Privacy & Data Protection Policy
Strict Non-Disclosure Protocols, Executive Discretion, and Rigorous Candidate Data Governance for Retained Executive Search.
01Data Controller & Practice Commitment
MG Headhunting Ltd (“MGH”, “we”, “our”, or “us”), led by Managing Director Mark Goldsmith, operates as a boutique retained executive search firm specializing in Board, Managing Director, and C-suite appointments across the UK and European Building Products and Built Environment sectors.
We are committed to maintaining the highest standards of data protection, executive confidentiality, and integrity. MGH operates in full compliance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 (DPA 2018), and is formally registered with the UK Information Commissioner’s Office (ICO).
02Bilateral NDA & Candidate Discretion Protocol
Unlike transactional recruitment agencies, MG Headhunting operates exclusively on a retained search basis:
We never circulate, broadcast, or transmit candidate profiles, CVs, or identifying information to third parties without prior express bilateral consent.
Client references, confidential restructurings, and candidate benchmarks are shared selectively only with pre-verified principals under bilateral non-disclosure agreements.
03Lawful Basis for Processing
We process personal information under the following lawful bases recognized by Article 6 of the UK GDPR:
- Legitimate Interests (Article 6(1)(f)): Processing is necessary for our legitimate commercial interests in providing bespoke retained executive search services to corporate clients, evaluating candidate suitability for board-level leadership roles, and maintaining professional market mapping intelligence across the built environment sector.
- Consent (Article 6(1)(a)): We obtain your explicit consent prior to submitting your formal candidacy dossier to a hiring client board or commissioning confidential referencing checks.
- Contractual Necessity (Article 6(1)(b)): To execute search mandates agreed with corporate clients, sponsors, or institutional investors.
04Categories of Data Collected
During the execution of executive search mandates and industry research, we may collect and process:
- Professional identity details (full name, current and historic executive titles, corporate board history).
- Direct contact information (executive telephone number, business and personal email address, professional LinkedIn URL).
- Career credentials (employment history, verified commercial track record, qualifications, P&L scale managed).
- Remuneration parameters (base salary, LTIP, bonus structure, co-investment expectations — collected solely under strict confidentiality).
- Third-party boardroom referencing and peer appraisals (obtained strictly with candidate pre-authorization).
05Data Retention & Cybersecurity
We retain candidate data only for as long as necessary to fulfill the purposes of executive search engagement, regulatory compliance, and post-placement 12-month assurance warranties. Inactive candidate records undergo structured biennial reviews.
All executive data is secured using enterprise-grade encryption in transit (TLS 1.3) and at rest (AES-256), multi-factor authentication, and strict access controls restricted exclusively to authorized partners.
06Your Individual Rights Under UK GDPR
Under UK data protection law, you have specific enforceable rights regarding your personal information:
07Data Protection Officer & Inquiries
To exercise any of your statutory rights, update your professional records, or submit a data privacy inquiry, please contact our Lead Practice Partner directly:
If you are not satisfied with our response or believe our processing does not comply with UK data protection laws, you have the right to lodge a complaint with the UK Information Commissioner’s Office (ICO) at ico.org.uk.