Legal
Privacy Policy
How HEG handles the information you send us, including CVs and position requests.
Last updated: 8 September 2026
1. Who we are
Hospitality Excellence Group (HEG, we, us) provides hospitality consulting and senior recruitment services across the United Kingdom, the United States and Kosovo. We are the data controller for the personal information described in this policy, which means we decide why and how it is used.
- Hospitality Excellence Group
- arber@thehegroup.com
- +383 43 846 684
2. What this policy covers
This policy explains what personal information we collect through thehegroup.com, why we collect it, how long we keep it, who we share it with and what rights you have over it. It applies to anyone who visits this site, to candidates who submit a CV, and to companies who send us a position request or get in touch.
3. The information we collect
Everyone who visits the site
Our hosting provider records standard server log data: your IP address, browser type, the pages you request, and the date and time. This is generated automatically by the server and is used to keep the site running and secure.
Candidates submitting a CV
Your full name, email address and phone number; the department and position you are looking for; your years of experience and current location; your CV file; and, if you choose to give them, your LinkedIn profile and a short cover note.
Companies submitting a position request
Your company or venue name; the contact person's name and job title; contact email and phone number; the type and size of your business and where it operates; and the details of the role you are hiring for, including the salary range, requirements and any notes you add.
Anyone who contacts us
Whatever you tell us, along with the name, email address and phone number you give us, whether that is through a form on this site, by email or by phone.
We do not ask for special category information such as health, ethnicity, religious belief or trade union membership. Please do not include it in a CV or a free-text box unless it is genuinely relevant to a role you are applying for.
4. Why we use it, and our lawful basis
Data protection law requires us to have a lawful basis for using your information. Ours are set out below.
Candidate applications
To assess your suitability for senior hospitality roles and to introduce you to prospective employers.
Lawful basis: your consent, given when you tick the consent box on the form. You can withdraw it at any time by emailing us, and we will remove your details.
Company position requests
To respond to your enquiry, source and screen candidates for you, and provide our recruitment services.
Lawful basis: our legitimate interests in responding to a business enquiry, and, once we are engaged, performance of our contract with you.
General enquiries and consulting work
To reply to you, to discuss what you need, and to carry out the work we agree.
Lawful basis: our legitimate interests in answering people who approach us, and performance of our contract once work begins.
Running and securing the website
To keep the site available, diagnose faults, and prevent spam and abuse of our forms.
Lawful basis: our legitimate interests in operating a working, secure website.
5. Sharing a candidate's details with employers
Introducing candidates to employers is what a recruitment service does, so we want to be plain about how we handle it.
If we think you are a good match for a role, we will share your CV and the details you gave us with the prospective employer. We ask you first, and we tell you which company it is, so you always know where your CV has been sent.
We do not publish CVs, sell them, or place them in a database that other parties can search.
6. Who else we share information with
We use a small number of service providers who process information on our behalf and on our instructions:
- our website host, which runs this site and stores form submissions;
- our email provider, which carries messages to and from us.
Each one acts under a written agreement and may only use the information to provide their service to us. We do not sell personal information, and we do not use it for advertising.
We may also disclose information where the law requires it, or to establish or defend a legal claim.
7. Where your information is held
HEG operates from Kosovo. Information you send us is stored on servers in Europe and is accessed by us from Kosovo.
Kosovo is not covered by a United Kingdom or European Commission adequacy decision. Where we receive personal information from the United Kingdom or the European Economic Area, we rely on appropriate safeguards for that transfer, and you can ask us for details of them.
8. How long we keep it
We keep information only as long as we need it for the purpose we collected it for.
- Candidate submissions, including CVs: 12 months from your last contact with us. Ask us and we will delete them sooner, or keep them on file for longer if you would like us to consider you for future roles.
- Company position requests and client records: for the length of our working relationship, and then for as long as we are required to keep business records for tax and accounting purposes.
- General enquiries: 24 months from your last contact with us.
- Server logs: a short period set by our hosting provider, after which they are overwritten.
9. Your rights
Depending on where you are, you have some or all of the following rights over your personal information. You can:
- ask for a copy of what we hold about you;
- ask us to correct anything that is wrong or incomplete;
- ask us to delete it;
- ask us to restrict how we use it;
- object to us using it where we rely on legitimate interests;
- ask us to send it to you, or to someone else, in a portable format;
- withdraw your consent at any time, where we rely on consent.
Email arber@thehegroup.com and we will respond within one month. Exercising these rights is free.
If you are not satisfied with how we have handled your information, you can complain to a data protection authority. In the United Kingdom that is the Information Commissioner's Office at ico.org.uk. In the European Economic Area it is the authority in the country you live in. In Kosovo it is the Information and Privacy Agency.
10. How we protect information
This site is served over an encrypted connection. CV uploads are stored in a protected directory that cannot be browsed or guessed from outside, and form submissions are held in the site's own database rather than left to sit in an inbox. Access is limited to the people who need it to do the work.
No system is perfectly secure, but if something goes wrong with your information and it is likely to affect you, we will tell you and the relevant authority within the time the law allows.
11. Cookies
This site uses only the cookies needed to make it work, for example to keep a form submission intact while you complete it. We do not use advertising cookies, and we do not run analytics or tracking scripts.
12. Changes to this policy
We update this policy when what we do with information changes. The date at the top tells you when it last changed. If a change materially affects you, we will make that clear rather than relying on you to notice.
13. How to contact us
Any question about this policy, or about the information we hold on you, should go to arber@thehegroup.com or +383 43 846 684.