Who we are
ValCera L.L.C-FZ is a limited liability company licensed by Meydan Free Zone, Dubai.
- Licence number: 2651720.01
- Registered address: Meydan Grandstand, 6th floor, Meydan Road, Nad Al Sheba, Dubai, U.A.E.
- Data protection contact: [email protected]
ValCera is an executive search firm. Handling other people's personal data is most of what we do, so we would rather set it out plainly than bury it in ten pages nobody reads.
ValCera is the controller of the personal data described on this page. We decide what we collect and why, and we are accountable for it.
Who this covers
Candidates. Anyone we approach, assess or represent for a role, whether or not you are introduced to a client.
Client contacts. People at client companies we deal with commercially.
Which rules we work to
ValCera is established in the UAE and processes personal data under Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data.
Where we process the personal data of people in the European Economic Area or the United Kingdom, we apply the GDPR and UK GDPR.
The DIFC and ADGM have their own data protection laws, which apply to organisations established in those centres rather than to us. Where a client is based in one of them and asks us to meet those standards under our contract, we do.
Rather than run a different policy per jurisdiction, we built this to the strictest applicable standard and apply it everywhere.
What we hold, and where it came from
For candidates:
- Name, contact details, location
- Career history, CV, qualifications
- Current and expected compensation
- Notes from our conversations with you, including our written assessment
- References, where you have given them
- Work authorisation status, where a specific role requires it
- Correspondence between us
Most of this comes from you. Some comes from professional sources: LinkedIn, company websites, published talks or writing, and referrals from people in our network. If we approached you first, we found you in public professional sources before we ever spoke. If you want to know exactly where, ask and we will tell you.
For client contacts, we hold name, job title, work contact details and our correspondence.
Referees. If you give us a referee's contact details, we only approach them once you have told us to. When we contact them, we say who we are and that you gave us their details. If a referee asks us to delete their information afterwards, we do.
Sensitive information. We do not go looking for data about your health, religion, race, ethnic origin, political views, or anything else treated as sensitive under data protection law. If something like that becomes relevant, for example an adjustment you need during an interview process, we only record and share what you have specifically asked us to.
Why we hold it
We approach candidates about specific roles on the basis of legitimate interest. Matching senior people to relevant work is what a search firm exists to do, and there is no way to ask permission before making first contact. We only approach people whose background is genuinely relevant to a live mandate. We do not run mass campaigns.
We share your details with a client only after you have given explicit consent, for that named client and that named role.
That is a hard rule with no exceptions. We do not send CVs speculatively. We do not keep a database that gets circulated to clients in bulk. We do not use one client's mandate as an excuse to market you to another.
Some searches are confidential and we cannot name the client in an early conversation. In those cases we describe the business in enough detail for you to decide whether you are interested, and we tell you the name before anything about you goes anywhere. Consent still comes before the introduction, never after.
You can withdraw that consent at any time, and it is as easy to withdraw as it was to give. Email [email protected] and we stop.
For client contacts, the basis is our contract with the client, or our legitimate interest in running the commercial relationship.
Who else sees it
Your data goes to the client you consented to, and to nobody else. We do not sell data, share it with other search firms, or use it for advertising.
Beyond that, it sits inside the tools we run the business on:
| Purpose | Provider | What it holds |
|---|---|---|
| Email, files, calendar, video calls, transcription | Google Workspace | Correspondence, documents, notes, meetings, call transcripts |
| Sourcing and professional research | LinkedIn and LinkedIn Recruiter | Professional profile data |
| AI assistance for research and drafting | Anthropic (Claude) | General research and drafting. We do not put candidate CVs, interview notes or personal records into it. |
| Invoicing | Our billing provider | Client billing contacts only |
This list is current as of the date above. If we add a tool that touches candidate data, we update this page.
Video calls, transcripts and notes
Conversations with candidates happen on video. We use the note taking and transcription built into Google Workspace so that we can listen properly rather than type while you are talking.
We tell you before the call that this is how we work, and we ask you before it starts. If you would rather we did not, say so and we take notes by hand instead. It makes no difference to how we assess you or whether we put you forward.
What happens to it:
- The transcript exists so that we can write an accurate assessment of your fit for the role. That is the only thing we use it for.
- Clients receive our written assessment. They never receive the transcript, the notes, or any recording.
- We delete transcripts when the search closes, and at the latest at our next quarterly review. The assessment is what we keep.
- Offer conversations happen by phone and are not recorded or transcribed.
AI tools, and who actually makes the decisions
We use AI tools for research, for drafting, and for transcribing and summarising the video calls described above. The transcription runs inside Google Workspace, under our agreement with Google.
We do not put candidate CVs, interview notes or personal details into general-purpose AI tools.
No decision about you is made by a machine. Every assessment we write and every recommendation we make to a client is our own judgement after speaking with you. There is no algorithmic scoring, ranking or filtering anywhere in the process, and nothing an AI tool produces reaches a client without us writing it ourselves.
Where your data sits
We are based in Dubai, and our systems run on Google's infrastructure. Your data may therefore be stored or processed outside the UAE and outside the country you live in.
Where you give us your information yourself, you are sending it directly to us in the UAE.
Where a client in the European Economic Area or the United Kingdom passes us personal data, that is a transfer out of those regions, and it happens under the Standard Contractual Clauses or the equivalent mechanism set out in our contract with that client.
Where a supplier we use moves data across borders, we rely on the transfer terms in that supplier's data processing agreement.
How we protect it
Our systems run on Google Workspace. Data is encrypted in transit and at rest, access requires two factor authentication, and the devices we work from are encrypted and locked.
Access is limited to the people who need it. For candidate assessments, that is one person.
We keep the number of places your data lives deliberately small. The tools listed above are the whole picture. We do not copy candidate records into spreadsheets, personal drives or messaging apps.
If personal data we hold is lost or exposed, we investigate straight away, tell anyone affected where there is a real risk to them, and notify the relevant authority without undue delay and within 72 hours where the law requires it.
How long we keep it
Twenty-four months from our last meaningful contact with you. After that we delete your record, or we come back and ask whether you want to stay in touch. We do not keep people on file indefinitely on the off chance.
We review what we hold every quarter and clear anything that has passed these points. If you ask us to delete your record sooner, we do it when you ask, rather than waiting for the next review.
Where we have introduced you to a client, we keep a record of that engagement for longer, because we may need it for contractual, tax or legal reasons.
Your rights
You can ask us to:
- Tell you what we hold about you
- Correct anything wrong
- Delete it
- Stop contacting you
- Withdraw a consent you have given us, at any time and as easily as you gave it
- Send you a copy in a portable format
- Object to how we are using it
Email [email protected]. We respond within 30 days and usually a lot faster. There is no charge.
If you want us to stop contacting you, say so. You do not need to give a reason, and it changes nothing else about how we would treat you in future.
Complaints
If we get this wrong, tell us first at [email protected] and we will fix it. If you are not satisfied with how we handle it, you can complain to the UAE Data Office. If you are in the EEA or the UK, you can complain to your national supervisory authority instead.
Changes to this page
If we change how we handle personal data, we update this page and change the date at the top. Material changes get flagged to anyone we are actively in contact with.