Privacy policy

Last updated: 2 November 2026

This policy explains what personal data Zemash Ltd collects, why we collect it, who we share it with and what rights you have. We only collect what we need to run our business and serve our clients. We do not sell your personal data. If you have a question, email contact@zemash.com.

Who we are

Zemash Ltd is registered in England and Wales under company number 15904249. Our registered office is 68 Hathaway Road, Croydon CR0 2TP. In this policy, “we”, “us” and “our” mean Zemash Ltd.

We are the controller of the personal data described in this policy. This means we decide how and why it is used. We sell four services to UK businesses: Remote Recruitment, AI Development, Web Design & Development, and SEO & Paid Ads.

Sometimes we handle personal data on a client’s behalf and on the client’s instructions. For example, this can happen when we manage remote staff for a client. In those cases the client is usually the controller and we act as its processor under a data processing agreement. The client’s own privacy notice then applies to that data.

Our website links to other brands in our group: Pro Virtual Assist, Hire AI Experts, WordPress Website Design Agency and Nect Me. They may have their own privacy notices. This policy covers Zemash Ltd and the zemash.com website only.

What data we collect

Enquiry forms

When you send us a message through our contact form, we collect the details you enter. This usually includes your name, email address, company name and your message. The form emails your enquiry to us. We also store each submission in our website, so that we have a record of it.

Emails and calls

If you email us or speak to us by phone or video call, we keep the messages and any notes we make. This can include your name, job title, company, contact details and what we discussed. If we want to record a call, we will tell you first.

Website analytics

If you accept analytics cookies, we use Google Analytics 4 to see how people use our website. This can include the pages you view, how long you stay, the device and browser you use, your approximate location and how you found our site. Our reports show approximate location, not your full IP address. If you reject analytics, Google Analytics does not set cookies on your device.

We also use Google Search Console. It gives us summary information about how people find our site in search results. It does not tell us who you are.

Cookies

Our site uses a small number of cookies. Some are essential. Others, such as analytics cookies, are only set if you accept them. Our cookie policy lists every cookie we use.

Recruitment shortlists and candidate data

When we find and vet candidates for a client, we handle candidates’ personal data. This can include a candidate’s name, contact details, CV, employment history, education, skills, location, availability and pay expectations. It can also include our interview notes, assessment results and references.

We get this data from the candidate, from people who refer them, or from professional profiles they have made public. If we get your details from somewhere other than you, we tell you within one month.

We do not ask for special category data, such as health, ethnicity or religion. Please leave it out of your CV. We share a candidate’s details with a client only where the candidate knows we are doing so.

Clients, suppliers and business contacts

If you are a client, supplier or other business contact, we keep your name, job title, business contact details, billing details, contracts and our communications with you. If you are a sole trader or partner, your business details can be personal data. We may also get business contact details from your public website or professional profile, or from a colleague who introduces you.

Our lawful bases

UK data protection law says we must have a lawful basis for using your personal data. We rely on these:

• Contract. We use your data to take steps you ask for before a contract is made, and to carry out a contract with you.
• Legitimate interests. We use your data to run and improve our business, reply to business enquiries, match candidates to roles, keep our systems secure and manage our relationships with clients and suppliers. We only do this where our interests are not outweighed by your rights. You can ask us for more detail about how we balanced them.
• Consent. We rely on your consent for analytics cookies and similar technologies. We also ask for consent where we want to keep a candidate’s details for future roles. You can withdraw consent at any time.
• Legal obligation. We keep records and share data where the law requires it. For example, this covers accounting, tax and company law.

How we use your data

• To reply to your enquiries and prepare quotes and proposals.
• To provide our services and manage our contracts, invoices and payments.
• To find, vet and present candidates to clients, and to arrange interviews.
• To run, secure and improve our website and understand how it is used, where you have agreed to analytics.
• To keep our accounts and meet our legal and regulatory duties.
• To protect our business, our clients and our systems from fraud, misuse and security incidents.
• To establish, exercise or defend legal claims.
• To tell you about our services, only where the law allows it. You can opt out at any time.

Who we share your data with

We share personal data only where we need to. We do not sell it. We may share it with:

• Hosting and website providers that host our website and store form submissions.
• Email and productivity providers that handle our email and documents.
• Analytics providers. This is Google, for Google Analytics and Google Search Console, and only after you accept analytics cookies where consent is required.
• Scheduling tools. This is Calendly, which provides the booking calendar on our contact page. It loads only if you choose to show it. If you book a call, Calendly receives the details you enter, such as your name, email address and the time you pick.
• Clients. We share a candidate’s shortlist details with a client only where the candidate knows we are doing so.
• Professional advisers, such as accountants, lawyers and insurers.
• Authorities and courts, where the law requires it or to protect our legal rights.
• A buyer or successor, if our business or part of it is sold or reorganised. They must use your data in line with this policy.

Our service providers act on our instructions and must protect your data. We do not allow them to use it for their own purposes, except where they act as controllers in their own right, as Google does for some analytics purposes.

International transfers

Some of our providers, and some of the people who work with us, may process personal data outside the UK. Where that happens, we make sure your data stays protected. We use safeguards such as UK adequacy regulations, which recognise that a country gives suitable protection. Otherwise we use the UK addendum to the standard contractual clauses, or the UK International Data Transfer Agreement. Where the law requires it, we also assess the risks of the transfer. You can contact us for more information about these safeguards.

How long we keep your data

We keep personal data only as long as we need it for the reasons we collected it. Our usual periods are:

• Enquiries that do not lead to a contract: up to 24 months after our last contact with you.
• Client and supplier records, contracts and invoices: for the length of the relationship and then six years, to meet accounting and legal needs.
• Candidate data: for as long as we need it for the recruitment concerned. We then delete it, normally within 12 months, unless you agree that we may keep it for future roles.
• Analytics data: for the period set in our Google Analytics account, which does not exceed 14 months.
• Cookie consent choices: for 12 months, as set out in our cookie policy.

If a legal claim or investigation is possible, we may keep data for longer. When we no longer need data, we delete it or make it anonymous.

Your rights

Under UK data protection law you have these rights:

• Access. You can ask for a copy of your personal data.
• Rectification. You can ask us to correct data that is wrong or incomplete.
• Erasure. You can ask us to delete your data in some cases.
• Restriction. You can ask us to limit how we use your data in some cases.
• Portability. You can ask for data you gave us in a structured, commonly used and machine readable format, in some cases.
• Objection. You can object to us using your data for legitimate interests or for direct marketing.
• Withdrawing consent. Where we rely on your consent, you can withdraw it at any time. This does not affect what we did before you withdrew it.

To use any of these rights, email contact@zemash.com. We normally reply within one month. We may need to check who you are first. There is usually no charge.

If you are unhappy with how we use your data, please tell us first. We will acknowledge your complaint within 30 days and tell you the outcome without undue delay. You also have the right to complain to the Information Commissioner’s Office (ICO) at ico.org.uk or on 0303 123 1113.

Cookies

We use cookies and similar technologies on our website. Analytics cookies are only set after you accept them. You can change your choice at any time using the “Cookie settings” link in the footer. Read our cookie policy for the full list and for how to manage cookies.

Security

We use appropriate technical and organisational measures to protect personal data. These include secure HTTPS connections on our website, access controls on our systems, and confidentiality duties for the people who work with us. No system is completely secure. If a data breach is likely to put your rights at risk, we will tell you and the ICO as the law requires.

Children

Our services are for businesses. Our website is not aimed at children. We do not knowingly collect personal data from anyone under 18. If you think a child has given us data, email us and we will delete it.

Changes to this policy

We may update this policy from time to time. The date at the top shows when it last changed. If we make an important change, we will say so on our website.

Contact us

If you have a question about this policy or want to use your rights, contact us:

• Email: contact@zemash.com
• Post: Zemash Ltd, 68 Hathaway Road, Croydon CR0 2TP