Privacy Policies
Last updated : June 2026
At a Glance
Castle & Co. Search is committed to protecting the privacy of everyone we work with. This policy explains what personal data we collect, why we collect it, how we use it, and your rights in relation to it.
Who we are
Castle & Co. Search Limited, a boutique senior recruitment agency.
What we do with your data
Use it to deliver recruitment services, communicate with you, and comply with our legal obligations.
Who we share it with
Only the clients or candidates directly relevant to your engagement. Never sold or shared for marketing.
How long we keep it
Typically 2 years for candidates; 6 years for financial records. See Section 7 for full detail.
Your rights
Access, rectify, erase, restrict, object, and portability. Contact simon@castleandcosearch.co.uk.
1. Who We Are
Castle & Co. Search Limited is the data controller for personal information collected through this website and in the course of providing recruitment services.
Registered name
Castle & Co. Search Limited
simon@castleandcosearch.co.uk
Website
www.castleandcosearch.co.uk
2. The Data We Collect
2.1 Candidates
When you register with us or are identified as a potential candidate, we may collect:
• Full name, address, telephone number, and email address
• CV, career history, qualifications, and professional achievements
• Salary expectations, notice period, and location preferences
• References and referee contact details (with your knowledge)
• Right-to-work status and nationality where relevant to a role
• Any other information you choose to share with us
2.2 Clients
When you engage Castle & Co. Search to conduct a search, we may collect:
• Name, job title, and business contact details
• Details of the vacancy and hiring criteria
• Billing information and company details
• Correspondence and notes from our working relationship
2.3 Website Visitors
When you visit our website, we may collect:
• IP address and browser/device information
• Pages visited and time spent on the site
• Referral source (how you arrived at our site)
• Information submitted via any contact or enquiry form
We do not collect any special category data (such as health information, ethnicity, or religious beliefs) unless you volunteer it and it is directly relevant to a role requirement.
3. How We Collect Your Data
We collect personal data in the following ways:
• Directly from you — when you contact us, submit a CV, or engage our services
• Via LinkedIn and other professional networks — where your profile is publicly available
• From referrals — when a colleague or contact recommends you
• From our clients — where they share contact details of internal stakeholders
• Via our website — through contact forms, cookies, and analytics tools
4. Why We Use Your Data — and Our Lawful Basis
Under UK GDPR, we must have a lawful basis for processing personal data. The table below sets out the purposes for which we process data and the corresponding lawful basis in each case.
A note on legitimate interests
Where we rely on ‘legitimate interests’ as our lawful basis, we have assessed that our interests are not overridden by your interests or fundamental rights. You have the right to object to processing carried out on this basis at any time — see Section 9.
5. Who We Share Your Data With
We share personal data only where necessary and appropriate:
• With client organisations —candidate information is shared only with clients relevant to a specific role, and only with your prior knowledge.
• With referees — only where you have provided their details and consented to us making contact.
• With technology providers — such as our email and document management platforms, who act as data processors under a written agreement.
• With professional advisers — such as our accountant or solicitor, where necessary and bound by confidentiality.
• With regulatory authorities —including HMRC and the ICO, where legally required.
We do not sell, rent, or trade personal data. We do not share personal data with third parties for their own marketing purposes.
6. International Transfers
We aim to keep all personal data within the UK or the European Economic Area (EEA). Where we use third-party service providers based outside these areas (for example, cloud software providers), we ensure appropriate safeguards are in place, such as the UK International Data Transfer Agreement(IDTA) or equivalent standard contractual clauses.
If you would like further information about the safeguards we use, please contact us at simon@castleandcosearch.co.uk.
7. How Long We Keep Your Data
We retain personal data only for as long as necessary for the purpose for which it was collected, or as required by law. Our standard retention periods are:
Active candidate records
For the duration of your registration plus 2 years from last contact
Unsuccessful candidates
12 months from the date of introduction or last contact
Placed candidates
6 years from the end of the guarantee period
Client contact records
6 years from the end of our last engagement
Financial and billing records
6 years (as required by HMRC)
Website enquiry data
12 months from receipt
We will securely delete or anonymise personal data once the applicable retention period has expired. You may request earlier deletion — see Section 9.
8. Cookies
Our website uses cookies — small text files placed on your device — to improve your browsing experience and help us understand how visitors use our site.
Types of cookies we use
• Essential cookies — necessary for the website to function. Cannot be disabled.
• Analytics cookies — help us understand page performance and visitor behaviour (e.g. Google Analytics). Used only with your consent.
• Preference cookies — remember settings such as language or region. Used only with your consent.
You can manage or withdraw your consent to non-essential cookies at any time via your browser settings or our cookie consent tool. Withdrawing consent will not affect the lawfulness of processing prior to withdrawal.
9. Your Rights
Under UK GDPR, you have the following rights in relation to your personal data:
Right of access
Request a copy of the personal data we hold about you (Subject Access Request).
Right to rectification
Ask us to correct inaccurate or incomplete data.
Right to erasure
Ask us to delete your data where there is no compelling reason for us to continue processing it.
Right to restriction
Ask us to pause processing of your data in certain circumstances.
Right to object
Object to processing based on legitimate interests or direct marketing.
Right to portability
Request your data in a structured, machine-readable format.
Right to withdraw consent
Where processing is based on consent, withdraw it at any time without affecting prior processing.
To exercise any of these rights, please contact us at simon@castleandcosearch.co.uk. We will respond within one calendar month. There is no charge for making a request.
If you are not satisfied with our response, you have the right to lodge a complaint with the ICO at ico.org.uk or by calling 0303 123 1113.
10. Data Security
We take the security of personal data seriously and have implemented appropriate technical and organisational measures to protect it against unauthorised access, loss, or destruction. These include:
• Secure, password-protected systems and devices
• Encrypted email and file transfer where appropriate
• Restricted access to personal data on a need-to-know basis
• Regular review of our data handling practices
In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the ICO within 72 hours and, where required, notify affected individuals without undue delay.
11. Changes to This Policy
We may update this Privacy Policy from time to time to reflect changes in our practices or applicable law. The current version will always be available on our website. Where changes are material, we will take reasonable steps to bring them to your attention.
12. Contact Us
If you have any questions about this Privacy Policy or how we handle your personal data, please contact us:
Name
Simon Castle
Role
Founder & Managing Director
Company
Castle & Co. Search Limited
simon@castleandcosearch.co.uk
Website
www.castleandcosearch.co.uk
FAQs
Here are a few of the questions clients and candidates ask us most often. If yours isn't here, get in touch. We're always happy to talk things through directly.
Castle & Co. Search are backed by over 25 years of senior retail and sales experience. We don't learn your industry from your brief, we already know it. That changes the questions we ask, the candidates we put forward, and the advice we give.
We focus on appointments from Store Manager level upwards, through to Director, VP, and C-Suite. If you're hiring below that level, we may be able to point you toward someone better suited.
We offer both contingency (15% of base salary, paid on start date, with a 12-week rebate period) and retained search (20%, paid in thirds across the search). Retained is recommended for senior and confidential mandates.
Most searches run between 4 and 8 weeks from brief to offer. Senior and C-Suite appointments can take longer, as we'd rather get it right than rush a placement that doesn't last.
We never share a CV or speak to a client about you without your explicit permission. Senior career moves are sensitive, and we treat them that way.
Still have questions?
We're happy to answer any questions directly. Just drop us a message.