This notice explains what personal data Capital Placement Ltd collects, why we collect it, how we use artificial intelligence (AI), who we share data with, how long we keep it, and the rights you have under UK law and, if you are in the European Union, EU law. We have written it in plain English. If anything is unclear, email us at info@capital-placement.com.
Who we are
Capital Placement Ltd ("Capital Placement", "we", "us") is a global talent mobility and internship placement company registered in England and Wales under company number 08246863. Our registered office is Kemp House, 152-160 City Road, London EC1V 2NX, United Kingdom.
We are the controller of the personal data described in this notice. This means we decide why and how your personal data is used. We are registered with the Information Commissioner's Office (ICO), the UK data protection regulator, under registration number ZA208197.
Privacy questions, requests and complaints: info@capital-placement.com or by post to the address above, marked "Data Protection".
Who this notice covers
This notice applies to you if you are:
- a candidate or applicant for an internship, placement, work experience, training programme or freelance engagement arranged through us, or someone who registers interest in one;
- a participant on one of our programmes, including after the programme ends;
- a contact at a host company, employer, university, college, government body, sponsor or partner organisation that works with us;
- a visitor to our websites, including capital-placement.com and our application portal, or someone who uses our website chat assistant;
- a supplier, adviser or other business contact; or
- a parent, guardian or emergency contact whose details a participant gives us. If you give us someone else's details, please let them know and point them to this notice.
It does not cover our own employees and job applicants for roles at Capital Placement, who receive a separate staff privacy notice. Our websites link to other sites (for example social media). Those sites have their own privacy notices and we are not responsible for them.
The personal data we collect
What we collect depends on your relationship with us. The table below shows the main categories.
| Category | Examples |
|---|---|
| Identity | Name, title, date of birth, gender, nationality, photograph. Identity documents such as a passport or national ID are requested only once you enrol on a programme, where they are needed for a visa, right-to-work check, insurance or travel booking, never at application stage. They are never stored on our website. |
| Contact | Email address, phone number, postal address, social media handles, emergency contact details. |
| Application and career | CV, cover letter, education history, qualifications, transcripts, work history, skills, languages, references, portfolio, interview notes and recordings, assessment results, preferred locations and sectors. |
| Programme and placement | Programme chosen, host company, start and end dates, visa and immigration details, travel and accommodation bookings, insurance, attendance, feedback and evaluations. |
| Financial | Payments are taken by a specialist payment provider. We never see or store full card details. We hold invoices, payment records and, where relevant, bank details for refunds or payments to freelancers, and funding or sponsorship information. |
| Special category data | Most of the time we do not need any. Where it is absolutely necessary, for example medical information for travel insurance or a visa, or accessibility needs so we can support you, we will tell you why we need it and ask for your explicit consent at that point. Equality monitoring data is only ever collected if you choose to give it. |
| Technical and usage | IP address, browser and device type, operating system, pages viewed, referral source, time and length of visits, cookie identifiers. |
| Marketing and preferences | Your marketing choices, survey responses, event registrations, competition entries. |
| Communications | Emails, messages, call notes, chat transcripts (including with our AI chat assistant), and support requests. |
| AI-generated data | Summaries, extracted CV fields, match scores and suggested rankings that our AI tools produce from the information above (see "How we use artificial intelligence"). |
You do not have to give us any personal data. But if you do not give us the details we need to process an application or run a programme (for example your CV, contact details or passport details for a visa), we will not be able to provide that service to you. Special category data and equality monitoring data are always optional.
Our programmes and services are for people aged 18 and over. We do not knowingly collect data from anyone under 18. If we have reason to believe that a record relates to someone under 18 we will delete it. If you are a parent or guardian and believe we hold data about your child, contact us at info@capital-placement.com and we will delete it.
Where we get your personal data
- Directly from you, when you apply, register, complete a form or survey, contact us, attend an event, use our chat assistant, make a payment or use our services.
- From partner organisations that promote or run programmes with us. These include universities, colleges, educators and training providers, government bodies and agencies, non-governmental and non-profit organisations, foundations and sponsors, professional bodies, companies, and agencies that promote our services in their country. They pass us your details when you register interest, apply through them, or are nominated or referred by them.
- From host companies and employers, for example interview feedback, evaluations and attendance.
- From listing portals and directories that advertise our programmes, such as GoAbroad, GoOverseas and GapYear.com.
- From referees you name.
- From publicly available sources, such as LinkedIn, professional networks and company websites, mainly for business contacts at organisations we work with.
- From our technology providers, for example our applicant tracking system, CRM, marketing and enrichment tools, which may add or verify business contact details.
- Automatically, through cookies and similar technologies when you use our websites (see "Cookies and similar technologies").
Because we work with many partners, we describe them here by type rather than by name. Where we receive your data from someone else, we will tell you within one month, when we first contact you, or before we first share your data with anyone else, whichever is soonest, and we will name the specific organisation that gave us your details where we hold that information. We ask every partner to tell you that your details will be shared with Capital Placement at the point you give them.
Why we use your personal data and our legal basis
UK data protection law requires us to have a legal basis for each use of your personal data. The table below sets out our purposes and the basis we rely on.
| What we do | Legal basis |
|---|---|
| Process your application, assess suitability, match you with placements, arrange interviews and communicate with you about your application | Performance of a contract with you, or steps you ask us to take before entering one. |
| Deliver your programme: placement, visa support, travel, accommodation, insurance, orientation, support during the placement, certificates | Performance of a contract with you; legitimate interests (running our programmes well). |
| Share your profile with prospective host companies | Performance of a contract with you, or steps you ask us to take before entering one. |
| Process payments, refunds, invoices and payments to freelancers | Performance of a contract; legal obligation (tax and accounting). |
| Comply with immigration, employment agency, tax, accounting and other legal duties | Legal obligation. |
| Manage relationships with host companies, universities, sponsors and partners | Legitimate interests (running and growing our business). |
| Send you marketing about our programmes and services (see "Marketing") | Consent, or legitimate interests where the law allows (existing customers and business contacts). |
| Run, secure and improve our websites, platform and IT systems, including the chat assistant | Legitimate interests (keeping our services working and secure); consent for cookies other than necessary ones. |
| Use AI tools to speed up and improve our work (see "How we use artificial intelligence") | Legitimate interests (efficient, consistent operations); performance of a contract where AI supports your application. |
| Analyse how our services are used and produce statistics | Legitimate interests (understanding and improving our services). |
| Handle complaints, disputes and legal claims | Legitimate interests (resolving complaints and defending our legal position); legal obligation. |
| Health and accessibility information | Your explicit consent, or, where you cannot give consent, to protect your vital interests (for example in an emergency abroad). |
| Equality monitoring data | Your explicit consent. Giving it is optional and it is kept separate from your application. |
Where we rely on legitimate interests, we have checked that our interests do not override your rights. You can ask us for details of that assessment and you can object at any time (see "Your rights").
Where we rely on consent, you can withdraw it at any time by contacting us or using the unsubscribe link in our emails. Withdrawing consent does not affect processing that happened before you withdrew it.
How we use artificial intelligence
We use AI tools to make our services faster, more consistent and more useful. This section explains what those tools do with your personal data, what they do not do, and the choices you have.
6.1 Where we use AI
| Area | What the AI does | Personal data involved |
|---|---|---|
| Application process | Reads and organises CVs and application forms, extracts key details (education, skills, experience), produces short summaries, and suggests how well a profile matches a placement based on the requirements set by our team. | Application and career data, identity and contact data. |
| Website and chat assistant | Answers questions about our programmes and services, helps you find information, and can collect your details to pass to our team. | Whatever you type into the chat, plus technical data such as IP address. |
| Communications | Helps our team draft emails, messages, programme documents and translations, and summarises long threads or call notes. | Contact and communications data. |
| Marketing and sales | Helps write marketing content, personalise messages to business contacts, research organisations we may work with and prioritise outreach. | Business contact data, marketing preferences, publicly available professional data. |
| General operations | Supports internal tasks such as document drafting, data entry, scheduling, reporting and quality checks. | Data relevant to the task. |
6.2 What our AI does not do
No decision about you that has a legal or similarly significant effect is made solely by AI. Whether you are shortlisted, offered a placement, matched with a host company or declined is always decided by a member of our team, who reviews the AI output, the underlying information and their own judgement. AI scores and summaries are one input, not the decision.
We do not use your personal data to train AI models that are made available to other organisations. Our AI providers are contractually prohibited from using your data to train their models.
We do not use AI to infer special category data (such as health, ethnicity or religious belief) or to profile you for reasons unrelated to the service you asked for.
6.3 The tools we use
Our applicant tracking and matching platform is Reena, our own product, built and run by Capital Placement Ltd and independently certified for information security. When we use Reena to handle your application, this notice applies. Reena also has its own privacy policy, which applies to organisations that buy Reena as a product and to their candidates, not to you as a Capital Placement candidate.
For language and generative AI features we use enterprise services from established AI providers, under business terms that prohibit them from training on your data. Our marketing and CRM platforms include AI features that we use for the marketing purposes described above. We adopt and retire tools from time to time. Whatever the tool, it processes your data only on our instructions, under a written contract, and only for the purposes in this notice. You can ask us for the current list of providers at any time.
6.4 Safeguards
- We complete a data protection impact assessment before introducing an AI tool that processes candidate data, following ICO guidance on AI in recruitment.
- We give AI tools only the data they need for the task and we set retention limits for AI-generated outputs.
- We check AI outputs for accuracy and bias, and we ask our providers for evidence of how they test for bias.
- Our team is trained on when AI may and may not be used with personal data.
- The chat assistant is for general questions. Please do not enter health, financial or other sensitive information into it. Chat transcripts are kept for up to 12 months and then deleted.
6.5 Your choices
You can ask us at any time to:
- tell you whether AI was used in handling your application and what it contributed;
- have a person review any outcome without relying on AI output;
- give your side of the story, and challenge an outcome you think is wrong; or
- object to the use of AI in relation to your data, where it is based on our legitimate interests.
Contact us at info@capital-placement.com. We will respond within one month.
Marketing
We may send you news about programmes, events and services we think will interest you:
- by email or SMS with your consent, which you can give when you register or apply;
- by email without a separate consent if you have already enquired about or bought a service from us and we are telling you about similar services (the "soft opt-in"), unless you told us not to. If you are in the EU we rely on this only where you have bought a service from us;
- to business contacts at companies and other corporate bodies we work with or would like to work with, based on our legitimate interests, where the message relates to their role. We treat sole traders and partnerships as individuals and ask for their consent.
Every marketing message has an unsubscribe link, or you can email us. We will act on your request within 10 working days. We may still send you service messages about a live application or programme, which are not marketing.
We may use your data to show you Capital Placement adverts on other websites and social media. You can stop this by rejecting advertising cookies (see "Cookies and similar technologies") and adjusting your settings on those platforms.
Cookies and similar technologies
Our websites use cookies and similar technologies. When you first visit, a banner asks for your consent before any cookie other than necessary ones is set, whether you are in the UK, the EU or elsewhere. You can change your choice at any time through the cookie settings link in the website footer.
| Type | What it does | Consent needed? |
|---|---|---|
| Necessary | Makes the site work, for example page navigation, security, form submission and remembering your cookie choices. | No. |
| Performance | Counts visits and shows us which pages are used so we can improve the site. Data is aggregated. | Yes. UK law allows some analytics cookies without consent, but we ask anyway. |
| Functional | Enables features such as our chat assistant, embedded videos and social media content, and remembers your preferences. | Yes. |
| Advertising | Set by our advertising partners to show you relevant adverts and measure campaigns. | Yes. |
The full list of cookies we use, including who sets each one and how long it lasts, is shown in the cookie settings panel on our website.
International transfers
We are a global business, so your personal data will often be handled outside the UK. Where it goes depends on your relationship with us:
- if you apply for a placement, your data goes to host companies and partners in the country you choose for your placement;
- our team, group companies and agents work from several countries across Asia, the Middle East, Europe and North America, and may access your data from there;
- our technology providers (the types are described in "How we use artificial intelligence" and "Who we share your personal data with") are based mainly in the United Kingdom and the United States. Most hold data in data centres in the UK, Europe or the US, and some provide support from other countries.
When we transfer personal data outside the UK we protect it in one of these ways:
- the destination country has been recognised by the UK government as providing adequate protection (this includes the European Economic Area);
- for transfers to the United States, the recipient is certified under the UK Extension to the EU-US Data Privacy Framework (the "UK-US data bridge");
- we have a contract with the recipient on the terms approved by the ICO (the International Data Transfer Agreement or the UK Addendum to the EU standard contractual clauses), together with a risk assessment; or
- where none of the above is available, the transfer is necessary to perform your contract with us, for example sending your application to a host company in the country where you have chosen to do your placement.
If you are in the EU, your data first comes to the UK. The European Commission recognises the UK as providing adequate protection, so no extra safeguard is needed for that step. Any onward transfer from the UK to another country is protected as described above, and for EU data we use the EU standard contractual clauses where a contract is the safeguard.
You can ask us for a copy of the safeguards we use for a specific transfer.
How long we keep your personal data
We keep personal data only for as long as we need it for the purposes in this notice, to meet legal requirements, or to deal with complaints or claims. Our main retention periods are:
| Data | How long |
|---|---|
| Applicants and registered candidates who have not yet been placed | Up to 4 years from when you register or last contact us. Many people register early in their studies, and this lets us offer you opportunities throughout a typical study programme. Every 2 years we will check whether you want to stay in our talent pool and delete your record if you do not reply. You can ask us to delete it at any time. |
| Participants placed on a programme (whether or not you complete it) | 6 years after the programme ends or you leave it, which is the usual limitation period for contract claims in England and Wales. |
| Employment agency and employment business records | At least 1 year after they were created, or after we last provided services to you, whichever is later, as required by the Conduct of Employment Agencies and Employment Businesses Regulations 2003. |
| Financial and tax records | 6 years after the end of the financial year they relate to. |
| Visa and immigration documents | For the period required by the relevant immigration authority, then deleted. |
| Marketing contacts | Until you unsubscribe, or 2 years after you last opened, clicked, replied or otherwise engaged with us. If you unsubscribe we keep your email address on a suppression list so we do not contact you again. |
| Website form entries | Removed from the website at the next annual review after we transfer them to our internal systems. |
| Chat assistant transcripts | 12 months. |
| Interview recordings (placed candidates) | Up to 6 years after the programme ends where a sponsor, funder, partner or the law requires an audit trail of how you were selected. Otherwise deleted at the next annual review after the programme ends. |
| Interview recordings (candidates not placed) | Deleted at the next annual review after the decision, so no more than 12 months. Written interview notes stay with your application record. |
| AI-generated summaries and match scores | Same period as the application they relate to, then deleted with it. |
| Website analytics | Up to 14 months, after which only aggregated statistics remain. |
Records held in systems with automatic deletion, such as chat transcripts and website analytics data, are removed at the end of their period. For other records we run a review once a year and delete or anonymise anything that has passed its retention period, so such a record may remain for up to 12 months after the period above until the next review. If you ask us to delete your data sooner, we will do so unless we have a legal reason to keep it. Copies may remain in secure backups for a short period until those backups are overwritten.
Your rights
Under UK data protection law you have the right to:
| Right | What it means |
|---|---|
| Be informed | Know how your data is used. This notice is how we do that. |
| Access | Get a copy of the personal data we hold about you, plus information about how we use it. |
| Rectification | Have inaccurate or incomplete data corrected. |
| Erasure | Have your data deleted, for example if it is no longer needed or you withdraw consent. If you have paid for a service we will delete everything except the invoices, payment and tax records we must keep for audit and legal reasons. |
| Restriction | Ask us to pause the use of your data while a dispute or accuracy check is resolved. |
| Portability | Receive data you gave us in a machine-readable format, or have it sent to another organisation, where we process it by automated means under contract or consent. |
| Object | Object to processing based on our legitimate interests, and to direct marketing at any time (marketing objections are always honoured). |
| Automated decisions | We do not make decisions about you based solely on automated processing that have legal or similarly significant effects. A member of our team always decides (see "How we use artificial intelligence"). If that ever changed, you would have the right to be told about the decision, to give your point of view, to ask for a person to review it and to challenge it. If you are in the EU, you also have the right not to be subject to such a decision except in the limited cases EU law allows. |
| Withdraw consent | At any time, where consent is our legal basis. |
Your right to object. You can object at any time to our use of your personal data based on our legitimate interests, and you can object at any time to direct marketing. If you object to marketing we will stop. Email info@capital-placement.com.
To use any of these rights, email info@capital-placement.com. We do not charge a fee. We may need to confirm your identity first. We will respond within one month. If your request is complex or you have made several, we may extend this by up to two further months and will tell you if so. If we need more information from you to deal with the request, the time limit pauses until you provide it. In some cases the law allows us to refuse a request; if we do, we will explain why. You can also complain to the ICO at any time (see "Complaints").
We are not required to appoint a Data Protection Officer and have not done so. Our privacy lead can be reached at info@capital-placement.com.
How we keep your personal data secure
We use technical and organisational measures appropriate to the risk. In plain terms: your data is encrypted, access is limited to the team members who need it and is logged, our systems are hosted with established cloud providers, we keep backups, we train our staff, and every provider that handles personal data for us is bound by a written contract. Our applicant tracking platform is independently certified for information security.
When you fill in a form on our website, the details you type (such as your name, contact details and basic information about you) are held securely so we can respond, and are then transferred to our internal systems. Identity documents, CVs, application files and programme records are never stored on our public website, capital-placement.com. They are held in separate, access-controlled systems, including our application portal, that only authorised team members can reach.
No system is completely secure. If a breach happens we will tell the ICO within 72 hours where the law requires, and tell you if the breach is likely to put you at high risk. If you think your data has been misused or accessed without permission, contact us immediately at info@capital-placement.com.
If you are in the European Union
We welcome candidates and work with partners across the EU, so the EU General Data Protection Regulation (EU GDPR) applies to you alongside UK law. Everything in this notice applies equally. In addition:
- You may complain to the data protection authority in the EU country where you live or work, as well as to the UK ICO. A list is at edpb.europa.eu.
- Transfers of your data outside the EU are described in "International transfers".
- Our cookie banner asks for your consent before any cookie other than necessary ones is set, as EU law requires.
Complaints
If you are unhappy with how we have used your personal data, please tell us first. You can complain by email to info@capital-placement.com or by post to our registered office, marked "Data Protection". We will acknowledge your complaint within 30 days, look into it without undue delay, keep you updated and tell you the outcome.
You also have the right to complain to the ICO at any time (or, if you are in the EU, to your local authority as described in "If you are in the European Union"):
Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF. Telephone 0303 123 1113. Website ico.org.uk/make-a-complaint.
If you are outside the UK you may also be able to complain to your local data protection authority.
Changes to this notice
We review this notice at least once a year and whenever our use of personal data changes, including when we adopt new AI tools. The version number and effective date at the top show when it was last updated. If we make a significant change we will tell you by email or by a notice on our website.
You may contact Capital Placement by email at info@capital-placement.com.
Updated on 15 September 2026
