This Privacy Statement is provided by Hartebridge Limited ("Hartebridge", "we", "us" or "our"). It is addressed to individuals outside our organisation with whom we interact, including (but not limited to) Candidates, Clients, Sources, Referees, and visitors to our website (together, "you").
Defined terms used in this Statement are explained in Section 15 below.
For the purposes of this Statement, Hartebridge is the Controller. Contact details are provided in Section 13.
Controller Identification
If you are a Candidate, the Controller of your Personal Data is Hartebridge Limited, the entity that contacts you in connection with the Services. If you are a Client, Source, or Referee, the Controller is Hartebridge Limited, the entity engaging with and managing the relationship with you. If you are a visitor to our website, the Controller is Hartebridge Limited.
This Statement may be amended or updated from time to time to reflect changes in our practices or in applicable law. We will notify you of any significant changes. We encourage you to check this page periodically.
| Data Controller | Hartebridge Limited |
| Registered Office | 5th Floor, 167–169 Great Portland Street, London W1W 5PF |
| Company Number | 17134352 |
| ICO Registration | ZA1375446 |
| Contact | info@hartebridge.com |
| Specialisation | Executive search and leadership advisory firm helping clients successfully navigate leadership transitions. We find and validate CEOs, senior executives, non-executive directors, Trustees and Chairs across investment banking, energy and social impact sectors. |
We may collect Personal Data about you from the following sources:
Your data is stored on our secure database, compiled and hosted between Atlas and Google Drive (our "Subprocessors"). Further detail on our Processors and international transfer safeguards is provided in Sections 7 and 8.
We may also create Personal Data about you, such as records of interviews you attend and assessment reports.
In some circumstances, you may provide us with Personal Data about others, for example, where you act as a Source or provide details of a Referee. If you do so, you must ensure that you are entitled to disclose that Personal Data to us, and that the individual concerned is aware of the matters detailed in this Statement.
We may also process Special Category Personal Data, including:
Special Category Personal Data is stored exclusively in Google Drive (one of our Subprocessors). Further detail is provided in Section 7.
We identify a specific lawful basis for each processing purpose. Where we rely on Legitimate Interests, we have completed a Legitimate Interests Assessment (LIA); a summary is available on request by contacting info@hartebridge.com.
| Processing Purpose | Lawful Basis (Art. 6) | Special Category Basis |
|---|---|---|
| Executive Search Services | Contract (Art. 6(1)(b)); Legitimate Interests (Art. 6(1)(f)) | N/A |
| Equal Opportunity Monitoring | Legal Obligation (Art. 6(1)(c)); Explicit Consent (Art. 6(1)(a)) | Explicit Consent (Art. 9(2)(a)) |
| Client Relationship Management | Contract (Art. 6(1)(b)); Legitimate Interests (Art. 6(1)(f)) | N/A |
| Market Research and Talent Mapping | Legitimate Interests (Art. 6(1)(f)) | N/A |
| Database Maintenance | Legitimate Interests (Art. 6(1)(f)) | N/A |
| Marketing and Communications | Consent (Art. 6(1)(a)) for new contacts; Legitimate Interests (Art. 6(1)(f)) for existing clients | N/A |
| Legal Compliance | Legal Obligation (Art. 6(1)(c)) | Art. 9(2)(b) + DPA 2018 Sch. 1, para. 1 where applicable |
| Service Improvement | Legitimate Interests (Art. 6(1)(f)) | N/A |
Where we rely on consent, you may withdraw it at any time by contacting info@hartebridge.com. Withdrawal of consent does not affect the lawfulness of processing carried out before withdrawal.
Where we send electronic marketing communications (including emails), we do so in compliance with the Privacy and Electronic Communications Regulations 2003 (PECR), as well as UK GDPR.
We maintain a suppression list of all individuals who have opted out. We do not contact suppressed individuals for marketing purposes.
We do not sell Personal Data. We may disclose your Personal Data to the following categories of recipient:
Your Personal Data is stored on our secure database, hosted between our Subprocessors: Atlas (Atlas Recruitment Technology Ltd, our AI-powered CRM and ATS) and Google Drive (Google Workspace, our document storage platform). Each Subprocessor acts as a data Processor under a written Data Processing Agreement meeting the requirements of Article 28 UK GDPR.
Our Data Processing Agreement with Atlas (Appendix D of the Atlas Service Agreement, dated 9 April 2026) further specifies: (i) Special Category Personal Data (UK GDPR Article 9) is not stored in Atlas. All such data is held in Google Drive only; (ii) on termination, Client Personal Data is made available for retrieval for 30 days, after which it is deleted, with full DPA-compliant deletion completed within 90 days.
Note on Atlas and AI Processing
Atlas uses OpenAI's models (accessed via API) to power certain features, including candidate/client database population and GPT-based querying. Under Atlas's agreement with OpenAI, your data is not used to train OpenAI's models, nor is your data used to train Atlas's own models. Data submitted to the OpenAI API forms part of a one-off prompt only.
We primarily process data within the United Kingdom. Where data is transferred outside the UK, we ensure appropriate safeguards are in place in accordance with UK GDPR Article 46. The safeguards we rely upon include:
Third-party beneficiary rights
As a data subject, you are a third-party beneficiary under any IDTA or UK Addendum we have entered into in respect of your Personal Data, and may enforce its terms against the data importer in the receiving country.
A copy of the applicable transfer safeguard can be obtained by contacting info@hartebridge.com.
We use AI-powered tools to support our executive search process. Our primary CRM and ATS, Atlas, uses AI for candidate and client database management, content extraction, opportunity matching, and market intelligence. Atlas accesses OpenAI's models via the OpenAI API. Under the terms of that API, your data is not used to train OpenAI's models, and Atlas does not use your data to train its own models.
This activity constitutes profiling within the meaning of Article 4(4) UK GDPR, in that automated tools are used to evaluate certain professional aspects relating to individuals.
However, we do not make final decisions about your suitability for a role, or any decision producing legal or similarly significant effects, based solely on automated processing. All assessments are subject to human review by Hartebridge before any recommendation is made to a Client.
You have the right to request that any significant assessment of you is reviewed by a human, to obtain an explanation of the assessment, and to contest any conclusion reached. Please contact us using the details in Section 13.
We retain Personal Data only for as long as is necessary for the purposes set out in this Statement. The 6-year retention period applicable to certain records reflects the Limitation Act 1980 and is consistent with convention in the UK executive search sector.
| Data Category | Retention Period |
|---|---|
| Candidate records (CVs, correspondence) | 6 years from last contact, unless you request earlier deletion or consent to longer retention. |
| Source data | Duration of the relevant search, plus 6 months to allow for follow-up. |
| Client search records | 7 years, to support legal record-keeping obligations. |
| Financial records (invoices, payment data) | 7 years, in line with HMRC requirements. |
| Diversity / equal opportunity monitoring data | Individual-level data deleted within 3 months of the conclusion of the relevant search. Aggregated, anonymised data may be retained indefinitely. |
| Background check data | 6 months from the conclusion of the relevant search. |
| Website and IT data | Log data: 13 months. IP addresses anonymised within 26 months. |
| Marketing consent records | Duration of the marketing relationship plus 6 years. |
We implement appropriate technical and organisational security measures to protect your Personal Data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, and unauthorised access, consistent with our obligations under UK GDPR Article 32. These measures are reviewed periodically and updated to reflect changes in technology and regulatory guidance. A summary of our current measures is available on request.
No transmission over the internet or method of electronic storage is entirely secure. Whilst we take all reasonable steps to protect your Personal Data, we cannot guarantee absolute security. You are responsible for ensuring that any Personal Data you send to us is transmitted securely.
Subject to applicable law, you have the following rights regarding the processing of your Personal Data:
To exercise any of these rights, please contact info@hartebridge.com. We will respond within one month. Where requests are complex or numerous, we may extend this period by a further two months; we will notify you of any extension within one month of receiving your request.
If you have any questions or concerns about this Statement, or about the processing of your Personal Data by Hartebridge, please contact:
Hartebridge Limited
5th Floor, 167–169 Great Portland Street, London W1W 5PF
Email: info@hartebridge.com
ICO Registration: ZA1375446
If you are dissatisfied with how we handle your Personal Data, you have the right to lodge a complaint with the Information Commissioner's Office (ICO). We would, however, appreciate the opportunity to address your concerns before you contact the ICO. Please contact us in the first instance at info@hartebridge.com.
| Website | ico.org.uk |
| Helpline | 0303 123 1113 |
| Address | Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF |
| Term | Meaning |
|---|---|
| "Candidate" | A candidate, or potential candidate, for a position with a Client. |
| "Client" | A client of Hartebridge. |
| "Controller" | The entity that decides how and why Personal Data is processed. Hartebridge is the Controller for the purposes of this Statement. |
| "Database" | Our secure database of Personal Data, compiled and hosted between our Subprocessors (Atlas and Google Drive). |
| "Data Protection Authority" | An independent public authority legally tasked with overseeing compliance with applicable data protection laws. In the UK, this is the Information Commissioner's Office. |
| "IDTA" | The International Data Transfer Agreement, issued by the UK Information Commissioner's Office, effective 21 March 2022. |
| "Personal Data" | Any information relating to an identified or identifiable natural person. |
| "Process" / "Processing" | Any operation or set of operations performed on Personal Data, including collection, recording, storage, use, disclosure, and deletion. |
| "Processor" | Any person or entity that processes Personal Data on behalf of the Controller, solely on the Controller's instructions. |
| "Referee" | An individual whose contact details have been provided by a Candidate as a professional reference. |
| "Source" | Any person who provides views or opinions regarding a Candidate's qualities or suitability for a role. |
| "Special Category Personal Data" | Personal Data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data for unique identification, data concerning health, or data concerning sex life or sexual orientation. |
| "Subprocessor" | A data Processor engaged by Hartebridge to host or process Personal Data on our behalf, specifically Atlas and Google Drive. |
| "UK GDPR" | The UK General Data Protection Regulation, as retained in UK law by the European Union (Withdrawal) Act 2018, as amended by the Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019. |
This website uses only essential cookies required for basic functionality. We do not use analytics cookies or any third-party tracking technologies. No cookie consent banner is required.
Our website includes a link to LinkedIn. Visiting LinkedIn is governed by LinkedIn's own privacy policy, available at linkedin.com/legal/privacy-policy.
If you are a Candidate, we rely on you to provide complete and accurate Personal Data about you so that we can provide appropriate services to you and to our Clients.
If you are a Source or Referee, we rely on you to ensure that you are lawfully entitled to disclose Personal Data about others to us.
Last updated: April 2026 | Hartebridge Limited | ICO Registration: ZA1375446