Last updated: 30 October 2026
At USPIO LTD (“USPIO”, “we”, “us” or “our”), we respect your privacy and are committed to protecting your personal data. USPIO LTD is responsible for deciding how and why your personal data is processed (the data controller) under the General Data Protection Regulation (GDPR).
This Notice explains how USPIO processes personal data about job applicants and candidates and individuals who participate in assessments and subscribe to job alerts or join our talent pool.
Our contact details
USPIO LTD
Registration number: HE 431350
Registered address: 110 Archiepiskopou Makariou III Street, 3021 Limassol, Cyprus
Privacy enquiries: privacy@uspio.ltd
We process personal data in accordance with the GDPR and applicable Cyprus data protection legislation, including Law 125(I)/2018.
The information we collect depends on the position you apply for and the stage of recruitment.
It may include:
We may also process limited health-related information if you request adjustments to help you participate in recruitment, such as an accessible interview location or additional time for an assessment.
We do not normally need information about your health, religion, political opinions, ethnic origin or other sensitive personal matters to assess your application. Please avoid including such information in your CV unless we have specifically requested it for a lawful purpose.
Most of the information we process comes directly from you, for example when you submit your CV, complete an application, attend an interview or communicate with our recruitment team.
We may also receive relevant professional information from:
If we obtain your information from another source, we will inform you about its use as required by the GDPR, usually when we first contact you or within one month of receiving it, unless a legal exception applies.
We use your personal data for the purposes described below. Each purpose has a legal basis under the GDPR.
| Why we use your data | Legal basis |
| Managing your application: Reviewing your CV, assessing your qualifications and suitability, arranging interviews, communicating with you and preparing an employment offer. | Taking steps at your request before entering into an employment contract (Article 6(1)(b) GDPR). |
| Assessing candidates and verifying qualifications: Conducting interviews and relevant recruitment assessments, checking professional qualifications and obtaining references where appropriate. | Taking steps before entering into an employment contract (Article 6(1)(b) GDPR). Where additional verification is justified by the position, our legitimate interest in making informed hiring decisions and ensuring the accuracy of information relevant to a candidate’s suitability (Article 6(1)(f) GDPR). |
| Meeting legal requirements: Verifying eligibility to work and carrying out employment, immigration or other checks required by law. | Compliance with our legal obligations (Article 6(1)(c) GDPR). |
| Managing recruitment-related complaints and claims: Keeping relevant application records for a limited period after recruitment has ended. | Our legitimate interest in demonstrating that recruitment decisions were made fairly and lawfully, responding to complaints and establishing, exercising or defending legal claims (Article 6(1)(f) GDPR). |
| Considering you for future vacancies: Keeping your candidate profile and contacting you about relevant job opportunities if you choose to join our talent pool. | Your consent (Article 6(1)(a) GDPR). |
| Protecting recruitment data and systems: Managing access to candidate information, maintaining system security and preventing or investigating unauthorised access or misuse. | Our legitimate interest in protecting candidate information, maintaining the security and integrity of our recruitment systems and preventing misuse (Article 6(1)(f) GDPR). |
Where we rely on legitimate interests, we consider whether the processing is necessary and whether our interests are outweighed by your rights and freedoms.
We may process limited health-related information if you need adjustments during recruitment.
Where this is necessary to meet our obligations under applicable Cyprus employment and disability-equality law, including Law 127(I)/2000, we may rely on Articles 6(1)(c) and 9(2)(b) GDPR, subject to the applicable legal requirements and safeguards.
We will only request information necessary to arrange the adjustment. You do not normally need to provide detailed medical records.
If we conduct voluntary equal-opportunity monitoring that involves sensitive personal data, we will ask for your explicit consent. Providing this information will be optional and will not affect your application.
For certain positions, we may need to carry out additional background checks. Checks involving criminal convictions or offences will only take place where authorised by applicable law and subject to the safeguards required by Article 10 GDPR.
We use Zoho Recruit, a cloud-based recruitment management system, to help us organise and manage applications. This system allows our recruitment team to store CVs, communicate with candidates, arrange interviews, record feedback and track the progress of applications.
This may include automated functions such as organising information or extracting details from CVs.
We do not use solely automated decisions that reject candidates or otherwise produce legal or similarly significant effects without meaningful human involvement.
If we introduce such decision-making in the future, we will provide the information and safeguards required by the GDPR before using it.
Your information is shared only with people and organisations that need it for recruitment or another lawful purpose. These may include:
Where providers process personal data on our behalf, we require appropriate contractual data protection safeguards.
We do not sell your personal data.
USPIO is based in Cyprus, within the European Economic Area (EEA).
Some of the technology and service providers we use, including providers supporting Zoho Recruit, may process or access personal data from countries outside the EEA.
Where personal data is transferred outside the EEA, we ensure that the transfer is covered by an appropriate mechanism under the GDPR. This may include a European Commission adequacy decision or Standard Contractual Clauses, together with additional safeguards where needed.
You can contact us at privacy@uspio.ltd for further information about the safeguards that apply to transfers of your personal data and how to obtain a copy.
We keep your information only for as long as we need it for recruitment or another lawful purpose.
Our standard retention periods are:
| Information | Retention period |
| Unsuccessful applications: CVs, interview notes, correspondence and other recruitment records. | 12 months after the final recruitment decision. |
| Assessment results: Technical tests and other recruitment assessments. | 12 months after the final recruitment decision. |
| Background-check documents: Supporting documents used for relevant checks. | Deleted when no longer needed and no later than 6 months after the recruitment decision or, if you are hired, 6 months after onboarding, unless a different period is required by law. |
| Talent pool: Information kept with your consent for future vacancies. | 24 months from the date of your consent, unless you withdraw it earlier. |
| Consent and security records: Records of consent, withdrawal and relevant system logs. | Generally 24 months, unless longer retention is necessary for a specific lawful purpose. |
If you are hired, information needed for your employment will become part of your employee record and will be handled under our Employee Privacy Notice.
If you are unsuccessful, we will not automatically keep your application for future vacancies. We will only include you in our talent pool if you have agreed to this separately.
We may contact you before your talent-pool consent expires to ask whether you would like us to keep your details for longer.
When the relevant retention period ends, we delete or anonymise the information, unless we need to keep it longer to comply with a legal obligation or deal with an actual or reasonably anticipated legal claim.
Under the GDPR, you have the right to:
These rights are subject to certain conditions and exceptions under the GDPR.
To exercise your rights or ask any questions about your personal data, contact us at privacy@uspio.ltd. We will normally respond within one month. If your request is particularly complex or we receive several requests, we may extend this period by up to two additional months. We will explain any extension within the first month.
We may ask for information to verify your identity where necessary.
You are generally free to decide what personal information to share when applying for a job.
However, we need certain information, such as your contact details, relevant experience and qualifications, to assess your application. Without it, we may not be able to consider you for the position.
If we offer you a job, we may also need documents to verify your identity and eligibility to work, as required by applicable law.
You do not have to agree to join our talent pool. Your decision will not affect your application for the position you have applied for.
We take appropriate steps to protect candidate information against unauthorised access, loss, disclosure or misuse.
These include restricting access to authorised personnel, using secure recruitment systems, applying appropriate technical security measures and requiring relevant service providers to protect personal data.
We also have procedures for managing personal data breaches and responding to requests concerning personal data.
If you have any questions or concerns about how we use your personal data, please contact us at privacy@uspio.ltd
You also have the right to lodge a complaint with a data protection supervisory authority.
In Cyprus, the competent authority is:
Office of the Commissioner for Personal Data Protection
Website: https://www.dataprotection.gov.cy
You may also complain to the relevant supervisory authority in another EU Member State where you live, work or where the alleged infringement took place.
We may update this Notice if our recruitment practices or legal requirements change. The latest version will be available on our website, together with the date it was last updated.