Legal
Xeltec Privacy Policy
How we collect, use, share and protect personal information.
1. Who we are and what this policy covers
Xeltec LLC (“Xeltec”, “we”, “us”) is a Workday and AI staffing company based at 44679 Endicott Dr Unit 438, Ashburn, VA 20147, USA. We are the controller of the personal information described in this policy.
This policy explains how we collect, use, share and protect personal information when you:
- visit www.xeltec.com (the “Site”);
- contact us or book a call as a current or prospective client or partner; or
- apply for, are considered for, or are placed in a role through us as a candidate or consultant.
If you are in the European Economic Area (EEA) or the United Kingdom, the EU General Data Protection Regulation (GDPR) and the UK GDPR give you specific rights, described in section 8.
Questions: email hr@xeltec.com or write to us at the address above.
2. Information we collect
Clients, partners and other business contacts. When you use a form on the Site or email us, we collect your name, work email, phone number, company or organization, the service or challenge you select, any message you send, and whether you have asked us to sign an NDA. We also keep records of our calls, emails and meetings with you.
Candidates and consultants. When you apply to us, are introduced to us, or we contact you about a role, we may collect:
- contact details (name, email, phone, location, LinkedIn or other professional profiles);
- your CV or resume, work history, skills, certifications (for example Workday, SAP, ServiceNow or Oracle), education and languages;
- role preferences, availability, notice period and rate or salary expectations;
- interview notes, assessment results and references;
- right-to-work or work authorization information, and background check results where a client role requires them and the law allows; and
- for consultants we place, the information needed to engage and pay you, such as tax and bank details and timesheets.
We collect candidate information from you directly, and from public professional sources such as LinkedIn, job boards, referrals and your references.
We do not ask for sensitive information (such as health, ethnicity, religion or criminal records) unless the law requires it or a role specifically and lawfully requires it, and we will tell you before we do.
Information collected automatically. When you visit the Site, our hosting servers may record your IP address, browser and device type, pages visited, referring website and the date and time of your visit. See section 9 for cookies.
3. How we use your information
We use personal information only for the purposes below. For people in the EEA and UK, the table also shows the legal basis we rely on.
| Purpose | Legal basis (GDPR / UK GDPR) |
|---|---|
| Replying to enquiries, booking calls and arranging NDAs | Legitimate interests (responding to business enquiries); steps before entering a contract |
| Providing staffing services to clients and managing our client relationships | Performance of a contract; legitimate interests |
| Finding, assessing and matching candidates to roles | Legitimate interests (running a recruitment business); your consent where we ask for it |
| Submitting a candidate’s profile to a client for a specific role | Legitimate interests; we always get your agreement before sending your profile to a client |
| Engaging, onboarding and paying consultants | Performance of a contract; legal obligation |
| Right-to-work and background checks | Legal obligation; legitimate interests of our clients; consent where required by law |
| Sending relevant updates, insights or opportunities | Consent, or legitimate interests for existing business contacts, always with an easy opt-out |
| Running, securing and improving the Site | Legitimate interests |
| Meeting legal, tax and accounting duties and defending legal claims | Legal obligation; legitimate interests |
We do not sell your personal information, and we do not make decisions about you based solely on automated processing that have legal or similarly significant effects.
5. International transfers
Xeltec is based in the United States, so information you send us is processed in the US. It may also be processed in other countries where our team or our service providers (Microsoft and Vultr) operate.
These countries may not have the same data protection laws as the EEA or UK. Where we or our service providers transfer personal information of people in the EEA or UK, we use recognised safeguards, such as the European Commission’s Standard Contractual Clauses, the UK International Data Transfer Addendum, or the EU-US Data Privacy Framework and its UK Extension where a provider is certified.
You can ask us for more information about these safeguards using the contact details in section 10.
6. How long we keep your information
We keep personal information only as long as we need it for the purposes in section 3, then delete or anonymize it.
| Type of information | How long we keep it |
|---|---|
| Website enquiries that do not lead to business | 24 months after our last contact |
| Client and partner records | Length of the relationship plus 6 years for legal, tax and contract purposes |
| Candidate profiles | 24 months after our last meaningful contact with you, unless you ask us to keep or delete it sooner |
| Placed consultants’ engagement records | Length of the engagement plus 7 years for tax and accounting purposes |
We may keep information longer where the law requires it or to deal with a legal claim.
7. How we protect your information
We use technical and organizational measures to protect personal information against loss, misuse and unauthorized access. These include encrypted connections (HTTPS) on the Site, access controls that limit data to staff who need it, multi-factor authentication on our business accounts, and confidentiality obligations for our staff and consultants. Our information security practices are certified to ISO/IEC 27001.
No system is completely secure. If a data breach is likely to put your rights at risk, we will notify you and the relevant authorities as the law requires.
8. Your rights
If you are in the EEA or UK, you have the right to:
- access the personal information we hold about you and get a copy;
- correct information that is inaccurate or incomplete;
- delete your information (“right to be forgotten”);
- restrict how we use your information;
- object to our use of your information based on legitimate interests, and to direct marketing at any time;
- data portability, receiving information you gave us in a commonly used format; and
- withdraw consent at any time, where we rely on consent. This does not affect anything we did before you withdrew it.
To use any of these rights, email hr@xeltec.com. We may need to confirm your identity. We will respond within one month, or tell you within that month if we need longer for a complex request.
Complaints. If you are unhappy with how we handle your information, please tell us first at hr@xeltec.com. We will acknowledge your complaint within 30 days and keep you updated until it is resolved. You also have the right to complain to a data protection authority: in the UK, the Information Commissioner’s Office (ico.org.uk); in the EEA, the authority in the country where you live or work.
If you are in the United States, some state laws give you rights to access, correct and delete your personal information and to opt out of certain uses. Whether or not those laws apply to Xeltec, you can make any of these requests by emailing hr@xeltec.com, and we will not treat you differently for doing so.
10. Other important information
Children. The Site and our services are for businesses and working professionals. We do not knowingly collect information from anyone under 16. If you believe we have, contact us and we will delete it.
Marketing emails. Every marketing email we send includes an unsubscribe link. You can also opt out at any time by emailing hr@xeltec.com. We will still send you messages needed for an active engagement or application.
Third-party websites. The Site links to other websites, such as our LinkedIn and Instagram pages. Those sites have their own privacy policies, and we are not responsible for them.
Changes to this policy. We may update this policy from time to time. We will post the new version on this page with a new “last updated” date, and tell you directly about significant changes where appropriate.
Contact us. Xeltec LLC, 44679 Endicott Dr Unit 438, Ashburn, VA 20147, USA · hr@xeltec.com · +1 202 816 7503