Privacy Policy

1. Who We Are

COS Recruiter Ltd (“we,” “us,” or “our”) is a UK-based company that operates a digital platform connecting healthcare professionals with Certificate of Sponsorship opportunities to verified employers.

Data Controller: COS Recruiter Ltd
Contact: recruiter@cosrecruiter.com
Address: London, United Kingdom

2. Legal Basis for Processing

We process your personal data under the following legal bases:

• Contract: To provide our recruitment platform services
• Legitimate Interest: To improve our services and prevent fraud
• Consent: For marketing communications (where required)
• Legal Obligation: To comply with employment and immigration laws

3. Information We Collect

3.1 Information You Provide

For Healthcare Professionals (Candidates):

• Personal details (name, contact information, date of birth)
• Professional qualifications and certifications
• Work history and experience
• Right to work documentation
• Passport and visa information
• Professional registration details
• References and recommendations

For Employers:

• Company information and registration details
• Contact person details
• Sponsorship license information
• Job requirements and descriptions
• Billing and payment information

3.2 Information We Collect Automatically

• Device and browser information
• IP address and location data
• Platform usage analytics
• Cookies and similar technologies
• Log files and error reports

3.3 Information from Third Parties

• Professional verification services
• Background check providers
• Reference checks
• Social media profiles (with your consent)

4. How We Use Your Information

4.1 Primary Purposes

• Matching candidates with suitable employers
• Verifying qualifications and right to work
• Facilitating communication between parties
• Processing applications and job postings
• Providing customer support

4.2 Secondary Purposes

• Improving our platform and services
• Conducting analytics and research
• Preventing fraud and maintaining security
• Complying with legal obligations
• Marketing (with your consent)

5. Information Sharing

5.1 When We Share Information

We share your information in the following circumstances:

• With Employers: When you apply for positions or express interest
• Verification Services: To confirm qualifications and right to work
• Service Providers: Our trusted partners who help deliver our services
• Legal Requirements: When required by law or legal process
• Business Transfers: In case of merger, acquisition, or sale of assets

5.2 International Transfers

Some of our service providers may be located outside the UK. When transferring data internationally, we ensure adequate protection through:

• Adequacy decisions by the UK government
• Standard contractual clauses
• Certification schemes
• Binding corporate rules

6. Data Retention

We retain your personal data for as long as necessary to:

• Provide our services to you
• Comply with legal obligations
• Resolve disputes and enforce agreements
• Maintain business records

Specific Retention Periods:

• Active accounts: While your account remains active
• Inactive accounts: 3 years after last activity
• Application data: 7 years for compliance purposes
• Financial records: 7 years as required by law
• Marketing data: Until you withdraw consent

7. Your Rights

Under UK GDPR, you have the following rights:

7.1 Access and Portability

• Request a copy of your personal data
• Receive your data in a portable format
• Transfer your data to another service provider

7.2 Correction and Deletion

• Correct inaccurate or incomplete data
• Request deletion of your personal data
• Restrict processing in certain circumstances

7.3 Objection and Withdrawal

• Object to processing based on legitimate interests
• Withdraw consent for marketing communications
• Object to automated decision-making

8. Data Security

We implement comprehensive security measures to protect your data:

• Encryption of data in transit and at rest
• Multi-factor authentication for account access
• Regular security audits and penetration testing
• Access controls and employee training
• Incident response and breach notification procedures

9. Cookies and Tracking

We use cookies and similar technologies to improve your experience. For detailed information about our cookie usage, please see our Cookie Policy.

10. Children's Privacy

Our platform is not intended for individuals under 18 years of age. We do not knowingly collect personal information from children. If we become aware that we have collected personal data from a child, we will delete it promptly.

11. Changes to This Policy

We may update this privacy policy from time to time to reflect changes in our practices or legal requirements. We will notify you of significant changes via email or prominent notices on our platform.

12. Contact Us

This Privacy Policy is effective as of June 2025. Previous versions are available upon request.