Privacy Notice – Carnelian Search 

1. Who We Are 

Carnelian Search (51 Romney Street, London, SW1P 3RF, United Kingdom) is a leadership consulting firm providing services such as executive and board search, board advisory, and evaluation reviews. More information about our services can be found at www.carneliansearch.com. 

2. Personal Data We Collect 

The personal information we collect depends on our relationship with you. We may receive data directly from you, from public or professional sources, or from third parties such as our clients, referees, or background-check providers.

Candidates
We may collect: 

• Contact details (name, email, address, phone number) and photographs 

• Professional information such as CVs, employment and education history, qualifications, skills, references, and interview notes (including recordings or transcripts, if applicable) 

• Compensation details (where lawful), work eligibility documentation, and job preferences 

• Public professional profiles (e.g. LinkedIn) 

• Information about diversity characteristics where voluntarily provided, to support equality monitoring and client diversity requirements 

• Information about religious affiliation only where manifestly public, relevant to the role, or voluntarily shared by you 

Referees and Sources
If you provide a reference or professional feedback, we may process your name, contact details, position, relationship to the individual, and the feedback you give. Any feedback will only be attributed to you with your consent. 

Clients and Suppliers
We process contact and business details such as name, role, email, phone number, and correspondence relating to the services we provide or receive. 

3. How We Collect Data 

We may obtain information through: 

• Direct interactions with you (applications, calls, interviews, emails) 

• Publicly available sources (e.g. professional networking sites) 

• Referrals, professional introductions, or events 

• Licensed third-party databases or recruitment tools, where permitted by law 

4. Why We Process Your Data 

We process personal data to manage our relationships and deliver our services, including: 

• Identifying and assessing suitability for executive or board roles 

• Communicating about opportunities and projects 

• Sharing candidate information with clients (with consent)

• Conducting background or reference checks

• Preparing reports, insights, and evaluations for clients

• Meeting legal, contractual, or regulatory obligations 

5. Legal Grounds for Processing 

We rely on the following lawful bases under the UK GDPR: 

• Legitimate interests – to manage and promote our business, maintain relationships, and improve our services (balanced against your rights and expectations). 

• Consent – for certain processing, such as background checks, use of sensitive information, or recording interviews. 

• Legal obligations – where processing is required by law (e.g. right-to-work verification, tax or regulatory reporting). 

When processing special category data (such as information revealing religious belief), this will only occur where: 

• You have made the information public; 

• You have explicitly shared it with us; or 

• Processing is required by law, including occupational requirements under the Equality Act 2010. 

We do not use sensitive data for marketing or unrelated recruitment activities. 

6. Data Storage and Sharing 

Your information is stored securely in Carnelian Search’s cloud-based systems, accessible only to authorised employees. 

We may share data with: 

• Clients and potential employers (with your knowledge and consent) 

• Background-check or verification providers 

• Technology providers such as cloud, ATS, or CRM platforms (acting as data processors) 

• Regulators or public authorities, when required by law 

• AI-powered tools used to assist in candidate research, summarisation, or matching, including Microsoft (Copilot) and Anthropic (Claude).  

All service providers are contractually required to protect personal data and comply with GDPR standards.  

Special category personal data under Article 9 UK GDPR (including, where relevant, religious belief) may be processed using Microsoft (Copilot) or Anthropic (Claude) under applicable commercial agreements, Terms of Service and Data Processing Addenda, under which Microsoft and Anthropic act as our data processors. 

Where Anthropic processes data on our behalf outside the UK, this is governed by the EU Standard Contractual Clauses together with the UK Addendum issued by the Information Commissioner's Office (Addendum B.1.0), incorporated into our Data Processing Addendum with Anthropic. A copy is available on request. 

Where Microsoft processes personal data on our behalf outside the UK, such processing is subject to Microsoft's Data Protection Addendum and applicable international data transfer safeguards, including the EU Standard Contractual Clauses together with the UK International Data Transfer Addendum (or successor transfer mechanisms recognised under UK GDPR, where applicable). Further information is available from Microsoft and can be provided on request. 

7. Data Retention 

We keep personal data only for as long as it is needed for the purposes set out above, or as required by law. Retention periods depend on the nature of our relationship and any ongoing business or legal obligations. 

Once personal data is no longer needed, we securely delete or anonymise it in line with data-minimisation principles. 

8. Your Rights 

You have the following rights under the UK GDPR: 

• Access – request a copy of the data we hold about you 

• Rectification – correct inaccurate or incomplete data 

• Erasure – ask us to delete your data (“right to be forgotten”) 

• Restriction – limit how we use your data 

• Objection – object to processing based on legitimate interests 

• Portability – request a copy of your data in a portable format 

You may also withdraw consent at any time (without affecting processing carried out before withdrawal). Please note that we may retain limited data to record your request or meet legal obligations. 

To exercise any of your rights, email: catriona@carneliansearch.com. We will respond within one month of receiving your request. 

9. Data Security 

We use a combination of technical, organisational, and procedural safeguards to protect personal information, including: 

• Secure, access-controlled cloud systems 

• Strong password and encryption standards 

• Regular data audits, reviews, and deletion processes 

These measures are periodically reviewed to ensure ongoing compliance and security. 

10. Automated Decision-Making and Profiling 

We do not make decisions about you based solely on automated processing that produce legal or similarly significant effects, as described under Article 22 of the UK GDPR. 

Where we use automated tools to assist in candidate screening or matching, these are used only to support — and not replace — human decision-making by our consultants and researchers. You have the right to request human review of any such decision, to express your point of view, and to contest the outcome. 

11. Contact Information 

If you have any questions, concerns, or complaints about how your data is handled, please contact: 

Data Protection Lead: GDPR@carneliansearch.com 
 
Regulator Contact: 
Information Commissioner’s Office (ICO) – https://ico.org.uk 
ICO Registration Number: CSN3828207