Confidentiality
Candidate Privacy Notice
Executive search involves sensitive information. This notice explains exactly how candidate information is handled at every stage.
Effective 10 September 2026
Confidentiality commitment
Executive profiles are held confidentially. Your information is never published, never sold, and never provided to a client organization without your explicit permission. We do not contact your current employer, and we do not approach referees, without your agreement.
Information we hold
Where you submit an executive profile or engage with us about a mandate, we may hold: your name and professional contact details; current and previous roles, employers, and dates; functional, sector, and geographic experience; board and committee service; a CV or executive profile document you upload; compensation expectations you choose to disclose; relocation, availability, and confidentiality preferences; your LinkedIn or equivalent professional profile; interview and assessment notes prepared by us; and references given with your consent.
Where you have not contacted us, our research may record publicly available professional information only: your name, role, employer, professional history, and business contact details, drawn from company websites, regulatory filings, professional networks, published directories, industry press, and referrals.
We do not seek information about health, ethnicity, religion, political opinions, trade union membership, sexual orientation, or criminal records, and ask that you do not include such information in a submission.
Why we hold it
We hold candidate information to assess your experience against current and future leadership mandates, to contact you confidentially about relevant opportunities, to prepare written assessments for clients where you have agreed to be presented, and to maintain a record of our relationship. Submitting a profile is not an application to a specific vacancy and does not create a contractual or agency relationship.
Consent
Your explicit consent is obtained before your identity, profile, or assessment is shared with a client organization, and separately before any referee is approached. Consent is recorded in writing, is specific to the named mandate, and can be withdrawn at any point in the process.
Where you ask us to keep your interest strictly confidential, we will not disclose that you are in conversation with us to any third party, including other executives in your market.
Storage and access
Candidate records are stored in access-restricted, encrypted cloud services operated by established providers, protected by multi-factor authentication and encrypted at rest and in transit. Access is limited to Thalvern Advisory personnel and contracted research support working on the relevant mandate, each bound by written confidentiality obligations. Uploaded documents are stored separately from general correspondence, and sensitive material is exchanged through secure channels rather than unprotected email.
Retention and removal
Candidate records are retained for up to five years from our most recent contact with you, after which they are reviewed and either confirmed as current or securely deleted. Records relating to a completed appointment are retained for seven years to meet contractual and professional record-keeping obligations.
You may ask us at any time to correct your record, restrict how it is used, or delete it entirely. Removal requests are actioned within 30 days, and we will confirm in writing when the record has been deleted.
International transfers
Mandates and research frequently cross borders. Where your information is transferred outside the United Kingdom or the European Economic Area — for example, to a client organization or service provider in another country — we rely on an adequacy decision or standard contractual clauses, and transfers to a client take place only with your consent for the specific mandate.
Your rights
You may request access to the information we hold about you, ask for it to be corrected or deleted, object to or restrict processing, request a portable copy of information you gave us, and withdraw consent at any time. Where we rely on legitimate interests to hold research information, you may object and we will remove the record unless we have a compelling reason to retain it. If you are in the United Kingdom or the European Economic Area you may also complain to your national supervisory authority.
Contact
Thalvern Advisory is the data controller for information described in this notice. Questions, requests, and complaints may be addressed to Kathleen Welch, Founder & Managing Partner, at support@thalvernadvisory.com. We aim to respond to every request within 30 days.