Privacy notice

Who we are and how to contact us

Signal GTM Ltd, trading as SignalGTM, is the controller of personal information used for our website enquiries, specialist recruitment, business relationships, market research and SignalME expressions of interest. This notice explains how we handle information relating to candidates, client contacts, prospective clients, community contacts and website visitors. Contact us at hello@signalgtm.io with the subject ‘Privacy request’.

Information we collect

We collect contact and professional information such as your name, email address, company, role, professional interests and messages. Recruitment information may include your CV, work history, qualifications, location, compensation expectations, availability, career preferences and notes from conversations. We may also hold correspondence, interview feedback, reference information where relevant, business-contract records and records of your privacy or marketing choices. Please do not send identity documents, financial-account details or sensitive information through an initial enquiry unless we specifically request it through an appropriate process.

Where information comes from

Information comes directly from you, from client hiring teams and authorised introductions, and from professional sources such as LinkedIn, company websites, published announcements and business-information providers. Where we obtain information indirectly, we explain the relevant source and categories in our first appropriate communication or otherwise within the time required by law. You can ask where information about you came from.

Why we use it and our UK/EU lawful bases

We use information to respond to enquiries, understand hiring needs, assess relevant experience, discuss opportunities and coordinate introductions and interviews. Our legitimate interests are providing specialist recruitment and research services, maintaining relevant professional relationships and protecting the business; we consider your interests and reasonable expectations. Where we take steps at your request to enter a contract, or perform a contract with you personally, the basis may be contractual necessity. Handling contracts, invoices and legal requirements may rely on contractual necessity or legal obligations as applicable. Optional community marketing and other activities requiring permission rely on consent. Where electronic-marketing rules require consent, we obtain it; otherwise relevant business communications may rely on legitimate interests, subject to your right to object. Website security and abuse prevention rely on legitimate interests. A privacy-notice acknowledgement is not consent to marketing.

SignalME expressions of interest

The SignalME form collects your first name, last name, email address and selected universe to respond to your interest and help shape relevant future community participation. It does not create a community account. Occasional community marketing is a separate, optional choice. You can withdraw that choice at any time by contacting us or using an unsubscribe option in the communication. Withdrawal does not affect the lawfulness of earlier consent-based processing.

AI support and human decisions

Our recruitment model uses data and AI to support research, preparation and organisation of professional information. Consultants review the resulting information and remain responsible for recommendations and introductions. The website enquiry forms do not automatically decide who is hired, shortlisted or admitted to a community. AI support is not a guarantee of accuracy. Contact us to correct information or discuss a recommendation. Any future solely automated decision-making with legal or similarly significant effects would require additional information and safeguards before use.

Sensitive information

We do not request special-category information, criminal-offence information or government identifiers in the initial website forms. If a recruitment process needs sensitive information, we will explain the purpose and applicable lawful basis and additional condition before collecting or using it. Avoid including unnecessary sensitive details in your CV or message.

Who receives information

Information may be accessed by authorised Signal personnel and service providers supporting hosting, email, recruitment records, document storage, security and agreed research or AI support. We share relevant candidate information with hiring organisations as part of an agreed recruitment process, and discuss intended introductions with candidates. Hiring organisations may be independent controllers with their own notices. Professional advisers, regulators or authorities may receive information where necessary for advice, legal obligations or legal claims. We aim to disclose only information needed for the relevant purpose. We do not use information submitted through the website enquiry forms for selling personal information or cross-context behavioural advertising.

International processing

Our work covers the UK, United States and European markets, and information may be accessed by relevant recipients or service providers in other countries. Where UK or EU rules restrict a transfer, an appropriate transfer mechanism is required, such as a relevant adequacy decision or approved contractual safeguards with any necessary additional measures. Contact us for the destinations and safeguards relevant to your information and to request a copy or explanation of applicable safeguards.

How long we keep information

Retention depends on the purpose and whether a continuing relationship or legal requirement justifies keeping the record. Enquiry and community-interest records are kept while needed to respond or manage the relevant relationship. Recruitment records are kept while relevant to an active search or an agreed ongoing recruitment relationship, considering accuracy, recent contact and your preferences. Contract and financial records may need to be kept for statutory accounting requirements and applicable limitation periods. Legal holds or disputes can require longer retention. Minimal suppression records may be retained to respect an objection or unsubscribe request. We assess purpose, relevance, legal requirements and claims when deciding whether to delete or anonymise information. Ask us for the retention position for a particular record.

Website submissions and security

The supplied enquiry form sends your submission to Signal’s configured email inbox. CV attachments use a temporary server file that is removed after the mail attempt; this does not remove copies retained in the recipient mailbox or subsequently used in the recruitment process. The form does not create a separate website submission archive. A short-lived keyed value derived from an IP address is used to limit repeated submissions. Hosting and email systems may maintain their own operational records. Access controls and other safeguards should match the information processed; no internet transmission or storage system is risk-free.

Cookies and external services

WordPress, the hosting environment and enabled plugins may use cookies or similar technologies for essential functions, administration or security. Optional analytics or advertising technologies require separate assessment and, where required, prior consent and clear choices. This notice does not constitute consent to non-essential cookies. Your browser can control or delete cookies, although essential functionality may be affected. Following an external link, such as LinkedIn, takes you to a service governed by its own privacy information.

Your UK and EU rights

Where UK or EU data-protection law applies, you may request access, correction, erasure, restriction and, where applicable, portability of your information. Rights depend on the circumstances and lawful basis; some records may need to be retained for legal obligations or claims. You may withdraw consent where consent is the basis. We may need proportionate information to verify your identity, and will respond within the applicable legal time limit. You do not have to provide optional information. Required form fields are needed to process the enquiry; if you prefer not to use the form, you can contact us by email.

Your right to object

You can object at any time to direct marketing, including related profiling. You can also object to processing based on legitimate interests for reasons relating to your situation. Send your request to hello@signalgtm.io. We will stop direct marketing following an objection and assess other objections in accordance with the applicable law.

United States privacy rights

US rights depend on your state, the context of the information and whether the relevant law applies to Signal. Employment-related or business-contact information may be treated differently from consumer information. Where applicable, rights may include access or confirmation, correction, deletion, a portable copy, and opting out of sale, sharing, targeted advertising or certain consequential profiling. California law also provides rights concerning sensitive personal information and protection against discrimination for exercising applicable rights. Send requests to hello@signalgtm.io and identify your state and request. We will verify identity where required and explain any applicable exception. An authorised agent may act for you with the proof required by law. Where state law provides an appeal, reply to our decision asking for an appeal; we will explain the outcome and the relevant regulator route. Applicable recognised opt-out signals, including Global Privacy Control, must be honoured where relevant processing and law require it.

Complaints

Contact us first if you would like us to investigate a concern. This does not limit your right to complain to a regulator. In the UK, contact the Information Commissioner’s Office at https://ico.org.uk/make-a-complaint/ or call +44 303 123 1113. In the EU/EEA, you may complain to the competent supervisory authority, including in the country where you live or work. A list is available at https://www.edpb.europa.eu/about-edpb/about-edpb/members_en. In the US, applicable complaints may be made to the relevant state privacy regulator or attorney general.

Updates

We update this notice when our processing or relevant requirements change. Material changes will be communicated where required. This notice was prepared on 5 October 2026. Additional information may be provided for a particular search, service, sensitive-data process or new technology before that processing begins.