Privacy Notice | Brainspotting

Last updated 11 September 2026

This notice explains, in plain language, what personal data Brainspotting uses, why we use it, where it comes from and what choices you have. It covers website visitors, people who contact us, candidates we interact with through our recruitment work, client and supplier contacts, and participants in our market research.

Who is responsible for your data

Brainspotting SRL, a company registered in Romania with tax identification number RO14217477, is generally the controller of the personal data described in this notice. This means we decide why and how that data is used.

For some dedicated client projects we may process data under the client's instructions. If that happens, the client's privacy notice and our project-specific information will explain the arrangement. If you are unsure which notice applies, write to dpo@brainspotting.ro.

The short version

We use personal data to connect people with opportunities, deliver recruitment and talent consulting services, run market research, manage business relationships and keep our website and systems secure. We do not sell personal data. We share candidate information with a client only where there is a relevant opportunity and a lawful basis for doing so, normally after discussing that opportunity with the candidate.

What data we use and why

Context	Data we may use	Why and legal basis
Candidates and potential candidates	Name and contact details; CV and public professional profile; work history, education, skills, location, salary or rate expectations, availability, language skills; interview notes and communications; role preferences and process outcomes.	To provide recruitment services, assess and discuss relevant roles, communicate with you, introduce you to clients, and keep an accurate candidate record. Depending on the activity, we rely on steps requested before a possible contract, our legitimate interests in operating a recruitment business, consent where required, and legal obligations.
Website visitors and enquiries	Contact details and anything you choose to send; IP address, browser and device information, security logs and essential cookie data.	To answer you, operate and protect the site, diagnose problems and prevent misuse. We rely on steps requested by you and our legitimate interests in running a secure website.
Client and prospective client contacts	Name, job title, company, work contact details, correspondence, meeting notes, interests and relationship history.	To discuss and provide our services, manage contracts, develop relevant business relationships and send relevant B2B communications. We rely on contract, steps before a contract and legitimate interests. You can object to direct marketing at any time.
Suppliers and partners	Business contact details, communications, contractual and payment information.	To select and manage suppliers, administer contracts, pay invoices and meet legal obligations.
Research and survey participants	Answers, professional background, demographics where relevant, and contact details if supplied. Some projects may include compensation, employment preferences or diversity information.	To produce Talent Insights, benchmarks and market research. We rely on consent where answers are voluntary or sensitive, legitimate interests for professional market analysis, and contract where research is commissioned. Published outputs are aggregated or otherwise designed not to identify individuals.
Content downloads, newsletters and events	Name, email, company, role, the content requested, communication preferences and basic delivery or engagement information if the mailing tool provides it.	To provide the material you requested and, where you have agreed, add you to Brainspotting's contact database and send similar content, new project announcements, market insights and newsletters. We rely on your request to deliver the material and on consent for recurring communications. Every marketing email offers an easy way to unsubscribe.

When you download content

If you request a report, study, sample or other resource from our website, we use the details you provide to send or give you access to that material. If you also choose to receive further communications, we add those details to Brainspotting's contact database and may send you similar research, new project announcements, market insights and content newsletters.

We keep these communications relevant to the professional interest shown by your download. You can unsubscribe at any time by using the link in any email or by writing to dpo@brainspotting.ro. Unsubscribing does not affect your access to material you have already requested.

We do not sell these contact details or give them to clients or other organisations for their own marketing. They remain under Brainspotting's control. Providers that operate our email, contact database, hosting or security systems may process the data only on our instructions and for our purposes.

Sensitive data

Recruitment usually does not require health, disability, ethnicity, religion, political views, trade-union membership, sexual orientation or other special-category data. Please share it only when it is relevant and requested. Where we need such data, for example for a reasonable workplace adjustment or voluntary diversity research, we will explain the purpose and use an appropriate legal basis, usually explicit consent or an employment-law ground. We do not ask candidates for criminal-record information unless the role and the law justify it.

Where the data comes from

Most information comes directly from you through email, a website contact form, an interview, a survey, a meeting or another recruitment conversation. The website does not contain job listings, candidate accounts or an online application function. In the course of our recruitment work, we may also receive professional information from:

public professional sources such as LinkedIn, company websites, conference pages and professional communities
job boards and recruitment platforms that allow recruiters to access profiles
a colleague, referrer or other person who believes an opportunity may be relevant to you
our clients, service providers or previous recruitment activity

When we contact you using information from another source, we will tell you who we are and give you a link to this notice. You can ask us not to contact you again.

Who receives the data

Access is limited to people who need the information for their work. Depending on the situation, we may share data with:

the Brainspotting team and authorised contractors working on the relevant assignment
a client or prospective employer connected to an opportunity we have discussed with you
technology providers that support email, recruitment records, document storage, surveys, analytics, security and hosting
professional advisers, auditors, insurers, banks and public authorities where this is necessary or legally required
a buyer or successor if our business is reorganised, subject to appropriate confidentiality safeguards

Our service providers may use the data only to provide services to us and must protect it. We do not provide candidate databases to third parties for their unrelated marketing.

International transfers

Some technology providers or clients may process data outside the European Economic Area. When this happens, we use a lawful transfer mechanism, such as an adequacy decision or the European Commission's standard contractual clauses, and additional safeguards where needed. You may contact us for information about the safeguard relevant to your data.

How long we keep data

We keep data only for as long as it serves the purpose described above, taking account of the recruitment cycle, our relationship with you, legal limitation periods and record-keeping duties. Our standard periods are:

Information	Standard period
Candidate profiles and recruitment history	Three years from the last meaningful interaction, unless you ask us to delete the data earlier or agree to remain in contact for longer. We may retain a minimal suppression record so that we respect a request not to contact you.
Unsuccessful applications and process records	Up to three years after the process ends, subject to applicable legal claims and client requirements.
General enquiries	Up to two years after the conversation ends, unless the information becomes part of a longer business or recruitment relationship.
Client and supplier contracts, invoices and related records	For the term of the relationship and afterwards for the period required by accounting, tax and limitation rules.
Marketing contacts	Until you unsubscribe or object, or after a reasonable period of inactivity under our internal retention schedule.
Security and technical logs	Normally up to 12 months, unless a security incident or legal duty requires longer retention.
Research data	Identifiable raw data only as long as needed for the project and validation; aggregated or anonymised results may be kept without a fixed period because they no longer identify a person.

Your choices and rights

Depending on the circumstances, you may ask us to:

give you access to your personal data and a copy of it
correct information that is inaccurate or incomplete
delete data or restrict how we use it
provide data you gave us in a portable format
stop using your data for direct marketing
consider an objection to processing based on legitimate interests
withdraw consent at any time, without affecting earlier lawful use

Some rights have legal limits. For example, we may need to retain records required by law or needed to establish, exercise or defend a legal claim. We will explain any limitation that applies to your request.

To exercise a right, email dpo@brainspotting.ro and tell us what you need. We may ask for information needed to verify your identity. The GDPR allows us to respond within one month, but we usually do it the same day or within a week; the GDPR allows an extension for complex or numerous requests, and we will tell you if that is necessary.

Complaints

We would like the opportunity to address any concern first. You may also complain to the Autoritatea Nationala de Supraveghere a Prelucrarii Datelor cu Caracter Personal at www.dataprotection.ro, or to the supervisory authority in the EEA country where you live or work or where you believe an infringement occurred.

Security

We use organisational and technical measures intended to protect personal data against loss, misuse, unauthorised access and disclosure. No online system is completely risk-free, so please avoid sending unnecessary sensitive information by ordinary email.

Changes and contact

We may update this notice when our services, systems or legal obligations change. We will publish the current version here and highlight material changes where appropriate.

Questions and privacy requests can be sent to dpo@brainspotting.ro. General enquiries can be sent to contact@brainspotting.ro.