what we hold, you gave us. It falls into these groups.
- Enquiry form. Your name, your company, your email address, the role you need, and the message you write.
- Guide downloads. Your name, work email, company and role, plus a record of which guide you asked for and when.
- Newsletter. Your email address, the date you subscribed, and a record of the consent you gave.
- Applications. Contact details, work history, the role you applied for, your location, and your right to work where you live.
- Interview records. The notes a recruiter writes during your live identity interview, and the written summary that follows it.
- Engagement records. If we engage you as a contractor, your agreement, the details we need to pay you, and any tax or registration details your country requires.
- Site use. Pages viewed, the site you arrived from, and an approximate country. This is collected only if you accept analytics.
- Technical records. Short-lived server logs kept by our hosting provider, including the IP address a request came from.
A small amount reaches us another way. It may come from a professional profile you have published, from someone who referred you, or from a client contact who names a colleague.
We do not ask for special category information, such as health, race, religion or trade union membership. Please do not send it. If it arrives in a message or a document, we remove it.
Why we use it, and our lawful basis
Under UK and EU GDPR we need a lawful basis for each purpose. Where the basis is legitimate interests, the interest is named in full.
| Purpose | What we use | Lawful basis |
|---|---|---|
| Answering an enquiry | Enquiry form fields | Legitimate interests: running a staffing business, and replying to people who write to us about work. |
| Sending the guide you asked for | Name, work email, company, role | Taking steps you asked for before any agreement, and your consent. |
| Writing to you after a download | Work email, company, role | Consent where the law requires it. Otherwise legitimate interests: offering a service to a company that asked for our material. |
| Running the newsletter | Email address | Consent, which you can withdraw in any message we send. |
| Reviewing an application | Application, recruiter notes, interview summary | Legitimate interests: matching people to the work they applied for, and running a fair, recorded process. |
| Putting a shortlist to a client | Profile, recruiter notes, interview summary | Legitimate interests: placing people in the roles they asked to be considered for. We tell you before we send it. |
| Engaging and paying a professional | Agreement, payment details, tax details | Performance of the contract between us. |
| Keeping financial and tax records | Payment records | Legal obligation. |
| Keeping the site and our records secure | Server logs, access records | Legitimate interests: preventing fraud, abuse and unauthorized access. |
| Measuring which pages are read | Page views, approximate country | Consent, given through the analytics panel. |
| Answering a rights request or a legal claim | Whatever the request or claim concerns | Legal obligation, and legitimate interests: defending a claim. |
Where we rely on legitimate interests, we have weighed them against your rights first. You can object at any time, and the sections on your rights explain how.
How long we keep it
We set a period for each category rather than keeping things by default. When a period ends, the record is deleted or stripped of anything that identifies you.
| Category | How long | Why |
|---|---|---|
| Enquiry that does not lead to work | 24 months from your last message | So we know you if you write again, and can show what was said. |
| Client and engagement records | 7 years after the engagement ends | Contract and tax record keeping. |
| Applicant records, including recruiter notes and interview summaries | 24 months from your last activity | Roles come round again. At the end we delete the record or ask you first. |
| Payment and tax records for a professional | 7 years after the final payment | Required by tax law. |
| Newsletter subscription | Until you unsubscribe | Consent lasts until you withdraw it. |
| Record that you unsubscribed or objected | Kept until you ask us to remove it | So we do not write to you again by mistake. |
| Guide download record | 24 months from the download | To answer questions about what we sent you. |
| Server logs | 30 days | Security and fault finding. |
| Analytics | Held in aggregate by the provider | There is no record tied to you to keep. |
Who we share it with
Clients
If we put you forward for a role, the client sees your profile, the recruiter notes and the interview summary. We name the client to you before we send anything. If you would rather we did not, say so and we stop.
Clients receive a shortlist, not our whole record of you. They are bound by their agreement with us to use it for the role in question.
The group's platform
Applications are held on EA Talent Hub, the platform run by EA Recruitment Group. Recruiters across the group's desks use it to run interviews and build shortlists. Clients never see EA Talent Hub. Your account owner sends the shortlist.
Companies that work for us
These act on our instructions under a written agreement, and cannot use your information for their own purposes.
- Our hosting and site analytics provider, Vercel, in the United States.
- Our email delivery provider, Resend, in the United States.
- Stripe and Wise, which move money to a professional we engage.
- Accountants, auditors and lawyers, where they need the information to advise us.
The list of companies that process information for us changes from time to time. Ask by email and we will send you the current one.
How a form submission travels
When you send a form, the page posts it to our own server. That server passes it to our internal operating system over an encrypted webhook, and emails a copy to the account owner who will reply. Nothing is posted to a third-party form service.
Other disclosures
- To a regulator, a court or law enforcement, where the law requires it.
- To a buyer, if the business or part of it is ever sold. You would be told first.
We do not sell personal information. We do not share it for cross-context behavioral advertising, and we never have.
Sending information across borders
The company is registered in the United States, and our recruiters work from Manila. Our providers are mostly in the United States and the European Union. So your information may be handled outside the country you live in.
Some information leaves the UK or the European Economic Area. Where it does, we rely on the European Commission's standard contractual clauses. The UK addendum applies where UK GDPR does.
We also check that a provider's security matches what the agreement requires. Ask by email for the safeguards that cover a particular transfer.
Your rights in the UK and the EU
If UK or EU GDPR applies to you, you have the right to:
- ask what we hold about you, and get a copy of it
- have anything wrong corrected, or anything incomplete completed
- have it deleted, where there is no good reason for us to keep it
- have our use of it restricted while a question about it is settled
- object to our use of it where we rely on legitimate interests
- object to direct marketing at any time, which we always honor
- receive the information you gave us in a portable form, or have it sent onward
- withdraw consent at any time, where consent is the basis we rely on
Withdrawing consent does not undo what we did lawfully before you withdrew it. It stops us from going further.
Your rights in California
If you live in California, the CCPA as amended by the CPRA gives you the right to:
- know what personal information we collect, use and disclose, and why
- get a copy of the specific pieces we hold about you
- have inaccurate personal information corrected
- have personal information deleted, subject to the exceptions in the law
- opt out of the sale or sharing of personal information
- limit the use of sensitive personal information
- be treated no differently for using any of these rights
We do not sell personal information, and we do not share it for cross-context behavioral advertising. There is therefore nothing to opt out of, and no financial incentive attached to any right on this page.
We do not use sensitive personal information to infer anything about you. You may use an authorized agent, and we will ask for proof that you gave them permission.
How to exercise a right
Email hello@hirayatalent.com and say which right you want to use. Put "privacy request" in the subject line so it reaches the right person.
We may ask for something that shows the request is yours. We ask for as little as possible, and we do not keep it once the request is closed.
Under UK and EU law we answer within one month. A complex request can take up to two months more, and we tell you why inside the first month.
Under California law we confirm receipt within 10 business days and answer within 45 days. If we need longer we tell you, and we take no more than 90 days in total.
You do not pay to use a right. If a request is repetitive or excessive we may say so, and explain what we can do instead.
Complaints
If you think we have handled your information badly, tell us first. We would rather fix it than have you chase it.
You can also complain to a regulator. In the UK that is the Information Commissioner's Office. In the EU it is the supervisory authority where you live, work, or where the problem happened.
California residents may contact the California Privacy Protection Agency or the California Attorney General.
Automated decisions
No decision about a person is made by automated means alone. A recruiter reads every application, and a person decides every shortlist.
Search and sorting tools help us find and order applications. They do not accept or reject anyone, and we do not profile you for advertising.
Cookies and analytics
This site sets no non-essential cookies by default. Analytics loads only after you accept it, and you can change that choice at any time.
The cookie policy lists exactly what is stored in your browser and gives you the control to change it.
Children
This site is written for people at work. We do not aim it at children, and we do not knowingly collect information from anyone under 16.
If you believe a child has sent us something, email us. We will delete it and confirm that we have.
Security
Access to our records is limited to the people who need it. Information is encrypted in transit, and accounts carry multi-factor authentication.
No system is perfectly safe. If a breach puts you at risk, we tell you and the regulator within the time the law allows. We also say what we are doing about it.
Changes to this policy
We update this page when our practice changes. The date at the top is the date of the last change.
When a change matters to you, we post a short summary of it here. Where we hold your email address for that purpose, we also write to you.
Questions about this page
Write to hello@hirayatalent.com and say which page you are asking about. A person reads it, and we reply within one business day.
Also here
Hiraya Talent is a trade name of Hiraya Recruitment and Staffing LLC, a Wyoming limited liability company.