Sarah Lacey & Associates Privacy Policy

1. Candidates/potential candidates

This section applies to personal data relating to candidates.

Data about you we will process	Legal basis for that processing (and any legitimate interest)
Your name	At the initial research stage and in preparing any long list and sharing it with our client, we rely on our legitimate interests as a research firm and our client’s legitimate interests in obtaining the best people it can to collate publicly available information. If we include your name in a shortlist or any further part of the recruitment process we will obtain your consent.
Your address, mobile telephone and email contact details	Your consent
Your employment history as obtained from press coverage, and work related websites like LinkedIn and Xing.	At the initial research stage and in preparing any long list and sharing it with our client, we rely on our legitimate interests as a research firm and our client’s legitimate interests in obtaining the best people it can to collate publicly available information Your consent
Your CV	Your consent (unless it is available online, in which case the previous line applies)
Our assessment of your fit to our client’s requirements	Your consent
Your salary and benefits	Your consent
Your interest in the job	Your consent
Relevant background like your willingness to relocate	Your consent

Candidates may also allow us to retain their personal data for future opportunities

If you consent to this activity, we will retain the information set out in the table above and use it to propose you for future jobs to which we think you might be suited. We will only disclose the following information to potential employers before approaching you for a further consent:

• Your name
• Your job title
• Your current employer
• A brief precis of your career
• A link to any public LinkedIn, Xing or similar site where you have a public profile

This processing will be on the basis of your consent. We will ask you if we can continue to hold your data not less often than once every 5 years. If we do not receive confirmation that we may continue to hold your data, we will delete it within 3 months of requesting if we can continue to hold it. Our processing of this data will be on the basis of your consent.

Subcontractors

The subcontractors we use in our business will also have access to your information to allow them to perform their tasks for us. They are subject to confidentiality terms and required to comply with privacy laws.

What we do with your data

The data we hold about you will:

• Only be disclosed to our clients for the relevant engagement and to those subcontractors we use in our business.
• Only be used in connection with fulfilling our obligations to our clients in relation to their searches for new staff (which includes providing them details about you and in some cases setting up meetings with our client).
• Not be sent to countries outside the EU (or countries which the EU considers to have equivalent privacy protections in place) unless we have explained to you that the job is in another country and appropriate protections are in place.

When your data will be destroyed

Where you have consented to our use of your personal data for a specific potential employer we destroy that data within 3 months of the end of our engagement with that client. Where you consent to us holding your personal data in relation to potential future opportunities, we will ask you if we can continue to hold your data not less often than once every 5 years. If we do not receive confirmation that we may continue to hold your data, we will delete it within 3 months of requesting if we can continue to hold it.

2. Clients

This section applies to information relating to individuals we deal with at our clients. We hold the following personal data for individual contacts at our clients:

• Name
• Address
• Job title
• Email
• Mobile phone
• Landline information

We rely on the fact that it is necessary to process our engagements with our client in relation to a particular engagement and consent when we retain data for ongoing relationship management and marketing. We will delete data relating to an individual when we are aware that they request it or we become aware that their role has changed such that our services are no longer relevant to them

3. Your rights and further information

As an individual you have the following rights in relation to your personal data:

• A right to obtain access to your personal data (including a copy in a common digital form)
• A right to have inaccuracies corrected
• A right to have your personal data deleted (or restricted in certain ways)
• The right to withdraw your consent to any processing
• The right to complain to the Information Commissioner (see https://ico.org.uk/concerns)
• The right to know of any automated decision making that we use (we do not use any).

You are not obliged to provide any information to us and it is not needed for any statutory or contractual reason. If candidates do not provide information we cannot provide that information to our client to help it make informed decisions. Further information about your rights is available from the Information Commissioner (for example, see https://ico.org.uk/for-the-public/is-my-information-being-handled-correctly). We do not have a data protection officer but the partners in our business are Sarah Lacey (sarah@saralacey.co.uk) and Simon Lacey (simon@sarahlacey.co.uk) and you should address any concerns you have about your personal data to one of them.