Who We Are (Data Controller)

Montash Limited
100 Clifton Street
London
England
EC2A 4TP

Email: privacy@montash.com

We act as a "data controller" under the UK GDPR and, where applicable, EU GDPR.

Who This Policy Applies To

This policy applies to:

• Job applicants and candidates
• Website visitors
• Clients and prospective clients
• Suppliers and partners
• Employees, consultants and contractors

Information We Collect

Information You Provide to Us

• CVs, profiles and cover letters
• Contact details (name, email, phone number, address)
• Work history, skills and qualifications
• Public profile links (e.g., LinkedIn, GitHub)
• Notes from interviews, meetings or calls
• Identification documents and right-to-work data (where required by law)
• Information provided via website forms
• Communication preferences

We may also analyse meeting and call communications using automated tools to generate summaries, operational insights and action items.

Automatically Collected Data (Website & Digital Tools)

• IP address
• Device type, browser and operating system
• Pages viewed and clickstream data
• Date/time stamps
• Cookies and tracking technologies (see Section 12)

Call Recordings & Voice Data

We may record and monitor telephone and video calls for legitimate business purposes.

This may include:

• Audio recordings
• Voice data
• Call transcripts
• AI-generated summaries
• Notes and action items
• Sentiment or keyword analysis
• Call metadata (date, time, duration, participants)

Where legally required, you will be informed at the beginning of the call if recording is taking place.

Special Category Data

We do not intentionally collect special category data (e.g., health, ethnicity, religious beliefs) unless you voluntarily provide it.

If you choose to share such information, we will process it only where legally permitted.

Children

Our services are not intended for individuals under 16 and we do not knowingly collect data from minors.

How We Use Your Information (Purposes)

We process your data for:

• Recruitment and job matching
• Assessing suitability for roles
• Introducing candidates to clients
• Providing staffing and consultancy services
• Managing client and supplier relationships
• Quality assurance and training
• Performance management
• Compliance and dispute resolution
• Fraud prevention and security
• Improving recruitment processes and services
• AI-assisted transcription, analysis and operational insights
• Website analytics and optimisation
• Marketing communications (with opt-out options)

Legal Bases for Processing

We rely on the following lawful bases:

Legitimate Interests

• Recruitment and candidate-client matching
• CV processing and business development
• Monitoring and recording business communications
• Quality control, training and compliance
• Service improvement and operational management
• Monitoring, recording and analysing business communications for quality assurance, training, security and operational insights

We conduct Legitimate Interest Assessments (LIAs) where required.

Contract

Where processing is necessary to:

• Fulfil a contract
• Take steps prior to entering a contract

Consent

We rely on consent for:

• Marketing communications
• Non-essential cookies
• Certain call recordings where legally required

You may withdraw consent at any time.

Legal Obligation

Including:

• Right-to-work checks
• Regulatory requirements
• Fraud prevention
• Audit and compliance obligations

Automated Processing, AI & Call Analytics

We may use AI-powered and automated tools to assist with:

• CV parsing and candidate matching
• Skills and keyword recognition
• Call transcription
• Call summarisation
• Sentiment and communication analysis
• Performance insights
• Operational analytics

These tools assist our consultants and internal teams but do not make solely automated decisions that produce legal or similarly significant effects.

AI outputs are reviewed by human staff and are not used as the sole basis for employment, candidate, or contractual decisions.

You have the right to:

• Request human intervention
• Contest automated processing
• Object to processing based on legitimate interests
• Request information about the logic involved

Contact: privacy@montash.com

Sharing Your Information

We may share your information as follows:

Clients

Where you are being considered for a role or assignment.

Service Providers / Processors

Including:

• IT hosting and cloud providers
• ATS/CRM platforms
• Call recording and transcription providers
• AI analytics platforms
• Background-check vendors
• Communication and collaboration tools
• Website analytics providers

We maintain Data Processing Agreements (DPAs) with all processors.

Legal & Compliance

Where required by law, court order, or regulatory obligation.

Corporate Transactions

In the event of a merger, acquisition, or sale of assets, your data may be securely transferred.

Mobile Information

Mobile information will not be shared with third parties or affiliates for marketing or promotional purposes.

All categories above exclude text messaging originator opt-in data and consent; this information will not be shared with any third parties.

SMS Notifications

Purpose of SMS Notifications

SMS notifications may be used to:

• Remind you of job opportunities
• Confirm interviews
• Provide important employment-related updates

Opt-In & Consent

By providing your phone number and opting in, you confirm you are the authorised user of that number.

You consent to receive recurring automated messages (SMS/MMS). Consent is not required to make any purchase.

Message frequency varies (typically 1-5 per week).

Opt-Out

You may opt out at any time by:

• Replying "STOP" to any message
• Emailing operations@qxigroup.com

You will receive a final confirmation message after opting out.

Help

Reply "HELP" to any message or email operations@qxigroup.com.

Message & Data Rates

Standard message and data rates may apply. Contact your mobile provider for details.

International Transfers

Where data is transferred outside the UK or EEA, we rely on:

• UK International Data Transfer Agreement (IDTA)
• EU Standard Contractual Clauses (SCCs)
• Additional safeguards where required

Transfer Risk Assessments are conducted where mandated.

Data Retention

We retain personal data only as long as necessary.

Recruitment Data

• Candidate data: up to 6 years from last interaction
• Client/supplier contracts: 6 years
• Financial records: 7 years

Call Recordings

Call recordings, transcripts and AI-generated outputs are typically retained for up to 24 months unless required for legal or regulatory reasons.

You may request earlier deletion where applicable.

Data Security

We use appropriate technical and organisational measures, including:

• Encrypted transmission (HTTPS/TLS)
• Access-controlled systems
• Secure hosting environments
• Regular audits
• Staff privacy training
• Incident response procedures

No system is entirely secure, but we take reasonable steps to protect your data.

Cookies & Tracking Technologies

We use cookies for:

• Essential website functionality
• Analytics (e.g., Google Analytics)
• Advertising and tracking technologies

Non-essential cookies are used only with your consent.

You may manage your preferences via the Cookie Settings link on our website.

Your Rights

You have the right to:

• Access your data
• Rectify inaccuracies
• Request erasure
• Restrict processing
• Object to processing
• Data portability
• Withdraw consent
• Challenge automated processing

We respond within 30 days and may verify your identity.

Submit requests to: privacy@montash.com

Complaints

You may contact the UK supervisory authority:

Information Commissioner's Office
Website: www.ico.org.uk

We encourage you to contact us first at privacy@montash.com so we can resolve your concern promptly.

Changes to This Policy

If we update this policy, we will:

• Post the updated version on our website
• Update the "Last Updated" date
• Notify users by email where changes are material

About Montash

Montash is a tech recruitment agency and consultancy.

We secure technology talent and build teams for leading global companies. Based in London, Munich and The Hague - where talent thrives.