Privacy Statement

1. Who we are

The Consultancy Group ("TCG", "we", "us") is the data controller for the personal data we collect through this website and in the course of delivering our services. Our Data Protection Officer is Christian Pampellonne, who can be contacted at the details given in Section 13.

2. What data we collect

The personal data we hold depends on how you interact with us. It typically includes:

• Contact details — name, email address, phone number, LinkedIn profile, company and job title
• Candidate information — CV, employment and education history, professional qualifications, career preferences, salary expectations, notice period, availability, and any other information you share as part of registering with us or being considered for a role
• Client information — business contact details, role briefs, candidate feedback, and other information relevant to the mandates we work on together
• Correspondence — records of emails, calls, meetings and messages exchanged with our consultants
• Website data — IP address, browser type, pages visited, and other analytics information collected through cookies and similar technologies (see our Cookie Policy)

3. How we collect your data

We collect personal data in the following ways:

• Directly from you — when you register as a candidate, submit a mandate, apply for a role, email a consultant, or visit this website
• From publicly available sources — such as LinkedIn, company websites, and professional directories, as part of executive search activity
• From third parties — including personal referrals from candidates or clients, previous employers providing references with your consent, and background check providers where engaged on a specific mandate with your permission

4. Why we use your data, and the lawful basis

We process your personal data for the following purposes. Each purpose has an associated lawful basis under UK GDPR (Article 6):

• Delivering talent advisory and executive search services — introducing candidates to clients and vice versa, advising on mandates, and conducting the associated search activity. Lawful basis: legitimate interests (running our business) and, where appropriate, performance of a contract.
• Keeping you informed — sending you updates about mandates, market insights, and events relevant to your discipline. Lawful basis: legitimate interests and, where required, consent.
• Maintaining our candidate and client relationships — including long-term contact across multiple roles and over time. Lawful basis: legitimate interests.
• Compliance with legal and regulatory obligations — including right-to-work checks, anti-money-laundering obligations where applicable, and responding to lawful information requests. Lawful basis: legal obligation.
• Improving our services and website — including analytics, service-quality review, and internal training. Lawful basis: legitimate interests.

Where we rely on legitimate interests, we have considered the potential impact on your rights and interests and are satisfied that our processing is proportionate.

5. Special category data

We do not routinely collect special category data (such as information about health, ethnicity, religion, or trade union membership). Where such information is incidentally included in a CV or other document you provide, we will process it only to the extent necessary for your assessment for a role, on the basis of your explicit consent, and we will not share it with a client without your specific agreement.

6. Sharing your data

We share personal data only in the following circumstances:

• Clients — where we believe you may be a fit for a specific role, we will share relevant information with the hiring client. We will not share a candidate's details with a client without the candidate's prior agreement.
• Candidates — where we introduce a mandate to a candidate, we will share information about the role and the hiring client, to the extent the client has agreed to disclose.
• Service providers — including our email, CRM, cloud storage, and analytics providers, who act as data processors on our behalf under contractual data-processing terms.
• Professional advisers — including auditors, legal counsel, and accountants, where required.
• Regulators and law-enforcement bodies — where required by law.
• Successors — in the event of a restructure, merger, or sale of the business, personal data may be transferred to the new ownership, subject to the same protections set out here.

We do not sell, rent, or trade personal data to any third party for marketing purposes.

7. International transfers

We place talent across the UK, Europe and the US. Where personal data is transferred outside the UK or European Economic Area, we ensure appropriate safeguards are in place — typically by relying on adequacy decisions, the UK International Data Transfer Agreement, or the EU Standard Contractual Clauses.

8. How long we keep your data

We retain personal data for as long as it is needed to deliver our services to you and to maintain our client and candidate relationships, which in the context of executive search may be a period of several years. We will delete or anonymise personal data that is no longer required.

Specifically:

• Candidate data — retained for up to 10 years from our last meaningful interaction with you, to support long-term career conversations and future mandates. You may request earlier deletion at any time (see Section 10).
• Client data — retained for the duration of our commercial relationship and for 6 years thereafter, to meet contractual and record-keeping obligations.
• Website analytics data — retained in aggregated, non-identifiable form only.

9. Security

We take the security of personal data seriously. Technical and organisational measures include encrypted transmission of data (TLS), access controls on our systems, principle-of-least-privilege permissions, regular security review of our vendors, and staff training on data handling. No system is completely secure, but we work to apply the standards appropriate to the sensitivity of the information we hold.

10. Your rights

Under UK GDPR you have the following rights in respect of your personal data:

• Right of access — to request a copy of the personal data we hold about you
• Right to rectification — to have inaccurate data corrected
• Right to erasure — to have your data deleted, subject to overriding legal obligations
• Right to restriction — to limit how we use your data in certain circumstances
• Right to data portability — to receive your data in a portable format or have it transferred to another controller
• Right to object — to object to processing based on our legitimate interests, including direct marketing
• Rights related to automated decision-making — we do not use personal data for automated decision-making or profiling that produces legal or similarly significant effects
• Right to withdraw consent — where we rely on your consent, you may withdraw it at any time

To exercise any of these rights, please contact Christian Pampellonne using the details in Section 13. We will respond within one month.

11. Cookies

This website uses cookies and similar technologies. For details, see our Cookie Policy.

12. Changes to this statement

We may update this Privacy Statement from time to time. The "Last Updated" date at the top of this page indicates when it was most recently revised. Significant changes will be communicated to registered candidates and active clients directly.

13. Contact and complaints

If you are not satisfied with how we have handled your personal data, you have the right to lodge a complaint with the UK supervisory authority: