Privacy notice

1. Who we are

Garfield Stephens Ltd provides specialist recruitment and executive search services, with particular expertise in Executive Search, Medical Underwriting and Credit Underwriting.

For the purposes of UK data protection law, the data controller responsible for the personal information described in this notice is:

ICO registration number: ZA652240

Privacy and data protection enquiries can be sent to: chris@garfieldstephens.com

2. Who this notice applies to

This notice may apply to:

• candidates and prospective candidates;
• individuals we identify or approach regarding potential opportunities;
• people who submit a CV or other career information;
• clients and prospective clients;
• hiring managers and other contacts within organisations;
• referees;
• suppliers and professional contacts;
• people who contact us or make an enquiry; and
• visitors to the Garfield Stephens website.

3. Information we may collect

The information we collect depends on how you interact with us.

Candidates and prospective candidates

We may collect information including:

• name and contact details;
• CV and employment history;
• job titles and responsibilities;
• education, qualifications and professional memberships;
• skills and experience;
• salary, remuneration or day-rate information;
• notice period and availability;
• location and working preferences;
• career interests and preferences;
• information you provide during conversations, applications or interviews;
• information contained in publicly available professional profiles;
• records of our communications with you;
• interview and recruitment-process information; and
• information reasonably required to assess your suitability for a particular opportunity.

Where appropriate and lawful, recruitment processes may also involve information required for eligibility, identity, regulatory or pre-employment checks.

We do not seek unnecessary sensitive personal information.

Where special category personal data is genuinely required, we will only process it where there is an appropriate lawful basis and condition under UK data protection law.

Clients and business contacts

We may collect:

• name;
• job title;
• organisation;
• business contact details;
• recruitment requirements;
• records of meetings and communications;
• information concerning roles, searches or assignments; and
• other information relevant to our professional relationship.

Website visitors and enquiries

When you use our website or contact us through it, we may receive:

• information submitted through contact or enquiry forms;
• email address and other contact information you provide;
• technical information required to operate and secure the website; and
• limited information generated by cookies, analytics or similar technologies where these are used.

Our use of website analytics and cookies is described further below.

4. Where we obtain personal information

We may receive personal information:

• directly from you;
• through a CV or application you provide;
• during telephone, email, video or in-person conversations;
• through professional networking platforms such as LinkedIn;
• from publicly available professional or business sources;
• through job boards or recruitment platforms where we are permitted to access your information;
• through referrals and recommendations;
• from clients or other professional contacts;
• from referees; and
• from service providers involved in a recruitment process where appropriate.

As an executive search and specialist recruitment business, we may identify and contact individuals who have not previously registered with Garfield Stephens where we reasonably believe a professional opportunity may be relevant to them.

5. How we use personal information

We may use personal information to:

• provide recruitment and executive search services;
• identify potentially suitable employment or career opportunities;
• assess potential suitability for roles;
• communicate with candidates and prospective candidates;
• introduce candidates to clients where appropriate;
• manage applications and recruitment processes;
• communicate with clients and prospective clients;
• understand recruitment requirements;
• maintain professional relationships;
• respond to website enquiries;
• administer and improve our website and services;
• protect our website, systems and business;
• maintain appropriate business and recruitment records;
• comply with legal and regulatory obligations; and
• establish, exercise or defend legal claims where necessary.

We will not use personal information in a way that is incompatible with the purposes for which it was collected unless permitted or required by law.

6. Our lawful bases for processing

UK data protection law requires us to have a lawful basis for processing personal information.

Depending on the circumstances, we may rely on:

Legitimate interests — including operating a specialist recruitment and executive search business, identifying potentially suitable candidates, communicating about relevant professional opportunities, managing client relationships, protecting our business and improving our services.

Where we rely on legitimate interests, we consider those interests against the individual’s rights and reasonable expectations.

Contract — where processing is necessary to enter into or perform a contract with you.

Legal obligation — where we are required to process information to comply with the law.

Consent — where consent is the appropriate lawful basis. Where processing relies on consent, you may withdraw that consent at any time.

Different lawful bases may apply to different processing activities.

7. Executive search and direct approaches

Executive search frequently involves identifying individuals who have not directly applied for a vacancy.

We may therefore use professional information available from legitimate sources to identify people whose experience appears potentially relevant to an assignment.

This may include information obtained from professional networking services, company websites, industry sources, professional directories, referrals or other publicly available professional information.

Where we contact you in this way, you are under no obligation to engage with us.

You may ask us not to contact you about future opportunities.

8. Sharing candidate information with clients

We may share relevant candidate information with clients or prospective employers where this is appropriate for a recruitment process.

We aim to be transparent with candidates about introductions and will not deliberately circulate a candidate’s CV indiscriminately.

Information shared will normally be limited to what is reasonably necessary for the relevant recruitment activity.

Clients receiving candidate information are responsible for their own processing of personal information in accordance with applicable data protection law.

9. Who else may receive personal information

Where reasonably necessary, information may also be processed by organisations that support our business, such as:

• website and hosting providers;
• email and communications providers;
• recruitment technology providers;
• IT and security providers;
• professional advisers;
• accountants or other business-service providers; and
• authorities, regulators or other organisations where disclosure is required by law.

We expect service providers processing personal information on our behalf to protect it appropriately and use it only for authorised purposes.

We do not sell personal information.

10. International transfers

Some technology or service providers may process information outside the United Kingdom.

Where personal information is transferred internationally, we will take appropriate steps required by UK data protection law to protect it. Depending on the circumstances, these safeguards may include UK adequacy regulations or approved contractual safeguards.

11. How long we keep information

We retain personal information only for as long as reasonably necessary for the purpose for which it was collected, including recruitment, business, legal, accounting and regulatory requirements.

Retention periods may differ depending on the type of information and our relationship with you.

Where information is no longer required, we will delete it or otherwise dispose of it appropriately, subject to any legal or legitimate record-keeping requirements.

You may contact us if you would like further information about how long a particular category of information is normally retained.

12. Keeping information accurate

Recruitment information can become outdated as people’s careers and circumstances change.

We encourage you to let us know if information we hold about you is inaccurate or materially out of date.

Where appropriate, we may also update professional information from information you provide or legitimate professional sources.

13. Security

We take reasonable technical and organisational measures to protect personal information against unauthorised access, loss, misuse, alteration or disclosure.

No internet or electronic storage system can be guaranteed to be completely secure, but we aim to use safeguards proportionate to the nature of the information we process.

14. Cookies and website technologies

Our website does not use cookies, analytics, advertising or other tracking technologies, and it does not load content from third parties while you browse.

A small amount of information is stored in your own browser only when you use certain features:

• If you use the Underwriting Lab’s scratchpad or working assumptions, what you enter is kept in your browser so it is still there on your next visit. It is not sent to us, and you can clear it at any time using the button provided.
• After you send an enquiry, your browser records the time it was sent, to prevent accidental duplicate submissions.

These are strictly necessary for features you choose to use, so they do not require consent.

Enquiries sent through our website forms are delivered to us by email through FormSubmit, a form-handling service.

If we introduce analytics or other non-essential technologies in future, we will update this notice and ask for your consent where required.

15. The Underwriting Lab

The Garfield Stephens website may provide interactive tools and reference material through the Underwriting Lab.

Information entered into Lab tools should not be treated as information submitted for a recruitment application unless this is expressly stated.

Some Lab features may operate locally within your browser rather than sending or permanently storing the information on Garfield Stephens systems.

Users should not enter unnecessary confidential, sensitive, patient, customer or personally identifiable information into scratchpads, calculators or other general-purpose Lab tools.

The Lab is intended as a reference and utility resource and does not provide medical, underwriting, lending, financial or regulatory advice.

16. Your data protection rights

Depending on the circumstances, UK data protection law may give you rights including the right to:

• request access to personal information we hold about you;
• request correction of inaccurate or incomplete information;
• request deletion of your information in certain circumstances;
• request restriction of processing in certain circumstances;
• object to certain processing, including processing based on legitimate interests;
• receive certain information in a portable format where the right to data portability applies; and
• withdraw consent where processing is based on consent.

These rights are not absolute and may depend on the circumstances and the lawful basis for processing.

To exercise a data protection right, contact: chris@garfieldstephens.com

We may need to verify your identity before fulfilling a request.

17. Direct marketing and recruitment communications

Recruitment communications concerning potentially relevant professional opportunities are not necessarily the same as general marketing communications.

Where electronic direct marketing rules apply, we will comply with applicable requirements.

You can ask us to stop sending marketing communications at any time.

You can also tell us that you do not wish to receive future recruitment approaches.

18. Automated decision-making

Garfield Stephens does not currently intend to make decisions producing legal or similarly significant effects about individuals solely through automated processing.

Technology may be used to support recruitment administration, search or assessment, but significant recruitment decisions should involve appropriate human judgement.

If this changes materially, this notice will be updated as required.

19. Links to other websites

Our website may contain links to third-party websites, including professional networks, clients, partners, projects or information sources.

Garfield Stephens is not responsible for the privacy practices of third-party websites. You should review their privacy information when using those services.

20. Complaints

If you have concerns about how Garfield Stephens handles your personal information, please contact us first so that we can investigate.

You also have the right to complain to the UK’s data protection regulator, the Information Commissioner’s Office (ICO).

21. Changes to this notice

We may update this Privacy Notice periodically to reflect changes to our services, technology, legal requirements or how we process personal information.

The latest version will be published on the Garfield Stephens website with its updated date.