LEGAL
Candidate Data Notice
Last updated 2 September 2026 · For everyone we represent or consider for a role
This notice is for candidates. It sits alongside our Privacy Policy and describes, in plain terms, what happens to your information once you are on our books. If you have only submitted the website enquiry form and nothing further, the Privacy Policy is the one that applies to you.
What we hold
- IDENTITY & CONTACT
- Name, email address, telephone number, city and country, right-to-work or visa status where a role requires it.
- PROFESSIONAL
- Your CV, employment history, security domains and technologies, certifications such as CISSP, CISM, OSCP or CCSP, education, and your public professional profiles.
- ROLE PREFERENCES
- Current and expected remuneration, notice period, availability, willingness to relocate, on-site or remote preference, and sectors you will or will not work in.
- PROCESS RECORDS
- Notes from our conversations, which roles you were submitted to, interview feedback, and offer outcomes.
- REFERENCES & VETTING
- Reference responses, and — only where a role requires it and only with your written consent — the results of employment, qualification or criminal-record checks.
Where it comes from
Most of it comes directly from you. We may also collect your details from your public professional profile, from a referral by someone in our network, or from a job board where you have made your profile visible to recruiters. If we approach you off the back of a public profile, we tell you so in our first message.
Our lawful basis
- Placing you in a role. Steps taken at your request in order to enter into a contract, and our legitimate interest in operating a recruitment service.
- Sending your details to an employer. Always your specific, role-by-role consent. We do not circulate CVs speculatively.
- Criminal-record and credit vetting, where a security-cleared or regulated role requires it. Your separate written consent, obtained at the time.
- Keeping you on file for future roles. Your consent, which you can withdraw at any time.
Who sees it
Your CV and details go to a prospective employer only after you have agreed to that specific submission. We tell you the organisation, the role and the person receiving it before we send anything.
Beyond that, your information is seen by Keystone Cyber consultants working on your placement, and by the processors listed in our Privacy Policy — our form provider, email and storage provider, and analytics provider. Where a role sits with an employer outside South Africa, submitting you to it involves a cross-border transfer of your details; we identify the country when we ask for your agreement.
Special personal information
We do not ask for information about your health, religion, political views, trade union membership, sexual orientation or race, and you should not include it in your CV. Where an employer runs a diversity monitoring process, participation is voluntary, the data goes to them rather than to us, and it plays no part in whether we represent you.
Automated decisions
No decision about whether to represent you or submit you to a role is made by software alone. A consultant reads every CV and makes every shortlisting decision. We do not use automated CV scoring or ranking.
How long we keep it
- ACTIVE CANDIDATES
- For as long as we are working together on your search.
- AFTER A PLACEMENT
- Five years, so that we can honour guarantee and rebate terms and meet record-keeping obligations.
- ON FILE, NOT PLACED
- 24 months from our last substantive contact. We will ask whether you want to stay on file before that period ends; if we do not hear from you, we delete your record.
- VETTING RESULTS
- Deleted within 6 months of the hiring decision.
Your rights
You can ask us at any time to show you what we hold, correct it, delete it, stop using it, or withdraw a consent you have given — including a submission already in flight, which we will withdraw with the employer on your instruction. Email hello@keystonecyber.co.za and we will respond within 30 days, free of charge.
Asking us to delete your record is straightforward and costs you nothing. It does mean we can no longer put you forward for roles, and we will not have a record of the conversations you have already had with us.
Contact
- INFORMATION OFFICER
- Scott Hayward, Managing Director — hello@keystonecyber.co.za
- TELEPHONE
- +27 62 168 8985
- REGULATOR
- Information Regulator of South Africa — inforegulator.org.za