Menu
Privacy Policy
Updated June 2024
This Privacy Policy describes how Carbon Leadership [LLP] ("Carbon", "we", "us") collects and uses the information that you provide. It also describes the choices available to you regarding our use of your personal information and how you can access and update this information. Carbon operates in accordance with the latest data protection laws enshrined in the General Data Protection Regulation(EU) 2016/679 ("EU GDPR'') and since 1 January 2021 in the retained version of the EU GDPR which applies in the UK, as amended from time to time (the “UK GDPR”)[1]. Carbon therefore monitors and adheres to evolving law and the core principles of purpose-limitation, storage-limitation, data accuracy, data security and integrity and data minimisation.
This Privacy Policy relates to your use of any of the Carbon services which shall include the Carbon website at the URL www.carbonsearch.com, the Gated Talent portal and associated resources, and any other existing or future Carbon service-line such as our executive search, market advisory and referencing services to which you are granted access (the "Services").
What information do we collect?
The datasets we primarily accumulate and hold fall into three broad kinds:
1. Contact details, CVs and career histories - this is essentially basic profile and contact information.
2. Educational records, certificates of achievement, employment and personal references - this is essentially more granular information we sometimes collect to be able to substantiate and evidence key facts or achievements relating to you.
3. Special category data such as information about your race or ethnicity or a relevant disability which is necessary to assist with any reasonable adjustments or information potential employers need to know about. We only collect and process these categories of special data with your explicit consent.
BY VISITING OUR WEBSITE ORGATED TALENT PORTAL OR OTHERWISE ACCESSING THE SERVICES WE OFFER, YOU ACCEPTAND CONSENT TO THE PRACTICES DESCRIBED IN THIS PRIVACY POLICY.
Collection & Use:
Information you give to us: When reviewing, accessing or using the Services, you may be asked to provide us with personal registration information which would include some or all of the personal datatypes listed above.
Information we collect about you: As is true of most websites and recruitment businesses, it is possible to gather information about you from computer-based sources such as your Internet Protocol (IP) address, browser type and operating system.
Information we receive from other sources: We may receive information about you from third parties including, for example, business partners, corporate clients, social media platforms and mobile applications and our network of searchers and freelance consultants.
This is in addition to publicly available information about your background, career history, which may be available on social media and elsewhere and which our researchers are able to verify and collate.
Why we collect this information about you? This information may be used to allow us to maintain our business relationship with you and provide all manner of support and service to you. We essentially hold your personal data to maintain our relationship with you now and into the future, especially given the nature and duration of modern careers and the changes that can and do occur within someone's career path.
We use your personal data to align candidate experience, skills and education with an assignment we are running.
If you are a referee, we use your information to contact you about a candidate and obtain a reference on them.
If you are a corporate client (such as a large employer which needs to attract and retain talent on an ongoing basis), we use personal data to allow us to fulfil our contractual obligations with you.
Our range of lawful bases for using your personal information:
We only hold and process personal data when the law allows us to. We set out below a [visual depiction] description of the core “legal bases” which allow us to process personal data under UK GDPR and EU GDPR followed by a short assessment of the most relevant to Carbon’s business operations:
We rely on one or more of the following legal bases:
Performance of a contract with you: Where we need to perform the contract we are about to enter into or have entered into with you.
Legitimate interests: We may use your personal data where it is necessary to conduct our business and pursue our legitimate interests or those of another, for example to prevent fraud and enable us to give you the most efficient and secure experience. We make sure we consider and balance any potential impact on you and your rights (both positive and negative) before we process your personal data for our legitimate interests. We do not use your personal data for activities where our interests are over ridden by the impact on you (unless we have your consent or are otherwise required or permitted to by law).
Legal obligation: We may use your personal data where it is necessary for compliance with a legal obligation that we are subject to. We will identify the relevant legal obligation when we rely on this legal basis.
Consent: We rely on consent only where we have obtained your active agreement to use your personal data for a specified purpose, for example if you subscribe to an email newsletter.
You will notice that we insist on very clear, affirmative action from you to signify your consent to our processing your personal data when you register with us (especially for any special category data which is always of a sensitive nature). We also have a compelling need to process your data in order to fully perform our contractual terms and conditions with our corporate clients and with you as a registrant or applicant (including our contractual terms and conditions of use). From time to time, we will also process your personal data where we need to comply with other legal obligations - for example connected with any regulatory requests made of us or in the conduct of litigation where we are compelled to assist a Court with a discovery request for our information.
Where we rely on a legitimate interest for collecting or processing your personal data we will only do so where we are satisfied that there is a legitimate interest established under the terms of the EU GDPR or UK GDPR as appropriate. This means that we will continually update and assess our legitimate interests as a recruitment and search business as we have done when producing the latest version of this policy. We set out below our most recent assessment of our business needs against the three legal tests designed to satisfy the legitimate interest requirements under relevant data protection law:
1. Identifying our legitimate business interests - We are a commercial enterprise servicing the labour market with our search, consultancy and recruitment services. We have taken the time to ask our client-base about their requirements. We know that our Services contribute to better appointments being made, better recruitment data being obtained, and well-matched candidates with employers.
2. The necessity of processing some amounts of personal data is obvious if our Services are to be optimally used by our growing candidate base and client base. The fact we collect some moderate amounts of personal data is therefore inevitable given our role and value to others, but this personal data is highly controlled. We also process personal data in order to grow our business, make optimal use of our communications and messaging, enhance the Carbon brand, provide excellent customer services, and improve the engagement experience for all our end-users, whether they are our search consultants, employees, corporate clients, candidates and visitors to our website. We realise the severe limitations to our aims which would result if we were not able to process personal data as we do. We have researched the market and conclude there is a distinct lack of any other less intrusive means to deliver the above interactions, customer services, brand enhancement, and benefits for our users than via the controlled and proportionate data-processing we currently conduct.
3. We have weighed the balance of the rights and interests of our business with interests of our people, clients and candidates. We aim to make sure that their personal data is specially protected within under the terms of the relevant law. We are aware from our growing client and candidate base that they have a good understanding of the value of our relationship with them and that they reasonably expect us to contact, engage, and communicate with them, and develop the Services which all require the processing of personal data to proportionate degrees. Further more, we have considered the impact of our types of data processing in relation to individuals (from having emails, director and company officer names, IP addresses, job titles, and other recruitment and search related data). When compared with other industries and other kinds of data processing which can involve a lot of sensitive personal data and cold-calling, we take the view that there is marginal or no harm or risk to the rights and freedoms of the valued employees, clients, candidates and contacts we have at Carbon.
We have completed this most recent assessment by concluding that our legitimate interest is prudently counterbalanced by the constant right of an individual to make a data access, cessation of processing or erasure request to us so that we can stop such processing as and when required.
Your rights under modern data protection law:
You have the following rights, as a result of the latest data protection rules set out in the EU GDPR and UK GDPR as applicable, in relation to your personal data:
1. to request a copy of any personal data that we hold about you (essentially your "subject access rights'') This enables you to receive a copy of the personal data we hold about you and to check that we are lawfully processing it;
2. to be told, where any information is not collected directly by us, what available information exists as to the source of the information about you;
3. to be told of the existence of automated decision-making (and any personal profiling which we conduct for the purposes of matching people with the right recruitment opportunities);
4. to object to the processing of data where the processing is based on either the conditions of public interest or our legitimate business interests (though in some cases, we may demonstrate that we have compelling legitimate grounds to process your information which override your right to object.);
5. to have all personal data erased (the right to be forgotten) which practically involves the removal of your data and any account you may have with us where there is no good reason for us continuing to process it;
6. to restrict processing where you have objected to the processing;
7. to have inaccurate data rectified
8. to withdraw consent at any time where we are relying on consent to process your personal data. Please note that this will not affect the lawfulness of any processing carried out before you withdraw your consent. If you withdraw your consent, we may not be able to provide certain products or services to you. We will advise you if this is the case at the time you withdraw your consent; and
9. to exercise an absolute right to object any time to the processing of your personal data for direct marketing purposes (however please note that we may continue to send you service-related (i.e. non-marketing) communications)
If you wish to exercise any of these rights, or wish to object to our use of your personal information, please write to or email:
Jayne Foster
Carbon Leadership LLP
91 Wimpole Street
London
W1G 0EF
privacy@carbonsearch.com
How to make a subject access request - to edit, delete or access your personal information
As you will note above, you have the right to ask for a copy of any personal information that we hold about you in our records, to correct any inaccuracies and to update any out-of-date information. We will provide you with a copy of the personal data undergoing processing in electronic emailable form. Any additional copies will incur a fee to cover our reasonable costs (including the staff time to assist with this additional work). Under most circumstances you will not have to pay a fee to access your personal data (or to exercise any of the other rights). However, we may charge a reasonable fee if your request is clearly unfounded, repetitive or excessive. Alternatively, we could refuse to comply with your request in these circumstances.
We try to respond to all legitimate requests within one month. Occasionally it could take us longer than a month if your request is particularly complex or you have made a number of requests. In this case, we will notify you and keep you updated.
Protecting Your Information: Who will we share your personal information with?
Except as described below, we will not share your information with any third parties. We will make your personal information visible to the organisations we depend on to provide our Service. In the modern era, this means we have arrangements in place with service providers who assist us with file storage, cloud hosting, analytics, database management, internal and external communications using providers such as Microsoft (Office and Teams primarily), website design and hosting services. We must also include any particular search specialists with whom we contract on a consultancy-basis rather than as an employee.
We require all third parties to respect the security of your personal data and to treat it in accordance with the law. We do not allow our third-party service providers to use your personal data for their own purposes and only permit them to process your personal data for specified purposes and in accordance with our instructions.
Naturally in order to perform our search and recruitment services, when you are put forward for an opportunity, we are required to share your personal information with those for whom and with whom we are working (such as corporate clients, credit reference checks, employment reference providers).
We do not sell your personal data to third parties, and we don't share it except as necessary as explained above.
All other data that we share with third parties will be anonymised and aggregated but will never identify you or your company.
We may disclose the information you provide us:
As required under a suitable lawful basis such as to comply with a writ, legal claim, a Court-endorsed disclosure or discovery request or regulatory request from the ICO, or FCA, or similar.
When we believe in good faith that disclosure is necessary to protect our rights, protect your safety or the safety of others, investigate fraud, or respond to a government request;
If Carbon is involved in a merger, acquisition, or sale of all or a portion of its assets, you will be notified via email and/or a prominent notice on our website of any change in ownership or uses of your personal information, as well as any choices you may have regarding your personal information;
To any other third party where we have obtained your freely given and informed consent to do so.
Cookies:
We may use technologies such as cookies, web beacons, or scripts to gather information about how you and others interact with our Services.
We use the following cookies:
Strictly necessary cookies. These are cookies that are required for the operation of our website. These essential cookies are always enabled because our website will not work properly without them. You can switch off these cookies in your browser settings, but you may then not be able to access all or parts of our website.
Analytical or performance cookies. These allow us to recognise and count how many users access a specific area or features within our website or Gated Talent Portal and which links or features they clicked on. We use this information to understand and optimize how our site is used, improve our marketing efforts, and provide content and features that are of interest to you.
Targeting cookies. These cookies record your visit to our website, the pages you have visited and the links you have followed. We will use this information to make our website and the advertising displayed on it more relevant to your interests.
In light of recent changes to cookies practices in 2021(with respect to the disablement of third-party cookies on some browsers) we include below an updated list of the more popular browser types with hyperlinks showing how to adapt their cookie settings accordingly:
· Google Chrome
· Microsoft Edge
· Mozilla Firefox
· [Microsoft]Internet Explorer
· Opera
· Apple Safari
Data Retention, Storage and Security:
The security of your personal information is important to us and that is why we have a dedicated policy entitled Security& Cyber Policy. We have in place suitable technical and organisational measures which comply with EU GDPR and UKGDPR requirements for suitable security of processing. We will retain your information for as long as needed to provide Services to you or our corporate clients. Given the nature of many careers which evolve over a period of years, we believe that a lengthy retention period is justifiable and welcomed by our corporate clients, candidates and other contacts. As a core rule, Carbon will hold your data for no longer than 5 years before seeking your views on whether you wish to confirm that you do not want us to continue to hold your data. As a proportionate counterbalance to this length of retention, we are committed to ensuring that our Data Privacy Policy, Records Management Policy, Data Breach Response procedure and Security and Cyber Policy are maintained and remain fit for purpose.
If you wish to cancel your registration or Gated Talent account with us or request that we no longer hold your personal information, contact us at privacy@carbonsearch.com
International Transfers:
The vast majority of personal information we collect will be stored and used within the UK and European Economic Area (EEA).There will be a much smaller sub-set of our data sets which may be transferred to, stored and processed in any country or territory outside the UK and EEA, especially where one or more of our overseas partners or third-party service providers are located.
Particular partners with overseas operations include Filefinder and the Gated Talent portal (by Ikiru People and owned by Dillistone Group PLC at (https://www.dillistone.com/privacy-cookies-and-tcs/)and Google Analytics. Google Analytics based in the USA require Carbon (and all users) to have a Privacy Policy in place and to alert our website users and readers of this Privacy Policy to the use of cookies such as tracking and retargeting triggers which are stored on the user’s device or computer. For more information on Google Analytics see https://marketingplatform.google.com/about/analytics/and for Google’s privacy policy please see here:https://policies.google.com/privacy?hl=en
We at Carbon are committed to taking all steps reasonably necessary to ensure that your data is treated with no less protection than it would receive if transferred and stored within the UK and EEA. Where appropriate, we will adhere to statutory ‘appropriate safeguards’ such as the approved “standard contractual clauses” which will be deemed to apply to certain transfers of information as prescribed by the EU GDPR and UKGDPR. For instance, we may use specific standard contractual terms approved for use in the UK which give the transferred personal data the same protection as it has in the UK, namely the International Data Transfer Agreement (IDTA) or the International Data Transfer Addendum to the European Commission’s standard contractual clauses for international data transfers (the UK Addendum).Alternatively, data may be transferred to partners in the USA under the terms of the EU-U.S. Data Privacy Framework (EU-U.S. DPF) and / or the UK Extension to the EU-U.S. DPF as set forth by the U.S. Department of Commerce.
Changes to This Privacy Policy:
We may update this Privacy Policy to reflect changes to our information practices or changes in the law or best practice. If we make any material changes we will notify you by email (sent to the e-mail address specified in your account) or by means of a notice on the website www.carbonsearch.com. We encourage you to periodically review our website and the Gated Talent portal for the latest information on our privacy practices.
This Privacy Policy and all changes made hereto as described in the previous paragraph remains effective unless and until we inform you otherwise.
Contact:
If you have any questions or comments about this Privacy Policy, you can contact privacy@carbonsearch.com You can also use this address if you wish to request a copy of the personal data we hold about you.
[1] Carbon adheres to relevant provisions within both EU GDPR for candidates located in the EU (and for all personal data held prior to 31 December 2020) and the UK GDPR for the vast majority of personal data held by Carbon since 1 January 2021.
