Last updated: 6th May 2026

This GDPR Statement summarises how Quantum People complies with the United Kingdom General Data Protection Regulation (UK GDPR) and the European Union General Data Protection Regulation (EU GDPR) when we process your personal data. For full operational detail (categories of data, sources, purposes, retention periods, transfers, your rights worldwide), please see our Global Privacy Notice.

Who we are (Controller)

Quantum People is the trading name of Talent Staffing Services Limited, a private limited company registered in England and Wales (Company No. 16667216). VAT No. 500462049. Registered office: 71–75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom.

We are registered with the UK Information Commissioner’s Office (ICO) as a data controller under reference ZC027132.

Contact: privacy@talentstaffingservice.com 

EU/EEA representative and Data Protection Officer: if and when required by law, we will appoint and publish details of an EU representative and / or Data Protection Officer here. Our current Data Protection Lead is Drew Percival, COO.

Scope and applicability

This Statement applies to personal data we process — globally — in delivering our recruitment and talent‑advisory services in quantum, photonics, and deep tech. We work with candidates, clients, prospects, event participants, and partners across the United Kingdom, European Economic Area, United States, Middle East, Asia, and Australia. Where local privacy laws apply alongside the UK / EU GDPR, we comply with each in line with our Global Privacy Notice.

Our commitments to UK / EU GDPR Article 5 principles

1. Lawfulness, fairness and transparency

We process personal data only where there is a valid lawful basis and we are transparent about our uses. The Global Privacy Notice sets out purposes and legal bases — primarily:

• Legitimate interests (Article 6(1)(f)) — for recruitment services, the talent map programme, prospect engagement, and security
• Contract (Article 6(1)(b)) — for placement engagements and client agreements
• Legal obligation (Article 6(1)(c)) — for tax, employment, immigration and right‑to‑work record‑keeping
• Consent (Article 6(1)(a)) — where required, for example non‑essential cookies and certain direct electronic marketing

For our Talent Map programme (the passive enrichment of public professional information into our HubSpot CRM), we rely on legitimate interests and have prepared a documented Legitimate Interests Assessment (LIA) covering the three‑part test (purpose, necessity, balancing). A summary of this LIA is available on request via privacy@talentstaffingservice.com.

2. Purpose limitation

We collect personal data for specific, explicit, and legitimate purposes — sourcing, screening, presenting candidates, coordinating interviews, maintaining the talent map — and avoid incompatible further processing.

3. Data minimisation

We collect only what is necessary for recruitment and related operations. The Talent Map programme reads public professional sources only and excludes special‑category data; criminal‑records data is processed only where required or permitted.

4. Accuracy

We take reasonable steps to keep data accurate and up‑to‑date, including by refreshing candidate profiles and offering corrections via privacy@talentstaffingservice.com.

5. Storage limitation

We retain personal data only for as long as needed and then delete or anonymise it per our retention rules. Key periods include up to 24 months for active candidate profiles, up to 36 months for talent pool, up to 7 years rolling for talent map records (with active enrichment refreshing the period), and up to 6 years for placement and commercial records. Full schedule in the Global Privacy Notice (Section 8).

6. Integrity and confidentiality (security)

We protect personal data with appropriate technical and organisational measures: encryption in transit and at rest, access controls, least‑privilege identity, multi‑factor authentication, audit logging, employee confidentiality and training, vendor due diligence, and incident response procedures. Our cloud compute for the Talent Map programme runs on Microsoft Azure UK South region; CRM data is hosted in HubSpot under the Microsoft / HubSpot UK / EU compliance framework.

7. Accountability

We:

• Maintain Records of Processing Activities (RoPA) under UK GDPR Article 30 / EU GDPR Article 30
• Perform Data Protection Impact Assessments (DPIAs) where the risk warrants
• Maintain documented Legitimate Interests Assessments (LIAs) for legitimate‑interest processing
• Train our staff
• Apply role‑based access
• Govern our vendors via data processing terms (UK GDPR Article 28 / EU GDPR Article 28) and international transfer safeguards
• Maintain a documented DSAR Workflow to action your rights within the statutory timeframe (typically 30 days)
• Maintain a documented Personal Data Breach Response Runbook covering ICO 72‑hour notification under UK GDPR Article 33 and equivalent obligations
• Review this posture annually

International data transfers

As a global business we may transfer data outside the UK / EEA. We use approved safeguards:

• UK adequacy regulations and EU adequacy decisions where in force
• UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses for transfers from the UK
• EU Standard Contractual Clauses (SCCs) for transfers from the EEA
• UK extension to the EU‑US Data Privacy Framework and the EU‑US Data Privacy Framework where applicable
• Additional organisational and technical measures (encryption, access controls, least privilege)

Details of the specific safeguards used for transfers of your data are available on request from privacy@talentstaffingservice.com.

Sharing data and service providers

We share personal data only as necessary with: clients (to consider you for roles and manage hiring processes); service providers under contract (for example HubSpot CRM, Microsoft 365 and Microsoft Azure, Anthropic for non‑PII canonicalisation only, Jeeva for engagement, Serper for search‑engine query relay); and regulators / courts / law enforcement where required by law.

We do not sell personal data. We do not “share” personal information for cross‑context behavioural advertising under California or other US state privacy laws.

Your rights under UK / EU GDPR

You have the right to:

• Access your personal data (Article 15)
• Rectification of inaccurate data (Article 16)
• Erasure (“right to be forgotten”) (Article 17)
• Restriction of processing (Article 18)
• Object to processing based on legitimate interests, including the Talent Map programme (Article 21). Direct‑marketing objections are absolute.
• Data portability (Article 20)
• Withdraw consent where applicable (Article 7(3))
• Not be subject to solely automated decision‑making that produces legal or similarly significant effects (Article 22)

To exercise your rights, contact privacy@talentstaffingservice.com  We will respond within 30 days.

You may also lodge a complaint with the UK Information Commissioner’s Office (ico.org.uk) or your local EEA supervisory authority.

We map these UK / EU rights to other global regimes (including US state privacy laws, UAE and Saudi Arabia PDPL, Singapore PDPA, Japan APPI, South Korea PIPA, Hong Kong PDPO, India DPDP Act, China PIPL, and Australia Privacy Act) for consistency. See the Global Privacy Notice for region‑specific detail.

Cookies, marketing and PECR / ePrivacy

We operate consent‑based controls for non‑essential cookies in the UK / EU, respect the UK Privacy and Electronic Communications Regulations 2003 (PECR) and the EU ePrivacy Directive, and apply equivalent rules in other regions where required. B2B “soft opt‑in” marketing is conducted under legitimate interests with clear opt‑out under PECR Section 22 in the UK. You can opt out at any time via the unsubscribe link in any marketing email or by writing to privacy@talentstaffingservice.com.

See our Cookie Notice and the marketing section of the Global Privacy Notice for cookie categories, lifespans, and how to change your choices.

Personal data breach notification

If we experience a personal data breach that is likely to result in a risk to the rights and freedoms of natural persons, we will notify the relevant supervisory authority within 72 hours of awareness, in line with UK GDPR Article 33. Where the breach is likely to result in a high risk, we will notify affected data subjects directly without undue delay (Article 34).

Children

Our services are aimed at adults and professional users. We do not knowingly collect data from children under 16 in the UK / EEA (or the lower minimum age set by Member State law) or under 13 in the United States. If you believe a child has provided data to us, please contact us so we can delete it.

Contact and complaints

Email: privacy@talentstaffingservice.com Postal: Privacy, Talent Staffing Services Limited, 71–75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom

You also have the right to complain to the UK ICO (ico.org.uk) or your local supervisory authority. A list of EEA Data Protection Authorities is available at edpb.europa.eu.

Changes to this Statement

We may update this GDPR Statement from time to time. When we do, we will revise the “Last updated” date above and, where appropriate, provide additional notice consistent with applicable laws. The current version is always available at quantumpeople.net/gdpr/.

Talent Staffing Services Limited (trading as Quantum People) is registered in England and Wales (Company No. 16667216), VAT No. 500462049, ICO registration ZC027132. Registered office: 71–75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom.