GDPR candidate privacy notice (UK)

Last updated: September 2026

1. Who we are

The Rivya Partnership Ltd ("we", "us", "our") is a UK strategic talent advisory and executive search consultancy. We are the data controller for the personal data described in this notice. You can reach us using the details on our contact page.

2. Who this notice applies to

This notice applies to anyone we consider, approach, assess, longlist, shortlist or represent in connection with a role, a market mapping exercise or a defined talent solution, whether you applied to us directly, were referred to us, or were identified through research.

3. The personal data we collect

• Identity and contact data: name, email address, telephone number and location.
• Career data: CV, employment history, remuneration, notice period, qualifications and references.
• Assessment data: interview notes, competency evidence, assessment results and our recommendations.
• Right to work and background information where a client engagement requires it.
• Publicly available information, for example a professional profile or company biography.
• Diversity information, where a client asks us to report on representation. This is only ever provided by you, on a voluntary basis, and reported in aggregate.

4. How we collect it

Directly from you, from our own research and market mapping, from referrals and recommendations, from professional networks and public sources, and from a client where they introduce you to a process.

5. Why we use it and our lawful basis

• Legitimate interests: to identify, approach and assess candidates, to advise clients, and to maintain a professional network. We have balanced this against your interests and rights.
• Contract: to take steps at your request before entering into an engagement, and to deliver our services to clients.
• Legal obligation: to meet employment, right to work, tax and record keeping obligations.
• Consent: for marketing, for keeping you on our network beyond a completed process, and for special category or diversity data. You may withdraw consent at any time.

6. Special category data

We do not seek special category data such as health, ethnicity or religious belief unless it is necessary, for example to make reasonable adjustments to an interview process. Where we do, we rely on your explicit consent or on substantial public interest in equality monitoring.

7. Who we share it with

We share your details with a client only where you have agreed to be represented for a specific role. We also use trusted suppliers, including secure IT hosting, email, document storage and assessment providers, who act on our instructions under written terms. We may disclose data where required by law or to protect our legal rights. We never sell personal data.

8. International transfers

Where a client, portfolio company or supplier is outside the UK, we transfer data only with appropriate safeguards, such as UK adequacy regulations or the International Data Transfer Agreement or Addendum.

9. How long we keep it

• Candidate records where a process is live: for the duration of the engagement.
• Candidate records on our network: up to 24 months from our last meaningful contact, after which we ask you to confirm you wish to remain, or we delete them.
• Placement and engagement records: six years from the end of the engagement, for legal and tax purposes.
• Unsuccessful applications: 12 months, so that we can consider you for comparable roles.

10. How we protect it

We apply access controls, encryption in transit, reputable cloud providers, confidentiality obligations for everyone acting for us, and a policy of collecting only what an engagement genuinely requires.

11. Your rights

Under UK GDPR you have the right to be informed, to access your data, to rectification, to erasure, to restrict or object to processing, to data portability, to withdraw consent, and not to be subject to solely automated decision making. We do not use automated decision making or profiling to reject candidates.

To exercise a right, contact us and we will respond within one month. If you are not satisfied you may complain to the Information Commissioner's Office at ico.org.uk.

12. Related notices

This notice sits alongside our privacy policy, cookie policy and terms of use. To understand how we work with organisations, see about The Rivya Partnership.

[Content placeholder: registered company details and data protection contact to be confirmed. This notice is provided for information and is not legal advice.]