Privacy notice

• Names and contact details
• Addresses
• Pronoun preferences
• Occupation
• Date of birth
• Payment details (including card or bank information for transfers and direct debits)
• Financial data (including income and expenditure)
• Transaction data (including details about payments to and from you and details of products and services you have purchased)
• Employment details (including salary, sick pay and length of service)
• Video recordings
• Audio recordings (eg calls)
• Records of meetings and decisions

• Names and contact details
• Addresses

• Names and contact details

• Name
• Contact information
• Identification documents
• Criminal offence data

We also collect or use the following special category information to comply with legal requirements. This information is subject to additional protection due to its sensitive nature:

• Health information

• Contact details (eg name, address, telephone number or personal email address)
• Date of birth
• National Insurance number
• Copies of passports or other photo ID
• Employment history (eg job application, employment references or secondary employment)
• Education history (eg qualifications)
• Right to work information
• Details of any criminal convictions (eg Disclosure and Barring Service (DBS), Access NI or Disclosure Scotland checks)

Under UK data protection law, we must have a “lawful basis” for collecting and using your personal information. There is a list of possible lawful bases in the UK GDPR. You can find out more about lawful bases on the ICO’s website.

Which lawful basis we rely on may affect your data protection rights, which are set out in brief below. You can find out more about your data protection rights and the exemptions which may apply on the ICO’s website.

• Your right of access — You have the right to ask us for copies of your personal information. You can request other information such as details about where we get personal information from and who we share personal information with. There are some exemptions, which means you may not receive all the information you ask for. Read more about the right of access.
• Your right to rectification — You have the right to ask us to correct or delete personal information you think is inaccurate or incomplete. Read more about the right to rectification.
• Your right to erasure — You have the right to ask us to delete your personal information. Read more about the right to erasure.
• Your right to restriction of processing — You have the right to ask us to limit how we can use your personal information. Read more about the right to restriction of processing.
• Your right to object to processing — You have the right to object to the processing of your personal data. Read more about the right to object to processing.
• Your right to data portability — You have the right to ask that we transfer the personal information you gave us to another organisation, or to you. Read more about the right to data portability.
• Your right to withdraw consent — When we use consent as our lawful basis you have the right to withdraw your consent at any time. Read more about the right to withdraw consent.

If you make a request, we must respond to you without undue delay and in any event within one month.

To make a data protection rights request, please contact us using the contact details at the top of this privacy notice.

We use cookies and similar technologies on our website to ensure it functions properly, to analyse how it is used, and to support our marketing activities. Where required by law, we will obtain your consent before placing non-essential cookies on your device, and you can manage your preferences at any time through your browser settings or our cookie controls.

• Consent — we have permission from you after we gave you all the relevant information. All of your data protection rights may apply, except the right to object. To be clear, you do have the right to withdraw your consent at any time.
• Contract — we have to collect or use the information so we can enter into or carry out a contract with you. All of your data protection rights may apply except the right to object.
• Legitimate interests — we’re collecting or using your information because it benefits you, our organisation or someone else, without causing an undue risk of harm to anyone. All of your data protection rights may apply, except the right to portability.

Our legitimate interests are:

• We collect personal information about candidates and potential candidates for job opportunities in order to execute our function as an executive search and talent advisory firm. The collection of this data allows us to connect people with job opportunities that we reasonably believe could offer them career progression, increase in remuneration, or improved job satisfaction. By being part of our network, individuals may be connected with opportunities which are confidentially available and as such not accessible through other means. We also collect some limited personal information about client contacts, for example work contact details, in order to communicate with them about the services we have been contracted to deliver.

For more information on our use of legitimate interests as a lawful basis you can contact us using the contact details set out above.

• Consent — we have permission from you after we gave you all the relevant information. All of your data protection rights may apply, except the right to object. To be clear, you do have the right to withdraw your consent at any time.
• Contract — we have to collect or use the information so we can enter into or carry out a contract with you. All of your data protection rights may apply except the right to object.
• Legitimate interests — we’re collecting or using your information because it benefits you, our organisation or someone else, without causing an undue risk of harm to anyone. All of your data protection rights may apply, except the right to portability.

Our legitimate interests are:

• We collect personal information about candidates and potential candidates for job opportunities in order to execute our function as an executive search and talent advisory firm. The collection of this data allows us to connect people with job opportunities that we reasonably believe could offer them career progression, increase in remuneration, or improved job satisfaction. By being part of our network, individuals may be connected with opportunities which are confidentially available and as such not accessible through other means. We also collect some limited personal information about client contacts, for example work contact details, in order to communicate with them about the services we have been contracted to deliver.

For more information on our use of legitimate interests as a lawful basis you can contact us using the contact details set out above.

• Legitimate interests — we’re collecting or using your information because it benefits you, our organisation or someone else, without causing an undue risk of harm to anyone. All of your data protection rights may apply, except the right to portability.

Our legitimate interests are:

• We collect some personal data such as names, job titles and work email addresses from public social media networks, company websites, and some third party data suppliers, in order to contact individuals to make them aware of our services. As a low volume, high-value professional services business, our ability to serve our customers depends on the cultivation of long-term relationships and as such it is essential for our functioning that we contact potential clients directly to make them aware of our capability and to offer insights into the market which they would otherwise not be able to access. We do not use personal contact details for these purposes without consent, and comply with any request to cease contact.

For more information on our use of legitimate interests as a lawful basis you can contact us using the contact details set out above.

• Legal obligation — we have to collect or use your information so we can comply with the law. All of your data protection rights may apply, except the right to erasure, the right to object and the right to data portability.

• Consent — we have permission from you after we gave you all the relevant information. All of your data protection rights may apply, except the right to object. To be clear, you do have the right to withdraw your consent at any time.
• Contract — we have to collect or use the information so we can enter into or carry out a contract with you. All of your data protection rights may apply except the right to object.
• Legal obligation — we have to collect or use your information so we can comply with the law. All of your data protection rights may apply, except the right to erasure, the right to object and the right to data portability.
• Vital interests — collecting or using the information is needed when someone’s physical or mental health or wellbeing is at urgent or serious risk. This includes an urgent need for life sustaining food, water, clothing or shelter. All of your data protection rights may apply, except the right to object and the right to portability.

• Directly from you
• Legal bodies or professionals (such as courts or solicitors)
• Publicly available sources
• Previous employment
• Providers of marketing lists and other personal information
• Suppliers and service providers
• Third parties, for example client organisations where a client wishes to include an internal candidate within a recruitment process delivered by Holmes Noble

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, including to satisfy legal, contractual, or operational obligations.

All candidate and client profiles stored in our CRM system are retained for a period of three years from the date the information was last updated. At the end of this period, the data is permanently deleted through a quarterly cleansing process. Data subjects may request the deletion of their data at any time, in which case we will promptly remove their personal data from our systems.

To ensure compliance with such requests and prevent further contact, we maintain a “do-not-contact” list comprising only email addresses. This list is managed by our IT service provider and is not accessible to Holmes Noble employees except for senior management under exceptional circumstances. It is used exclusively to prevent re-contacting individuals who have opted out, in accordance with Article 21 GDPR and the principle of accountability under Article 5(2) GDPR.

We retain personal data of former employees for a period of six years following the termination of employment. This is to comply with applicable legal obligations, including those relating to tax, employment, and potential claims.

Personal data provided to us by employees in respect of third-party emergency contacts is deleted immediately upon the employee’s exit from the company, as it is no longer necessary for the original purpose of collection.

These retention periods are reviewed periodically to ensure compliance with the data minimisation and storage limitation principles under Article 5(1)(c) and (e) GDPR. For more information on how long we store your personal information or the criteria we use to determine this, please contact us using the details provided above.

• Insurance companies, brokers or other intermediaries
• Professional or legal advisors
• Organisations we’re legally obliged to share personal information with
• Publicly on our website, social media or other marketing and information media
• Previous employers
• Suppliers and service providers

Where necessary, we may transfer personal information outside of the UK. When doing so, we comply with the UK GDPR, making sure appropriate safeguards are in place. For further information or to obtain a copy of the appropriate safeguard for any of the transfers below, please contact us using the contact information provided above.

In the course of providing our executive search services, we may transfer personal data of candidates to client organisations located outside the United Kingdom. Due to the confidential nature of our engagements, we do not disclose client identities in this privacy notice.

All international data transfers are carried out in accordance with the UK General Data Protection Regulation (UK GDPR). We only transfer personal data to countries or territories that have been deemed to provide an adequate level of data protection under UK ‘adequacy regulations’ pursuant to section 17A of the Data Protection Act 2018 and Article 45 of the UK GDPR. This ensures that your personal data continues to benefit from a level of protection essentially equivalent to that provided within the UK.

Where such adequacy regulations do not apply, we implement appropriate safeguards as required under Chapter V of the UK GDPR, such as Standard Contractual Clauses approved by the UK Information Commissioner’s Office (ICO), or binding corporate rules where applicable. These mechanisms are designed to ensure that your rights and freedoms as a data subject are respected and upheld.

Holmes Noble may use artificial intelligence (“AI”) tools to support aspects of our executive search, recruitment and business operations. These tools are used to enhance the quality, consistency and efficiency of our services and are always used under the supervision of our consultants.

AI may be used to assist with activities including:

• analysing and summarising CVs, biographies and career histories;
• organising and analysing interview notes and candidate assessments;
• preparing draft candidate reports, market mapping documents and research summaries;
• identifying themes, competencies and patterns across recruitment processes;
• improving internal business processes, documentation and knowledge management.

AI tools do not make recruitment decisions on behalf of Holmes Noble. All recommendations, assessments, shortlisting decisions and hiring advice are reviewed and made by our consultants using their professional judgement.

Where appropriate, information that you provide to us, or which we collect as part of our recruitment and executive search services, may be processed using secure third-party AI service providers acting as our data processors. This may include personal information contained within CVs, career histories, interview notes, correspondence and other recruitment-related documentation.

We only use AI providers that provide appropriate contractual commitments and technical and organisational measures designed to protect personal data in accordance with applicable UK data protection legislation.

Where practical and appropriate, we seek to minimise the amount of personal data shared with AI systems and avoid processing special category personal data unless this is necessary and lawful.

Holmes Noble does not use AI to make solely automated decisions that produce legal or similarly significant effects in relation to individuals. All decisions relating to candidate assessment, shortlisting, presentation to clients and recruitment recommendations involve meaningful human review and judgement.

The use of AI does not affect your rights under UK data protection legislation. You retain the right to request access to your personal data, request correction or deletion where applicable, object to certain processing activities and exercise any other rights available under applicable data protection law.

If you have any questions about our use of AI or how your personal information is processed, please contact us using the details provided in this privacy notice.

If you have any concerns about our use of your personal data, you can make a complaint to us using the contact details at the top of this privacy notice.

If you remain unhappy with how we’ve used your data after raising a complaint with us, you can also complain to the ICO.