Privacy notice

Who we are

Mastella Search Ltd (“Mastella Search”, “we”) is the data controller for the personal data described in this notice. We are a recruitment business operating in England & Wales. Registered office details are available on request.

Questions about this notice, or any request about your data, should go to kirsty@mastellagroup.com.

The data we hold

Candidates

• Identity and contact details — name, email, telephone, location
• Career information — CV, work history, qualifications, skills, references, salary and notice period
• Information you give us in conversation — motivations, constraints, roles of interest
• Your LinkedIn profile or other professional profiles you share or that are publicly available
• Right-to-work documentation, where an engagement reaches that stage

Clients and prospective clients

• Business contact details — name, job title, employer, email, telephone
• Role briefs, interview feedback, and correspondence

Website visitors

• Anything you submit through our contact or CV forms
• Anonymised analytics data, but only if you accept analytics cookies — see our cookie notice

Where the data comes from

Most of it comes directly from you. We also source candidate information from publicly available professional sources such as LinkedIn, company websites, and professional directories, and occasionally from referrals made by people in our network. If we approach you off the back of public information, we will tell you where we found you.

Why we hold it, and on what lawful basis

Who we share it with

We never send a CV or introduce a candidate to a client without that candidate's explicit permission for that specific role. Beyond that, personal data is shared only with:

• Clients, where you have agreed to an introduction for a named role
• Service providers who process data on our behalf under contract — currently our website and form hosting (Netlify), email and document storage, and, where consented, Google Analytics
• Professional advisors, or authorities where we are legally required to disclose

We do not sell personal data, and we do not share candidate data with other recruitment businesses.

International transfers

Some of our service providers process data outside the UK. Where that happens, transfers are covered by UK adequacy regulations or by standard contractual clauses with additional safeguards.

How long we keep it

• Candidate records: up to two years from our last meaningful contact with you, after which they are reviewed and deleted or refreshed with your agreement
• Placement records: six years from the end of the engagement, for tax and contractual purposes
• Client correspondence and briefs: six years from the end of the relationship
• Website enquiries that go nowhere: twelve months

Your rights

Under UK GDPR you have the right to:

• Ask for a copy of the personal data we hold about you
• Have inaccurate data corrected
• Ask us to delete your data
• Object to processing based on legitimate interests, including being contacted about roles
• Ask us to restrict how we use your data
• Receive your data in a portable format
• Withdraw consent at any time, where consent is the basis

Email kirsty@mastellagroup.com and we will respond within one month. Asking us to delete your data costs you nothing and we will not ask you to justify it.

Complaints

If you are unhappy with how we have handled your data, please tell us first so we can put it right. You also have the right to complain to the Information Commissioner's Office at ico.org.uk.

Changes to this notice

We update this notice when our practices change. The date at the top of the page shows when it was last revised.