Privacy Notice

MB MILSHAM (“Milsham”, “we”) is the controller of the personal data described in this notice. Milsham provides recruitment and professional services in the European Union.

• Privacy contact: shameem@milsham.com
• Contact form: choose “Privacy or data request”

Workers who register: name, email address, WhatsApp number, nationality, country of residence, profession, years of experience, availability, languages, preferred work countries, notes you add, profession details (such as licence categories, Code 95 status, ADR, certificates and skills) and, if you choose to upload one, your CV.

Employers and other enquirers: name, company name, email address, WhatsApp number and the content of your message or request.

Technical data: to protect our forms against abuse we process your IP address. We store it only as a one-way keyed hash for rate limiting and security logs, never in readable form.

• Reviewing your registration and finding suitable work — to take steps at your request before entering into a contract, and our legitimate interest in providing recruitment services (GDPR Art. 6(1)(b) and (f)).
• Publishing a public profile — only with your explicit consent (Art. 6(1)(a)), which you can withdraw at any time.
• Answering enquiries from employers and individuals — our legitimate interest in responding to requests and providing our services (Art. 6(1)(f)).
• Security, fraud and abuse prevention — our legitimate interest in protecting our website and the people who use it (Art. 6(1)(f)).
• Legal obligations — where the law requires us to keep or disclose information (Art. 6(1)(c)).

If — and only if — you consent and our team approves your profile, we show a summary in our worker directory: your first name and the first letter of your surname (for example “Anna K.”), a reference number (for example W-1001), your profession and professional title, country of residence, years of experience, availability, qualifications, skills, languages and preferred work countries.

We never publish your full name, email address, phone or WhatsApp number, CV, identity documents, exact address or our internal notes. Employers contact Milsham, not you, and we manage every introduction. If you agreed to a public profile under an earlier version of this notice, your profile stays anonymous (without your name) unless you agree again.

We share a candidate’s details with a prospective employer only as part of the recruitment process and in line with your registration. We do not sell personal data.

We use carefully selected service providers acting on our instructions (processors), such as website hosting, database and secure file storage providers. They may only use the data to provide their service to us.

We aim to keep personal data within the European Economic Area. If a provider processes data outside the EEA, we rely on appropriate safeguards such as an adequacy decision or the European Commission’s standard contractual clauses.

• Active worker registrations are kept while you remain interested in work through us. We review profiles that have not been updated for 24 months and contact you or delete them.
• Rejected registrations are deleted after 6 months.
• Closed enquiries from employers and individuals are deleted after 24 months.
• Resolved profile update requests are deleted after 12 months.
• Security and audit logs contain no contact details and are kept for 24 months.

Under the GDPR you have the right to:

• access the personal data we hold about you and receive a copy;
• have inaccurate data corrected or incomplete data completed;
• have your data deleted, or its use restricted, in certain circumstances;
• receive your data in a portable format;
• object to processing based on our legitimate interests;
• withdraw your consent to a public profile at any time, without affecting earlier processing.

To exercise these rights, use the Update Profile page or contact us. To protect you, we verify requests through the email address or WhatsApp number already registered with us before acting on them.

You also have the right to lodge a complaint with a data protection supervisory authority, in particular in the EU country where you live or work.

Our public website does not use advertising or analytics cookies. A strictly necessary security cookie is set only when an authorised Milsham administrator signs in to the internal admin area.

Data is transmitted over encrypted connections. CVs are kept in private storage that is never publicly accessible and can only be opened by authorised staff through an authenticated, logged admin area protected by multi-factor authentication. Access to personal data is limited to the people who need it.

We may update this notice from time to time. The date at the top shows when it last changed, and we record which version was in force when you registered.