Exsolvium Privacy Policy
Oct 15, 2026
1. Who we are and what this policy covers
Exsolvium [Limited – confirm legal name] (“Exsolvium”, “we”, “us”) is the data controller for the personal data described in this policy, and this policy explains what we collect, why, and the choices you have. We are a consultancy and recruitment business registered in England and Wales [company number: insert], with our registered office at [insert address]. We supply project management, commissioning, advisory and executive search services, and place contract and permanent talent, for clients in the oil and gas, energy and infrastructure industries, in the UK and internationally.
We are registered with the UK Information Commissioner’s Office (ICO) [registration number: insert]. You can contact us about this policy or your data at [dataprotection@exsolvium.com – insert] or by post at the address above. [If you appoint a Data Protection Officer or an EU/UK representative, name them here.]
This policy should be read together with our [Cookie Policy – link]. It is written to meet the UK GDPR, the Data Protection Act 2018, the Data (Use and Access) Act 2025 and the Privacy and Electronic Communications Regulations (PECR).
2. Whose data we handle
This policy applies to:
- Candidates and consultants: people who apply for, or are put forward for, contract, permanent or executive roles, or who work with us on client projects.
- Referees and emergency contacts: people whose details are given to us by a candidate or consultant.
- Client and prospect contacts: people at current or potential client organisations.
- Suppliers and partners: individuals at businesses that provide services to us.
- Website visitors and people who contact or follow us, including by email or social media.
If you give us information about someone else, such as a referee, please make sure they know and are happy for you to do so.
3. Personal data we collect
| Category | Examples | Mainly relates to |
| Identity and contact | Name, address, email, phone, social media handle, nationality, right-to-work status | Candidates, consultants, contacts |
| Professional profile | CV, work history, qualifications, certificates, training and safety tickets (for example offshore survival, BOSIET, CSCS), skills, availability, salary and rate expectations, interview notes, references | Candidates, consultants |
| Engagement and payment | Contract terms, timesheets, bank details, tax and national insurance or equivalent numbers, payroll and expense information | Consultants, suppliers |
| Travel and mobilisation | Passport and visa details, travel bookings, accommodation, site access and induction records | Consultants |
| Client and business contact | Job title, employer, business contact details, meeting notes, project and enquiry history | Client contacts, suppliers |
| Technical | IP address, device and browser type, pages visited, cookie identifiers, system and security logs | Website visitors, platform users |
| Communications | Emails, messages, call or video notes, marketing preferences, enquiry forms | Everyone |
| Sensitive data (see section 6) | Medical fitness-to-work results, criminal record checks, and, where you volunteer it, health, diversity or trade union information | Candidates, consultants |
4. How we collect it
- From you directly: when you send us a CV, apply through exsolvium.com, email or message us, attend an interview, sign a contract or complete a form.
- From third parties: job boards and professional networks we subscribe to (such as LinkedIn), publicly available profiles, referees, clients, other recruiters, background screening and medical providers, and your current or former employers.
- Automatically: through cookies and similar technologies, and server logs, when you use our website or systems.
Where we obtain your details from a source other than you, we will tell you who we got them from and why, normally within one month and at the latest when we first contact you.
5. How we use your data and our lawful bases
We only use personal data where the law allows. We do not sell personal data.
| Purpose | Lawful basis (UK GDPR Art. 6) |
| Assessing your suitability and matching your profile to roles and client opportunities | Legitimate interests (finding and supplying suitable talent to clients) |
| Putting you forward to a client, with your agreement for each submission | Legitimate interests, and consent where we tell you we are relying on it |
| Entering into and performing a contract with you (engagement, payroll, expenses, mobilisation) | Contract |
| Right-to-work, tax, immigration, health and safety and other legal checks | Legal obligation |
| Providing consultancy and advisory services to clients, and managing client relationships | Legitimate interests; contract |
| Sending job alerts and marketing by email or text | Consent for individuals where PECR requires it; otherwise legitimate interests for business contacts, always with an easy opt-out |
| Keeping our systems, premises and website secure, preventing fraud, and improving performance | Legitimate interests |
| Keeping records, handling disputes and defending legal claims | Legitimate interests; legal obligation |
| Sensitive data (section 6) | See section 6 |
Where we rely on legitimate interests, we have balanced them against your rights and can explain that assessment on request. Where we rely on consent you can withdraw it at any time, without affecting earlier processing. Withdrawing consent may mean we can no longer put you forward for some roles.
6. Sensitive data and criminal records
Some roles in energy and infrastructure require medical fitness-to-work certification, security clearance or criminal record checks. We collect this “special category” or criminal offence data only where it is needed for the role or a client’s site requirements, and we ask for your explicit consent first, or rely on a legal obligation or employment-law condition under the Data Protection Act 2018, as we will explain at the time.
We share the outcome of a check (for example “fit” or “clear”) with a client only when necessary and, where possible, not the underlying detail. We do not ask for sensitive data in a CV. If you volunteer it, we will handle it with the same care and may delete it if it is not relevant. Providing diversity monitoring information is always optional.
7. Who we share your data with
We share personal data only where there is a need, and with these groups:
- Clients: your CV and relevant details when we put you forward for a role or project, in line with section 5.
- Service providers acting for us: payroll and payment providers, IT and cloud hosting, applicant tracking and CRM systems, email and marketing tools, travel and accommodation agents, background screening and occupational health providers, insurers, and professional advisers. They act on our instructions under written contracts.
- Group companies and partners that help deliver a project, where relevant.
- Authorities and regulators, such as HMRC, immigration or law enforcement bodies, where the law requires or permits.
- Buyers or investors, if our business is sold or restructured, subject to this policy continuing to protect your data.
We do not sell your data or share it for third-party advertising.
8. International transfers
Because our clients and projects are global, your data may be sent to, or accessed from, countries outside the UK, including countries without an equivalent level of data protection. We only do this where a lawful transfer mechanism applies:
- the destination is covered by UK “adequacy regulations” (including the UK Extension to the EU-US Data Privacy Framework for certified US recipients);
- we use the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, together with a transfer risk assessment; or
- a specific exception applies, such as your explicit consent to a CV being sent to a client overseas after we have explained the risks.
You can ask us for details of the safeguards we use for a particular transfer.
9. How long we keep your data
We keep personal data only as long as needed for the purposes above. These periods are our standard approach [confirm against your own legal advice]; we may keep data longer where a law, regulator or live claim requires it.
| Data | Retention |
| Candidate CVs and profiles where no placement is made | 2 years from our last meaningful contact with you, then deleted or anonymised unless you agree to renewal |
| Consultant and placed candidate records (contracts, timesheets, references, right-to-work evidence) | 7 years after the engagement or project ends, or longer where regional rules require |
| Payroll, tax and invoicing records | 7 years from the end of the relevant financial year |
| Sensitive data (medical, criminal record checks) | Only as long as needed for the check or the client’s requirement, usually no more than 12 months, then deleted. We keep a record that the check was done |
| Client and prospect contacts | While the relationship is active and for 3 years after our last contact |
| Marketing preferences and suppression lists | Until you opt out, and then a minimal record to honour your opt-out |
| Website and security logs | Up to 12 months, unless needed to investigate an incident |
| Consultant names in historical project records | Kept in our project history, limited to name, role and dates, unless you ask us to remove them and no legal need to keep them applies |
10. Keeping your data secure
We use technical and organisational measures appropriate to the risk. These include access limited to staff who need it, encryption in transit and at rest, multi-factor authentication, regular backups, supplier security checks, staff training and confidentiality obligations, and an incident response process.
If a breach is likely to put your rights and freedoms at risk, we will report it to the ICO within 72 hours and tell you without undue delay where the risk is high. No internet-based system is completely secure, so please protect your own passwords and avoid sending sensitive documents by unencrypted email.
11. Your rights
You have the right to:
- be informed about how we use your data (this policy);
- access a copy of your data;
- have inaccurate data corrected;
- have your data erased, in some circumstances;
- restrict our use of your data, in some circumstances;
- object to processing based on legitimate interests, and to direct marketing at any time;
- receive your data in a portable format, where we process it by consent or contract using automated means;
- withdraw consent at any time; and
- not be subject to a decision based solely on automated processing that has legal or similarly significant effects, without safeguards.
To use any of these rights, email [dataprotection@exsolvium.com – insert]. We will reply within one month, which we can extend by up to two further months for complex requests, and we will tell you if so. We do not charge a fee unless a request is clearly unfounded or excessive. We may need to verify your identity first.
Residents of the EU/EEA, California and other regions may have additional rights under local law, such as the right to know, delete or correct personal information, and not to be discriminated against for using these rights. See section 12 for how to exercise them.
12. Other important information
Cookies and similar technologies. We use strictly necessary cookies to run our website. We set analytics, functional or advertising cookies only with your consent, which you can change at any time through our cookie banner or your browser settings. Where analytics cookies are low-risk and permitted by law without consent, we will say so in our [Cookie Policy – link].
Marketing. We send job alerts and news by email or text where you have agreed, or, for business contacts, in line with PECR. Every message has an unsubscribe option, and you can also write to us.
Automated decisions and AI. We may use software, including AI-assisted tools, to search, sort or summarise CVs. A person reviews all shortlisting and placement decisions, and we do not make decisions about you solely by automated means. Tell us if you would like a person to reconsider any outcome. [Amend if you use automated screening.]
Children. Our services are for people aged 18 and over. We do not knowingly collect data from children.
Other websites. Our website may link to other sites, including social media and job boards. We are not responsible for their privacy practices, so please read their policies.
Regional supplement. If you are in the EU/EEA or California, or another region with specific privacy laws, you may have extra rights and we will honour them. [Add a short regional notice or link, for example a California notice: we do not sell or share personal information for cross-context behavioural advertising.]
Changes to this policy. We will update this policy when our practices or the law change. The date at the top shows the latest version, and we will tell you directly of material changes.
13. Contact and complaints
If you have a question or concern, contact us first so we can try to put it right: [dataprotection@exsolvium.com – insert], or by post to Exsolvium, [registered address – insert]. We will acknowledge complaints within 30 days and investigate and respond without undue delay.
You also have the right to complain to the Information Commissioner’s Office (ICO): ico.org.uk/make-a-complaint, telephone 0303 123 1113. If you are in the EU/EEA, you may also contact your local data protection authority.