Privacy & data
Privacy & data protection policy in accordance with the UK General Data Protection Regulation (GDPR), tailored by the Data Protection Act 2018
Introduction and application
Lygon Group gathers and processes data on individuals and companies for the purposes of executive search and for the purposes of executive mentoring. We are committed to processing personal data lawfully, fairly and transparently in accordance with applicable data protection laws, including the UK GDPR and the Data Protection Act 2018.
This policy describes how personal data must be collected, handled and stored in order to meet Lygon Group’s data protection standards and to comply with GDPR. Lygon Group takes the privacy rights of individuals, whether members of staff, candidates or clients, seriously and aims to protect them and act with transparency at all times.
This policy protects the rights of staff, candidates and clients.
Policy scope
This policy applies to all employees of Lygon Group. Employees act under the authority of Lygon Group, which is the data controller, when processing personal data. This policy applies to all data that the company holds relating to identifiable individuals.
Third party providers to Lygon Group are required to confirm that they comply with the provisions of UK GDPR, the Data Protection Act 2018, and the terms of this policy as a data processor on Lygon Group’s behalf.
Definitions
Employees process personal data on Lygon Group’s behalf, under its instructions, as the data controller. A data processor is a third party, such as an outsourced IT provider, engaged under contract to process data for Lygon Group. Third party IT providers contracted by Lygon Group are data processors, and are bound by this policy.
For the purposes of the UK GDPR and the Data Protection Act 2018, the data controller is Lygon Group (Lygon Partners Ltd) of 1 Albemarle Street, London W1S 4HA.
The term ‘Lygon Group employee’ refers to any full or part time member of Lygon Group, whether on a permanent or temporary contract.
Legal basis for processing personal data
Personal data will only be collected and processed by Lygon Group for the legitimate purposes of:
- the execution of an executive or non-executive search
- the provision of mentoring services
- business development activities pursuant to winning search or mentoring assignments
- Lygon Group staff and company administration
Wherever possible, Lygon Group attempts to secure consent from an individual to store and process their data. Consent is sought when an individual writes to a member of staff at Lygon Group pursuant to job opportunities. Individuals are replied to by a named and contactable employee of Lygon Group with an email stating that Lygon Group will retain a copy of their CV on its database so that staff from Lygon Group can contact them about relevant searches at some point in future.
When an individual actively engages in a search process pursuant to a job opportunity, Lygon Group relies on its legitimate interests in carrying out executive search work as the legal basis for processing (Article 6(1)(f) UK GDPR), having checked this does not override the individual’s own rights and interests. The individual is explicitly informed that their data and interest in the role will be shared with a client.
Categories of personal data
Personal data for the purposes of Lygon Group’s legitimate business interests includes:
- Name
- Address/location
- Date of birth
- Gender
- Education
- Work history
- Compensation
- Performance and suitability assessments
- Telephone, email, social media and Skype contact details
- Formal and informal references
- Profile picture sourced online
Lygon Group will only collect personal data that is adequate, relevant and limited to what is necessary for the purposes described above.
Lygon Group does not typically process sensitive personal data, such as ethnic origin, political opinions, religious beliefs or physical or mental health. In the event that a client of Lygon Group wishes to see diversity statistics for a search, we will seek a candidate’s explicit consent to store this information. Diversity statistics on topics of sensitive personal data will be anonymous when shared with the client and will not be attributable to an individual candidate.
Categories of individuals
Personal data is collected by Lygon Group about:
- potential and actual candidates
- potential and actual clients
- referees, both named and informal
- potential and actual mentors
- employees
Source of data
The personal data processed by Lygon Group is sourced via one or more of the following methods:
- Direct telephone, email, online, and in-person contact with the individual in question
- Third party individuals, such as referees
- The client interview process
- Public company records, websites and press releases
- Subscription databases, such as BoardEx and Capital IQ
Categories of recipients of personal data
Personal data collected for business development, mentoring, and executive search purposes will only be shared on a need-to-know basis with:
- Potential and actual candidates
- Potential and actual clients
- Potential and actual mentors
- Individuals employed by Lygon Group
Personal data will only be transferred to a client outside the UK where the destination country has UK adequacy status, an appropriate safeguard is in place (such as the UK International Data Transfer Agreement), or, exceptionally, the individual has given explicit consent to that transfer.
Length of time data is retained for
For the legitimate business interests of Lygon Group and its data controllers, personal data about clients and candidates is stored securely for as long as necessary for the purposes for which it was collected, and periodically reviewed to ensure it remains relevant and up to date, unless a candidate requests otherwise. Retaining contact with clients and candidates (prospective or actual), and understanding the course of an individual’s career and their respective experiences and personal progression is a critical factor in Lygon Group’s ability to carry out its legitimate business interests.
Each time personal data is processed by a Lygon Group employee, that employee will take all reasonable measures to ensure the data is up to date. Measures may include: contacting the individual about whom the data is being processed, accessing databases to which Lygon Group subscribes, and using publicly available information.
Data storage and access
Lygon Group stores personal data as follows:
- Ezekia (Executives Place Ltd) – a licenced internal database to which only Lygon Group employees have access and to which access is password protected
- Hand written records are either securely shredded (via an outsourced provider) or are stored in locked filing cabinets at Lygon Group’s offices
- Additional data is stored (documents, emails, and contacts) via Lygon Group’s IT system, which includes outlook and a shared drive
Lygon Group employees will have access to personal data stored about candidates and clients (actual or potential). Employees access this data via Lygon Group’s on-premise IT equipment and mobile devices.
Lygon Group employees must follow comprehensive guidelines regarding the entry and processing of data onto and through Ezekia (Executives Place Ltd).
Lygon Group outsources its IT management and data security provision to 123 Technology Limited, which carries out annual assessments of system and data security in line with GDPR regulations. Individual personal data may be accessible by 123 Technology Limited for the purpose of its IT service provision.
Other third party providers may have limited access to personal data held and processed by Lygon Group for specific and limited purposes, such as for employee payroll.
Right of access and objection
Individuals about whom Lygon Group processes data are entitled to:
- confirmation that their data is being processed
- access to their personal data
- a copy of Lygon Group’s privacy and data protection policy
Individuals who request access to their personal data in writing will be provided with their data within 1 month of their request.
An individual who has reviewed the personal data held on them by Lygon Group has the right to have their personal data rectified within one month if it is inaccurate or incomplete, in which instance Lygon Group will inform any third party who has received the data in question of the rectification where possible.
An individual has the right to object to the processing of their personal data at any point by emailing: privacy@lygongroup.com. In that instance, Lygon Group will continue to store their data but will not process it for any purpose. The right to object explicitly forms part of Lygon Group’s initial consent request (see above).
An individual has the right to object to the storage of their personal data at any point by emailing: privacy@lygongroup.com. In that instance, Lygon Group will destroy/delete the data stored on the individual unless it is required to retain this information for a period of time, such as in the case of a placed candidate or for regulatory purposes. The right to object explicitly forms part of Lygon Group’s initial consent request (see above).
Data breaches
If Lygon Group becomes aware of a data breach that risks individuals’ rights and freedoms, it will notify the ICO without undue delay, normally within 72 hours. Where the breach is high-risk, Lygon Group will also notify the affected individuals and clients without undue delay.
How to make a complaint
Individuals can write to Lygon Group’s data protection officer with details of their complaint: privacy@lygongroup.com.
A written response will be provided after an internal investigation and within 30 days.
Individuals also have the right to raise their concerns with the Information Commissioner’s Office (ICO) at https://ico.org.uk/make-a-complaint/