Privacy Policy of Carnaby & Knight Limited
Effective Date: 12th June 2025
Carnaby & Knight Limited (“Carnaby & Knight”, “we”, “us”, or “our”) is committed to safeguarding the privacy and personal data of all individuals with whom we engage, including but not limited to candidates, clients, prospects, and website users. This Privacy Policy outlines how we collect, use, disclose, retain, and protect your personal data in compliance with the United Kingdom General Data Protection Regulation (UK GDPR), the European Union General Data Protection Regulation (EU GDPR), and all other applicable data protection and privacy laws.By engaging with us or submitting personal data to us via our website or other channels, you acknowledge and, where required, consent to the practices set forth herein.
1. Identity of the Data Controller
The data controller for purposes of this Privacy Policy is:
Carnaby & Knight Limited
Suffolk House, George Street, Croydon, Surrey, United Kingdom, CR0 0YN
Email: j.thurston@carnabyandknight.com
Company Number: 11362707
Jurisdiction: United Kingdom (with global operations)
We do not currently appoint a Data Protection Officer (DPO), but inquiries regarding data protection matters should be directed to the email address above.
2. Categories of Personal Data Collected
We may collect, store, and process the following categories of personal data, including but not limited to:
Candidates:
Identifying details: full name, date of birth (where applicable), nationality
Contact information: email address, telephone number, physical address
Employment and professional information: CVs, resumes, cover letters, career history, job titles, references
Additional voluntary data: LinkedIn or portfolio links, salary expectations, notice periods, right-to-work documentation
Clients and Business Contacts:
Business identifiers: company name, industry
Contact details: name, business address, email address, telephone number
Position and role-related data: job title, department, recruitment preferences
Website Visitors:
Form submission details (e.g., contact forms)
Metadata (e.g., IP address, user agent) when applicable
We do not actively collect or request sensitive or special categories of personal data (e.g., health, ethnicity, union membership) unless provided voluntarily and lawfully.
3. Purposes and Legal Bases for Processing
We process your personal data only when there is a lawful basis to do so. This may include, but is not limited to:
Performance of a contract: e.g., facilitating candidate placements, executing recruitment agreements
Legitimate interests: e.g., business development, talent mapping, operational efficiency
Consent: e.g., for marketing communications where required by law
Legal obligations: e.g., responding to lawful data subject requests, complying with tax or employment regulations
The purposes for which data may be used include:
Talent sourcing and job matching
Client management and business communication
Market analysis and internal reporting
Direct marketing, subject to opt-out rights
Compliance with legal or regulatory requirements
4. Data Sharing and International Transfers
We may disclose personal data to the following third parties, strictly as necessary:
Prospective and existing client employers
Technology service providers (e.g., CRM, cloud hosting platforms)
Legal or regulatory authorities upon lawful request
In the course of our global operations, your personal data may be transferred to jurisdictions outside the UK or EEA. In such cases, we ensure adequate safeguards are in place, including reliance on Standard Contractual Clauses or other legally recognized transfer mechanisms.
5. Data Retention and Storage
Personal data shall be retained only for as long as necessary to fulfil the purposes for which it was collected, or as required under applicable laws. Absent a specific retention period mandated by law, we operate under the following general principle:
Candidate and client data is retained indefinitely, subject to periodic review, unless a data subject requests erasure or the data becomes demonstrably obsolete.
We reserve the right to anonymize or aggregate data for analytical and business continuity purposes.
6. Data Subject Rights
Under the UK GDPR and EU GDPR, you are entitled to exercise the following rights in respect of your personal data:
Right of access – to obtain a copy of your personal data
Right to rectification – to correct inaccuracies
Right to erasure – to request deletion of your data (“right to be forgotten”)
Right to restriction of processing
Right to data portability
Right to object to processing, including for direct marketing
Right to withdraw consent at any time (without affecting processing based on prior consent)
Right to lodge a complaint with a supervisory authority
To exercise your rights, please contact us at j.thurston@carnabyandknight.com. We may require verification of identity prior to fulfilling certain requests.
7. Security Measures
We take all reasonable and appropriate technical and organisational measures to safeguard your personal data against unauthorized or unlawful processing and against accidental loss, destruction, or damage. These include:
Role-based access restrictions
Password-protected systems
Encryption and secure storage systems
Regular system audits and staff training
However, no transmission of data over the internet is guaranteed to be completely secure. You acknowledge and accept this risk.
8. Marketing and Communications
Where legally permitted, we may contact you for marketing purposes, including to provide updates on job opportunities or industry insights. You may opt out of receiving such communications at any time by:
Clicking the “unsubscribe” link in any of our emails; or
Contacting us at j.thurston@carnabyandknight.com
We will not sell, rent, or lease your data to third parties for marketing purposes.
9. Cookies and Website Tracking
At present, our website does not use cookies, tracking pixels, or third-party analytics tools (e.g., Google Analytics). Should this change, we will update this Privacy Policy accordingly and implement appropriate opt-in mechanisms in compliance with cookie laws and consent requirements.
10. Policy Amendments
Carnaby & Knight Limited reserves the right to amend this Privacy Policy at any time to reflect changes in the law or our data practices. The revised policy will be published on our website with an updated effective date. Continued use of our services after such amendments constitutes acceptance of the revised terms.
11. Contact Information
For all inquiries, requests, or complaints related to this policy or our data processing activities, please contact:
Carnaby & Knight Limited
Email: j.thurston@carnabyandknight.com
Website: www.carnabyandknight.com
Registered in UK
--
Sai Sinnaiah
Founder
Carnaby & Knight
