Privacy Policy

At Peridot Partners, we provide executive search and board review services to clients looking to recruit staff or board members for their organisations, and we are committed to protecting and respecting your privacy.

This Policy sets out the basis on which any personal data we collect from you, or you provide to us, will be handled and processed by us. Please read the following carefully. By visiting this site, you are accepting the practices described in this policy.

For the purposes of the UK General Data Protection Regulation (UK GDPR), Data Protection Act 2018, and the Data (Use and Access) Act 2025 (DUAA), the data controller is Peridot Partners, Techspace Goswell Road, 140 Goswell Road, London EC1V 7DY and our data privacy leads are:

• Laura Burchett – Head of Business and Executive Support (DPO Lead)
• Oliver Gardner – Technical Support Manager

This policy sets out the types of personal data that we may collect about you and will explain how and why your personal data is collected and used. We will also explain how long your data will be kept and when, why and with whom your data may be shared.

The policy sets out the legal basis we have for using your personal data and explains the effect/s of refusing to provide the personal data requested. We also explain the various rights and choices that you have when it comes to your personal data, how we may contact you and how you can contact us.

What personal data do we collect about you?

We collect and process the information necessary to be able to match you with available and future opportunities and, should you make an application, information needed to assess your eligibility at each stage of the recruitment process.

We may receive sensitive personal data about you, such as through the completion of our Equality Monitoring Form. If sensitive and protected personal data about you is collected for the purposes of equality monitoring only, this data is anonymised. We only collect and process sensitive personal data from you with your explicit consent.

Where do we collect personal data about you from?

We collect personal data about you from various sources including:

Our Website and Microsites:

• Information that you provide by filling in the form on our website and microsites (name, telephone number, job title, employer, LinkedIn profile link etc).
• Information provided at the time of accepting to use our site which is captured in cookies and explained in our cookie policy, available on our sites.
• Accessing information on one of our recruitment microsites in relation to a specific position.

Directly from You:

• Information you email to us while searching for a new opportunity.
• During a telephone conversation or email exchange in relation to an opportunity.
• Submitting a CV, profile or application for a position.

Through publicly available sources:

• LinkedIn
• Profiles on individual organisation web pages
• Companies’ House
• Search Engines
• Event and conference information
• Membership directories

Referrals and recommendation:

• You may be recommended by a friend, a former employer, a former colleague or even a present employer.

How and why do we use your personal data?

• We use your personal data to match your skills, experience, education and interests against a specific brief or requirement with a potential employer or requirement.
• We will initially collect basic information on you such as job title, role, experience and contact details to assess a potential match to the requirement.
• Once we have determined your interest in an opportunity, or to be considered for future opportunities, we will collect further information from you to share with the client or retain for future clients. This will only be done with your approval.
• If you are selected to progress through further stages of a recruitment process, we will collect additional information such as due diligence requirements and information from referees, whom you have nominated.
• We may also use your data to provide you with information about future positions and services which may be of interest to you, and we may contact you about these by email or telephone.

Additional requirements under the Data (Use and Access) Act 2025

The DUAA introduced important changes to the UK’s data protection and privacy framework, some of which came into force on 5 February 2026.

Key DUAA‑related provisions now reflected in our processing activities include:

Automated Decision-Making (ADM)

The DUAA allows organisations to use automated decision‑making in a broader set of circumstances, provided safeguards are in place. These include:

• Providing individuals with information about significant decisions
• Allowing individuals to challenge decisions
• Allowing individuals to request human intervention

Peridot Partners does not use automated decision‑making to determine candidate suitability, but any client‑requested assessments (e.g., psychometrics) will comply with the DUAA safeguards.

Recognised Legitimate Interests

The DUAA introduces “recognised legitimate interests” as a lawful basis for certain processing, such as direct marketing, intra‑group data transfers, and maintaining information security without requiring a balancing test.

Where relevant, Peridot Partners may rely on these interests.

Scientific Research & Clarified Definitions

If we process any data for statistical or research purposes (e.g., anonymised data for internal reporting), DUAA provisions provide a clarified definition of “scientific research” and conditions for broad consent.

How long do we keep your personal data for?

• We will keep candidate data for five years from our last contact with you.
• We will keep client data for six years from our last contact with the organisation.
• After this time, if we have had no further contact with you or your organisation, we will minimise the data held.

Who do we share your personal data with?

Peridot Partners and our clients act as separate, independent data controllers. When we share your personal data with a client as part of a recruitment process, that client becomes an independent data controller of that information and is responsible for its own compliance with data protection legislation. We do not jointly determine the purposes or means of processing with our clients, and we do not act as joint controllers.

• Your personal data is shared within Peridot Partners as part of the executive search and recruitment process.
• We share your personal data with a client when you have given your approval or by applying in response to a specific recruitment process or position.

What legal basis do we have for using your information?

• Legitimate interests – For prospective candidates, clients and referees, processing your information is done based on our legitimate interest because we require the information to be able to assess experience and suitability for potential roles, to find potential candidates and to contact clients and referees.
• Consent – If you apply as a candidate, then this may involve the processing of more detailed personal data including sensitive data such as health information that you or others provide about you, or when required for DUAA. In this case we always ask for your consent before undertaking such processing.
• Preparation for a contract – For clients, we may also rely on our processing being necessary to help prepare a contract for you, for example we need contact details to communicate with you over the course of the recruitment process.

What happens if you do not provide us with the information we request or ask that we stop processing your information?

If you do not provide the personal data necessary, or if you withdraw your consent for the processing of your personal data, we may not be able to match or consider you for opportunities and may not be able to proceed with an application or interest.

Do we make automated decisions concerning you?

• We do not undertake automated decisions.
• We review candidates through a manual and structured screening process to assess whether each candidate meets the specific criteria for a position, and this is available and clearly explained in the information provided for each position. This screening process may result in a candidate being deemed not suitable for a position.
• Some of our clients request that we carry out personality or psychometric assessments on their behalf and this information is passed on to the client. This is only carried out with your full consent.

Cookies

• To provide a better service to you on our website and microsite, we use cookies to collect your personal data when you browse. Our cookie policy is available here.

International transfers

We do not transfer personal data out of the European Economic Area (EEA).

Links to and from other websites

Our sites may contain links to and from other websites, documents, advertisers and affiliates. If you follow a link to any of these, please note that these sites have their own privacy policies and that we do not accept any responsibility or liability for these policies. Please check these policies before you submit any personal data to these sites.

Your rights in relation to the data we hold on you

You retain full rights under the UK GDPR, DPA 2018 and now the DUAA, including:

1. The right to be informed

You have the right to be provided with clear, transparent and easily understandable information about how we use your information and your rights. This is why we are providing you with the information in this Policy.

2. The right of access

You have the right to obtain access to your information (if we are processing it), and certain other information (similar to that provided in this Privacy Policy).

This is so you’re aware and can check that we’re using your information in accordance with data protection law.

3. The right to rectification

You are entitled to have your information corrected if it is inaccurate or incomplete.

4. The right to erasure

This is also known as ‘the right to be forgotten’ and, in simple terms, enables you to request the deletion or removal of your information where there is no compelling reason for us to keep using it. This is not a general right to erasure; there are exceptions.

5. The right to restrict processing

You have rights to ‘block’ or suppress further use of your information. When processing is restricted, we can still store your information but may not use it further. We keep lists of people who have asked for further use of their information to be ‘blocked’ to make sure the restriction is respected in future.

6. The right to data portability

You have rights to obtain and reuse your personal data for your own purposes across different services. For example, if you decide to switch to a new provider, this enables you to move, copy or transfer your information easily between our IT systems and theirs safely and securely, without affecting its usability.

7. The right to object to processing

You have the right to object to certain types of processing, including processing for direct marketing (i.e. if you no longer want to be contacted with potential opportunities).

8. The right to lodge a complaint

You have the right to lodge a complaint about the way we handle or process your personal data with your national data protection regulator.

9. The right to withdraw consent

If you have given your consent to anything we do with your personal data, you have the right to withdraw your consent at any time (although if you do so, it does not mean that anything we have done with your personal data with your consent up to that point is unlawful). This includes your right to withdraw consent to us using your personal data for marketing purposes.

The DUAA additionally enhances:

• Your right to complain directly to data controllers before approaching the ICO
• Your rights relating to automated decision‑making and transparency

Access to Information

• You have the right to obtain a copy of the personal data that we hold and process on you.
• You also have the right to require us to correct errors and if it is inaccurate or incomplete, to require us to update or delete your records from our records.
• You can make a data access request by contacting us at GDPR@peridotpartners.co.uk
• We aim to act on requests and provide information free of charge, but may charge a reasonable fee to cover our administrative costs of providing the information for:
• baseless or excessive/repeated requests, or
• further copies of the same information.
• Alternatively, we may be entitled to refuse to act on the request if the request is unfounded, excessive or repetitive. If we refuse a request, an explanation will be provided.
• Please consider your request responsibly before submitting. We will respond as soon as we can. Generally, this will be within one month from when we receive your request but, if the request is going to take longer to deal with, we will let you know.
• We may contact you by phone, email or social media. If you prefer a particular contact means over another, please let us know.

Contact Us

If you have any questions, comments and requests regarding this privacy policy please contact us by emailing: GDPR@peridotpartners.co.uk

If you are unhappy with how we’ve handled your information, please contact us to let us know so we can address any issues.

Changes to our Privacy Policy

We reserve the right to make changes to this privacy policy in line with legal updates, including further staged commencement of the DUAA at any time, as appropriate.