Data Protection & Privacy Notice

1. Who we are

Mycelium Search is an executive search firm. For the purposes of data protection law we are the data controller of the personal data described in this notice.

• Legal entity: Mycelium Search LLP, a limited liability partnership
• Registered in: England & Wales, LLP number OC459002
• Registered office: 13 Whitchurch Lane, Edgware, Middlesex, HA8 6JZ, United Kingdom
• Data protection contact: Adam Davies, hello@myceliumsearch.co.uk

Where a client instructs us on a search and shares candidate lists with us, we and the client may act as independent controllers (or, in limited cases, controllers in common) in respect of that data. We are transparent about this in our client terms.

2. Who this notice applies to, and where you are

This notice applies to everyone whose personal data we hold, wherever in the world you are based:

• Candidates — people we approach, assess, introduce to clients, or hold on file as potential candidates for current or future roles.
• Clients — the organisations that instruct us, and their individual representatives.
• Referees and sources — people who provide information about a candidate, or who help us identify candidates.
• Website visitors — people who use our website or contact us through it.
• Suppliers and contacts — individuals at organisations we work with.

Because we work internationally, the candidates and contacts we deal with may be based anywhere in the world. We aim to meet the highest applicable standard. Our baseline is the UK GDPR and EU GDPR; on top of that we honour the specific rights given to you by the data protection law of your own country or state, including those set out in Section 14.

3. The personal data we collect

Depending on your relationship with us, we may collect:

• Identity and contact data — name, title, email address, telephone number, postal or business address, and links to your public professional profiles (e.g. LinkedIn).
• Professional and CV data — employment history, current and past roles, employer, seniority, career objectives, education and qualifications, skills, languages, professional memberships, and the content of your CV.
• Assessment data — our own notes, observations and assessments about your suitability for a role or the market, formed from conversations, meetings and research. Where a search involves formal testing, this may include psychometric or similar assessment results.
• Compensation and availability data — current or expected remuneration, notice period and availability, where you choose to share it and where local law permits.
• Correspondence and relationship data — records of our contact with you across email, calls, meetings, WhatsApp and messaging, including a log of touchpoints and next steps.
• Referee and reference data — information provided by, or about, referees and sources.
• Technical and website data — see Section 15 (Cookies and website analytics).
• Special category and sensitive data — only in the limited circumstances described in Section 6.

4. Where we get your data

We collect personal data from:

• You, directly — when you send us your CV, email or call us, meet us, or complete a form on our website.
• Publicly available and professional sources — principally LinkedIn, company websites, news, press releases and other publicly available professional information, which we use to identify and research potential candidates. This is a core part of how executive search works.
• Mutual professional connections, referees and sources — people who introduce you to us or provide relevant professional information about a candidate.
• Our clients — where a client shares a candidate name or list with us for a specific search.

5. Why we use your data, and our legal bases

Under the UK and EU GDPR we must have a lawful basis for each use of your data. Our uses and bases are:

Our legitimate interests, in plain terms: to source and assess senior candidates, maintain a professional network, and run a viable search business. We have weighed these against your interests and rights, and we do not use your data in ways you would find unexpected or intrusive. You can object to processing based on legitimate interests at any time (see Section 13). Where we rely on consent, you can withdraw it at any time without affecting the lawfulness of earlier processing.

6. Special category and sensitive data

We do not seek out sensitive data. “Special category” data (such as health, racial or ethnic origin, religious or philosophical beliefs, sexual orientation, or trade union membership) and criminal records data are collected only where:

• you choose to share it with us, or
• it is genuinely necessary for a specific role and permitted by local law.

Where we process special category data we rely on your explicit consent, or another lawful condition where one applies (for example, the establishment or defence of legal claims, or a legal obligation). You can withdraw consent at any time.

7. Diversity monitoring

Where a client asks us to support a diverse shortlist, we may process limited diversity information. We do so only where local law permits, on the basis of your explicit consent or an applicable legal condition, and we share it with clients in aggregated or anonymised form wherever possible. Providing diversity information is always optional.

8. Automated decision-making

We do not make decisions about you by solely automated means that produce legal or similarly significant effects. A person is always involved in decisions about your candidacy.

9. Who we share your data with

We share personal data only as needed to run our services:

• Clients — where we introduce you as a candidate (with your consent before we share your full details).
• Referees and sources — only as necessary and, where appropriate, on a confidential basis.
• Our service providers (sub-processors) — the trusted platforms that help us operate. We put contracts in place requiring them to protect your data and use it only on our instructions. Our current key sub-processors are listed below.
• Professional advisers, and authorities — lawyers, accountants, insurers, and regulators or law enforcement where we are legally required to disclose.

We also hold a working record of contacts in a private database kept locally on the firm's own device, not on a third-party cloud service.

We do not sell your personal data, and we do not share it for third-party advertising.

10. International data transfers

Because we work internationally and use global providers, your data may be transferred to, or accessed from, countries outside the UK and EEA — including the United States. Where we do this, we protect your data using one or more of:

• Adequacy — transfers to countries the UK or EU has decided provide adequate protection;
• UK International Data Transfer Agreement / Addendum and EU Standard Contractual Clauses (SCCs) — for transfers to countries without an adequacy finding; and
• the EU-US Data Privacy Framework where the receiving provider is certified.

You can ask us for details of the safeguards in place using the contact details in Section 17.

11. How long we keep your data

We keep personal data only as long as we need it. Our standard rule:

• Candidates and network contacts: we review our records where there has been no contact with you for three years, and delete data we no longer have a legitimate reason to hold. If our relationship is active, we keep your data so we can consider you for suitable roles.
• Clients and engagement records: for the duration of the relationship and for six years after the last engagement, to meet contractual, tax and legal-claim requirements.
• Correspondence and financial records: in line with legal and accounting retention requirements (generally six years).
• Website and cookie data: as set out in Section 15.

Where you ask us to delete your data, we may keep the minimum information needed to record that you do not wish to be contacted, so we can respect that request.

12. How we protect your data

We take the security of your data seriously and apply appropriate technical and organisational measures, including: access controls and strong, unique passwords; device encryption and locked screens; restricted access on a need-to-know basis; secure disposal of documents; care over email and messaging; and due-diligence and data-protection contracts with our service providers. No transmission over the internet is ever completely secure, but we work to protect your data and to respond quickly if anything goes wrong.

13. Your rights

Wherever you are based, you can ask us to:

• access the personal data we hold about you;
• correct data that is inaccurate or incomplete;
• delete your data (the “right to be forgotten”);
• restrict or object to our processing, including processing based on legitimate interests and any direct marketing;
• port your data to another provider in a structured, machine-readable format; and
• withdraw consent where we rely on it.

To exercise any right, email hello@myceliumsearch.co.uk. We will respond within one month (or the period required by your local law). Exercising your rights is free, and we will not treat you differently for doing so. We may need to verify your identity first.

14. Your rights depending on where you live

We honour the specific rights given to you by your local data protection law. In particular:

14.1 United Kingdom and EEA (UK GDPR / EU GDPR). You have all the rights in Section 13. You also have the right to complain to a data protection authority — in the UK, the Information Commissioner's Office (ICO), ico.org.uk; in the EEA, your local supervisory authority — though we would welcome the chance to resolve any concern first.

14.2 California (CCPA / CPRA). If you are a California resident you have the right to know what personal information we collect and how we use and disclose it; to access, delete and correct it; to opt out of the “sale” or “sharing” of personal information; and to limit the use of sensitive personal information. We do not sell or share personal information as those terms are commonly understood, and we do not use sensitive personal information beyond the purposes described here. We will not discriminate against you for exercising these rights. To make a request, contact us at hello@myceliumsearch.co.uk; we will respond within 45 days.

14.3 Other countries. For candidates and contacts elsewhere, we honour the rights available under your applicable local law, including regimes such as Switzerland's revised FADP, Canada's PIPEDA, Australia's Privacy Act, Brazil's LGPD, South Africa's POPIA, Singapore's PDPA and the UAE's data protection law. If your local law gives you a right not listed above, contact us and we will honour it.

15. Cookies and website analytics

Our website uses cookies and similar technologies. Strictly necessary storage keeps the site working and remembers your cookie choice; analytics cookies are used only with your consent, which you can manage or withdraw at any time using the cookie preferences link below.

With your consent, we use Google Analytics 4, a web analytics service provided by Google, to understand how visitors use the site: which pages are viewed, roughly where visitors come from, and how they found us. Google Analytics sets cookies on your device and collects information such as your approximate location, device type and pages visited. We use this information only in aggregate to improve the website; we do not use it to identify individuals. We do not use marketing or advertising cookies.

You can change your choice at any time: manage cookie preferences. You can also opt out of Google Analytics across all websites using Google's browser add-on at tools.google.com/dlpage/gaoptout, or block cookies in your browser settings. For details of how Google processes this data, see Google's privacy policy. We also collect limited technical data (such as IP address and browser type) when you visit.

16. Changes to this notice

We may update this notice from time to time. The current version and its date are shown at the top. Material changes will be notified where appropriate.

17. How to contact us

Questions, requests or complaints about your data: Adam Davies, hello@myceliumsearch.co.uk, Mycelium Search LLP, 13 Whitchurch Lane, Edgware, Middlesex, HA8 6JZ. You can also complain to the ICO (ico.org.uk) or your local data protection authority.