Privacy Policy & GDPR

1. Introduction

This Privacy Policy explains how Foundations Search ("we", "us", or "our") collects, uses, stores, and protects personal data. It applies to all visitors to our website, candidates engaging with our recruitment services, clients, and other stakeholders.

Foundations Search is committed to protecting personal privacy and ensuring compliance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and all applicable data protection legislation.

1.1 Document control

2. Data controller

The data controller is Foundations Corp Ltd, trading as Foundations Search, registered in England and Wales (Company Number 12495265). Registered office: 86-90 Paul Street, Hackney, London EC2A 4NE.

For any data protection enquiries or to exercise your rights, please contact our Data Protection Officer at info@foundations-search.com.

3. Data we collect

We collect and process the following categories of personal data:

Candidate data

• Identity information: name, date of birth, nationality, right-to-work status.
• Contact details: email address, telephone number, postal address.
• Professional profile: CV, employment history, qualifications, skills, security clearance level.
• Application data: cover letters, interview notes, assessment results.
• Sensitive data: only where strictly necessary and with explicit consent (e.g. disability information for reasonable adjustments, diversity monitoring data).

Client data

• Contact details for client representatives.
• Organisational information and role requirements.
• Contract and billing information.

Business development / prospect data

• Professional contact details (name, job title, company, work email address, telephone numbers, LinkedIn profile URL and similar professional information).

These details are obtained from publicly available sources, professional networking platforms, data enrichment providers, referrals, or other third-party sources for the purpose of identifying and contacting relevant professionals about potential recruitment partnerships or talent needs.

Website visitor data

• IP address, browser type, device information.
• Pages visited, time on site, referring URL.
• Cookie preferences and consent records.

4. Legal basis for processing

We process personal data under the following lawful bases as defined by Article 6 of the UK GDPR:

• Consent: where you have given clear consent for us to process your personal data for a specific purpose (e.g. receiving our newsletter or submitting your CV).
• Contractual necessity: where processing is necessary for the performance of a contract or to take steps at your request prior to entering into a contract.
• Legitimate interest: where processing is necessary for our legitimate business interests (e.g. contacting candidates about relevant opportunities, improving our services), provided these interests do not override your fundamental rights and freedoms. This includes contacting business development prospects about relevant professional opportunities. A Legitimate Interests Assessment has been conducted for this activity.
• Legal obligation: where processing is necessary to comply with a legal or regulatory obligation.

5. How we use your data

We use personal data for the following purposes:

• Matching candidates with suitable roles across our specialist sectors (energy, transport, defence, government, financial services, and other critical national infrastructure).
• Managing the end-to-end recruitment process including interviews, assessments, and onboarding support.
• Conducting security clearance and vetting checks where required by the role.
• Communicating with clients about search mandates and candidate shortlists.
• Contacting relevant professionals (business development / prospect contacts) about potential recruitment needs, partnerships or related services, where we have a legitimate interest in doing so.
• Sending relevant market insights, job alerts, and newsletters (where consent is given).
• Analysing website usage to improve our services and user experience.
• Complying with legal and regulatory obligations.

6. Cookies

Our website uses cookies to enhance your browsing experience. On your first visit, you will be presented with a cookie consent banner allowing you to accept or decline non-essential cookies.

Types of cookies we use

• Essential cookies: required for the website to function correctly. These cannot be disabled.
• Analytics cookies: help us understand how visitors interact with our website. We use privacy-focused analytics that do not track individuals across websites.
• Marketing cookies: used only with your explicit consent to deliver relevant content and measure campaign effectiveness.

You can manage your cookie preferences at any time through the cookie settings on our website, or by adjusting your browser settings.

7. Data sharing

We may share your personal data with:

• Clients: where necessary to progress your candidacy for a specific role (only with your knowledge and, where appropriate, your consent).
• Vetting agencies: where security clearance checks are required for the role.
• Service providers: such as our CRM platform, email service provider, and cloud hosting — all of whom are contractually bound to protect your data.
• Legal authorities: where required by law or regulation.

We do not sell personal data to third parties under any circumstances. Where data is transferred outside the UK, we ensure appropriate safeguards are in place (such as Standard Contractual Clauses or adequacy decisions) in accordance with UK GDPR requirements.

8. Data retention

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected:

When data is no longer required, it is securely deleted or anonymised.

9. Your rights

Under the UK GDPR, you have the following rights in relation to your personal data:

• Right of access: request a copy of the personal data we hold about you (Data Subject Access Request).
• Right to rectification: request correction of inaccurate or incomplete data.
• Right to erasure: request deletion of your personal data (the "right to be forgotten").
• Right to restrict processing: request that we limit how we use your data.
• Right to data portability: request your data in a structured, machine-readable format.
• Right to object: object to processing based on legitimate interests, including direct marketing.
• Rights related to automated decision-making: you will not be subject to decisions based solely on automated processing that significantly affect you.

To exercise any of these rights, please contact us at info@foundations-search.com or via the contact form on our website. We will respond within one calendar month.

If you are not satisfied with our response, you have the right to lodge a complaint with the Information Commissioner’s Office (ICO) at ico.org.uk.

10. Data security

We take the security of personal data seriously and implement appropriate technical and organisational measures to protect it, including:

• Encryption of data in transit (TLS/SSL) and at rest.
• Access controls ensuring only authorised personnel can access personal data.
• Regular security awareness training for all staff.
• Secure cloud infrastructure with SOC 2 certified providers.
• Regular review and testing of our security measures.

In the unlikely event of a personal data breach that poses a risk to your rights and freedoms, we will notify the ICO within 72 hours and inform affected individuals without undue delay, in accordance with our incident response procedures.

11. External links and social media

Our website may contain links to external websites. We are not responsible for the privacy practices of these third-party sites and encourage you to read their privacy policies before submitting any personal data.

We maintain profiles on professional social media platforms including LinkedIn. Any interaction with our social media accounts is subject to the respective platform’s terms and privacy policies. We will never request sensitive personal information via social media.

12. Changes to this policy

We may update this Privacy Policy from time to time to reflect changes in legislation, our business practices, or feedback from stakeholders. The latest version will always be available on this page. We encourage you to review this policy periodically.