Privacy Policy

Privacy Policy

Last updated: 1 October 2026

In accordance with Regulation (EU) 2016/679 (GDPR) and Spanish Organic Law 3/2018 (LOPDGDD), we inform website users, clients and candidates in our recruitment processes about how we process their personal data.

1. Data controller

Identity: Silvia Rodríguez Castells (Siroca Talent)
Tax ID (NIF): 47651921-S
Address: Calle Fernán Núñez 53, 28016 Madrid (Spain)
Phone: +34 629 943 067
Email: silvia@sirocatalent.com
Website: www.sirocatalent.com

We have not appointed a Data Protection Officer, as it is not required for our activity. For any question about your data, please write to silvia@sirocatalent.com.

2. What data we process and where it comes from

  • Data you provide through forms, email, phone, WhatsApp, Calendly, video calls or when you send us your CV: name, email, phone number, company, job title, CV, career history, education, job expectations and the content of your messages.
  • Data from public professional networks. In recruitment and direct search (headhunting) processes, we may collect professional data you have published on networks such as LinkedIn: name, current role and company, experience, education, skills, languages and location. If so, we will inform you when we first contact you and, in any case, within one month.
  • Browsing data, only if you accept it, through analytics cookies. More information in our Cookie Policy.

Special categories of data. We do not ask for data about health, ethnic origin, religion, political opinions or sexual orientation; please do not include it in your CV. If a process requires proof of a disability (for example, for reserved positions), we will only process it with your explicit consent and for that purpose. If you choose to share this kind of information during a coaching session, we will treat it confidentially, with your explicit consent and only to provide the service.

3. Purposes and legal basis

We use your data for the following purposes, each with its own legal basis:

  • Answering enquiries and requests for information (form, email, phone or WhatsApp). Legal basis: your consent and, where your enquiry concerns our services, steps taken at your request before entering into a contract.
  • Managing appointments and video calls (Calendly, Google Meet, Zoom or Microsoft Teams). Legal basis: pre-contractual steps or performance of a contract.
  • Providing our services to companies (project-based recruitment, direct search, embedded or interim recruitment) and managing the business relationship, including invoicing. Legal basis: performance of a contract and compliance with legal obligations (tax and accounting).
  • Managing your application if you apply for a position or send us your CV. Legal basis: your consent, given when you send us your application.
  • Contacting you and assessing your profile if we have identified you on a professional network for a direct search process. Legal basis: our legitimate interest in identifying professionals for recruitment processes, using data you have made public on professional networks. You may object at any time.
  • Keeping your CV for future processes that may match your profile. Legal basis: your consent.
  • Providing career guidance, coaching and training services. Legal basis: performance of a contract.
  • Sending you our newsletter and communications about our services. Legal basis: your consent (Article 21 of Spanish Law 34/2002, LSSI). If you are already a client, we may inform you about services similar to those you have contracted, based on our legitimate interest, unless you object. Every communication includes an unsubscribe link.
  • Protecting the website and forms against spam and automated access (Google reCAPTCHA). Legal basis: our legitimate interest in keeping the website secure.
  • Analysing how the website is used (Google Analytics). Legal basis: your consent, which you manage through the cookie banner.

You may withdraw your consent at any time, using the unsubscribe link included in every email or by writing to silvia@sirocatalent.com.

Required data. Fields marked as required in our forms are necessary to handle your request. If you do not provide them, we will not be able to reply or manage your application.

Automated decisions. We do not make decisions based solely on automated processing, nor do we carry out profiling with legal effects on you. In our recruitment processes, decisions are always made by people.

4. When we work on behalf of a client company

In some services, such as embedded or interim recruitment, we work within a client company's processes and systems. In those cases, the client company is the controller of its candidates' data and Siroca Talent acts as a data processor, under the contract signed with that company. The company's own privacy policy then applies, and you may exercise your rights with them. If you contact us instead, we will pass your request on.

5. Data retention

  • Enquiries: for as long as needed to resolve them.
  • Clients: for the duration of the business relationship and, afterwards, for the applicable legal periods (for example, tax and commercial).
  • Candidates in a process: until the process ends. If you consent to being considered for future processes, we will keep your CV for a maximum of 2 years from our last contact, unless you withdraw your consent earlier.
  • Profiles identified through direct search: if you are not interested or you object, we will delete your data when the process ends.
  • Career guidance, coaching and training: for the duration of the service and, afterwards, for the applicable legal periods.
  • Newsletter and resource downloads: until you unsubscribe or ask us to delete your data.
  • Cookies: as set out in the Cookie Policy.

Once your data is no longer needed, it will be blocked for the period during which legal liabilities may arise and then deleted.

6. Recipients

  • Client companies: if you take part in a recruitment process, we will share your application with the company looking to fill the position, always after speaking with you and once you have confirmed your interest.
  • Public authorities, where required by law (for example, the Spanish Tax Agency).
  • Service providers acting as data processors, with whom we have signed the agreements required by the GDPR: web hosting and email, form handling (FormSubmit), scheduling (Calendly), video conferencing (Google Meet, Zoom, Microsoft Teams), messaging (WhatsApp), web analytics (Google Analytics) and, in particular:
  • Kit (Kit.com, formerly ConvertKit): the email marketing platform we use to manage resource download forms, send our newsletter and handle email communications. More information in its privacy policy.
  • Google reCAPTCHA (Google Ireland Limited): a security service we use on our forms to tell people apart from automated programs. To do so, Google may collect data such as your IP address, information about your browser and device, and your interaction with the page. Its use is subject to Google's privacy policy and terms of service.

If we communicate with you through LinkedIn, that platform processes your data under its own privacy policy.

7. International transfers

Some providers (such as Google, Kit, Calendly, Zoom, Microsoft or WhatsApp) may store or process data outside the European Economic Area, mainly in the United States. In those cases, transfers are based on the European Commission's adequacy decision on the EU-U.S. Data Privacy Framework, where the provider is certified under it, or on the Standard Contractual Clauses approved by the European Commission.

8. Your rights

You may exercise the following rights at any time:

  • Access: find out what data we process about you.
  • Rectification: correct inaccurate data.
  • Erasure: ask us to delete your data.
  • Restriction: ask us to restrict processing.
  • Objection: object to a specific processing activity.
  • Portability: receive your data in electronic format.
  • Withdrawal of consent: at any time, without affecting the lawfulness of processing carried out before.

To exercise them, write to silvia@sirocatalent.com stating which right you wish to exercise. We will only ask you to prove your identity if we have reasonable doubts about it. We will reply within one month.

If you believe we have not handled your data correctly, you may lodge a complaint with the Spanish Data Protection Agency (AEPD) or with the data protection authority of your country of residence.

9. Accuracy of data

Please make sure the data you provide is accurate and let us know of any changes. If you provide data about other people, you must have informed them beforehand.

10. Data security

We apply technical and organisational measures to protect your data and prevent unauthorised access, loss or disclosure, and we treat all information confidentially.

11. Changes to this policy

We may update this policy to reflect changes in legislation or in our services. The new version will be published on this page, showing the date of the last update.

Scroll to Top