Privacy Policy

Mystro Employment Services ("Mystro", "we", "our", or "us") is committed to protecting the privacy and personal data of all individuals who interact with our services — including job seekers, candidates, clients, employers, and website visitors. This Privacy Policy explains what data we collect, why we collect it, how it is used and shared, and the rights you have over your personal information.

This policy applies to all data processing activities carried out by Mystro Employment Services in connection with our recruitment, staffing, and employment services, and our website at mystroservices.com.

1. Who We Are (Data Controller)

Mystro Employment Services is the data controller responsible for the personal data we process in connection with our recruitment and employment placement services. We operate globally, with our primary digital presence at mystroservices.com.

Contact for data matters:
Email: privacy@mystroservices.com
General Enquiries: info@mystroservices.com

2. Information We Collect

We collect personal information in the course of providing recruitment and employment placement services. The categories of data we collect include:

2.1 Information Provided Directly by You

• Identity data: Full name, date of birth, nationality, gender (where voluntarily provided)
• Contact data: Email address, phone number, postal address, city and country of residence
• Professional data: CV/résumé, employment history, job titles, responsibilities, achievements, employers' names, dates of employment
• Qualifications data: Educational background, academic certifications, professional licenses, professional memberships
• Skills and competencies: Technical skills, language proficiency, software experience, industry expertise
• References: Names and contact details of professional references (where provided)
• Immigration and right-to-work data: Work authorisation status, visa type, passport details (only where legally required for a specific role)
• Job preferences: Preferred role types, salary expectations, preferred work locations, remote work preferences, availability date
• Cover letters and personal statements
• LinkedIn profile URL or portfolio links
• Communication history: Emails, messages, and notes from interactions with our recruiters

2.2 Information We Collect Automatically

• Technical data: IP address, browser type and version, operating system, device type
• Usage data: Pages visited, time spent on pages, links clicked, referring URLs
• Cookie data: Session identifiers, preference cookies, analytics data (see Section 10)

2.3 Information from Third Parties

• LinkedIn and other professional networking platforms (where you connect your profile)
• Background check providers (only where applicable to specific roles, with your explicit consent)
• Reference checks from employers or professional contacts you nominate
• Job boards and public professional databases (where permitted by those platforms' terms)

3. How We Use Your Information

We use your personal data for the following purposes:

3.1 Core Recruitment Services

• Matching your profile to suitable job vacancies and opportunities worldwide
• Registering you as a candidate in our applicant tracking system (ATS)
• Submitting your profile and CV to prospective employers (only with your knowledge and agreement)
• Arranging and scheduling interviews, assessments, and employer introductions
• Providing career advice, salary benchmarking, and market insights
• Managing the offer and placement process, including employment contracts
• Providing post-placement support and feedback

3.2 Communication & Administration

• Responding to your enquiries and job applications submitted via our website
• Sending you relevant job alerts and vacancy notifications (with your consent)
• Sending transactional communications such as application confirmations and interview reminders
• Maintaining records of our interactions for quality and compliance purposes

3.3 Legal and Compliance

• Verifying your right to work in the relevant jurisdiction as required by law
• Complying with applicable employment, tax, immigration, and data protection laws
• Responding to lawful requests from courts, regulators, or law enforcement agencies
• Preventing and detecting fraud or other unlawful activities

3.4 Service Improvement

• Analysing aggregated, anonymised data to improve our recruitment matching capabilities
• Monitoring website performance and improving user experience

4. Legal Basis for Processing (GDPR)

For individuals in the European Economic Area (EEA), United Kingdom, and other jurisdictions with data protection laws, we rely on the following legal bases for processing your personal data:

• Contractual necessity: Processing required to provide our recruitment and placement services to you
• Legitimate interests: Maintaining our candidate database, matching candidates to roles, and running our business operations — balanced against your rights and expectations
• Legal obligation: Compliance with employment law, right-to-work verification, tax obligations, and regulatory requirements
• Consent: For sending marketing communications, optional profiling, or processing sensitive personal data where consent is the appropriate basis — you may withdraw consent at any time

5. Who We Share Your Data With

We share your personal data only where necessary and appropriate, with the following categories of recipients:

5.1 Prospective Employers and Clients

With your knowledge and agreement, we share your CV, profile, and relevant professional information with employers who have engaged us to fill specific vacancies. We require our employer clients to process your data only for the purpose of evaluating your candidacy and to comply with applicable data protection laws.

5.2 Service Providers and Technology Partners

We use trusted third-party service providers to support our operations, including:

• Applicant Tracking System (ATS) providers
• Email delivery and communication platforms
• Cloud hosting and data storage providers
• Website analytics providers (e.g. anonymised usage data)
• Background screening providers (where applicable, with your consent)

All service providers are contractually required to handle your data securely and only for the purposes we specify.

5.3 Legal and Regulatory Bodies

We may disclose your data where required by law, court order, or government authority.

5.4 Business Transfers

In the event of a merger, acquisition, or sale of our business, your personal data may be transferred to the acquiring entity, subject to the same privacy protections.

6. International Data Transfers

Mystro Employment Services operates globally. Your personal data may be transferred to and processed in countries outside your country of residence, including countries that may have different data protection standards.

Where we transfer personal data from the EEA or UK to countries outside these regions, we implement appropriate safeguards such as:

• Standard Contractual Clauses (SCCs) approved by the European Commission
• UK International Data Transfer Agreements (IDTAs) where applicable
• Transfer to countries with adequate data protection levels as determined by relevant authorities

7. Data Retention

We retain your personal data for as long as is necessary to fulfil the purposes set out in this policy, subject to applicable legal requirements. Our standard retention periods are:

• Active candidate profiles: 3 years from the date of last meaningful contact (e.g. application, interview, or communication)
• Placed candidates: 7 years from the end of the placement (to comply with employment and tax law)
• Unsuccessful applications: 12 months from the application date, unless you consent to longer retention
• Website enquiry/contact form data: 2 years
• Financial and billing records: 7 years (legal obligation)

After the relevant retention period, your data will be securely deleted or anonymised. You may request deletion at any time (see Section 8).

8. Your Rights

Depending on your location, you may have the following rights regarding your personal data:

8.1 Rights Under GDPR (EEA & UK)

• Right of access: Request a copy of the personal data we hold about you
• Right to rectification: Request correction of inaccurate or incomplete data
• Right to erasure ("right to be forgotten"): Request deletion of your data where there is no compelling reason for continued processing
• Right to restriction of processing: Request that we limit how we use your data in certain circumstances
• Right to data portability: Receive your data in a structured, machine-readable format
• Right to object: Object to processing based on legitimate interests or for direct marketing purposes
• Right to withdraw consent: Where processing is based on consent, withdraw it at any time without affecting prior processing

8.2 Rights Under CCPA (California, USA)

California residents have the right to know what personal information we collect, the right to delete their personal information, the right to opt-out of the sale of personal information (we do not sell personal data), and the right to non-discrimination for exercising their privacy rights.

8.3 How to Exercise Your Rights

To exercise any of your rights, please contact us at privacy@mystroservices.com. We will respond within 30 days. We may need to verify your identity before processing your request.

9. Data Security

We implement appropriate technical and organisational security measures to protect your personal data against unauthorised access, loss, alteration, disclosure, or destruction. Our security measures include:

• HTTPS/TLS encryption for all data transmitted via our website
• Secure, access-controlled servers with restricted personnel access
• Regular security assessments and vulnerability testing
• Staff training on data protection and confidentiality obligations
• Secure disposal of data when retention periods expire
• Confidentiality agreements with all staff and contractors handling personal data

While we take all reasonable precautions, no online transmission of data is completely secure. We encourage you to use strong passwords and to contact us immediately if you believe your data with us may have been compromised.

10. Cookie Policy

Our website uses cookies — small text files stored on your device — to improve your browsing experience and analyse how our site is used.

10.1 Types of Cookies We Use

• Essential cookies: Required for the website to function properly. These cannot be disabled.
• Functional cookies: Remember your preferences (e.g. language, location) to enhance your experience.
• Analytics cookies: Help us understand how visitors use our site so we can improve it. Data is aggregated and anonymised.
• Marketing cookies: Used to deliver relevant job advertisements. Only used where you have given consent.

10.2 Managing Cookies

You can control and delete cookies through your browser settings. Note that disabling certain cookies may affect the functionality of our website. For more information, visit allaboutcookies.org.

11. Children's Privacy

Our services are intended for individuals who are at least 16 years of age (or the applicable age of employment in their jurisdiction). We do not knowingly collect personal data from children under 16. If we become aware that we have collected data from a child under 16 without appropriate parental consent, we will take steps to delete that data promptly. If you believe we may have collected data from a minor, please contact us at privacy@mystroservices.com.

12. Sensitive Personal Data

Certain categories of personal data are classified as "special category" or "sensitive" data under data protection law. This includes information about:

• Racial or ethnic origin
• Religious or philosophical beliefs
• Health or disability status
• Criminal convictions or offences
• Trade union membership

We do not request or require sensitive personal data unless it is strictly necessary for a specific role (e.g. disability accommodations or legally required background checks). Where we collect such data, we do so only with your explicit consent or where required by law, and it is subject to stricter access controls.

13. Employer and Client Data

If you interact with us as an employer or client representative, we collect and process your professional contact data (name, job title, company, business email, phone) to fulfil our recruitment service contract, communicate with you, and manage our business relationship. This data is held for the duration of our relationship plus a reasonable period thereafter for legal and administrative purposes.

14. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our services, legal requirements, or data handling practices. When we make material changes, we will update the "Last Updated" date at the top of this page and, where appropriate, notify you directly by email. We encourage you to review this policy periodically.

Continued use of our services after any update constitutes your acknowledgement of the revised policy.

15. Contact & Complaints