1. Scope

This policy applies to personal data collected through our website, including any information provided through the ‘Careers’ page, Contact Form, or direct email communications.

2. What We Collect

We may collect and process the following personal data:

• Identification and contact details: name, email, phone number, postal address.
• Employment information: CV, cover letter, qualifications, employment history, and references.
• Technical data: IP address, browser type, and limited cookies or analytics data.

We do not intentionally collect sensitive (“special category”) data such as ethnicity, religion, or health, and we ask that applicants avoid including such information unless essential for lawful employment purposes.

3. How We Use Your Data

We process your personal data for legitimate business purposes, including:

• Assessing and responding to employment applications.
• Communicating with candidates during recruitment.
• Evaluating suitability for roles and maintaining shortlists or talent pools.
• Managing interview scheduling and correspondence.
• Complying with legal and HR obligations.

If your application is progressed, your personal data may be shared securely with IWG plc or its affiliated brands (Regus, Spaces, HQ, or others) for the purpose of onboarding, HR management, and employment administration.
Once transferred, IWG plc or its affiliates become the data controller for all ongoing employment processing, and their respective privacy policies will apply.

Celvista retains a minimal record of your application for internal audit and legal compliance purposes only.

4. Legal Basis for Processing

We process your data under the following lawful bases:

• Consent, when you voluntarily submit your application or enquiry.
• Legitimate interest, to assess your suitability for employment and manage recruitment processes.
• Legal obligation, where processing is required by employment or tax law.
• Contractual necessity, if you become an employee or contractor of Celvista.
  
  

5. Data Retention

• Unsuccessful applicant data is retained for up to 12 months after the recruitment process unless you request earlier deletion.
• Successful applicants’ data will be shared with IWG plc (Regus, Spaces, HQ, etc.) and retained as part of their HR system under their data retention policies.
• After the retention period, Celvista securely deletes or anonymises all data.
  
  

6. Data Sharing and Third Parties

We may share data with trusted third‑party service providers who support our operations (for example, secure email, document storage, or IT systems).
All such parties are bound by confidentiality and data‑processing agreements that comply with UK GDPR.

Our website contains links redirecting to IWG plc, Regus, Spaces, and other affiliated sites.
Celvista has no control over those external platforms and accepts no liability for their content, security, or data handling.
Any data you provide on those websites will be governed solely by the privacy policies of the relevant operator.

7. Data Security

Celvista uses secure email systems, device passwords, and restricted access to protect personal information.
While we implement reasonable safeguards, no system is entirely secure, and data transmission is undertaken at your own risk.

8. Your Rights Under UK GDPR

You have the right to:

• Access, correct, or delete your personal data.
• Object to or restrict processing.
• Withdraw consent at any time (without affecting prior lawful processing).
• Lodge a complaint with the Information Commissioner’s Office (ICO) at www.ico.org.uk.

Requests should be sent to admin@celvista.com and will be handled within 30 days.

9. International Transfers

Celvista does not transfer personal data outside the United Kingdom or EEA.
If a transfer becomes necessary (for example, by IWG plc during onboarding), it will be governed by approved safeguards and adequacy regulations.

10. Liability and Third‑Party Responsibility

Celvista acts as the data controller only for data submitted directly via this website or to admin@celvista.com.
For any data processed by IWG plc, Regus, Spaces, or HQ, Celvista bears no liability for their data protection compliance, retention, or cyber security.
Those entities are separate controllers responsible for their own GDPR obligations.

11. Policy Updates

Celvista may update this policy from time to time.
The latest version will always be available on our website, and material changes will be noted with a new effective date.