Privacy Policy
Effective date: 15 July 2020
Last reviewed: 15 October 2026
Introduction
Falcon Brook Search Ltd (“Falcon Brook”, “we”, “us” or “our”) is committed to protecting the privacy, confidentiality and security of personal information entrusted to us or obtained in the course of providing our services.
We recognise the importance of handling personal data responsibly and transparently, particularly given the confidential nature of executive search, leadership advisory and talent intelligence activities.
This Privacy Policy explains how we collect, use, disclose, store and protect personal information, the lawful bases upon which we process it, and the rights available to individuals under applicable data protection legislation.
We process personal data in accordance with the UK General Data Protection Regulation (“UK GDPR”), the Data Protection Act 2018 and other applicable data protection and privacy laws.
This policy applies to personal information relating to:
- Candidates and prospective candidates for executive and specialist appointments.
- Individuals identified through executive search, market mapping, succession planning and talent research activities, whether or not we have contacted them.
- Individuals who are the subject of leadership advisory, talent intelligence or other professional research.
- Clients, prospective clients and their representatives.
- Suppliers, business partners and professional contacts.
- Visitors to our website and individuals who otherwise communicate with us.
Who We Are
Falcon Brook is an executive search and talent consultancy firm providing services to organisations operating across international markets.
Our services include:
- Retained executive search and recruitment.
- Executive succession planning and leadership advisory.
- Market mapping and talent identification.
- Diversity pipelining and direct introductions.
- Competitor analysis and market intelligence.
- Talent management consultancy.
- Professional benchmarking, data analytics and industry research.
- Bespoke research and advisory reports.
Data Controller
Falcon Brook Search Ltd generally acts as an independent data controller when determining the purposes and means of processing personal data in connection with our executive search, market mapping and talent consultancy services.
In certain circumstances, we may process information on behalf of a client as a data processor, or act as a joint controller where the relevant legal criteria are met.
Our responsibilities will depend on the nature of the processing and the arrangements between the parties.
Contact details
Falcon Brook Search Ltd
4th Floor
95 Gresham Street
London EC2V 7AB
United Kingdom
Email: info@falconbrooksearch.com
Telephone: +44 (0)20 7993 2890
ICO Registration Number: ZA509950
Personal Information We Collect
The personal information we collect and process depends on our relationship with an individual and the nature of our services.
We may process the following categories of information:
- Identification and contact information
- Names, business and personal contact details, professional networking profiles and other relevant contact information.
- Professional and employment information
- Current and previous employers, job titles, professional responsibilities, career history, experience, achievements, qualifications, education, professional memberships and publicly available biographical information.
- Recruitment and candidate information
- CVs, career preferences, remuneration information, availability, interview records, professional assessments, references and information relevant to potential appointments.
- Market mapping and talent intelligence information
- Professional information used to identify, research, categorise and assess individuals operating within particular industries, organisations, functions or geographic markets.
- Business relationship information
- Correspondence, meeting records, contractual information and other information relating to our relationships with clients, suppliers and professional contacts.
- Special category information
- Where relevant, necessary and lawful, we may process information relating to diversity, health, reasonable adjustments or other special categories of personal data.
We will only process special category information where an appropriate condition under Article 9 UK GDPR applies, together with any additional requirements under applicable legislation.
Where criminal offence information is processed, we will ensure that an appropriate legal basis and statutory authorisation exist.
We aim to collect and retain only information that is relevant, necessary and proportionate to the purposes for which it is processed.
How We Collect Personal Information
We obtain personal information from a variety of sources.
Information Provided Directly by Individuals
Individuals may provide information when they:
- Submit a CV or professional profile.
- Apply for or express interest in an appointment.
- Communicate with our consultants.
- Participate in interviews, assessments or other recruitment activities.
- Attend professional meetings or events.
- Engage with our website or services.
Information Obtained from Publicly Available Sources
As part of our executive search, market mapping, leadership research and talent intelligence activities, we may identify and collect professional information from publicly available sources.
These may include:
- LinkedIn and other professional networking platforms.
- Corporate websites and published leadership profiles.
- Professional directories and industry databases.
- Industry publications, press releases and news articles.
- Regulatory filings and public company records.
- Conference materials, professional associations and other legitimate research sources.
The nature of executive search means that we may identify and process professional information about individuals before contacting them or establishing whether they are interested in a particular opportunity.
The fact that professional information is publicly available does not remove our obligations under applicable data protection law.
Information Obtained from Third Parties
We may also receive information from:
- Clients and prospective clients.
- Professional contacts and referrals.
- Industry sources and research providers.
- Other individuals who recommend potential candidates.
- Professional advisers and authorised service providers.
Where we obtain personal information indirectly, we will comply with applicable transparency requirements, including Article 14 UK GDPR, subject to any relevant statutory exceptions.
Lawful Bases for Processing Personal Information
We process personal information only where we have an appropriate lawful basis under applicable data protection legislation.
Depending on the circumstances, these may include:
Legitimate Interests – Article 6(1)(f) UK GDPR
We may process personal information where necessary for our legitimate business interests or those of our clients or other third parties, provided those interests are not overridden by the rights and freedoms of the individuals concerned.
Our legitimate interests include:
- Providing effective executive search and talent consultancy services.
- Identifying individuals with relevant professional experience and expertise.
- Conducting executive talent research, market mapping and succession planning.
- Identifying and assessing potential candidates for executive appointments.
- Sharing relevant professional information with clients where necessary and proportionate to a specific assignment.
- Supporting clients in understanding relevant executive talent markets.
- Identifying existing relationships, conflicts of interest and potential restrictions on candidate approaches.
- Conducting benchmarking, market intelligence and industry analysis.
- Maintaining professional relationships and appropriate business records.
- Managing our operations, protecting our systems and safeguarding our commercial interests.
Where we rely on legitimate interests, we consider the purpose and necessity of the processing, the reasonable expectations of individuals and the potential impact on their rights and freedoms.
We implement appropriate safeguards and, where required, document our assessment.
Contractual Necessity – Article 6(1)(b)
We may process personal information where necessary to perform a contract with an individual or take steps at their request before entering into a contract.
Legal Obligations – Article 6(1)(c)
We may process information where necessary to comply with applicable legal or regulatory requirements.
Consent – Article 6(1)(a)
Where appropriate, we may seek an individual’s consent for specific processing activities.
Where processing relies on consent, individuals may withdraw that consent at any time.
We do not assume that an individual’s consent is required for every executive search research activity, nor that information being publicly available automatically establishes a lawful basis for processing.
Executive Search, Market Mapping and Talent Research
Executive search and market mapping are core components of Falcon Brook’s services.
Our work frequently involves identifying and researching individuals who may possess the experience, qualifications, leadership capabilities or professional expertise relevant to appointments or other talent consultancy assignments undertaken on behalf of our clients.
This may involve researching individuals who have not approached us, submitted an application or expressed an interest in changing employment.
Preliminary Identification and Research
We may collect and process limited professional information about individuals to:
- Understand the composition of relevant executive talent markets.
- Identify individuals occupying relevant positions.
- Assess professional backgrounds against the requirements of an assignment.
- Develop preliminary target lists and market maps.
- Identify potential conflicts or existing client relationships.
- Determine appropriate research and engagement strategies.
We may undertake these activities before contacting the individuals concerned.
Preliminary Disclosure to Retained Clients
As part of a retained executive search or talent consultancy assignment, we may share limited professional information with the client commissioning the assignment.
This information may include an individual’s name, current employer, job title and relevant professional experience.
Such disclosure may occur before we have contacted the individual, where it is necessary and proportionate for the legitimate purposes of the assignment and applicable data protection requirements have been satisfied.
The purposes of preliminary disclosure may include:
- Enabling clients to understand the relevant executive talent market.
- Identifying existing relationships or potential conflicts.
- Assessing the relevance of professional backgrounds.
- Agreeing target populations and research priorities.
- Determining which individuals should be considered for further engagement.
We consider whether anonymised or aggregated information could reasonably achieve the same purpose before disclosing identifiable personal information.
Individuals Who Have Not Been Contacted
Individuals identified through market research may not have been contacted by Falcon Brook or expressed an interest in a particular opportunity.
Inclusion in a market mapping report, research document or preliminary target list does not mean that an individual:
- Is actively seeking employment.
- Has expressed interest in a particular appointment.
- Has consented to being represented.
- Has been interviewed or formally assessed.
- Has agreed to participate in a recruitment process.
We distinguish between individuals identified through preliminary research and candidates who have actively engaged with our consultants.
Formal Candidate Introductions
Where individuals engage with us regarding a specific opportunity, we may collect additional information necessary to assess their suitability and facilitate the recruitment process.
The disclosure of detailed candidate information, including CVs, interview assessments, remuneration information or other non-public information, is subject to appropriate lawful processing arrangements, transparency requirements and, where applicable, the individual’s consent.
Confidentiality and Restrictions on Client Use
Information provided to clients through market mapping, preliminary research and executive search activities is intended solely for the agreed assignment and is subject to appropriate confidentiality and data protection safeguards.
Our client arrangements are intended to restrict unauthorised use, disclosure and retention of this information.
In particular, unless separately authorised and lawfully permitted, clients must not use personal information concerning individuals identified solely through market research to:
- Populate or enrich internal or external recruitment databases, CRM systems or talent pools for unrelated purposes.
- Conduct independent recruitment campaigns unrelated to the assignment.
- Disclose information to unauthorised third parties.
- Retain information beyond the agreed purpose or applicable retention period.
Information relating to candidates who formally participate in a client’s recruitment process may be processed by that client in accordance with its own lawful basis, transparency obligations and retention requirements.
Transparency and Privacy Notifications
We recognise that individuals have the right to understand how their personal information is collected, used and disclosed.
Where we obtain personal information directly from an individual, we provide relevant privacy information at the time of collection.
Where information is obtained indirectly, including from LinkedIn, corporate websites or other professional sources, we comply with Article 14 UK GDPR and applicable transparency requirements.
Subject to any relevant statutory exceptions, we provide the required privacy information within a reasonable period and no later than one month after obtaining the information.
Where we intend to communicate with an individual or disclose their information to another recipient, the relevant earlier notification deadline will apply.
Exceptions to Individual Notification
UK GDPR recognises circumstances in which the requirement to provide privacy information directly to an individual may not apply.
These include circumstances where the individual already possesses the relevant information or where another statutory exception under Article 14(5) applies.
In certain circumstances, providing information may involve disproportionate effort or may render impossible or seriously impair the achievement of the objectives of the processing.
We do not assume that these exceptions apply simply because information is publicly available or because an executive search assignment is confidential.
Where we rely on an exception, we assess its applicability, document the reasons and implement appropriate measures to protect individuals’ rights and freedoms.
We make this Privacy Policy publicly available to explain our processing activities and provide a means for individuals to exercise their rights.
Publication of this policy does not, by itself, replace any requirement to provide individual privacy information where such notification is legally required.
Sharing Personal Information
We may disclose personal information to third parties where necessary, proportionate and lawful.
These may include:
Clients and prospective employers
Organisations engaging us to provide executive search, recruitment, market mapping, leadership advisory or other talent consultancy services.
Professional advisers
Legal advisers, accountants, auditors, insurers and other professional advisers.
Service providers
Organisations providing recruitment database systems, IT services, cloud hosting, communications, document management, security and other operational services.
Regulatory and public authorities
Where required by law or necessary to comply with lawful regulatory obligations.
Other authorised recipients
Where disclosure is necessary for a legitimate purpose and appropriate safeguards are in place.
We require organisations processing personal information on our behalf to maintain appropriate confidentiality, security and contractual protections.
Where clients receive personal information as independent data controllers, they are responsible for complying with their own applicable data protection obligations.
We do not sell personal information to third parties for their own marketing purposes.
International Transfers
Falcon Brook operates in international markets and may transfer, disclose or permit access to personal information outside the United Kingdom.
This may include transfers to international clients, authorised service providers and technology platforms.
Where personal information is transferred internationally, we ensure that an appropriate transfer mechanism or lawful exception applies.
Depending on the destination and circumstances, this may include:
- Applicable UK adequacy regulations.
- The UK Extension to the EU-US Data Privacy Framework, where applicable.
- The UK International Data Transfer Agreement.
- The UK Addendum to the EU Standard Contractual Clauses.
- Other safeguards or exceptions permitted under applicable data protection legislation.
Where required, we undertake appropriate assessments of international transfers and implement additional safeguards.
Individuals may contact us for further information about applicable transfer arrangements and how to obtain details of relevant safeguards.
Storage and Security
We take appropriate technical and organisational measures to protect personal information against unauthorised access, loss, misuse, alteration or disclosure.
These measures may include:
- Role-based access controls.
- Secure business and recruitment systems.
- Authentication and account security measures.
- Confidentiality obligations.
- Appropriate encryption and secure transmission arrangements.
- Supplier due diligence and contractual safeguards.
- Information security monitoring.
- Data retention and deletion procedures.
- Staff training and internal data protection policies.
Personal information may be stored in our recruitment database, Invenias, provided by Bullhorn, and other authorised business systems.
We periodically review our security arrangements and seek to ensure that personal information is accessible only to individuals who require it for legitimate business purposes.
Data Retention
We retain personal information only for as long as reasonably necessary to fulfil the purposes for which it was collected, subject to applicable legal, regulatory and legitimate business requirements.
Retention periods vary according to the nature of the information, the purposes of processing and our relationship with the individual.
Candidates and Professional Contacts
We may retain relevant professional information for up to seven years following our last meaningful interaction, where justified by our legitimate business purposes and subject to periodic review.
Individuals Identified Through Market Research
Information concerning individuals identified solely through market mapping, talent identification or preliminary research will be retained only for as long as necessary for the relevant assignment, research purpose or another documented lawful purpose.
Such information will be subject to periodic review and will not automatically be retained for the same period as information relating to individuals who have actively engaged with us.
Client and Supplier Information
We retain relevant information in accordance with applicable contractual, legal, accounting and legitimate business requirements.
Where information is no longer required, we will securely delete or anonymise it, unless continued retention is justified or required by law.
We may retain limited information where necessary to comply with an individual’s objection or request not to be contacted again.
Your Data Protection Rights
Subject to applicable legal conditions and exemptions, individuals have the following rights:
Right of access
To request confirmation of whether we process their personal information and obtain a copy of relevant data.
Right to rectification
To request correction of inaccurate or incomplete personal information.
Right to erasure
To request deletion of personal information in certain circumstances.
Right to restriction
To request that processing be restricted in certain circumstances.
Right to object
To object to processing based on legitimate interests, including processing for executive search and market mapping purposes.
Right to data portability
To receive certain personal information in a structured, commonly used and machine-readable format where the applicable legal conditions are met.
Right to withdraw consent
To withdraw consent where consent is the lawful basis for processing.
Objecting to Executive Search and Market Mapping
Individuals may object to the processing of their personal information for executive search, market mapping or talent research purposes where we rely on legitimate interests.
Where an objection is received, we will assess it in accordance with applicable data protection law.
Unless we can demonstrate compelling legitimate grounds that override the individual’s interests, rights and freedoms, or processing is necessary for legal claims, we will cease the relevant processing.
Where an individual objects to processing for direct marketing purposes, we will stop processing their personal information for that purpose.
Requests may be submitted to info@falconbrooksearch.com.
We will respond within the applicable statutory timescales, generally within one month, subject to any permitted extension.
Automated Processing, Profiling and Artificial Intelligence
We may use appropriate technology, research tools and automated systems to support our executive search, talent identification, market analysis and administrative activities.
Where such tools process personal information, we assess the relevant data protection, confidentiality and information security requirements.
We apply appropriate human oversight to our executive search and candidate assessment activities.
We do not make decisions based solely on automated processing, including profiling, which produce legal or similarly significant effects on individuals unless such processing is permitted by applicable law and appropriate safeguards are in place.
Where we use external technology providers to process personal information, we implement appropriate contractual, technical and organisational safeguards.
Marketing Communications
We may communicate with individuals regarding professional opportunities, our services, industry developments and other relevant business matters where permitted by law.
We comply with applicable data protection and electronic marketing requirements, including the Privacy and Electronic Communications Regulations (PECR).
Where consent is required, we will obtain it.
Individuals may opt out of marketing communications at any time.
We do not sell personal information to third parties for their own marketing purposes.
Cookies and Website Analytics
Our website may use cookies and similar technologies to support website functionality, analyse usage and improve user experience.
Where consent is legally required for non-essential cookies or similar technologies, we will obtain consent before using them.
Further information about the technologies used, their purposes and how individuals can manage their preferences is available through our [Cookie Policy / Cookie Settings].
Complaints
If you have concerns about how Falcon Brook processes your personal information, please contact us so that we can investigate and respond.
You also have the right to complain to the Information Commissioner’s Office (ICO), the UK’s data protection regulator.
Website: https://ico.org.uk
Changes to This Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in our services, business operations, processing activities, legal requirements or regulatory guidance.
The latest version will be published on our website with its effective date.
Where changes materially affect how we process personal information, we will take appropriate steps to bring those changes to the attention of affected individuals.
Contact Us
For any questions about this Privacy Policy, our processing of personal information or your data protection rights, please contact:
Falcon Brook Search Ltd
4th Floor
95 Gresham Street
London EC2V 7AB
United Kingdom
Email: info@falconbrooksearch.com
Telephone: +44 (0)20 7993 2890
ICO Registration Number: ZA509950