Privacy Policy

Energize Group Global Data Protection & Privacy Policy (2026)

1. Introduction

Energize Group ("we", "us", "our") is committed to safeguarding the privacy of our customers, candidates, clients, and partners. This policy sets out how we process your personal information globally in accordance with:

• The UK General Data Protection Regulation (UK GDPR) and Data Protection Act 2018
• The EU General Data Protection Regulation (EU GDPR)
• The German Federal Data Protection Act (BDSG)
• California Consumer Privacy Act / California Privacy Rights Act - CCPA/CPRA)

 

2. Scope of this Policy

This privacy policy applies to personal data processed globally across all Energize Group entities in connection with:

• Recruitment, executive search, and staffing services (permanent, contract, and temporary)
• Candidate sourcing, assessment, and placement management
• Client relationship management and business development
• Website usage, digital interactions, and client/candidate portals
• Marketing, communications, and internal automation platforms

3.    Data Controller

The relevant data controller is the specific Energize Group entity providing services to you, or with whom you have business dealings:

• Energize Recruitment Solutions Ltd (United Kingdom)
• Energize Recruitment Solutions GmbH (Germany)
• Energize Recruitment Solutions Iberica S.L.** (Spain)
• Energize Recruitment Solutions Inc.** (United States)

4.    Data Sourcing, Collection, and Retention

4.1    Categories of Data Collected
We collect, store, and use the following categories of personal data:

• Identity & Contact Data: Name, email address, phone number.
• Professional & Employment Data: CVs, employment history, qualifications, skills, salary and pay expectations, language proficiencies, and interview notes.
• Technical, Usage & Tracking Data: IP address, browser type, device details, open statistics, link clicks, and information about your visits to and interaction with our website via cookies, pixels, and automated tracking platforms (see Section 9 for full details).

4.2    Sources of Data
We collect data directly from you (when registering, filling out forms, or communicating with us), and from the following third-party sources:

• Professional networking platforms (e.g., LinkedIn, XING)
• Job advertising boards and resume databases
• Corporate websites and corporate directories
• Business card exchanges and professional referrals

4.3    Sensitive Personal Data
We do not actively seek to collect sensitive data (e.g., health data, criminal records, trade union membership, diversity metrics) unless strictly necessary for legal compliance, visa sponsorship, or background check requirements mandated by a client. Such data is only processed with your explicit consent or under absolute legal obligation.

4.4    Data Retention
We retain personal data only for as long as necessary to fulfill the purposes we collected it for, including satisfying any recruitment-related, legal, accounting, or regulatory reporting requirements. Candidate data is kept active to support your ongoing career search and match you with prospective employers, unless you request its deletion or we are required by local tax, corporate, or employment laws to retain certain transactional or contract records for longer compliance periods.

To process your data legally under European laws, we rely on the following distinct legal bases depending on the context:

• Activity: Sourcing Candidates: Identifying talent for open positions via LinkedIn, XING or job boards.    
• Activity: Managing Applications: Processing your resume for a specific job application you submitted.    
• Activity: Performance of a Contract: To take steps at your request prior to entering into an employment or placement contract.
  Lawful Basis for Processing: Legitimate Interest: It is within our legitimate interest as a recruitment agency to process professional data to introduce candidates to potential employers.
   
• Activity: Marketing & Alerts: Sending job alerts, newsletters, or marketing communications.    
  Lawful Basis for Processing: Consent: You have the right to withdraw this consent at any absolute moment via unsubscribe links.
   
• Activity: Compliance: Managing tax invoices, verifying right-to-work, or meeting regulatory audits.    
  Lawful Basis for Processing:Legal Obligation: Necessary to comply with mandatory local corporate, employment, and tax laws.

6.    Global Data Transfers

Energize Group operates across the United Kingdom, European Union and United States. Personal data is primarily processed and stored within the UK and European Economic Area (EEA) through approved technology providers, including Bullhorn and Microsoft 365, using UK and EU-hosted infrastructure where available. Access to personal data may be granted to authorised Energize Group personnel located in the UK, EU or, where operationally necessary, the United States. Where this results in a transfer of personal data outside the UK or EEA, Energize Group implements appropriate safeguards, including Standard Contractual Clauses (SCCs), the UK International Data Transfer Addendum, and any other lawful transfer mechanisms available under applicable data protection legislation. For certain clients or projects, Energize Group may implement additional technical and organisational measures, including region-specific storage, restricted access controls, segregated environments and data residency arrangements where contractually agreed. All international transfers are subject to appropriate security controls, encryption, access management and data protection requirements designed to provide an equivalent level of protection to that required under UK GDPR and EU GDPR.

7.    Automated Decision-Making & Profiling

We use modern automation and software platforms to help screen, parse, and match candidate profiles to job descriptions.
No Automated Decisions: We do not use purely automated decision-making or AI profiling tools that result in legal or similarly significant effects on candidates without human intervention. All final shortlisting, screening, and placement decisions are made by our human recruitment consultants.


8.    Your Legal Rights

8.1    Right to Instruct, Remove, and Opt-Out
You may instruct us to provide you, or remove, with any personal information we hold about you at any time. You may also instruct us not to process your personal data for marketing purposes by email at any time.
In practice, you will usually either expressly agree in advance to our use of your personal data for marketing purposes, or we will provide you with an opportunity to opt-out of the use of your personal data for marketing purposes. If you do grant consent, please note you can withdraw your consent to all or any one of our processing purposes at any time by contacting GDPR@energizerecruitment.com.Processing Timeline: Please note that all processing of your personal data will cease once you have withdrawn consent, but this will not affect any personal data that has already been processed prior to this point. Please allow up to 30 days for us to process your request.

8.2    European Union & United Kingdom Rights
If you are located in the UK or EU, you have the following statutory rights:

• Right of Access: Request a copy of the personal data we hold about you.
• Right to Rectification: Request that we correct incomplete or inaccurate data.
• Right to Erasure ("Right to be Forgotten"): Request that we delete your data where there is no good reason for us to  continue processing it.
• Right to Object: Object to processing where we are relying on a legitimate interest or using your data for direct marketing.
• Right to Restriction: Request that we suspend processing your data in specific scenarios (e.g., challenging its accuracy).
• Right to Portability: Request the transfer of your data to you or a third party in a structured, machine-readable format.

8.3    United States (including California CCPA/CPRA) Rights
If you are a US resident, you have the right to:

• Know/Access what specific personal information we have collected about you.
• Delete personal information collected from you
• Correct inaccurate personal information.
• Opt-Out of the "Sale" or "Sharing" of personal information. Note: Energize Group does not sell your personal data to third parties for monetary value, nor do we share it for cross-context behavioral advertising.
• Non-Discrimination: We will not discriminate against you (e.g., deny services or adjust terms) for exercising your privacy rights.

How to Exercise Your Rights
To submit a data access, correction, or deletion request, please email GDPR@energizerecruitment.com. We will respond to European requests within 30 days and US state requests within the legally mandated timeframes (typically 45 days).

9.    Cookies & Tracking Technologies

9.1    General Use of Cookies
We may use both ‘session’ cookies and ‘persistent’ cookies on our website. We use cookies to keep track of you whilst you navigate the website and to enable our website to recognise you when you visit.

• Session cookies will be deleted from your computer when you close your browser.
• Persistent cookies will remain stored on your computer until deleted, or until they reach a specified expiry date.

We use Google Analytics to analyse the use of this website.

9.2    Force24 Marketing Automation Platform
Our organisation utilises Force24’s marketing automation platform. Force24 cookies are first-party cookies and are enabled at the point of cookie acceptance on this website. They allow us to understand our audience engagement, thus allowing better optimisation of marketing activity.
The specific Force24 cookies utilised are detailed below:

• F24_autoID: This is a temporary identifier on a local machine or phone browser that helps us track anonymous information to be later married up with F24_personID. If this is left anonymous, it will be deleted after 6 months. Classification: Non-essential, first-party, 10 years, persistent.
• F24_personID: This is an ID generated per individual contact in the Force24 system to be able to track behaviour and form submissions into the Force24 system from outside sources per user. This is used for personalisation and the ability to segment decisions for further communications. Classification:

Non-essential, first-party, 10 years, persistent. The information stored by Force24 cookies remains anonymous until:

• Our website is visited via clicking from an email or SMS message, sent via the Force24 platform, and cookies are accepted on the website
• A user of the website completes a form containing an email address from either our website or our Force24 landing pages.

The Force24 cookies will remain on a device for 10 years unless they are deleted.

9.3    Tracking Pixels and Link Tracking
We also use similar technologies, including tracking pixels and link tracking, to monitor your viewing activities.

• Device & Browser Type and Open Statistics: All emails have a tracking pixel (a tiny invisible image) with a query string in the URL. Within the URL, we have user details to identify who opened an email for statistical purposes.
• Link Tracking: All links within emails and SMS messages sent from the Force24 platform contain a unique tracking reference; this reference helps us identify who clicked an email for statistical purposes.

Under our SMS policy, we will never disclose information about you to third parties.

10.    Call Recording
Where interviews, meetings, or business calls are recorded, Energize Group provides participants with advance notice and processes recordings only for legitimate business purposes, such as quality assurance, training, compliance, or record-keeping. Recordings are managed in accordance with applicable GDPR, BDSG and other local legal requirements, including consent and transparency obligations where required.

11.    Contact & Questions
If you have any questions about this privacy policy or our treatment of your personal data, please write to us by email to GDPR@energizerecruitment.com.