1. Who we are and which laws apply
1.1 Dorson Trading Ltd, trading as Dorson Services ("Dorson Services", "we", "us"), registered office Unit 214, Dundas Street East, Mississauga, Ontario L4Y 2C1, Canada, is the controller of the personal data described in this Policy. Our Gulf operations office is at Office 556, Regus, Sahara Healthcare City, Al Nahda, Sharjah, United Arab Emirates.
1.2 Privacy contact: privacy@dorsonservices.com.
1.3 Depending on the circumstances, our processing is subject to Canada's Personal Information Protection and Electronic Documents Act (PIPEDA); the EU General Data Protection Regulation (GDPR) where it applies to us, for example when we offer our services to businesses in the European Union or monitor use of our website there; and the data protection law of the United Arab Emirates, including Federal Decree-Law No. 45 of 2021, for processing at our Gulf office. We apply the protections in this Policy to all personal data we hold, wherever it is processed.
2. Personal data we collect
| Who | What we collect |
|---|---|
Website visitors | IP address, browser and device information, pages visited, referring site, date and time; anything you type into a form (name, email, company, message); cookie identifiers (section 11) |
Business contacts (employers, placement agencies, prospects) | Name, job title, organisation, business email and telephone, business address; our correspondence and meeting notes; contract and billing details; publicly available professional information such as a business profile; for employers, whether the company trains apprentices, prior non-EU hiring, how long roles have been open, offered wage |
Candidates | Identity and contact details (name, date of birth, nationality, telephone, email, messaging number, current address); passport details and copy; residence permit and national ID copy; employment history, current employer, contract dates, job titles, salary and payslip or wage-protection records; qualifications, trade certificates, test results, language level, driving licences; highest trade qualification and length of training; current employer or sponsor; residence-visa expiry date; CV and, if you choose to provide one, a photograph; references; availability and preferences; records of our calls and messages with you and of your consent; after placement, your start date, employer and whether you are still employed at agreed check-points |
Candidates (only where a role or the destination country requires it, and only with explicit consent) | Police clearance certificate; medical fitness certificate (section 5) |
We do not ask for information about religion, ethnic origin, political opinions, sexual orientation or trade union membership. Please do not include it in your CV.
3. Where we get personal data
- From you: through forms, email, calls, messages and the documents you send us.
- From your current or former employer, our recruitment partners and your referees, with your knowledge (for example, confirmation of your employment dates and salary).
- From certification bodies and training providers, about your results.
- From our Clients, about offers, start dates and your employment status after placement.
- For business contacts, from you, your colleagues, publicly available business sources and professional networks.
- Automatically, when you use our website.
4. Why we use personal data, and our legal bases
| Purpose | Whose data | Legal basis under the GDPR |
|---|---|---|
Operating and securing the website | Visitors | Legitimate interests: running a secure, working website |
Analytics and other non-essential cookies | Visitors | Consent |
Answering enquiries | Visitors, business contacts, Candidates | Legitimate interests; steps taken at your request |
Telling businesses about our services by email, telephone or professional networks | Business contacts | Legitimate interests; consent where e-marketing law requires it. You can opt out at any time |
Entering into and performing contracts with Clients; invoicing and collections | Business contacts | Performance of a contract; legal obligation (tax and accounting) |
Assessing Candidates for roles, verifying their information and preparing candidate files | Candidates | Consent; legitimate interests in giving Clients accurate, verified information |
Sharing a Candidate's profile and documents with a Client for a specific role | Candidates | Consent: we do not share your profile with a Client without it |
Coordinating document authentication, translation, interviews and training | Candidates | Consent; legitimate interests |
Follow-up after placement, retention checks and replacement obligations | Candidates, business contacts | Legitimate interests; performance of our contract with the Client |
Preventing fraud and recruitment fees; keeping responsible-recruitment records | Everyone | Legitimate interests; legal obligation where applicable |
Complying with the law, responding to authorities, and establishing or defending legal claims | Everyone | Legal obligation; legitimate interests |
Under PIPEDA we rely on your consent (express consent for Candidates' documents, and implied consent for routine business communications), and we use personal data only for the purposes set out here.
Where we rely on legitimate interests, you may object (section 10). Where we rely on consent, you may withdraw it at any time; this does not affect processing already carried out.
5. Sensitive information
Some roles and destination countries require a police clearance certificate or a medical fitness certificate. We handle these only when a specific role or process requires them, only with your explicit consent, and only to send them to the Client or employer that needs them. We handle certificates, not detailed medical records. We delete our copies when the process ends (section 8). Where the GDPR applies, we process such data only as Articles 9 and 10 GDPR and the law of the destination country permit.
6. Who we share personal data with
We do not sell personal data.
- Clients: employers and placement agencies in Europe. We share a Candidate's profile and documents only for a specific role and only with the Candidate's consent. The Client then processes that data as an independent controller, under its own privacy notice and the law of its country.
- Service providers acting on our instructions: website hosting and database, email and cloud productivity, secure document storage, video-conferencing, notaries, translators and document-authentication agents, certification and language-training providers, payment and accounting services, and professional advisers such as lawyers and accountants. They are bound by contract to use the data only for the service they provide to us and to protect it.
- A Candidate's current or former employer: only as needed to confirm employment, obtain documents and agree release dates, and with the Candidate's knowledge.
- Authorities: where the law requires it, or to protect rights and safety or prevent fraud. We do not submit immigration applications; Candidates and employers do.
- A buyer or successor: if our business or assets are transferred, subject to this Policy.
7. International transfers
7.1 We work across borders. Our team and service providers access personal data from Canada, the United Arab Emirates and Pakistan, and some service providers process data in the United States. Candidate data is sent to Clients in the European Union and the European Economic Area.
7.2 The safeguards we use:
| Country | Status | Safeguard |
|---|---|---|
Canada | EU adequacy decision for organisations subject to PIPEDA | Adequacy |
United Arab Emirates | No EU adequacy decision | European Commission Standard Contractual Clauses, with supplementary measures such as access controls, encryption and data minimisation |
Pakistan | No EU adequacy decision | Standard Contractual Clauses, with the same supplementary measures |
United States | Adequacy for providers certified under the EU–US Data Privacy Framework | The Framework where the provider is certified; otherwise Standard Contractual Clauses |
EU / EEA Clients | Within the GDPR area | The Client receives the data subject to the GDPR |
7.3 You can request a copy of the relevant safeguards from privacy@dorsonservices.com.
8. How long we keep personal data
| Data | Retention |
|---|---|
Website server logs | 90 days |
Analytics cookies | No longer than 13 months |
Business contacts | For the business relationship and up to 3 years after our last meaningful contact; you can ask us to stop sooner |
Contracts, invoices and accounting records | As required by tax and accounting law: in Canada, generally six years from the end of the tax year to which they relate |
Candidates not placed | Up to 24 months after our last contact, unless you ask us to delete your data sooner or to keep your profile longer |
Copies of passports, residence permits and ID, police clearance and medical fitness certificates | Deleted within 6 months after the recruitment process for which they were collected ends, unless the law requires longer |
Placed Candidates | Follow-up records until 12 months after the start date; then a minimal placement record (name, role, Client, dates) for up to six years to meet contractual and legal obligations |
Fraud reports and responsible-recruitment evidence | Up to six years |
9. How we protect personal data
We use technical and organisational measures appropriate to the risk, including: access limited to staff who need it; role-based permissions; multi-factor authentication on our business systems; encryption in transit and, where our systems support it, at rest; storage of identity documents separately from general files; confidentiality obligations on staff and service providers; and staff training. If a personal data breach occurs, we will notify you and the relevant authorities where the law requires.
10. Your rights
10.1 Depending on the law that applies to you, you have the right to:
- access the personal data we hold about you;
- have inaccurate data corrected;
- have your data deleted;
- restrict our processing;
- object to processing based on legitimate interests, and to direct marketing at any time;
- receive your data in a portable format;
- withdraw consent at any time;
- complain to a supervisory authority.
10.2 To exercise a right, email privacy@dorsonservices.com. We may ask you to confirm your identity. We respond within one month where the GDPR applies and within 30 days under PIPEDA, free of charge unless a request is manifestly unfounded or excessive.
10.3 You may complain to the data protection authority in the EU country where you live, work or where the issue arose; to the Office of the Privacy Commissioner of Canada; or to the UAE Data Office. We would appreciate the chance to resolve your concern first.
11. Cookies
Our website uses cookies that are strictly necessary for it to work. We set analytics or other non-essential cookies only with your consent, which you can give or withdraw at any time through the cookie settings on the website.
| Cookie | Purpose | Type | Duration |
|---|---|---|---|
dorson-cookie-consent (kept in your browser's local storage, not a cookie) | Remembers your cookie choice, so that we do not ask again on every page | Necessary | Until you clear your browser's stored data, or until we change the choices on offer and ask you again |
_gcl_* (set by the Google Ads tag) | Measures how our advertising on Google performs, for example whether an enquiry or registration followed an ad | Analytics and marketing (only with your consent) | Set by Google; removed from this website when you withdraw your consent |
_fbp, _fbc (set by the Meta Pixel) | Measures how our advertising on Meta platforms performs, for example whether an enquiry or registration followed an ad | Analytics and marketing (only with your consent) | Set by Meta; removed from this website when you withdraw your consent |
12. Automated decisions
We do not make decisions about anyone based solely on automated processing, including profiling, that produce legal or similarly significant effects. Every Candidate shortlist is reviewed by a person.
13. Children
Our website and services are not directed at anyone under 18. We do not knowingly accept Candidates under 18 and will delete any such data we receive.
14. Recruitment fraud
We never ask Candidates for money. Genuine messages from us come only from email addresses ending in @dorsonservices.com. If someone asks you for payment in our name, do not pay and report it to report@dorsonservices.com. We may keep reports and share them with authorities or platforms to stop the fraud.
15. Changes to this Policy
We may update this Policy from time to time. The "last updated" date at the top shows the current version. Where a change is significant and we hold your contact details, we will tell you directly.
16. Contact
Controller | Dorson Trading Ltd, trading as Dorson Services |
|---|---|
Registered office | Unit 214, Dundas Street East, Mississauga, Ontario L4Y 2C1, Canada |
Gulf operations office | Office 556, Regus, Sahara Healthcare City, Al Nahda, Sharjah, United Arab Emirates |
Privacy enquiries and requests | |
EU representative (Article 27 GDPR) |