Privacy Policy

Last updated: 24 July 2026

Who we are

Zepa is operated by Oshi Group Ltd ("we", "us"). Where Zepa is used by a recruitment agency to manage its candidates, that agency is the data controller for its candidates' data and Zepa acts as its processor. For staff accounts and the operation of the platform itself, we are the controller.

Data we process

Depending on how the platform is used, we process:

• Candidate data — name and contact details, CV and work history, right-to-work documents, DBS / background-check information, and recorded video introductions.
• Application activity — the stage a candidate has reached, messages, interview and onboarding records.
• Staff accounts — name, work email, role and permissions, and activity within the console.
• Technical data — log and device information needed to run and secure the service.

Why we process it & lawful basis

We process data to operate the recruitment and onboarding service: to manage applications, run right-to-work and background checks, communicate with candidates, and provide the console to agency staff. Our lawful bases are performance of a contract, our legitimate interests in operating the service (including background and DBS checks, carried out under a legitimate-interests assessment), and compliance with a legal obligation (for example, right-to-work checks). We do not rely on consent as the lawful basis for background checks; where we rely on consent at all it is only for optional communications such as marketing, and you can withdraw it at any time.

How long we keep it

We keep personal data only as long as needed for the purposes above or as required by law, after which it is deleted or anonymised. The retention period for each data category is:

• Candidate & application data — up to 12 months following the recruitment decision, unless a longer period is required
• DBS / background-check information — no longer than 6 months after the recruitment decision
• Right-to-work documents — the duration of employment plus 2 years
• Staff accounts — the life of the account plus a limited period afterwards
• Technical & log data — up to 12 months

Candidates and users can request deletion at any time (see Data Deletion).

Who we share data with

We share data only as needed to provide the service, with:

• The recruiting agency using Zepa, and the end-client an applicant is being recruited for.
• Messaging providers — Meta / WhatsApp Business API and email/SMS delivery — to communicate with candidates.
• Authentication providers — Google OAuth and our authentication platform — for sign-in.
• Right-to-work and background-check providers (for example, Experian and DBS-check partners).
• Infrastructure and hosting providers that run the platform on our behalf under data-processing terms.

Your rights

Subject to applicable law you have the right to access, correct, delete, restrict or object to the processing of your data, and to data portability. To exercise any of these, use the Data Deletion / Request page or contact us below. You also have the right to complain to your data-protection regulator.

Contact & DPO

Data-protection enquiries: courtney@oshigroup.co.uk. Data Protection Officer / representative: courtney@oshigroup.co.uk.