1. Who we are and what this policy covers
1.1 Our role
Baxter Nelson is a founder-led search and market-intelligence business for engineering and environmental consultancies. We provide Engaged Search, Market Mapping and Talent Advisory, and may provide direct recruitment or other agreed business services.
1.2 Controller details
The data controller is Baxter Nelson Ltd, company number 17479761. The registered office is Bartle House, 9 Oxford Court, Manchester, M2 3WQ. Our privacy contact is lewis@baxternelson.com. If our role changes for a particular service, the relevant agreement or notice will explain whether we act as a separate controller, joint controller or processor.
1.3 Applicable law
We aim to comply with the UK General Data Protection Regulation, the Data Protection Act 2018, the Privacy and Electronic Communications Regulations and other applicable data-protection law. This policy is information for individuals; it does not replace a client data-processing agreement, joint-controller arrangement, retention schedule or internal security procedure.
2. Personal data we may collect
2.1 Candidates and prospective candidates
Depending on the service, we may collect your name, contact details, CV, employment history, qualifications, professional memberships, skills, location, work preferences, salary or rate expectations, availability, right-to-work information, references, interview notes, communications, online professional information and information you choose to provide about your career. We only request information relevant to a genuine recruitment, search, market or advisory purpose.
2.2 Clients and professional contacts
We may collect your name, work contact details, job title, employer, professional background, communications, meeting notes, preferences, instructions, billing information and information needed to deliver a search, mapping, advisory or other business service.
2.3 Website and technical data
We may collect information you submit through forms, files or enquiries, together with device, browser, IP address, approximate location, access times, pages visited and cookie or similar technology information. We do not treat every technical identifier as personal data in every context, but we handle it carefully when it can identify or relate to you.
2.4 Sensitive information
We may process health, disability, diversity, criminal-offence or other special-category information only where it is relevant, lawfully obtained and a suitable condition applies. We do not want people to send unnecessary sensitive information. Tell us if an agreed recruitment or advisory process requires a reasonable adjustment or particular safeguard.
2.5 Information from other sources
We may receive information from you, a client, a colleague, a referee, a professional body, a publicly available professional source, an authorised service provider or another recruitment or talent-intelligence contact. Where we obtain information indirectly, we will provide the required privacy information unless a lawful exception applies.
3. How we use personal data
The purposes and typical lawful bases for our work may include:
| Purpose | Typical lawful basis |
|---|---|
| Provide search, recruitment, mapping or advisory services; communicate about an agreed assignment. | Contract, steps before contract, or legitimate interests. |
| Identify and assess potential candidates; share suitable profiles with a client where appropriate. | Legitimate interests, consent where required, or steps before contract. |
| Manage clients, proposals, invoices, records and disputes. | Contract, legitimate interests and legal obligation. |
| Meet legal, regulatory, professional and insurance requirements. | Legal obligation and legitimate interests. |
| Send business-development or marketing messages. | Consent or legitimate interests where lawful, subject to PECR and your right to object or unsubscribe. |
| Maintain security, prevent misuse and improve our systems and services. | Legitimate interests and legal obligation. |
5. International transfers
5.1 Safeguards
If personal data is accessed from or transferred to a country outside the UK, we will use a lawful transfer route and any required safeguards, such as UK adequacy regulations, approved contractual protections or another permitted mechanism. We will not treat consent as a universal substitute for proper transfer arrangements.
6. Retention
6.1 How long we keep data
We keep personal data only for as long as reasonably necessary for the relevant purpose, including recruitment, relationship management, legal, tax, insurance, audit, security and dispute needs. Actual periods depend on the category, service and legal obligation. Protection periods in client terms do not automatically authorise indefinite retention of every candidate record.
7. Your data-protection rights
7.1 The rights available
Subject to legal conditions and exceptions, you may have the right to be informed, request access to your personal data, request correction of inaccurate or incomplete data, request erasure, restrict processing, object to processing, withdraw consent where consent is the basis, and receive certain data in a portable format. You may also have protections in relation to solely automated decisions and profiling.
7.2 Rights are not absolute
Some rights apply only in particular circumstances. We may retain or continue processing information where necessary for legal obligations, legitimate grounds, public-interest reasons, freedom of expression, research, archiving, or establishing, exercising or defending legal claims. We will explain any refusal or limitation unless the law prevents us from doing so.
7.3 How to make a request
Send a request to lewis@baxternelson.com or write to Baxter Nelson Ltd, Bartle House, 9 Oxford Court, Manchester, M2 3WQ, identifying the information and right concerned. We may need to verify your identity. We will normally respond within the period required by law and may contact you for clarification. You do not have to use a particular form.
7.4 Marketing choices
You can ask us to stop direct marketing at any time. You can unsubscribe through the message, change your communication preference or contact lewis@baxternelson.com. We will keep a suppression record where needed to respect your request.
8. Automated decision-making and profiling
8.1 Human involvement
We may use ordinary search, matching, research or workflow tools to organise information and support human work. We do not intend to make a solely automated recruitment decision that has a legal or similarly significant effect on you under this policy. If a service changes to involve such processing, we will provide the required information, safeguards, meaningful human intervention and challenge route.
9. Children
9.1 Children's data
Our core services are aimed at professional and business users. We do not knowingly target children or collect their information unnecessarily. If we receive information about a child, we will assess whether it is necessary and lawful to retain it and will apply appropriate safeguards.
11. Security and incident handling
11.1 Safeguards
We use proportionate technical and organisational measures intended to prevent unauthorised access, loss, misuse, alteration or disclosure. These may include access controls, authentication, secure transfer, provider controls, backups, staff guidance, confidentiality obligations and incident procedures. No transmission or storage system can be guaranteed to be completely secure.
11.2 Security incidents
If we become aware of a personal-data incident, we will assess it, contain it, record it and notify regulators or affected people where required by law. If you believe information has been sent to the wrong person, lost or misused, contact lewis@baxternelson.com immediately.
12. Third-party websites and links
12.1 External services
Our website or communications may link to third-party websites, platforms or services. Their privacy practices are controlled by them and are outside this policy. Review their notices before submitting information. A third party may share information with Baxter Nelson under its own lawful arrangements; this policy then explains how Baxter Nelson uses it.
13. Changes and complaints
13.1 Changes
We may update this policy to reflect legal, operational, service or technology changes. We will post the current version and update the effective date. For material changes affecting people in a way that requires active communication, we will use an appropriate notification method.
Effective date: 29 September 2026.
13.2 Contact and ICO complaint
Questions, rights requests and concerns should be sent to lewis@baxternelson.com or to Baxter Nelson Ltd, Bartle House, 9 Oxford Court, Manchester, M2 3WQ. You also have the right to complain to the Information Commissioner's Office, the UK supervisory authority, through its current website or helpline. We would welcome the opportunity to address your concern first.