This privacy notice explains how Innotech Recruit Limited ('we', 'us', 'our') collects, uses, stores, and shares personal data. It applies to all individuals whose data we process, including:
We are committed to handling your personal data lawfully, fairly, and transparently in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
Innotech Recruit Limited is a boutique retained executive search firm based in Stockport, England, specialising in placing commercial leadership talent for medical device companies operating in the US, UK, and Republic of Ireland markets. For the purposes of data protection law, we are the data controller in respect of personal data processed in connection with our services.
We are registered with the Information Commissioner's Office (ICO) under registration number ZA526916.
We may collect and process the following categories of personal data about candidates:
We collect this data directly from you, from third parties (including LinkedIn and other professional networks, referrals, and publicly available sources), and from clients where they share candidate information with us.
For individuals at client organisations, we process:
When you visit innotechrecruit.com, we may collect technical data including IP address, browser type, pages visited, and time spent on site, via cookies and similar technologies. Please refer to our Cookie Policy for further detail.
| Purpose | Lawful Basis | Notes |
|---|---|---|
| Identifying and approaching suitable candidates for client vacancies | Legitimate interests (Article 6(1)(f)) | Our legitimate interest in providing executive search services to our clients |
| Evaluating suitability, conducting assessments and interviews | Legitimate interests (Article 6(1)(f)) | |
| Presenting your profile to potential employer clients | Legitimate interests (Article 6(1)(f)) | We will not present your profile without first discussing the opportunity with you |
| Carrying out right-to-work checks (where required) | Legal obligation (Article 6(1)(c)) | Applies where a placement proceeds |
| Managing the placement process including offer and counter-offer stages | Contract (Article 6(1)(b)) | Applies once you are an active candidate in a search process |
| Maintaining a talent pool for future relevant opportunities | Legitimate interests (Article 6(1)(f)) | You may opt out of talent pool retention at any time |
| Sending you relevant market intelligence or vacancy information | Legitimate interests (Article 6(1)(f)) or Consent (Article 6(1)(a)) | Where we rely on consent you may withdraw it at any time |
| Processing special category data (e.g. disability for reasonable adjustments, diversity monitoring) | Explicit consent (Article 9(2)(a)) or substantial public interest (Article 9(2)(g) + DPA 2018 Schedule 1) | We process this data only where it is necessary and with appropriate safeguards |
We process client contact data to manage our business relationship, fulfil our contracted search obligations, communicate regarding search progress and candidate shortlists, and invoice for services rendered. The lawful basis is contract performance (Article 6(1)(b)) and, where no formal contract is in place, our legitimate interests in conducting our business (Article 6(1)(f)).
We process technical data collected via cookies and analytics tools to understand how our website is used and to improve it. Please see our Cookie Policy for full details. Where we use non-essential cookies, we rely on consent.
In addition to data you provide directly, we may obtain your personal data from the following sources:
Where we collect data about you indirectly, we will provide you with this privacy notice within one month of obtaining your data, or at our first point of meaningful contact with you, in accordance with Article 14 UK GDPR.
Innotech Recruit Limited serves clients and candidates in the United States, United Kingdom, and Republic of Ireland. Where personal data is transferred outside the UK, we ensure that appropriate safeguards are in place.
Transfers to the Republic of Ireland and other European Economic Area (EEA) countries are covered by the UK's adequacy regulations in respect of EEA transfers.
Transfers to the United States are conducted where one or more of the following safeguards applies:
You may request a copy of the relevant transfer mechanism by contacting us at the details above.
We retain personal data only for as long as necessary for the purposes for which it was collected, in accordance with our data retention schedule:
| Data Category | Retention Period |
|---|---|
| Unsuccessful candidate CVs and profiles (no active placement) | 12 months from last contact, unless you consent to retention in our talent pool |
| Talent pool candidates (with consent) | Up to 3 years from the date of consent, refreshed where you remain engaged |
| Placed candidates | 6 years from the date of placement (to cover potential claims and guarantee periods) |
| Psychometric assessment data | Retained for the duration of our engagement with the candidate and up to 2 years thereafter, or as directed by the candidate |
| Client contact and business relationship data | 6 years from the end of the business relationship |
| Financial records (invoices, payments) | 7 years from the end of the relevant financial year, as required by HMRC |
| Website visitor data | Typically 13 months for analytics data; see our Cookie Policy |
At the end of the applicable retention period, personal data is securely deleted or anonymised.
Under UK GDPR, you have the following rights in relation to your personal data:
| Right | What It Means |
|---|---|
| Right of access (Subject Access Request) | You may request a copy of the personal data we hold about you. |
| Right to rectification | You may ask us to correct inaccurate data or complete incomplete data. |
| Right to erasure ('right to be forgotten') | You may ask us to delete your data where there is no compelling reason for us to continue processing it. Note that this right isn't absolute and may be limited where we have legal obligations to retain data. |
| Right to restriction of processing | You may ask us to pause processing of your data in certain circumstances (e.g. where accuracy is contested). |
| Right to data portability | Where processing is based on consent or contract and is carried out by automated means, you may ask us to provide your data in a structured, commonly used format. |
| Right to object | You have the right to object to processing based on legitimate interests. Where you object, we must stop processing unless we can demonstrate compelling legitimate grounds that override your interests. You have an absolute right to object to processing for direct marketing purposes. |
| Rights in relation to automated decision-making | We don't currently use fully automated decision-making processes that produce legal or similarly significant effects on individuals. If this changes, we will update this notice accordingly. |
To exercise any of your rights, please contact us at datacollector@innotechrecruit.com. We'll respond within one month of receiving your request. There's no charge for exercising your rights in most circumstances.
Where we process your data on the basis of consent, you may withdraw that consent at any time. Withdrawal of consent doesn't affect the lawfulness of processing carried out before withdrawal.
You have the right to object at any time to the processing of your personal data where we rely on legitimate interests as our lawful basis. If you object, we'll stop processing your data for those purposes unless we can demonstrate compelling legitimate grounds that override your interests, rights, and freedoms, or that the processing is necessary for the establishment, exercise, or defence of legal claims. You also have an absolute right to object to the use of your data for direct marketing purposes.
To exercise this right, please contact datacollector@innotechrecruit.com.
In most cases, providing your personal data to us is voluntary. However, in some circumstances, providing certain data is necessary:
We'll always make clear at the point of collection whether providing particular data is mandatory or voluntary.
We take the security of your personal data seriously. We have put in place appropriate technical and organisational measures to prevent accidental loss, unauthorised use, alteration, or disclosure of your data. Access to your personal data is restricted to those who have a genuine need to know it.
Where we use third-party service providers to process data on our behalf, we require them to have appropriate security measures in place and to process data only on our instructions.
In the event of a personal data breach that's likely to result in a risk to your rights and freedoms, we'll notify the ICO within 72 hours of becoming aware of the breach, and we'll notify affected individuals without undue delay where required.
If you have concerns about how we handle your personal data, we'd always prefer you to contact us first so that we can address the issue directly. You can reach us at info@innotechrecruit.com for general enquiries, or at policy@innotechrecruit.com for privacy-specific concerns.
If you aren't satisfied with our response, or if you believe we are processing your data unlawfully, you have the right to lodge a complaint with the Information Commissioner's Office (ICO):
We review and update this privacy notice regularly to ensure it remains accurate and reflects our current practices. Where changes are material, we'll take reasonable steps to bring them to your attention. The date at the top of this notice indicates when it was last updated.
We encourage you to review this notice periodically.
Innotech Recruit Limited · Stockport, England · ICO Registration No. ZA526916 · innotechrecruit.com