Privacy Policy
Last updated 13 September 2026.
Last updated 13 September 2026.
The Outstaff Solutions name is used by three separate legal entities under common ownership: Outstaff Solutions Limited, incorporated in England and Wales (Company No. 17272604); Outstaff Solutions & Technology FZCO, licensed in the IFZA free zone, Dubai (Reg. 79670); and Outstaff Solutions, an association of persons registered in Pakistan (Reg. J177366). These are independent companies rather than a parent and its subsidiaries. Together they provide workforce augmentation and managed services to clients internationally, and are referred to in this policy as “Outstaff Solutions”, “we”, “us” or “our”. This policy describes how we collect, use, disclose and otherwise process personal data through this website and in connection with our services, and the rights available to individuals in respect of that data.
Outstaff Solutions Limited, whose registered office is at 2 Redwood Garden, Godolphin Road, Slough, England, SL1 3DT, United Kingdom, is the controller of personal data collected through this website. We process personal data in accordance with applicable data protection law, including the UK General Data Protection Regulation and the Data Protection Act 2018 and, in respect of our Dubai operation, Federal Decree-Law No. 45 of 2021 of the United Arab Emirates.
Where we process personal data on behalf of a client under a written agreement, the client is the controller of that data and its own privacy notice applies. This policy does not apply to that processing, or to individuals employed or engaged by Outstaff Solutions, who receive a separate notice.
Please do not submit information relating to health, ethnicity, religion or criminal records unless we have requested it. Any such information received will be deleted unless we have a lawful basis for retaining it.
We use cookies and similar technologies for informational and analytics purposes only.
We do not use cookies for advertising, we do not create behavioural or advertising profiles, we do not permit third parties to track you across other websites through this site, and we do not sell cookie data or disclose it for the marketing purposes of others. No cookie other than a strictly necessary cookie is set before you consent. Consent may be refused as easily as it is given and may be varied or withdrawn at any time through the cookie preferences link on this site.
How our analytics is configured. This site uses Google Analytics 4 with Google Consent Mode v2 in advanced mode. If you accept analytics in the cookie banner, analytics cookies are set. If you decline or do not answer, no cookies are set and nothing is stored on your device, but limited cookieless signals (including IP-derived, non-identifying data) still reach Google and are used only for aggregate modelling. You can decline analytics cookies in the banner at any time.
Third-party links. The WhatsApp button on this site opens a chat with us on WhatsApp, and Meta receives that interaction. Links to LinkedIn, Instagram and Facebook are plain links, not embedded trackers.
| Purpose | Lawful basis |
|---|---|
| Responding to enquiries and providing requested information | Necessary for our legitimate interests (responding to those who contact us); performance of a contract, or steps taken at your request prior to entering one |
| Sourcing, assessing and introducing candidates to clients | Necessary for our legitimate interests (matching professionals to roles); performance of a contract once an offer has been accepted |
| Holding a candidate profile created on our Find a job page in our talent bank, showing an anonymised version of it to clients through our client portal, and releasing that candidate’s identity to a client | Consent, given when the profile is created and again, separately, for each release of identity. Consent may be withdrawn at any time |
| Security logging and fraud prevention for the talent bank and the client portal | Necessary for our legitimate interests (keeping the portal secure and preventing misuse of the profile form) |
| Verifying identity, qualifications, references and right to work | Necessary for our legitimate interests (accuracy of information provided to clients); compliance with a legal obligation where a check is required by law |
| Administering engagements, contracting, invoicing and payment | Performance of a contract; necessary for our legitimate interests |
| Analytics cookies and business communications | Consent, which may be withdrawn at any time |
| Legal, regulatory, tax and accounting compliance | Compliance with a legal obligation |
| Establishing, exercising or defending legal claims, and information security | Necessary for our legitimate interests |
Processing carried out by our Dubai operation is founded on consent or on a corresponding ground permitted under applicable UAE law. We do not take decisions producing legal effects, or otherwise significantly affecting you, by automated means alone.
This section is for people who create a profile on our Find a job page. It explains what we collect, what we do with it, what a client can see, and the choices you have. It applies together with the rest of this policy.
The form asks for:
You must tick the consent box before the form can be sent. We record that you ticked it, and when. We also record the page the form was sent from and the IP address it was sent from, in an internal security log. We use the IP address to limit the number of profiles that can be sent from one address in a short time. When your profile reaches our portal we send an acknowledgement email to the address you gave. If you did not create the profile, tell us and we will remove it.
If our portal cannot be reached at the moment you send the form, your details are delivered to us by email through our form-handling provider instead of directly into the portal.
During screening, one of our consultants may add information to your profile, for example your current employer, your current job title and a short headline describing your experience.
We hold your profile in our talent bank. Nothing in it is visible to any client until one of our consultants has screened it and chosen to list it. Once listed, an anonymised version of your profile is shown to prospective employer clients who use our client portal. A client who is interested can ask us for an introduction.
The anonymised profile contains only:
The anonymised profile never includes your name, email address, phone number, current employer, current job title, city, LinkedIn profile or salary expectation. Your skills are shown to clients exactly as you typed them, so please do not put your name, your employer or your contact details in that field.
We use the word anonymised because a client cannot tell who you are from what they see. Outstaff Solutions can, because we hold the record that the reference number points to. In data protection terms the profile is therefore pseudonymised rather than anonymous, and it remains your personal data, protected by everything in this policy.
Two separate decisions are needed before a client learns who you are.
Only if you agree is that information shown to that one client. If you do nothing, nothing is shared. If you decline, nothing is shared and the rest of your profile is not affected. You are not asked for a reason and the client is not given one.
A release lasts 90 days from the date you agree. After that the client can no longer see your details and must ask again, and both decisions are made afresh. If you withdraw your profile from the talent bank, every open or approved introduction is closed at the same time.
We keep your profile for two years from the date you gave consent. At the end of that period we review it. The general rules under Retention below also apply. You can ask us to correct or remove your profile at any time by emailing info@outstaffsol.com.
We rely on your consent to hold your profile and to show the anonymised version to clients. We rely on your separate consent for each release of your identity to a client. You can withdraw either consent at any time. Withdrawing consent does not affect processing that has already taken place. We rely on our legitimate interests for security logging and fraud prevention, including the IP address log described above.
Because our three entities share one system, your profile can be accessed by Outstaff Solutions staff in the United Kingdom, the UAE and Pakistan. Where that means your information is accessed from a country that does not have a UK adequacy decision, we have appropriate safeguards in place, using the UK International Data Transfer Agreement.
Two-factor authentication is mandatory for every Outstaff Solutions administrator and consultant account, which are the only accounts that can see the full talent bank. When one of our staff opens your full record, that is logged, together with who opened it and when. Every step of an introduction is also logged: the client’s request, our decision, your answer and any withdrawal. The links we email you work once and are stored only in hashed form, so a copy of our database would not contain a working link.
You can ask us to correct or remove your profile at any time, and you can withdraw your consent at any time, by emailing info@outstaffsol.com. Withdrawing consent does not affect what has already been done with your consent. You also have the rights described under Your rights below: to access your data, to have it corrected or erased, to restrict or object to its processing, and to receive a copy of it in a portable form. You can complain to the Information Commissioner’s Office at any time.
We disclose personal data to:
We do not sell personal data and we do not disclose it to third parties for their own marketing purposes.
Because we operate internationally, personal data may be transferred to and accessed from countries other than the one in which it was collected, including the United Arab Emirates and Pakistan. Where a transfer is made to a country that does not benefit from an adequacy decision, it is made under the International Data Transfer Agreement or the UK Addendum to the European Commission’s standard contractual clauses issued by the Information Commissioner’s Office, as applicable, supported by a documented transfer risk assessment. Transfers between Outstaff Solutions entities are governed by an intra-group agreement which requires each entity to protect personal data to a standard equivalent to that required under United Kingdom data protection law. A copy of the applicable safeguards is available on request.
We retain personal data for no longer than six years, and only for as long as necessary to fulfil the purposes for which it was collected, including to satisfy applicable legal, accounting, tax and reporting requirements. In determining the appropriate period we consider the amount, nature and sensitivity of the personal data, the purposes for which it is processed, and whether those purposes can be achieved by other means. Relevant retention periods may vary according to the national law of the country in which an individual is based.
Candidate records carry an explicit retention date, typically two years from consent, at which point they are reviewed. Identity documents are deleted once verification has been recorded. Records of marketing objections are retained for as long as we carry out marketing, so that those objections continue to be honoured. Where personal data is relevant to a claim, investigation or audit, deletion is suspended until the matter has concluded. Where personal data is no longer required it is deleted or anonymised; where deletion is not immediately possible, it is securely stored and isolated from further processing until deletion is possible.
We take appropriate technical and organisational measures designed to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure and unauthorised access. These include limiting access to personal data to those who need it for the purposes described in this policy, confidentiality obligations binding on our personnel, and the selection of reputable service providers whose platforms carry recognised security certifications. This website is served over an encrypted connection. No method of transmission or storage is ever completely secure, and we cannot guarantee absolute security. Where a personal data breach is likely to result in a risk to affected individuals, we will notify the relevant supervisory authority, and those individuals where the risk is high, within the periods required by law.
In accordance with applicable law, you may have the right to request access to your personal data; to request its correction or erasure; to request restriction of processing; to data portability; to object to processing carried out on the basis of our legitimate interests; to object to direct marketing; and to withdraw consent where processing is based on it. We extend the rights set out above to all individuals whose personal data we process, regardless of location, except where applicable law provides otherwise.
Please note that these rights are subject to conditions and exceptions. Requests may be made using the contact details below. You will not have to pay a fee, we will take steps to verify your identity before responding, and we will respond within one month, or within any other period prescribed by applicable law. Where a request is manifestly unfounded or excessive we may refuse to act on it, in which case we will explain why.
Complaints should be raised with us in the first instance and will be acknowledged within 30 days and answered without undue delay. You may also complain to the Information Commissioner’s Office (ico.org.uk/make-a-complaint, 0303 123 1113) or, in the United Arab Emirates, to the UAE Data Office. This does not affect your right to seek a remedy before the courts.
We review this policy periodically. The date above indicates when it was last updated. Where a change is material we will notify you directly or by prominent notice on this website.
info@outstaffsol.com, marked “Privacy”. Written correspondence should be addressed to Data Protection, Outstaff Solutions Limited, 2 Redwood Garden, Godolphin Road, Slough, England, SL1 3DT, United Kingdom.