Candidate Privacy Notice
How GFFC collects and uses personal information about candidates and prospective candidates in connection with executive search and recruitment.
Draft — pending UK legal review. This document is a working draft prepared for the GFFC Executive Search website. It must be reviewed and approved by qualified UK legal counsel before launch. Version 2026-09-21-draft.
1. Who we are
GFFC Limited ("GFFC", "we", "us") is the data controller for the personal information described in this notice. GFFC provides executive search and permanent recruitment services and acts as an employment agency in relation to permanent appointments. Our registered office is 105 High Street, Brentwood, England, CM14 4RR, and our company number is 14683888.
For any question about this notice or your personal information, contactprivacy@gffc.io.
2. Scope
This notice applies to candidates, prospective candidates, referees and other individuals whose personal information we process for the purpose of recruitment and executive search. It applies whether we obtained your information directly from you or from another source.
3. The information we collect
Depending on the circumstances, we may collect:
- Identity and contact details (name, email, telephone, location);
- Career information (roles, employers, responsibilities, achievements);
- Professional information (LinkedIn profile, CV, qualifications);
- Recruitment preferences (locations, working model, notice period);
- Compensation information and expectations, where you provide it;
- Right-to-work information at a high level, where relevant to a role;
- Selection and assessment notes created during a search process;
- Correspondence with you and records of consents and approvals.
4. Where the information comes from
We may receive your information:
- Directly from you, including through our website forms and CV uploads;
- From referrals and professional contacts;
- From publicly accessible professional sources such as LinkedIn, company websites, professional directories and industry publications.
Where we obtain your information indirectly, we will provide this notice within the time required by applicable data protection law.
5. Why we use it, and our lawful bases
- To assess your suitability and consider you for roles.Lawful basis: legitimate interests (conducting executive search) and, where a specific opportunity arises, steps towards a possible introduction.
- To contact you about relevant opportunities.Lawful basis: legitimate interests, or your consent where required.
- To maintain and update our records of professional contacts.Lawful basis: legitimate interests.
- To share your details with a client for a specific opportunity.Lawful basis: your prior approval for that specific opportunity.
- To comply with legal and regulatory obligations.Lawful basis: legal obligation.
6. How we assess legitimate interests
Where we rely on legitimate interests, we carry out a balancing assessment to ensure our interests do not override your rights. We consider the nature of the data, your reasonable expectations in a professional recruitment context, and the safeguards we apply. We also apply a documented legitimate interests assessment for sourcing and maintaining professional contact data.
7. Special category and criminal offence data
We do not seek special category data or criminal offence data as part of general candidate registration. If such information is ever relevant to a role — for example, fitness-and-propriety or reference checks — it will be handled only where there is a lawful basis, appropriate safeguards and, where required, your explicit consent or information that a lawful requirement applies.
8. Sharing your information
We do not sell your personal information. We may share it with:
- Clients: only where you have given prior approval for that specific opportunity. Your details are not sent to a client without your knowledge and approval for that role.
- Service providers: recruitment CRM, cloud hosting, email delivery and information-security providers acting on our instructions.
- Professional advisers and authorities: where required by law or to establish or defend legal claims.
9. International transfers
Online trading is an international market. Where we transfer personal information outside the UK, we use appropriate safeguards, such as the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, or a valid adequacy mechanism.
10. Retention
We retain candidate information only for as long as necessary for recruitment and executive search purposes. As a guide, we review inactive candidate records periodically and delete or anonymise information that is no longer needed, unless a longer period is required by law or a specific process.
11. Your rights
Subject to applicable law, you have the right to access, rectify, erase, restrict or object to the processing of your personal information, and to data portability where relevant. Where processing is based on consent, you have the right to withdraw it at any time. To exercise any right, contactprivacy@gffc.io.
12. Automated decision-making
We do not make decisions about you based solely on automated processing, including profiling, that produce legal or similarly significant effects.
13. How we protect your information
We use access controls, multi-factor authentication and encryption in transit, restrict access to authorised personnel, and keep CVs and candidate records in controlled systems rather than public locations.
14. Keeping your information up to date
You can ask us to update, correct or erase your information at any time by contacting privacy@gffc.io.
15. Complaints
If you are unhappy with how we have handled your information, you can complain to the UK Information Commissioner's Office (ICO) at ico.org.uk. We would appreciate the chance to address your concern first.
16. Version
Version 2026-09-21-draft, effective 21 September 2026. We may update this notice and will publish any revised version here.