Privacy Policy
Contents
1. Who we are
SOS Global AI Solutions ("SOS Global AI," "we," "us") is the controller for personal data processed across our divisions: SOS Global Recruitment Solutions, SOS Global Entertainment, and SOS Financial (in development). We are based in the United Kingdom.
For any privacy query, contact us at support@sosglobalai.com.
2. What data we collect, and why
What we collect depends on which division you interact with:
| Division | Data collected | Purpose |
|---|---|---|
| Recruitment | Candidate contact details, employment history, right to work status, DBS/background check outcomes, professional registration status, training records — sourced only from a client's own consented CRM | Sourcing, screening, and compliance-verified candidate placement |
| Entertainment | Contact details of writers, producers and buyers; submitted scripts, pitch decks, and IP material | Project development, buyer-matching, and rights clearance |
| Financial (in development) | Not yet collecting personal financial data — this section will be updated before launch | N/A — pre-launch |
| All divisions | Name, email, organisation, and message content submitted via our contact form | Responding to your enquiry |
We do not scrape personal data from the open web, and we do not purchase or license third-party candidate databases. Recruitment data is drawn only from a client's own consented CRM.
3. Our lawful basis for processing
We rely on the following lawful bases under UK GDPR, depending on the specific processing activity:
- Consent — where a candidate or contact has directly consented to their data being used for a specific purpose.
- Contract — where processing is necessary to perform a contract with a client or candidate, such as facilitating a placement.
- Legitimate interests — for limited purposes such as responding to enquiries, where we've weighed that purpose against your rights and interests before relying on it.
- Legal obligation — where processing is required to meet a compliance or regulatory obligation, such as right to work verification.
4. Right to work, DBS & criminal offence data
Where our recruitment division processes DBS certificate outcomes or other criminal-record-related information, this is treated as criminal offence data under Article 10 UK GDPR — a distinct category from "special category data," requiring its own Schedule 1 condition under the Data Protection Act 2018 (typically the employment condition) and a supporting Appropriate Policy Document.
Right to work documentation is treated as high-sensitivity data given Home Office retention expectations, even where it does not itself constitute special category or criminal offence data.
5. Who we share data with
We share candidate data with the client agency or organisation a candidate is being considered for placement with, and with verification services used to confirm right to work, DBS, and professional registration status. We share entertainment division material only with named, relevant buyers or partners as part of active project development, and under confidentiality obligations. We do not sell personal data, and we do not share it with data brokers.
6. International transfers
Where any subprocessor or service we use is based outside the UK, we ensure an appropriate transfer mechanism is in place — such as the UK International Data Transfer Agreement (IDTA) or UK-approved Standard Contractual Clauses.
7. How long we keep data
We retain personal data only for as long as necessary for the purpose it was collected, or as required by law. As a default: unsuccessful candidate records are retained for 12 months from the date of application, then deleted; placed-candidate compliance records are retained for 6 years, in line with standard contractual limitation periods; entertainment submissions not taken forward are retained for 12 months. These defaults are reviewed periodically and may vary for a specific client engagement.
8. Automated decisions and human review
Our systems use AI to assist with candidate sourcing, screening, and matching, and with entertainment project assessment. Under the Data (Use and Access) Act 2025, individuals have a right to safeguards around solely automated decisions that produce legal or similarly significant effects — including the right to obtain meaningful human intervention.
Across every division, a named human reviews AI-generated outputs before they affect a real candidate, client, or project — with genuine authority to change, reject, or escalate the outcome, not a procedural sign-off on a decision already made. See our Trust & Compliance page for how this works at each division.
9. Your rights
Under UK GDPR, you have the right to: access your data; correct inaccurate data; request erasure; restrict processing; object to processing (including profiling); receive your data in a portable format; and lodge a complaint with the ICO. To exercise any of these rights, contact us at support@sosglobalai.com.
10. Security & data isolation
Where multiple clients or licensees use the same underlying platform, their data is structurally isolated from one another, with access controls and encryption applied appropriate to the sensitivity of the data involved. If we become aware of a data breach affecting your personal data, we'll notify the ICO and affected individuals where required by law.
11. Contact us & complaints
Questions about this policy: support@sosglobalai.com. You also have the right to complain to the UK's Information Commissioner's Office (ICO) at ico.org.uk if you believe we have not handled your data properly.