1. Who is responsible
Baxter Nelson Ltd is the controller of the personal information described in this notice, unless a specific service notice explains a different arrangement.
- Company number: 17479761.
- Registered office and postal privacy contact: Bartle House, 9 Oxford Court, Manchester, M2 3WQ.
- Email: [email protected].
We handle personal information under UK data-protection law, including the UK GDPR and the Data Protection Act 2018, as amended. Electronic marketing and website technologies are also subject to the Privacy and Electronic Communications Regulations.
This is an external privacy notice. It is not consent to every use of information, a guarantee of recruitment representation, or a replacement for our service terms. Separate notices apply where a service or relationship requires them.
2. Information we use
We limit the information we use to what is relevant to the purpose concerned.
- Candidates and prospective candidates: name, contact details, CV, professional profile, work and education history, qualifications, skills, location, career preferences, availability, salary expectations, relevant interview or assessment notes and correspondence.
- Career-advice customers: contact details, CV, degree subject, location, career interests, an optional LinkedIn profile, target roles, advice notes, appointments, rewritten CVs, personalised recommendations and correspondence. For Graduate Career Day expressions of interest, we collect name, email, degree subject, graduation year and preferred location to respond and organise suitable events.
- Clients and professional contacts: name, employer, job title, business contact details, instructions, proposals, assignment records and correspondence.
- Referees: name, professional relationship, contact details and relevant reference information.
- Purchases and bookings: service purchased, order reference, payment amount and status, invoice details, appointment details, and cancellation, rescheduling or refund records. Payment providers process the payment information submitted to their systems.
- Website visitors and enquiries: information entered in forms, uploaded files, and technical information generated by the website or its providers, such as IP address, browser information and security or access logs. Cookies and similar technologies are addressed in section 10.
Do not include unnecessary passport copies, National Insurance numbers, financial-account information or sensitive personal details in an ordinary CV or enquiry. We request verification documents only when a relevant process needs them and there is a lawful reason to do so.
3. Where information comes from
We receive information directly from you and, where relevant, from hiring clients, referees, professional contacts, professional directories, publicly available professional profiles and service providers supporting an assignment.
Public availability does not remove your privacy rights. We assess whether using information is necessary, fair and consistent with reasonable expectations. We do not assume that a public profile permits unrestricted copying, disclosure or marketing.
When we obtain personal information about you from another source, we provide the required privacy information within the applicable deadline: normally within one month, or earlier at our first communication with you or first disclosure to another recipient. We rely on an exception only where its legal conditions are met. You can ask us about the source and categories of information held about you.
4. Why we use information
The lawful basis depends on the actual purpose and relationship. A contract with a company does not, by itself, make every use of its employees' or candidates' information necessary for a contract with those individuals.
- Enquiries about a service you ask to buy personally: steps at your request before entering a contract, where necessary; otherwise legitimate interests in responding to enquiries.
- Deliver a purchased consultation and written follow-up, arrange appointments and communicate about your order: performance of our contract with you, for information necessary to provide that service.
- Research suitable professionals, assess suitability, communicate about relevant recruitment opportunities and conduct an agreed search: legitimate interests in matching suitable people with relevant opportunities and helping clients recruit, subject to necessity and a balancing assessment. Any permission separately required for disclosure is also obtained.
- Produce a commissioned market map or talent-intelligence assignment: legitimate interests in providing relevant, proportionate information for a defined business decision, subject to assessment of individuals' interests and reasonable expectations. We minimise identifiable information and use aggregated information where it meets the brief.
- Manage client relationships and assignments through business contacts: legitimate interests in operating and delivering business services. Contract applies where the individual is personally a contracting party and processing is necessary for that contract.
- Maintain legally required financial or regulatory records: compliance with the relevant legal obligation.
- Maintain other order, payment, professional and dispute records: legitimate interests in accurate administration, preventing fraud and establishing, exercising or defending legal claims.
- Send electronic marketing to individuals: consent, unless all conditions of a lawful existing-customer exception are met; in that case legitimate interests, with the required opt-outs.
- Send relevant business marketing to corporate contacts: legitimate interests in business development, where lawful under electronic-marketing rules and subject to your right to object.
- Protect systems, investigate misuse and improve service administration: legitimate interests in security and reliable operation; legal obligation where a specific duty applies. Consent is obtained separately for website technologies that require it.
We do not use legitimate interests as a blanket permission. We consider the purpose, necessity, likely impact and safeguards before relying on it. Where we rely on consent, you can withdraw it by contacting us or using the relevant preference control. Withdrawal does not make earlier processing under valid consent unlawful.
Your right to object: You can object to processing based on legitimate interests for reasons relating to your situation. We will stop unless the law permits us to continue. If you object to direct marketing, we stop using your information for that marketing, including related profiling.
5. Paid advice is separate from recruitment
Buying a Graduate Advisory service is optional. You do not have to buy advice to be considered for a recruitment opportunity, and cancellation or refusal to buy advice does not penalise you in a recruitment process.
Information submitted for paid advice is used to deliver and administer that service. We do not automatically treat that purchase as a request to send your CV to employers or enrol you in ongoing recruitment marketing. If you separately request recruitment support, we explain the relevant use of your information.
The information needed for an order is identified when we collect it. Without necessary contact, payment, booking or service-input information, we may be unable to confirm or deliver the service. Optional marketing choices are not a condition of purchase. Where information is required by law or a particular recruitment process, we explain that requirement and the consequences of not providing it.
6. Sensitive information and checks
Health, disability and other special-category information receives additional protection. We do not request it as a routine part of paid advice or a general enquiry. If you ask for an adjustment that involves health information, we explain the limited purpose and obtain explicit consent where that is the applicable condition. Another condition is used only where it actually applies, for example a relevant employment-law duty or the handling of legal claims.
Criminal-offence information is subject to separate legal rules; it is not simply another type of special-category information. We do not request criminal-record information as part of a standard career-advice call. Any relevant check requires a lawful Article 6 basis, the necessary authority or UK-law condition, and specific information about the check before it takes place.
We restrict access to sensitive information and do not include it in ordinary candidate presentations unless necessary, lawful and appropriately explained. We do not collect diversity monitoring information or carry out screening merely because a general policy mentions it.
7. Who receives information
Hiring clients and their authorised hiring teams. We share relevant information for a specified recruitment opportunity. Before sending an identifiable CV or candidate profile, we explain the intended recipient and purpose and obtain permission where required by recruitment law. A general CV submission is not permission to circulate it indiscriminately. We do not contact your current employer or approach a referee without the required permission.
Market Mapping clients. A defined assignment may involve professional information about people in the relevant market. We assess the purpose and legal basis, minimise what is disclosed, provide required transparency and meet applicable recruitment confidentiality requirements. A commercial brief does not authorise disclosure of confidential candidate conversations, sensitive details or unrestricted contact lists. Information that is genuinely anonymous is not personal information; removing a name alone may not make a profile anonymous.
Service providers. Relevant providers may receive information needed for website hosting, email and document storage, forms and uploads, CRM or recruitment administration, research, bookings and video meetings, payment processing, accounting, communications and security. Their access is limited to the functions they perform. Processors must have appropriate contractual obligations. A provider acting as an independent controller explains its own processing in its privacy notice.
Professional advisers and lawful recipients. We may disclose necessary information to accountants, lawyers, insurers, auditors, banks, courts, regulators or law-enforcement bodies when there is a lawful reason. A proposed business sale or reorganisation requires appropriate confidentiality and proportionate disclosure.
We do not give recipients unrestricted permission to reuse personal information for unrelated purposes. Client organisations are usually responsible for their own handling of information after receipt; our expectations and contracts do not remove their separate responsibilities. Contact us for more information about the recipients relevant to your interaction with us.
8. Access from outside the UK
An international transfer can arise from overseas storage, support or remote access, including through a supplier. Where a restricted transfer occurs, we use an applicable lawful route: for example UK adequacy regulations, or the UK International Data Transfer Agreement or UK Addendum with the assessment and protections required by law.
The route depends on the provider, destination and circumstances. We do not rely on consent as a routine substitute for proper safeguards. You can ask [email protected] for the destinations, transfer route and a copy or explanation of the relevant safeguards. We may redact confidential material without withholding the meaningful protection information you are entitled to receive.
9. How we decide retention
We retain information according to its purpose, not simply because it may be useful someday. The following criteria determine our retention periods:
- Recruitment and prospective-candidate records: whether there is an active assignment or genuine continuing recruitment relationship, how recently the information was verified, your preferences and objections, and any necessary legal or regulatory recordkeeping. We review stale or inactive records and delete or anonymise information when the relevant purpose ends.
- Career-advice CVs and session notes: completion of the purchased service and a reasonable follow-up or complaint period. Only the material needed for an outstanding complaint, legal duty or claim is kept longer. A purchase does not justify indefinite retention in a talent database.
- Orders, invoices and necessary payment records: applicable accounting and tax requirements, and relevant contractual or legal-claim periods. These records do not require retention of every CV or working note.
- Graduate Career Day expressions of interest: organising suitable career days and responding to your enquiry. Registering interest does not enrol you in unrelated marketing. We review these records and delete them when the relevant event-planning or enquiry purpose ends, unless another stated reason requires retention.
- Client, referee and general enquiry records: completion of the enquiry or assignment, a genuine continuing relationship and relevant recordkeeping or dispute needs.
- Unpaid or abandoned submissions: the short period reasonably needed to recover the intended transaction or resolve a technical issue. Where no purchase or separate recruitment request follows, uploaded material is deleted when that limited purpose ends.
- Marketing permissions and suppression records: evidence needed to demonstrate valid permission and a minimal record needed to honour an objection or unsubscribe. Suppression information is not used to continue marketing.
- Security logs, complaints and rights requests: the relevant investigation, security, accountability and legal requirements, with access and content limited to what is necessary.
We restrict information preserved for a dispute or legal hold rather than keeping it in ordinary active use. Deleted information in backups is isolated from routine use and removed through the relevant backup cycle. You can ask how the criteria apply to your records. We implement these criteria through appropriate review and deletion routines.
10. Cookies and similar technologies
Website technologies can include cookies, local storage, tracking pixels and embedded third-party services. Our Cookies page explains the technologies actually in use, their providers, purposes, duration and available controls.
Where consent is required, the relevant technology is not enabled before you choose it, and you can change that choice later. Where a lawful exemption applies, we provide the information and any opt-out that the exemption requires. Browser settings are an additional control, not a replacement for our obligations. Essential order and service communications are distinct from marketing.
11. Human decisions and security
The services covered by this notice use human judgement. We do not make recruitment or advisory decisions with a legal or similarly significant effect on you solely through automated processing under this notice. Tools that support research or administration do not remove our responsibility for the accuracy, fairness and confidentiality of the information used.
If we introduce materially different profiling, automated decisions, recording or transcription, we first assess the lawful basis and risks and provide the required information and safeguards. Ordinary participation in a call is not permission for undisclosed recording or AI processing.
We use proportionate technical and organisational safeguards, including appropriate access controls, secure handling, supplier arrangements and incident procedures. No system is completely risk-free. If you suspect that personal information has been lost, accessed improperly or sent to the wrong recipient, contact us promptly. We assess incidents and notify regulators or affected people where legally required.
12. Your rights and how to use them
Depending on the circumstances, you can ask to access your information, correct it, erase it, restrict its use or receive eligible information in a portable format. You can object as described in section 4, withdraw consent and exercise applicable protections concerning significant automated decisions.
Email [email protected] or write to our postal privacy contact. No special form is required. We may ask for proportionate identity information or clarification where necessary. Requests are normally free. We respond without undue delay and normally within one month, subject to lawful timing rules, clarification and extensions; where an extension applies, we explain it within the required period.
Rights have legal conditions, and a request to erase information does not necessarily require deletion of legally necessary invoices or claim records. We explain any limitation and the available complaint route. We do not treat a general list of exemptions as a reason to refuse a request.
13. Privacy complaints
You can complain about our handling of personal information by email or post using the contact details above. Tell us what happened and the outcome you seek; we can help you explain the concern if needed. We acknowledge complaints within 30 days, investigate without undue delay, keep you informed and explain the outcome.
You can also complain to the Information Commissioner's Office. Contacting us first may help resolve the issue, but this notice does not remove your right to approach the ICO.
14. Young people, other websites and updates
Our services are professional and career-focused. Some people starting their careers may be under 18. We assess any such service and information use appropriately, including the need for additional safeguards. We do not assume that describing the website as professional excludes young visitors.
Other websites and independent providers have their own privacy notices. Linking to them does not mean this notice controls their processing, or relieve us of responsibility for disclosures we make.
We update this notice when our services, processing or legal requirements change. We provide additional information before using personal information for a materially different purpose, and obtain new consent where required. Publishing a revised notice does not itself authorise a new use of your information.