Privacy & GDPR

GRT Consulting Limited respects your privacy. This notice explains how we collect and use personal data in line with UK GDPR, the Data Protection Act 2018, and the Privacy and Electronic Communications Regulations (PECR). It covers this website (grtconsult.com) and our consultant portal at portal.grtconsult.com.

Version 2026-11-10b. Last updated 10 November 2026.

1. Who we are (the controller)

The controller is GRT Consulting Limited, a company registered in England and Wales under company number 09162170. Our registered office is The Retreat, 406 Roding Lane South, Woodford Green, Essex, IG8 8EY. Our main trading address is 71–75 Shelton Street, Covent Garden, London WC2H 9JQ. Our VAT number is 199 7795 11.

For privacy questions, to exercise your rights, or to withdraw consent, email us at info@grtconsult.com or write to us at the registered office. Telephone: +44 20 3695 9251.

2. What this notice covers

This notice applies to personal data we collect through this website (including contact and “register with us” or RFP forms) and through the GRT Consultant Portal. The portal has a more detailed candidate notice at portal.grtconsult.com/privacy, which you should read before you register or upload a CV.

This website may contain links to other sites. We are not responsible for how those sites use your data.

3. What we collect

Depending on how you use our services, we may collect:

• Identity and contact details: name, job title, company, email address, telephone number and postal address.
• Information you send us in an enquiry, RFP or “register with us” form, and records of our correspondence.
• For candidates who use the portal: account details, CV and profile information, right-to-work and availability details, and notes our staff add when considering you for roles. This is described in full in the portal Privacy Notice.
• Technical data such as IP address, browser type and pages visited, and cookies, as described in our Cookie Policy.

We do not seek to collect special category data through this website. Please do not send us health, ethnicity or similar information unless we have asked for it for a specific legal purpose (for example right-to-work checks on a placement).

4. Why we use it, and our lawful bases

We use personal data to:

• respond to enquiries, RFPs and requests to register interest in our services (legitimate interests, and where needed steps towards a contract);
• provide our consulting services and administer our relationship with clients and suppliers (contract and legitimate interests);
• operate the consultant portal, hold candidate details and CVs in our candidate database, search them, and put candidates forward for roles within GRT Consulting Limited and its affiliates, and with clients when we propose a person for a specific role (consent, given by a mandatory tick box on the portal, and legitimate interests in running a consultant network);
• meet legal obligations, including right-to-work and record-keeping duties when we place a consultant;
• keep the website and portal secure, and improve them (legitimate interests);
• send service messages about your enquiry, account or a role. We will not send general marketing by email or similar electronic means unless PECR allows it, typically with your consent or the soft opt-in where it applies. You can opt out of marketing at any time.

You can withdraw consent at any time by emailing info@grtconsult.com or, for portal accounts, by deleting your account from your profile page. Withdrawal does not affect processing already carried out. If you withdraw candidate-database consent, we will stop using your profile to search or put you forward for roles and will delete that data, unless we must keep a limited record to meet a legal obligation.

5. Who we share it with

We may share personal data with:

• authorised GRT staff;
• affiliates of GRT Consulting Limited, so they can consider candidates for roles or help us deliver services;
• clients, when we propose a candidate for a specific role, or when needed to deliver a project you have asked us about;
• service providers who process data for us (for example website and application hosting, email delivery, and the optional AI model used to pre-fill a portal profile). They may only use the data on our instructions;
• professional advisers, and anyone we must disclose data to if the law requires it.

Original CV files uploaded to the portal are stored privately and are not published on this website.

6. International transfers

GRT places consultants in the United Kingdom, India, Germany, Hong Kong, Japan and Australia. If we put you forward for a role, or if we deliver work involving those locations, your personal data may be accessed or received in those countries by our affiliates or by the relevant client. Some of our processors may also be located, or may store data, outside the UK.

Where we transfer personal data outside the UK to a country that is not covered by a UK adequacy regulation, we use appropriate safeguards, such as the UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses. You can ask us for more information about these safeguards using the contact details above.

7. How long we keep it

We keep website enquiry and correspondence data for as long as we need it to deal with your request and our legitimate business records, and then delete or anonymise it.

We keep consultant portal accounts, profiles and CVs for 72 months (six years) after the candidate’s last sign-in or profile update. This period is aligned with the six-year limitation period under the Limitation Act 1980 for potential legal claims, and allows us to match candidates to future roles over a similar horizon. Candidates can withdraw consent or request deletion at any time. We may keep a limited record for longer if the law requires it. The period is also stated in the portal notice.

8. Your rights

You have the right to access, correct, download (port) or delete your data, to withdraw consent, to restrict or object to certain processing, and not to be subject to a solely automated decision with legal or similarly significant effects. We do not make solely automated decisions of that kind about you.

To exercise these rights, email info@grtconsult.com. Portal users can also download or delete their data from their profile page.

You also have the right to complain to the UK Information Commissioner’s Office (ICO) at ico.org.uk, or by calling 0303 123 1113.

9. Cookies

This website uses cookies as described in our Cookie Policy. The consultant portal uses only strictly necessary cookies to keep you signed in and to protect the service; those are allowed under PECR without a consent banner, and the portal does not use advertising cookies.

10. Security

We protect personal data with appropriate technical and organisational measures, including HTTPS, access limited to authorised staff, hashed passwords on the portal, and private storage of CV files. No method of transmission or storage is completely secure, but we take steps to reduce the risk of unauthorised access, loss or misuse.

11. Changes

If we change this notice we will update the version and date on this page. If a change is material we may also ask candidates to review the portal notice and tick the consent box again the next time they submit data.