1. Introduction

Robert Lindsay Associates (Robert Lindsay Associates, we or us) is committed to protecting your personal information and respecting your privacy. This Privacy Policy, together with any other documents referred to in it, sets out the basis on which any personal data that we collect from or about you, or that you provide to us, will be processed by us. Please read the following carefully to understand our views and practices regarding your personal data and how we treat it.

For the purpose of the Data Protection Act 1998 and the General Data Protection Regulation which comes in force on 25th May 2018, the data controller is Robert Lindsay Associates, a company registered in England (company number 06600480), registered address 112 Morden Road, London, SW19 3BP United Kingdom.

This Privacy Policy has been issued on 1st May 2018. We may update this Privacy Policy from time to time. Any future changes will be posted on our website at robert-lindsay.com (the Website). Please check back regularly to see any updates or changes to this Policy.

2. Data Protection Officer

The contact details for our Data Protection Officer are as follows: Email: enquiries@robert-lindsay.com; Telephone: +44 (0)20 7099 5554; Post: Robert Lindsay Associates, 112 Morden Road, London, SW19 3BP

It is the responsibility of the Data Protection Officer to keep our organisation and our staff informed and advised about their obligations to comply with data protection laws, to monitor compliance with those laws, to advise on data protection impact assessments and any breaches, to train staff and conduct internal audits, and to be the first point of contact for supervisory authorities and for individuals whose personal data we are processing.

3. Particulars of processing

We process personal data about a range of data subjects, and for a range of purposes. We are a talent advisory firm which helps our clients address their most fundamental business needs – advising on leadership, talent acquisition and assessment, recruitment and retention and coaching. Client activities often take the form of executive search and talent-related network services which involve the controlling and processing of personal data. The categories of person about whom we process personal data are described in more detail in the Particulars of Processing that are set out in the Schedule to this Privacy Policy.

4. Your rights as a data subject

This Section 4 sets out the rights that you have as a data subject, by reason of the General Data Protection Regulation.
You have the following rights:

• The right to request access to the personal data that we hold about you;
• The right to request rectification of the personal data that we hold about you;
• The right to request erasure of the personal data that we hold about you;
• The right to request restriction of processing about you;
• The right to object to processing; and
• The right to data portability.

If you wish to invoke any of the above rights, please notify our Data Protection Officer using the contact details set out in Section 2 above. Please include the words DATA PRIVACY REQUEST in the subject line of your email, or at the top of your letter.

Where our processing of personal data is based on your having given consent, you have the right as a data subject to withdraw that consent at any time. If you wish to invoke this right, please notify our Data Protection Officer using the contact details set out in Section 2 above. Please include the words DATA PRIVACY REQUEST in the subject line of your email, or at the top of your letter.

You have the right to lodge a complaint with a supervisory authority. In the United Kingdom, the supervisory authority is the Office of the Information Commissioner, full contact details for which can be found at https://ico.org.uk/global/contact-us/

5. Contact details

You can contact our Data Protection Officer if you have any other questions or concerns about personal data and privacy matters, using the contact details set out in Section 2 above.

Please include the words DATA PRIVACY REQUEST in the subject line of your email, or at the top of your letter.

Category of data subject:

Candidates who have registered directly with Robert Lindsay Associates via the Website, or who have entered into direct communication via email / phone with any team members, whether with reference to specific client searches / activity or unsolicited.

Designated client personnel involved in supporting partnering activity with Robert Lindsay Associates on the client side are also included as data subjects, as their personal data permits effective execution of searches and other talent-related activity.

Categories of personal data that we process:

• Name
• Job Title
• CV / Bio / Resumé or similar
• Salary information
• Future salary expectations
• Future job preferences and/or aspirations
• Contact information such as home / email addresses and telephone numbers
• Demographic information such as post code, preferences and interests
• Some sensitive personal data acquired through screening and interviews, needed to assess eligibility at different stages of client searches / activity
• The minimum information required to represent data subjects accurately and in an up-to-date manner as part of client searches / activity.

Source of information:

Most of the above personal data is received direct from the data subject or candidate. However, additional public information will be added as needed such as provided from publicly-posted personal profiles owned and managed by data subjects / candidates themselves, which are hosted on business and social media platforms such as (not exclusively) LinkedIn, Xing, Not Actively Looking, etc..

Data subject consent:

Robert Lindsay Associates retains personal data in electronic, paper-based or any other relevant format only with the express written / emailed, and suitably-stored, consent of data subjects. This consent requirement does not apply to any data subjects on whom only publicly-accessed data is held by Robert Lindsay Associates; nor does it apply to designated client personnel, who operate under specifically agreed contractual terms.

Purposes of the processing:

We process the personal data of data subjects listed above in order to support the search and talent-related services we provide to our clients as follows:

Fulfilling data subject requests – we may use your personal data to respond to your inquiries as data subjects and to fulfil your requests. We may keep a record of your contact information and correspondence, and we may use any information you provide in your messages to respond to your inquiry.

Business purposes – we may use personal data for our business purposes, such as (not exclusively) audits, informational communications, administrative communications and internal communication regarding data subjects and clients.

Providing search and talent services to clients – in the course of providing our services, we use personal data that we have collected concerning data subjects to identify professional opportunities which we think may be of interest to them, particularly where they match specific client searches / requirements. We may contact data subjects / potential candidates from time to time regarding such opportunities. We also may contact data subjects other than candidates from time to time to solicit names of, or other personal data regarding, potential candidates in connection with a search which we are conducting and for purposes of market intelligence. We also use personal data to confirm references, written and verbal, and conduct education and other background checks, as appropriate. We may further use personal data which we collect for purpose of aggregating and disclosing diversity statistics and other similar statistical information regarding our candidates and client search activity.

Providing other talent-related services to clients – in the course of non-search related client activity such as coaching, assessment or team building, we may use personal data collected through our assessments to ensure we are able to render these services to our clients effectively.

De-identified data – additionally we may aggregate and anonymise or de-identify personal data in such a manner that the client service or end-product does not personally identify you or any other individual, for example, to generate norms by industry, geography, level, etc.. Such aggregate or de-identified personal data is not considered personal data for purposes of this Privacy Policy and Schedule, and we may use it for any purpose.

Client data sharing:

In the course of our client search activity, we may provide personal data regarding candidates / data subjects, including the results of assessments taken through our search and evaluation process and related data, to prospective employers / clients who have engaged Robert Lindsay Associates to fulfil search requests, or to access sources or acquire references.

In the course of other talent-related services, we may disclose your personal data to clients who have engaged our services; we disclose assessment and other information to the client / employer which has engaged Robert Lindsay Associates and to designated client personnel. Assessment and other personal data collected by our team (or provided by our client) may be maintained in a Robert Lindsay Associates database and/or research reports presented periodically to our client, and to which our client and their designated personnel will have access both during and after the conclusion of the search or talent-related service.

Other disclosure:

Robert Lindsay Associates may also use or disclose personal data in order to: (i) comply with applicable laws; (ii) respond to inquiries or requests from public or government authorities, including those from jurisdictions outside the EU; (iii) comply with valid legal process. We cannot and do not assume any responsibility for the actions or omissions of third parties, such as clients, including the manner in which they use personal data received from Robert Lindsay Associates or from other independent sources.

Lawful basis of processing:

For prospective candidates and data subjects, and for clients and referees, our data processing is necessary for our legitimate interests, in that we need personal data in order to be able to assess suitability for potential roles in respect to client searches, to find potential candidates and to contact clients and referees.

For shortlisted candidates (who fulfil client search eligibility criteria), this may involve the processing of more detailed personal data including sensitive data, such as health information provided by or about candidates. When sensitive data such as this is involved, we seek candidates’ specific consent before undertaking such process.

For clients, we may also rely on our processing of personal data being necessary to perform a search agreement effectively.

In summary, the lawful basis of processing is that the processing is necessary for the performance of contractual agreements with clients which are the business of Robert Lindsay Associates, and to allow data subjects / candidates to be assessed for client searches.

Overseas transfers:

All personal data that Robert Lindsay Associates holds is stored within the EU. However, where client searches and talent-related activity is outside the EU, personal data may be stored in the client’s jurisdiction which may subject be outside to the data privacy the EU regulations and in the client’s jurisdiction.

Duration of processing:

Personal data will be processed and stored for as long as the data subject expressly consents to its use by Robert Lindsay Associates.

Automated decisions:

Robert Lindsay Associates does not carry out any automated profiling or engage in any automated selection decisions.

London, 1st May 2018