Privacy policy

Who we are

Keelfield LLC is a limited liability company registered in Florida, USA. In this policy, Keelfield, we, and us mean Keelfield LLC, and you means the person the data is about.

Where the EU or UK General Data Protection Regulation applies, Keelfield is the controller of the personal data described below. Where we handle personal data on a client's behalf as part of a service, the client is the controller and we act as a processor under the written agreement between us.

What this policy covers

This policy covers personal data we collect through keelfield.com, through the forms on it, and in the course of running our services. It applies to site visitors, to candidates we consider for roles, and to people who work at our clients and prospective clients.

It does not cover sites we link to. It does not override a signed agreement between Keelfield and your employer, which governs where the two differ.

Information we collect

Information you give us

Your name, work email, company, role, phone number, and the content of anything you type into a form on this site or send to us by email. We do not ask for payment card details on this site.

Information about your use of the site

Aggregate page views, referring sites, country, browser, and device type, collected by Plausible Analytics. Plausible sets no cookies and stores no identifier on your device, so this data is not linked to you. It runs whatever you decide about cookies.

If you accept cookies, Google Analytics 4 also records the pages you view, the order you view them in, your approximate location, your device and browser, and an identifier Google stores in a cookie on your device. That identifier is personal data. Google Analytics can also be used to show you a Keelfield advert on another site. We do not do that today: the setting that builds advertising audiences is off, and no Google Ads account is linked. If we turn it on, this page will say so first.

None of that happens unless you press "Accept cookies". You can change your mind at any time using Cookie choices in the footer, and the cookies page lists every cookie with its lifetime.

Information from other sources

For recruitment only, we may collect details from job boards, professional networks, and public profiles where you have made them available for that purpose, or from someone who refers you. Section 04 covers what happens next.

Candidate personal data

Keelfield places engineering, legal, and corporate professionals with client employers. If you apply to a role, send us a CV, or ask us to represent you, this section is the one that applies to you. It sits alongside the rest of this policy and wins where the two differ.

What we hold

• Name, contact details, and location or time zone.
• Work history, education, certifications, licenses, and the full content of the CV or resume you send.
• Right to work and visa status, where a role requires it and the law allows us to ask.
• Salary expectations, notice period, and availability.
• Interview notes, assessment results, and feedback a client gives us about you.
• References, where you have given us the referee's details.
• A record of what we have sent where, and when, and with your consent.

Please do not send us data we have not asked for. That includes health information, religious or political affiliation, criminal history, and national identity numbers. If a role legally requires one of these, we will ask for it in writing and tell you why.

Where it comes from

Directly from you when you apply or send us your details. From a person who refers you, who should tell us they have your agreement first. From job boards, professional networks, and public profiles where you have published your details for recruitment.

Our lawful basis for holding it

Where the EU or UK GDPR applies, we rely on the following.

• Legitimate interests, to run a recruitment process and match you with roles you may want. We have weighed this against your interests and you can object at any time.
• Steps taken at your request before a contract, where you ask us to represent you for a role.
• Consent, where we keep your details on file for future roles, or send them to a named client. Consent can be withdrawn at any time, and withdrawing it does not undo processing that already happened.
• Legal obligation, for right to work checks, tax, and record keeping.

Who sees it

Keelfield people working on the role. The client employer considering you, after we have told you which client it is and you have agreed. Service providers that host our email, our candidate records, and this website, each under a written contract that limits them to our instructions.

We do not sell candidate personal data. We do not send your details to a client without telling you first, and we do not post them publicly.

International transfers of candidate data

Keelfield is a US company working with international clients and international candidates. Your details may reach a client, or Keelfield people, in a country other than the one you live in. That country may not protect personal data the way your own law does.

Where we transfer personal data out of the EEA, the UK, or Switzerland, we put a lawful transfer mechanism in place first. You can ask us which one applies to you and we will tell you.

How long we keep it

Our proposed retention period is 24 months from our last substantive contact with you, after which we delete or anonymize your record. We keep it longer only where a legal duty or an active dispute requires it. You can ask us to delete it sooner and we will, subject to those same duties.

How to have your data corrected or removed

Email legal@keelfield.com with "Data request" in the subject line. Tell us what you want changed or deleted, and give us enough detail to find your record. We may ask you to confirm your identity before we act, and we will not charge you.

Section 11 sets out the full list of rights and the time limits that apply to our response.

Client and prospect data

If you contact us about a project or a hiring need, we collect your name, work email, company, and whatever you tell us about the work. We use it to answer you, scope the work, and keep a record of the engagement.

Where the EU or UK GDPR applies, we rely on our legitimate interest in business communication, or on the steps needed to enter a contract with you. You can ask us to stop contacting you at any time.

How we use personal data

• To answer enquiries and hold the conversation that follows.
• To match candidates to roles and present them to client employers.
• To deliver, support, and invoice the services we are engaged for.
• To meet record keeping, tax, and employment law duties.
• To protect this site and our systems from abuse and spam.
• To see which pages are read. Plausible does this without identifying anyone. Google Analytics does it with a cookie, and only where you have accepted one.
• To show Keelfield adverts to people who have already visited this site, again only where you have accepted cookies.

We do not sell personal data, and we do not share it for cross-context behavioral advertising as California law defines that. Google Analytics can be used that way, and if we ever do, this page will say so before it starts. Today the setting that builds advertising audiences is off and no Google Ads account is linked. Declining cookies, withdrawing consent fromCookie choices in the footer, or sending Global Privacy Control stops Google Analytics entirely, which covers this either way.

Candidate records and client records are never used for advertising and are never sent to an advertising network. That separation is not a setting, it is how the systems are built: the analytics tag sees pages, never form contents.

Personal data and AI models

Keelfield builds AI workflows for clients, so it matters what we do with data in that context. Our proposed position is that we do not use client or candidate personal data to train publicly available models, and that any model use inside a client engagement is governed by that client's written agreement.

Lawful bases for processing

Where the EU or UK GDPR applies, we process personal data on one of four bases: your consent, the performance of a contract or steps before one, a legal obligation, or our legitimate interests. Section 04 sets out which basis covers each part of the recruitment process.

Analytics and advertising cookies run on consent alone. We do not claim a legitimate interest in them, they are not set before you answer the banner, and withdrawing consent stops them at once. Cookieless analytics needs no consent because it stores nothing on your device.

If you object to processing based on legitimate interests, tell us and we will stop unless we have a compelling reason to continue that overrides your interests. For direct marketing, an objection always stops it.

If you are a California resident, the rights in section 11 include the rights to know, delete, and correct under the California Consumer Privacy Act, and the right not to be treated differently for using them.

Who we share personal data with

• Client employers, for candidate data only, and only after we have named the client to you.
• Service providers that host our website, email, and records, under contracts that limit them to our instructions.
• Professional advisers, such as lawyers and accountants, where they need it to advise us.
• Authorities, where the law requires it or to establish or defend a legal claim.
• A buyer, if the business or part of it is ever sold, under the same protections that apply now.
• Google, for site analytics, and only where you have accepted cookies. Google receives your IP address, your device and browser, the pages you view here, and the identifier it stores in its own cookie. It receives nothing you type into a form. We do not currently use it for advertising.

We do not sell personal data. Apart from the Google analytics described above, which runs on your consent and stops when you withdraw it, we do not give personal data to data brokers or advertising networks.

International transfers

Keelfield works with clients and candidates outside the United States, so personal data may be processed in more than one country. Where we move personal data out of the EEA, the UK, or Switzerland, we put a lawful transfer mechanism in place before the transfer.

You can ask which mechanism covers your data and we will tell you. Candidate transfers are described in more detail in section 04.

If you accept cookies, the analytics data described in section 03 goes to Google and is processed in the United States and other countries where Google operates. That transfer happens on your consent, and declining or withdrawing it prevents the transfer rather than merely stopping the reports.

How long we keep personal data

• Enquiries that go nowhere. Deleted once the conversation has clearly ended, and no later than 24 months after the last message.
• Candidate records. 24 months from the last substantive contact, unless you ask us to delete them sooner.
• Client and contract records. For as long as the engagement runs, then for the period tax and limitation law requires.
• Cookieless analytics. Aggregate counts only, with nothing linking them to a person.
• Google Analytics. Only where you accepted cookies. Google keeps event-level data for the period set on our property, which Google limits to 2 or 14 months. The cookies on your device have a default lifetime of 2 years, and you can delete them at any time.
• Your cookie choice. Held in your browser for 12 months, then we ask again. It never reaches our servers.

Your rights and how to use them

Depending on where you live, you may have the right to get a copy of the personal data we hold about you, correct it, delete it, restrict or object to how we use it, receive it in a portable format, and withdraw consent. You can also complain to the data protection authority where you live or work.

Consent for analytics and advertising cookies is withdrawn on the site itself, not by email. Use Cookie choices in the footer of any page. It takes one press, the same as giving consent, and it takes effect immediately.

To use a right, email legal@keelfield.com with "Data request" in the subject line. Say which right you want to use and give us enough detail to find your records. We may ask you to confirm your identity first.

Under the EU and UK GDPR we must respond within one month, and we may extend that by two further months for a complex request. If we need the extension we will tell you inside the first month and explain why.

How we protect personal data

This site is served over HTTPS. The only third-party tracking script it can load is Google Analytics, and it is not fetched at all until you accept cookies. Access to candidate and client records is limited to the people who need it for the work in front of them.

No system is perfectly secure and we will not pretend otherwise. If a breach affects your personal data, we will notify you and the relevant authority where the law requires it. Keelfield holds no security certification and makes no certification claim on this site.

Children

This site is aimed at businesses and working professionals. We do not knowingly collect personal data from anyone under 16. If you believe a child has given us personal data, write to legal@keelfield.com and we will delete it.

Changes to this policy

We post changes on this page and update the date at the top. Where a change materially affects your rights, we will say so clearly rather than leaving you to spot the difference.

How to contact us

Email legal@keelfield.com. Put "Data request" in the subject line if you are using one of the rights in section 11, and "Privacy" for anything else.

Keelfield LLC is registered in Florida, USA.