Privacy notice
Last updated 8 November 2026 · Draft for launch. Highlighted items are placeholders to be filled before the site goes live.
In short. We are a recruitment business. We hold professional information about the people we might place and the people who might hire them. We use it to find and fill senior technology, cyber security and data roles, and for nothing else. We never charge candidates, we never send a CV to a client without the candidate's permission, and you can see, correct or delete what we hold at any time.
How we use AI, in plain words. People decide. AI helps.
We use AI (Claude, made by Anthropic) to help us read, search and organise information faster: for example summarising a brief, drafting a message, or finding people in our own records who may fit a role.
- A person at Aaronson Search makes every decision that affects you. Nothing about a candidate or a client is decided by a computer alone.
- We never contact someone, put a candidate forward or change a record because an AI suggested it, until a person has reviewed it.
- AI-written drafts are checked and edited by a person before they are sent.
- We do not use AI to guess who a website visitor is. We only use what you choose to tell us.
- Candidates are only shown to clients with their agreement.
- Where AI gives a suggestion, we keep the reason and the source so a person can check it.
- You can ask us what we hold about you, ask us to correct it, or ask us to delete it at any time: email [email protected] or use the "Your data" form on the site.
The legal detail is in section 5 below.
1. Who we are
Aaronson Search, which also trades as IT Cyber Consultants, is the data controller. We are an employment agency and employment business under the Conduct of Employment Agencies and Employment Businesses Regulations 2003. Registered office: [to follow]. Offices: Dashwood House, 69 Old Broad Street, London EC2M 1QS · Kurfürstendamm 11, 10719 Berlin. ICO registration: [to follow].
Contact for anything in this notice: [email protected]. We do not have a statutory data protection officer; the founder is responsible for data protection.
2. Whose data we hold and what it is
Candidates and potential candidates
- Name, work and personal contact details, LinkedIn or other professional profile.
- Career history: current and previous job titles, employers, dates, skills, qualifications, languages, location and right to work.
- What you tell us about a move: salary and package, the conditions under which you would move, companies you do not want approached, how visible you want to be, interview notes and feedback.
- Records of our contact with you, including notes and, where you agree in advance, recordings or transcripts of video calls.
- For contractors: limited company or umbrella details, IR35 status determinations and timesheets.
Clients and prospective clients
- Business contact details of hiring managers, HR and procurement contacts; role briefs; records of our dealings; invoicing and payment information.
Website visitors
- Anything you type into the site (the Ask bar, brief builder, Quiet Move, booking and contact forms) is stored only when you submit it. Our hosting provider keeps standard security logs (IP address, browser type, pages requested) for a short period. See the cookie policy: this site sets no tracking cookies.
Special category and criminal records data
We do not ask for health, ethnicity, religion, sexual orientation, trade union or similar data. If you volunteer it (for example to ask for an interview adjustment) we use it only for that purpose and only with your explicit consent. Criminal record checks are carried out only where the role lawfully requires them, by a specialist provider, with your knowledge.
3. Where the data comes from
- You: forms on this site, email, calls, your CV, LinkedIn messages.
- Public professional sources: LinkedIn and similar professional networks, company websites, press releases, conference and speaker listings.
- Business data providers that supply work contact details (currently Apollo.io), job-advert feeds and Companies House.
- Referrals from people in our network, and references you ask us to take.
- Clients, when they tell us about a role or give feedback on a candidate.
When we hold your details from a source other than you, we tell you where they came from the first time we contact you, or within one month, whichever is sooner.
4. Why we use it and the lawful basis
| Purpose | Lawful basis (UK GDPR Article 6) |
|---|---|
| Identifying and approaching people who may suit a senior role, and holding their career details so we can do so in future | Legitimate interests: ours in running a search business, yours in hearing about relevant roles. You can object at any time. |
| Putting your CV or profile forward to a named client | Consent, given for that role. We never send your name to a client without it. |
| Contacting businesses about our services | Legitimate interests. We write to work addresses only, you can opt out in every message, and we keep a suppression list. (PECR rules on business-to-business marketing.) |
| Delivering a search or contract placement, invoicing, paying contractors | Contract, and our legitimate interests. |
| Checking right to work and identity, keeping the records the Conduct Regulations require, tax and company law | Legal obligation. |
| Interview adjustments or diversity information you volunteer | Explicit consent (Article 9). |
| Security logs and preventing misuse of the site | Legitimate interests. |
5. How we use AI
We use Claude, an AI assistant made by Anthropic, to help run the business: reading what you type into the site, drafting briefs and notes, summarising calls you have agreed to record, matching career histories to roles, and keeping our database tidy. Two rules apply:
- No decision that affects you is made by a machine alone. Every shortlist, every approach and every piece of feedback is reviewed by a person before it reaches a client or a candidate.
- Your data is not used to train AI models. We use Anthropic's commercial service under terms that prohibit training on customer data.
Our matching looks at your whole career, not only your current job title. If you think we have read your career wrongly, tell us and we will correct the record.
6. Who we share it with
- Clients: your profile for a specific role, only with your consent for that role. Anonymised summaries (no name, employer or contact details) may be shown to clients we work with if you choose the "Anonymous" visibility setting.
- Service providers acting on our instructions: Microsoft (email, calendar, bookings, file storage), Cloudflare (website hosting and security), Anthropic (AI processing as described above), Apollo.io (business contact data and email delivery), LinkedIn (professional networking), Sonovate (contractor payroll, invoicing and funding, contractors only), and our accountants.
- Referees and screening providers, with your knowledge, at offer stage.
- Authorities where the law requires, for example HMRC or the Employment Agency Standards Inspectorate.
We do not sell personal data.
7. International transfers
We work in the UK, Germany, Austria and Switzerland. Where we send personal data outside the UK, we rely on UK adequacy regulations (including for the EEA and Switzerland), or on the UK International Data Transfer Agreement or Addendum with the recipient. Some of our providers process data in the United States under the UK Extension to the EU-US Data Privacy Framework or standard contractual clauses.
8. How long we keep it
| Record | Period |
|---|---|
| Candidate profiles where there is ongoing contact or you have asked us to keep you in mind | While you remain in contact with us, reviewed every two years. We write to you before deleting. |
| Candidate profiles with no contact | Deleted or anonymised two years after our last contact. |
| Records the Conduct Regulations require (work-finding services) | At least one year after we last provided a work-finding service, as the Regulations require. |
| Contracts, placements, invoices, contractor pay records | Six years after the end of the tax year they relate to. |
| Marketing suppression list (people who asked us not to contact them) | Indefinitely, name and email only, so we can honour the request. |
| Website security logs | Up to 30 days. |
9. Your rights
You can ask us at any time to:
- give you a copy of the data we hold about you (access);
- correct it (rectification);
- delete it (erasure);
- stop using it for a particular purpose or altogether (restriction and objection), including an absolute right to stop any marketing;
- give it to you in a portable format;
- withdraw consent you have given, without affecting anything done before.
Email [email protected] or use the data request form on this site. We reply within one month. We may ask you to confirm your identity first. There is no charge unless a request is clearly unfounded or excessive.
If you are unhappy with how we handle your data, you can complain to the Information Commissioner's Office: ico.org.uk/make-a-complaint, telephone 0303 123 1113. We would rather you told us first so we can put it right.
10. Security
Our systems use encryption in transit and at rest, two-factor authentication and access limited to the people who need it. Our database is backed up every weekday. If a breach is likely to put your rights at risk we will tell you and the ICO within 72 hours of becoming aware of it.
11. Changes
We will post changes here with a new date. Material changes to how we use candidate data will be notified to people on our database by email.