Privacy Policy — Marta Oryl Consulting

1

Data Controller

The data controller responsible for the processing of your personal data is:

Marta Oryl Consulting
Email: contact@martaoryl.com
Phone (Spain): +34 691 644 154
Phone (Poland): +48 796 346 870

Marta Oryl Consulting operates across the United Kingdom, Spain, and Poland, providing recruitment and HR consulting services to small and medium enterprises.

2

Personal Data We Collect

We collect and process personal data that you voluntarily provide to us, as well as data generated through your interaction with our services.

Category	Data Types	Source
Contact information	Name, email address, phone number, company name	Contact form, email, phone
Professional information	Job title, company, industry, professional experience	Direct communication, LinkedIn
Recruitment data	CVs, cover letters, references, interview notes	Candidates, referees
Communication data	Messages sent via email, WhatsApp, or our website form	Direct communication
Technical data	IP address, browser type, pages visited, access timestamps	Website analytics

3

Purpose and Legal Basis for Processing

We process your personal data for the following purposes, each supported by a lawful basis under the General Data Protection Regulation (GDPR):

Contractual necessity (Art. 6(1)(b) GDPR)

Providing recruitment and HR consulting services
Processing candidate applications and managing recruitment pipelines
Communicating with clients regarding service delivery

Legitimate interest (Art. 6(1)(f) GDPR)

Responding to inquiries submitted through our website contact form
Improving our services and website experience
Internal business administration and record keeping
Communication via WhatsApp Business for client and candidate interaction

Consent (Art. 6(1)(a) GDPR)

Sending marketing communications (only with your explicit opt-in)
Using non-essential cookies and analytics tools

Legal obligation (Art. 6(1)(c) GDPR)

Compliance with employment law across the UK, Spain, and Poland
Tax, accounting, and regulatory reporting requirements

4

WhatsApp Business & Meta Platform

We use WhatsApp Business (operated by Meta Platforms, Inc.) as a communication channel for client and candidate interactions. When you communicate with us via WhatsApp:

Your messages, phone number, and profile information are processed by Meta Platforms in accordance with WhatsApp's Privacy Policy.
We use the WhatsApp Cloud API to manage conversations, which means message data is hosted on Meta's infrastructure.
We may use AI-powered automated responses for initial candidate screening and common inquiries. You will always be informed when interacting with an automated system and can request human interaction at any time.
We do not sell or share your WhatsApp communications with third parties beyond what is necessary for service delivery.

📱 Your choice: Communication via WhatsApp is entirely voluntary. You may always choose to contact us via email or phone instead.

5

Data Sharing & Third Parties

We may share your personal data with the following categories of recipients, only to the extent necessary:

Client companies: When you are a candidate, your CV and relevant professional data may be shared with the hiring company, with your prior knowledge and consent.
Technology providers: Hosting providers, email services, and communication tools (including Meta/WhatsApp) that support our operations, all bound by data processing agreements.
Professional advisors: Legal, tax, and accounting professionals as required for compliance.
Authorities: Government or regulatory bodies when required by law.

We do not sell your personal data to any third party. We do not use your data for profiling or automated decision-making that produces legal effects.

6

International Data Transfers

As we operate across the United Kingdom, Spain, and Poland, your data may be transferred between these jurisdictions. All transfers within the EEA are protected by GDPR. For transfers to the UK, we rely on the EU-UK adequacy decision.

When using services provided by Meta Platforms (WhatsApp Cloud API), data may be transferred to the United States. Such transfers are safeguarded by:

EU-US Data Privacy Framework (where applicable)
Standard Contractual Clauses (SCCs) approved by the European Commission

7

Data Retention

We retain your personal data only for as long as necessary to fulfil the purposes for which it was collected:

Data Category	Retention Period
Client contact & contract data	Duration of the business relationship + 6 years
Candidate recruitment data	Up to 2 years after the recruitment process ends, or longer with consent
Website contact form submissions	Up to 12 months
WhatsApp conversation logs	Up to 12 months
Tax and legal records	As required by local law (typically 5–10 years)

8

Your Rights

Under the GDPR and applicable data protection legislation in the UK, Spain, and Poland, you have the following rights:

Right of access — Request a copy of the personal data we hold about you.
Right to rectification — Ask us to correct inaccurate or incomplete data.
Right to erasure — Request deletion of your data ("right to be forgotten"), subject to legal obligations.
Right to restrict processing — Ask us to limit how we use your data in certain circumstances.
Right to data portability — Receive your data in a structured, machine-readable format.
Right to object — Object to processing based on legitimate interest or for direct marketing.
Right to withdraw consent — Where processing is based on consent, you can withdraw it at any time.

To exercise any of these rights, please contact us at contact@martaoryl.com. We will respond within 30 days.

🇪🇺 Supervisory authority: You have the right to lodge a complaint with a data protection authority. Depending on your location, this may be the ICO (UK), the AEPD (Spain), or the UODO (Poland).

9

Cookies & Tracking Technologies

Our website may use the following types of cookies:

Essential cookies: Necessary for the website to function properly (e.g., language preference). These do not require consent.
Analytics cookies: Help us understand how visitors interact with our website. Only used with your consent.

You can manage cookie preferences through your browser settings at any time. Disabling cookies may affect some website functionality.

10

Data Security

We implement appropriate technical and organizational measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction. These measures include:

Encrypted communications (HTTPS, end-to-end encryption on WhatsApp)
Secure storage of digital records with access controls
Regular review of data processing practices
Confidentiality agreements with any third-party processors

11

Children's Privacy

Our services are not directed at individuals under 16 years of age. We do not knowingly collect personal data from children. If you believe we have inadvertently collected such data, please contact us immediately and we will promptly delete it.

12

Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. The "Last updated" date at the top of this page will be revised accordingly. We encourage you to review this page periodically.

For material changes that significantly affect your rights, we will make reasonable efforts to notify you via email or through a prominent notice on our website.

13

Contact Us

If you have any questions about this Privacy Policy, your personal data, or wish to exercise your rights, please contact us:

Marta Oryl Consulting
📧 Email: contact@martaoryl.com
🇪🇸 Spain: +34 691 644 154
🇵🇱 Poland: +48 796 346 870
🔗 LinkedIn: marta-oryl