[LEGAL]
Candidate Privacy Notice
Candidate Privacy Notice
Candidate Privacy Notice
Noesis Partners Inc. • Effective date: 1 August 2026 • Version: 2.0
Noesis Partners Inc. • Effective date: 1 August 2026 • Version: 2.0
1. Overview
1. Overview
This Candidate Privacy Notice (“Notice”) explains how Noesis Partners Inc. (“Firm”, “we”, “us”, “our”) collects, uses, stores and discloses personal data in connection with our executive search services.
This Candidate Privacy Notice (“Notice”) explains how Noesis Partners Inc. (“Firm”, “we”, “us”, “our”) collects, uses, stores and discloses personal data in connection with our executive search services.
This Notice applies to all individuals (“Candidates”) whose personal data we process in the course of a search, including individuals we identify and approach directly, and individuals who participate in screening calls, interviews or other communications with us.
This Notice applies to all individuals (“Candidates”) whose personal data we process in the course of a search, including individuals we identify and approach directly, and individuals who participate in screening calls, interviews or other communications with us.
This Notice is issued in accordance with the Personal Information Protection and Electronic Documents Act (“PIPEDA”), applicable United States federal and state privacy laws, and, where applicable, the EU General Data Protection Regulation (EU) 2016/679 and the UK General Data Protection Regulation (together, “GDPR”).
This Notice is issued in accordance with the Personal Information Protection and Electronic Documents Act (“PIPEDA”), applicable United States federal and state privacy laws, and, where applicable, the EU General Data Protection Regulation (EU) 2016/679 and the UK General Data Protection Regulation (together, “GDPR”).
Application of the GDPR depends on a Candidate’s location, not their nationality or citizenship. Where this Notice refers to Candidates located in the European Economic Area (“EEA”) or the United Kingdom, it means Candidates who are physically present in those territories at the time their personal data is collected or processed.
Application of the GDPR depends on a Candidate’s location, not their nationality or citizenship. Where this Notice refers to Candidates located in the European Economic Area (“EEA”) or the United Kingdom, it means Candidates who are physically present in those territories at the time their personal data is collected or processed.
2. Data Controller
2. Data Controller
For the purposes of applicable data protection law, the data controller is:
For the purposes of applicable data protection law, the data controller is:
Noesis Partners Inc. [Insert full postal address] Email: info@noesispartners.co
Noesis Partners Inc. [Insert full postal address] Email: info@noesispartners.co
We determine the purposes and means of the processing described in this Notice, including which individuals to approach, what personal data to collect, the legal basis for processing, and how long personal data is retained.
We determine the purposes and means of the processing described in this Notice, including which individuals to approach, what personal data to collect, the legal basis for processing, and how long personal data is retained.
Where we disclose Candidate personal data to a client company in connection with a search engagement, that client company acts as a separate and independent data controller in respect of its own use of that personal data. We are not a data processor acting on the instructions of our clients, and we are not a joint controller with them.
Where we disclose Candidate personal data to a client company in connection with a search engagement, that client company acts as a separate and independent data controller in respect of its own use of that personal data. We are not a data processor acting on the instructions of our clients, and we are not a joint controller with them.
3. Personal Data We Collect
3. Personal Data We Collect
We may collect the following categories of personal data:
We may collect the following categories of personal data:
Identification and contact information. Full name, email address, telephone number, mailing address and LinkedIn or other professional profile URL.
Identification and contact information. Full name, email address, telephone number, mailing address and LinkedIn or other professional profile URL.
Professional and employment information. Current and prior job titles, employers, dates of employment, industry experience and professional qualifications.
Professional and employment information. Current and prior job titles, employers, dates of employment, industry experience and professional qualifications.
Compensation expectations. Expected base salary, signing bonus, on-target earnings, benefits and other compensation expectations relevant to the search engagement. We do not request, and ask Candidates not to provide, current or historical compensation information.
Compensation expectations. Expected base salary, signing bonus, on-target earnings, benefits and other compensation expectations relevant to the search engagement. We do not request, and ask Candidates not to provide, current or historical compensation information.
Resume and application materials. Curriculum vitae, cover letters, portfolio materials and other documents provided by the Candidate.
Resume and application materials. Curriculum vitae, cover letters, portfolio materials and other documents provided by the Candidate.
Interview and assessment data. Notes taken during screening calls and interviews, and written or verbal assessments of suitability for a role.
Interview and assessment data. Notes taken during screening calls and interviews, and written or verbal assessments of suitability for a role.
Call recordings and transcriptions. Audio recordings and written transcriptions of calls, where the Candidate has consented as described in Section 6.
Call recordings and transcriptions. Audio recordings and written transcriptions of calls, where the Candidate has consented as described in Section 6.
Communications. Emails, messages and other correspondence between the Candidate and the Firm.
Communications. Emails, messages and other correspondence between the Candidate and the Firm.
4. Where We Obtain Personal Data
4. Where We Obtain Personal Data
We obtain personal data from the following sources:
We obtain personal data from the following sources:
Directly from the Candidate, including materials and information provided during calls, interviews and correspondence.
Directly from the Candidate, including materials and information provided during calls, interviews and correspondence.
From publicly available sources, including company websites, press coverage, regulatory filings and public professional profiles.
From publicly available sources, including company websites, press coverage, regulatory filings and public professional profiles.
From professional networking platforms, including LinkedIn.
From professional networking platforms, including LinkedIn.
From third-party data enrichment and contact-data providers, which we may use to obtain business contact details such as a telephone number or email address.
From third-party data enrichment and contact-data providers, which we may use to obtain business contact details such as a telephone number or email address.
From referrals, including recommendations from professional contacts and other Candidates.
From referrals, including recommendations from professional contacts and other Candidates.
A Candidate may request further detail about the specific source of their personal data by contacting us at the address in Section 14.
A Candidate may request further detail about the specific source of their personal data by contacting us at the address in Section 14.
5. Purposes of Collection and Use
5. Purposes of Collection and Use
We collect and use Candidate personal data in order to identify, evaluate and present Candidates for executive search engagements conducted on behalf of our clients; conduct screening calls and interviews; share Candidate information with the client company for which the search is being conducted; maintain an accurate written record of conversations; communicate with Candidates about the search process; consider Candidates for future search engagements within the retention periods set out in Section 10; and comply with applicable legal, regulatory and professional obligations.
We collect and use Candidate personal data in order to identify, evaluate and present Candidates for executive search engagements conducted on behalf of our clients; conduct screening calls and interviews; share Candidate information with the client company for which the search is being conducted; maintain an accurate written record of conversations; communicate with Candidates about the search process; consider Candidates for future search engagements within the retention periods set out in Section 10; and comply with applicable legal, regulatory and professional obligations.
6. Call Recording and Transcription
6. Call Recording and Transcription
We may record and transcribe calls with Candidates in order to maintain an accurate record of the conversation and to support internal quality assurance.
We may record and transcribe calls with Candidates in order to maintain an accurate record of the conversation and to support internal quality assurance.
We will tell a Candidate at the outset of a call that we would like to record and transcribe it, and we will proceed only if the Candidate expressly agrees. Silence or continued participation in the call is not treated as agreement.
We will tell a Candidate at the outset of a call that we would like to record and transcribe it, and we will proceed only if the Candidate expressly agrees. Silence or continued participation in the call is not treated as agreement.
A Candidate may decline recording, either at the outset or at any point during the call. If a Candidate declines, the call proceeds without recording or transcription. Declining has no effect on a Candidate’s participation in the search process or on their candidacy for any role.
A Candidate may decline recording, either at the outset or at any point during the call. If a Candidate declines, the call proceeds without recording or transcription. Declining has no effect on a Candidate’s participation in the search process or on their candidacy for any role.
A Candidate may withdraw agreement to a recording after the call by contacting us at the address in Section 14. On withdrawal, we will delete the existing recording and its transcription within thirty (30) days. Written notes and assessments prepared before withdrawal may be retained on the basis described in Section 7.
A Candidate may withdraw agreement to a recording after the call by contacting us at the address in Section 14. On withdrawal, we will delete the existing recording and its transcription within thirty (30) days. Written notes and assessments prepared before withdrawal may be retained on the basis described in Section 7.
Recordings and transcriptions are retained in accordance with Section 10.
Recordings and transcriptions are retained in accordance with Section 10.
7. Legal Bases for Processing (GDPR)
7. Legal Bases for Processing (GDPR)
For Candidates located in the EEA or the United Kingdom, we rely on the following legal bases under Article 6 of the GDPR:
For Candidates located in the EEA or the United Kingdom, we rely on the following legal bases under Article 6 of the GDPR:
Legitimate interests (Article 6(1)(f)). We rely on our legitimate interests in providing executive search services, identifying and evaluating Candidates, presenting Candidates to our clients, and maintaining a database of senior professionals for consideration in future engagements. We have carried out a balancing assessment and concluded that these interests are not overridden by the interests, rights and freedoms of Candidates, having regard to the professional context of the data, the limited categories of data involved and the retention limits in Section 10. A Candidate may object to this processing at any time, and may request a copy of our balancing assessment.
Legitimate interests (Article 6(1)(f)). We rely on our legitimate interests in providing executive search services, identifying and evaluating Candidates, presenting Candidates to our clients, and maintaining a database of senior professionals for consideration in future engagements. We have carried out a balancing assessment and concluded that these interests are not overridden by the interests, rights and freedoms of Candidates, having regard to the professional context of the data, the limited categories of data involved and the retention limits in Section 10. A Candidate may object to this processing at any time, and may request a copy of our balancing assessment.
Consent (Article 6(1)(a)). We rely on consent for the recording and transcription of calls, as described in Section 6. Consent is obtained expressly at the outset of each call and may be withdrawn at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.
Consent (Article 6(1)(a)). We rely on consent for the recording and transcription of calls, as described in Section 6. Consent is obtained expressly at the outset of each call and may be withdrawn at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.
Legal obligation (Article 6(1)(c)). Where we are required to process personal data to comply with a legal obligation to which we are subject.
Legal obligation (Article 6(1)(c)). Where we are required to process personal data to comply with a legal obligation to which we are subject.
8. Special Categories of Personal Data
8. Special Categories of Personal Data
We do not seek to collect special categories of personal data, as defined in Article 9 of the GDPR, and we ask Candidates not to provide such information. This includes data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic or biometric data, and data concerning health, sex life or sexual orientation.
We do not seek to collect special categories of personal data, as defined in Article 9 of the GDPR, and we ask Candidates not to provide such information. This includes data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic or biometric data, and data concerning health, sex life or sexual orientation.
Where such information is disclosed incidentally during a call or in correspondence, we will not use it to assess a Candidate’s suitability for a role, we will not disclose it to a client company, and we will delete it from our records where it is practicable to do so.
Where such information is disclosed incidentally during a call or in correspondence, we will not use it to assess a Candidate’s suitability for a role, we will not disclose it to a client company, and we will delete it from our records where it is practicable to do so.
9. Data Sharing
9. Data Sharing
We share Candidate personal data with the client company for which the search engagement is being conducted. This may include identification and contact information, professional and employment information, compensation expectations, resume and application materials, and interview and assessment data, to the extent reasonably necessary for the client to evaluate the Candidate’s suitability for the role.
We share Candidate personal data with the client company for which the search engagement is being conducted. This may include identification and contact information, professional and employment information, compensation expectations, resume and application materials, and interview and assessment data, to the extent reasonably necessary for the client to evaluate the Candidate’s suitability for the role.
We share written summaries and assessments with client companies. We do not share audio recordings or verbatim transcriptions of Candidate calls with client companies. If a particular search engagement requires an exception to this, we will tell the Candidate before any recording takes place and will proceed only with the Candidate’s separate express agreement.
We share written summaries and assessments with client companies. We do not share audio recordings or verbatim transcriptions of Candidate calls with client companies. If a particular search engagement requires an exception to this, we will tell the Candidate before any recording takes place and will proceed only with the Candidate’s separate express agreement.
We also share personal data with service providers who process data on our behalf, including cloud hosting, customer relationship management, transcription and communications providers. These providers act only on our documented instructions and are bound by written data processing agreements.
We also share personal data with service providers who process data on our behalf, including cloud hosting, customer relationship management, transcription and communications providers. These providers act only on our documented instructions and are bound by written data processing agreements.
We do not sell, rent or trade Candidate personal data. We may disclose personal data where required by applicable law, regulation, subpoena or court order, or where necessary to establish, exercise or defend our legal rights.
We do not sell, rent or trade Candidate personal data. We may disclose personal data where required by applicable law, regulation, subpoena or court order, or where necessary to establish, exercise or defend our legal rights.
10. Data Retention
10. Data Retention
We retain Candidate personal data only for as long as necessary for the purposes described in this Notice. Our standard retention periods are: [Retention schedule to be inserted].
We retain Candidate personal data only for as long as necessary for the purposes described in this Notice. Our standard retention periods are: [Retention schedule to be inserted].
“Last meaningful contact” means the most recent substantive interaction between the Candidate and the Firm, including a call, an exchange of correspondence, or a Candidate’s response to an approach. At the end of the applicable period, personal data is deleted or irreversibly anonymised.
“Last meaningful contact” means the most recent substantive interaction between the Candidate and the Firm, including a call, an exchange of correspondence, or a Candidate’s response to an approach. At the end of the applicable period, personal data is deleted or irreversibly anonymised.
A Candidate may request deletion at any time by contacting us at the address in Section 14, in which case we will delete or anonymise their personal data within thirty (30) days, except where retention is required by applicable law.
A Candidate may request deletion at any time by contacting us at the address in Section 14, in which case we will delete or anonymise their personal data within thirty (30) days, except where retention is required by applicable law.
11. International Data Transfers
11. International Data Transfers
We store Candidate personal data, including call recordings and transcriptions, using cloud-based services hosted in the United States. For Candidates located in the EEA or the United Kingdom, this constitutes a transfer of personal data outside those territories.
We store Candidate personal data, including call recordings and transcriptions, using cloud-based services hosted in the United States. For Candidates located in the EEA or the United Kingdom, this constitutes a transfer of personal data outside those territories.
[Select and state the mechanism you actually rely on, and delete the others:] We rely on the European Commission’s Standard Contractual Clauses (Decision 2021/914) and, for transfers from the United Kingdom, the UK International Data Transfer Addendum, supported by a transfer impact assessment; or we are certified under the EU-US Data Privacy Framework and its UK Extension, and rely on the European Commission’s adequacy decision of 10 July 2023.
[Select and state the mechanism you actually rely on, and delete the others:] We rely on the European Commission’s Standard Contractual Clauses (Decision 2021/914) and, for transfers from the United Kingdom, the UK International Data Transfer Addendum, supported by a transfer impact assessment; or we are certified under the EU-US Data Privacy Framework and its UK Extension, and rely on the European Commission’s adequacy decision of 10 July 2023.
A Candidate may request further information about the safeguards applied to international transfers, including a copy of the relevant clauses, by contacting us at the address in Section 14.
A Candidate may request further information about the safeguards applied to international transfers, including a copy of the relevant clauses, by contacting us at the address in Section 14.
12. Your Rights
12. Your Rights
Under PIPEDA, Candidates have the right to access the personal data we hold about them; request correction of inaccurate or incomplete personal data; withdraw consent to the collection, use or disclosure of personal data, subject to legal or contractual restrictions; and file a complaint with the Office of the Privacy Commissioner of Canada.
Under PIPEDA, Candidates have the right to access the personal data we hold about them; request correction of inaccurate or incomplete personal data; withdraw consent to the collection, use or disclosure of personal data, subject to legal or contractual restrictions; and file a complaint with the Office of the Privacy Commissioner of Canada.
Candidates located in the EEA or the United Kingdom additionally have the right to erasure of their personal data (Article 17), restriction of processing (Article 18), data portability (Article 20), object to processing based on legitimate interests (Article 21), and lodge a complaint with a supervisory authority in the Member State of their habitual residence or place of work, or with the UK Information Commissioner’s Office.
Candidates located in the EEA or the United Kingdom additionally have the right to erasure of their personal data (Article 17), restriction of processing (Article 18), data portability (Article 20), object to processing based on legitimate interests (Article 21), and lodge a complaint with a supervisory authority in the Member State of their habitual residence or place of work, or with the UK Information Commissioner’s Office.
Candidates resident in California, and in other US states with comparable legislation, have the right to know what personal data we have collected, the sources from which it was collected and the purposes of collection; to request access to and deletion or correction of that data; and not to be subject to discrimination for exercising those rights. We do not sell personal data and we do not share personal data for cross-context behavioural advertising.
Candidates resident in California, and in other US states with comparable legislation, have the right to know what personal data we have collected, the sources from which it was collected and the purposes of collection; to request access to and deletion or correction of that data; and not to be subject to discrimination for exercising those rights. We do not sell personal data and we do not share personal data for cross-context behavioural advertising.
To exercise any of these rights, contact us at the address in Section 14. We will respond within thirty (30) days, or within any shorter period required by applicable law. We may need to verify a Candidate’s identity before acting on a request.
To exercise any of these rights, contact us at the address in Section 14. We will respond within thirty (30) days, or within any shorter period required by applicable law. We may need to verify a Candidate’s identity before acting on a request.
13. Data Security
13. Data Security
We implement technical and organisational measures appropriate to the risk in order to protect Candidate personal data against unauthorised access, disclosure, alteration or destruction. These measures include access controls, encryption in transit and at rest, and contractual controls on our service providers. We review these measures periodically and update them as necessary.
We implement technical and organisational measures appropriate to the risk in order to protect Candidate personal data against unauthorised access, disclosure, alteration or destruction. These measures include access controls, encryption in transit and at rest, and contractual controls on our service providers. We review these measures periodically and update them as necessary.
14. Contact
14. Contact
For any question, concern or request relating to this Notice or our handling of Candidate personal data, contact: Noesis Partners Inc. [Insert full postal address] Email: info@noesispartners.co
For any question, concern or request relating to this Notice or our handling of Candidate personal data, contact: Noesis Partners Inc. [Insert full postal address] Email: info@noesispartners.co
15. Updates to This Notice
15. Updates to This Notice
We may update this Notice from time to time to reflect changes in our practices or in applicable law. The current version is published at [insert URL]. Where a change is material, we will notify affected Candidates by email or by publishing the updated Notice with a revised effective date and version number.
We may update this Notice from time to time to reflect changes in our practices or in applicable law. The current version is published at [insert URL]. Where a change is material, we will notify affected Candidates by email or by publishing the updated Notice with a revised effective date and version number.
