Moonwalk Recruitment Solutions Ltd Privacy Policy

I. Introduction

1.1. Moonwalk Recruitment Solutions Ltd ("Moonwalk", "we", "our" or "us") is committed to protecting the privacy, confidentiality and security of the personal data entrusted to us and to ensuring that such data is processed in a lawful, fair and transparent manner.
1.2. This Privacy Policy explains how Moonwalk collects, uses, stores, discloses, transfers, retains and otherwise processes personal data in connection with the provision of executive search, recruitment and talent advisory services, executive search assignments undertaken on behalf of our clients, candidate identification, talent mapping and market research activities, recruitment consultancy and business development, the operation and administration of our website, communications with clients, candidates, suppliers and other business contacts and compliance with applicable legal and regulatory obligations.
1.3. Moonwalk recognises that the protection of personal data is fundamental to maintaining the trust of candidates, clients and other individuals with whom we interact. We are committed to ensuring that all personal data is processed in accordance with the principles of lawfulness, fairness, transparency, purpose limitation, data minimisation, accuracy, storage limitation, integrity, confidentiality and accountability as set out in Article 5 of Regulation (EU) 2016/679 as EU General Data Protection Regulation.
1.4. This Privacy Policy has been prepared in accordance with the UK General Data Protection Regulation ("UK GDPR"), the Data Protection Act 2018, the Privacy and Electronic Communications (EC Directive) Regulations 2003 ("PECR"), where applicable, Regulation (EU) 2016/679 ("EU GDPR"); and applicable guidance and recommendations issued by the UK Information Commissioner’s Office ("ICO").
1.5. This Privacy Policy applies whether personal data is obtained directly from an individual or indirectly from lawful third-party sources, including publicly available professional information, referrals and client instructions.
1.6. Where Moonwalk collects personal data from sources other than the individual concerned, we will provide the information required by Article 14 UK GDPR unless an exemption under applicable data protection legislation applies.
1.7. This Privacy Policy should be read together with our Cookie Policy, Website Terms of Use and any supplementary privacy notices that may be provided in relation to particular recruitment assignments or processing activities.
1.8. This Policy applies to candidates, prospective candidates, clients, client representatives, referees, suppliers, contractors, website visitors, business contacts, individuals identified through executive search, talent mapping or referrals, and individuals whose data is received from third parties.

II. Data Controller
2.1. For the purposes of the UK GDPR and the Data Protection Act 2018, the controller responsible for the processing of personal data described in this Privacy Policy is: Moonwalk Recruitment Solutions Ltd,  company registration number: 15 910 151, registered Office: United Kingdom, Unit 82a, James Carter Road, Mildenhall, Bury St Edmunds IP28 7DE, United Kingdom, website: https://www.moonwalkrec.com, phone number: +44 1223 865 320. 
2.2. Moonwalk is responsible for determining the purposes for which and how personal data is processed in connection with its executive search, recruitment consultancy and related business activities.
2.3. Where Moonwalk engages third-party service providers to process personal data on its behalf, such providers act as processors and are contractually required to process personal data only in accordance with Moonwalk’s documented instructions, to implement appropriate technical and organisational security measures and to comply with applicable data protection legislation.
2.4. Moonwalk may appoint a Data Protection Officer ("DPO") or another appropriately qualified individual responsible for overseeing compliance with applicable data protection legislation. Where such an appointment has been made, the relevant contact details will be published on our website and may be used for any questions concerning this Privacy Policy or the exercise of data subject rights.
2.5. Individuals wishing to exercise any of their rights under the UK GDPR, including the right of access under Article 15 UK GDPR, or who have any questions concerning the processing of their personal data, may contact Moonwalk using the contact details set out above.

III. Scope of Privacy Policy
3.1.         This Privacy Policy applies to all personal data processed by Moonwalk Recruitment Solutions Ltd in connection with its executive search, recruitment consultancy, talent advisory and related business activities.'
3.2.         This Privacy Policy applies to personal data relating to, including but not limited to current, former and prospective candidates for permanent, temporary, interim, consultancy and board-level appointments, individuals identified through executive search, talent mapping, market research or other proactive sourcing activities, candidates whose details have been provided to Moonwalk by clients, professional advisers, recruitment partners or other third parties, individuals referred to Moonwalk by existing candidates, clients or other business contacts, clients and prospective clients, employees, directors, officers, shareholders and authorised representatives of clients and prospective clients, referees and individuals providing professional references, suppliers, consultants, contractors and other service providers, visitors to the Moonwalk website, individuals who contact Moonwalk by telephone, email, social media, online forms or other communication channels, attendees at meetings, conferences, networking events or other business events organised or attended by Moonwalk, individuals subscribing to newsletters, publications or marketing communications and any other individual whose personal data Moonwalk processes in the course of conducting its legitimate business activities.
3.3.         This Privacy Policy applies irrespective of whether personal data is collected directly from the individual concerned or indirectly from lawful third-party sources, including publicly available professional information, client instructions, referrals, business networking activities or other legitimate sources.

IV Definitions
For the purposes of this Privacy Policy, the following terms shall have the meanings set out below:
4.1  Applicable Data Protection Laws means all legislation, regulations and legally binding guidance governing the processing of personal data applicable to Moonwalk from time to time, including the UK GDPR, the Data Protection Act 2018, Privacy and Electronic Communications (EC Directive) Regulations 2003 ("PECR") and, where applicable, the EU GDPR.
4.2  Candidate means any individual who applies for, is considered for, is identified for, or may be suitable for permanent, temporary, interim, consultancy, executive or board-level positions or other professional opportunities.
4.3  Client means any existing or prospective organisation or individual to whom Moonwalk provides executive search, recruitment, talent advisory or related consultancy services.
4.4  Controller means the natural or legal person which, alone or jointly with others, determines the purposes and means of the processing of personal data.
4.5  Executive Search means the process of identifying, researching, assessing, approaching and introducing suitably qualified individuals to clients for employment, consultancy, interim management or board appointments.
4.6  Personal Data means any information relating to an identified or identifiable natural person, whether directly or indirectly identifiable, as defined in Article 4(1) UK GDPR and GDPR.
4.7  Processing means any operation or set of operations performed on personal data, whether or not by automated means, including collection, recording, organisation, structuring, storage, adaptation, retrieval, consultation, use, disclosure by transmission, dissemination, alignment, restriction, erasure or destruction.
4.8  Processor means any natural or legal person, public authority, agency or other body which processes personal data on behalf of the Controller.
4.9  Special Category Data means personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data processed for the purpose of uniquely identifying an individual, data concerning health, or data concerning an individual’s sex life or sexual orientation, as defined in Article 9 UK GDPR and GDPR.

V. Categories of Personal Data
5.1.   Moonwalk processes only such personal data as is adequate, relevant and limited to what is necessary for the purposes described in this Privacy Policy and in accordance with the principle of data minimisation under Article 5(1)© UK GDPR.
5.2.   Depending upon the nature of our relationship with an individual and the services provided, Moonwalk may process the following categories of personal data: identity information (full name, ID), contact information (residential or business address, email address, telephone number, LinkedIn profile and other professional networking profiles), professional information (curriculum vitae (CV), employment history, professional experience, education, qualifications, professional memberships, licences and certifications, skills and competencies), recruitment information (career aspirations, salary expectations, remuneration and benefits information, notice period, relocation preferences, interview notes, assessment results, candidate evaluations, references), communications (correspondence by email, telephone or post, meeting notes, interview records, 
communications with candidates, clients and other business contact), technical information (when individuals visit our website, Moonwalk may process technical information including IP address, browser type and version, 
operating system, device identifiers, website usage information, cookie identifiers, log files).
5.3. Moonwalk does not intentionally collect more personal data than is reasonably necessary for the purposes for which it is processed and regularly reviews the categories of personal data collected to ensure continued compliance with the principles of data minimisation and storage limitation.

VI. Purposes of Processing
6.1. Moonwalk processes personal data only where there is a legitimate business purpose and a valid lawful basis under the UK GDPR. Personal data is processed solely for specified, explicit and legitimate purposes and will not be further processed in a manner that is incompatible with those purposes, unless otherwise required or permitted by applicable law.
6.2. Depending on the nature of our relationship with an individual, Moonwalk may process personal data for one or more of the following purposes:
6.2.1.      identifying, researching and approaching potential candidates for current or future employment opportunities;
6.2.2.      providing executive search, recruitment consultancy and talent advisory services to clients;
6.2.3.      conducting talent mapping, market intelligence and workforce research activities;
6.2.4.      assessing candidates' qualifications, experience, competencies and suitability for particular roles;
6.2.5.      arranging and managing interviews, meetings and recruitment processes;
6.2.6.      verifying information provided by candidates, including obtaining and reviewing professional references where appropriate;
6.2.7.      introducing candidates to clients and facilitating recruitment processes;
6.2.8.      maintaining and administering candidate databases and talent pools;
6.2.9.      managing relationships with existing and prospective clients;
6.2.10.   responding to enquiries and requests submitted through our website or other communication channels;
6.2.11.   negotiating, entering into and administering contracts with candidates, clients, suppliers and other business partners;
6.2.12.   providing recruitment-related advice and consultancy services;
6.2.13.   maintaining accurate internal business records;
6.2.14.   operating, maintaining and improving our website, information systems and business processes;
6.2.15.   ensuring network, information and cyber security;
6.2.16.   monitoring and preventing fraud, unauthorised access and other unlawful activities;
6.2.17.   protecting the safety, integrity and security of our personnel, systems and business operations;
6.2.18.   complying with applicable legal, regulatory and professional obligations;
6.2.19.   establishing, exercising or defending legal claims;
6.2.20.   responding to requests from courts, regulators, supervisory authorities and law enforcement agencies where legally required;
6.2.21.   carrying out internal audits, risk management, quality assurance and corporate governance activities;
6.2.22.   sending marketing communications, newsletters, event invitations and other business updates where permitted by applicable law;
6.2.23.   analysing recruitment trends, business performance and service quality to improve our services;
6.2.24.   maintaining business continuity, disaster recovery and incident management procedures and any other purpose that is compatible with the original purpose for which the personal data was collected or otherwise authorised by applicable law.
6.3.    Moonwalk will not use personal data for purposes that are materially different, unrelated or incompatible with those described in this Privacy Policy without first identifying an appropriate lawful basis and, where required by law, informing the relevant individuals.

VII. Lawful Bases for Processing
 
7.1. Moonwalk processes personal data only where one or more of the lawful bases set out in Article 6(1) UK GDPR applies.
7.2. The lawful basis relied upon will depend upon the particular processing activity and the relationship between Moonwalk and the individual concerned.
7.3. The principal lawful bases relied upon by Moonwalk are as follows:


7.4. Where Moonwalk relies on Article 6(1)(f) UK GDPR (legitimate interests), it undertakes an appropriate balancing assessment to ensure that its legitimate interests, or those of its clients, are not overridden by the interests, fundamental rights or freedoms of the individuals concerned.
7.5. Where processing is based on consent, individuals may withdraw their consent at any time. Withdrawal of consent shall not affect the lawfulness of any processing carried out before consent was withdrawn.
7.6. Where Moonwalk processes Special Category Data, such processing will only take place where an appropriate condition under Article 9 UK GDPR and, where applicable, Schedule 1 of the Data Protection Act 2018 has been satisfied.
7.7. Moonwalk regularly reviews the lawful basis relied upon for its processing activities to ensure continued compliance with applicable data protection legislation and the principles of accountability under Article 5(2) UK GDPR.
 
VIII. Recipients of Personal Data

8.1. Moonwalk treats all personal data as confidential and will disclose personal data only where it is necessary for the purposes described in this Privacy Policy, where required by applicable law, or where the individual has otherwise authorised such disclosure.
8.2. Depending upon the nature of the recruitment assignment or business relationship, Moonwalk may disclose personal data to one or more of the following categories of recipients:
8.2.1. existing and prospective clients in connection with executive search, recruitment and talent advisory services;
8.2.2. employees, consultants and authorised personnel of Moonwalk who require access to personal data for the performance of their duties and who are subject to appropriate confidentiality obligations;
8.2.3. third-party recruitment partners engaged in connection with specific recruitment assignments;
8.2.4. providers of information technology services, including cloud hosting, data storage, email, cybersecurity, software development and technical support services;
8.2.5. providers of applicant tracking systems, recruitment software and other human resources technology platforms;
8.2.6. providers of communication, video conferencing and collaboration services;
8.2.7. background verification, identity verification and reference checking providers, where such checks are appropriate and lawful;
8.2.8. legal advisers, external consultants and other professional advisers;
8.2.9. auditors, accountants and tax advisers;
8.2.10.   regulatory authorities, supervisory authorities, law enforcement agencies, courts, tribunals and other competent public authorities where disclosure is required or permitted by law;
8.2.11.   any other recipient where disclosure is necessary to establish, exercise or defend legal claims or otherwise protect the legitimate interests of Moonwalk, its clients or other affected parties.
8.3.   Where Moonwalk engages third-party service providers to process personal data on its behalf, such providers act as processors and are contractually required to process personal data only in accordance with Moonwalk’s documented instructions, to implement appropriate technical and organisational security measures and to comply with applicable data protection legislation.

IX. International Transfers of Personal Data
 
9.1. Moonwalk may transfer personal data to countries outside the United Kingdom where this is necessary for the provision of executive search, recruitment consultancy or related business services.
9.2. Where personal data is transferred internationally, Moonwalk will ensure that an appropriate level of protection is maintained in accordance with UK GDPR and GDPR.
9.3. Moonwalk will take appropriate contractual, technical and organisational measures to protect personal data transferred internationally, including encryption where appropriate, access controls, confidentiality obligations and ongoing monitoring of transfer arrangements.
9.4. Individuals may request further information regarding the safeguards applied to international transfers by contacting Moonwalk using the contact details set out in this Privacy Policy.

X. Data Retention
 
10.1. Moonwalk retains personal data only for as long as is necessary to fulfil the purposes for which it was collected, to comply with applicable legal, regulatory, contractual and professional obligations, to resolve disputes, and to establish, exercise or defend legal claims.
10.2. When determining the appropriate retention period, Moonwalk takes into account the nature, sensitivity and volume of the personal data, the purposes for which the personal data is processed, applicable statutory limitation periods, legal and regulatory requirements, contractual obligations, the likelihood of future recruitment opportunities, the potential need to establish, exercise or defend legal claims  and the risks associated with retaining the personal data.
10.3. Upon expiry of the applicable retention period, personal data will be securely deleted, anonymised or otherwise disposed of in accordance with Moonwalk’s internal data retention procedures, unless continued retention is required or permitted by law.
10.4. The following retention periods generally apply:


10.5. Retention periods may be extended where necessary to comply with legal obligations, regulatory investigations, litigation holds, court proceedings or other legitimate business requirements.
10.6. Moonwalk in accordance to the internal retention policy reviews the personal data it holds and securely deletes or anonymises information that is no longer required for the purposes for which it was collected.

XI. Data Subject Rights
11.1. Moonwalk respects the rights of individuals in relation to their personal data and is committed to facilitating the exercise of those rights in accordance with UK GDPR and GDPR.
11.2.Subject to the conditions, limitations and exemptions provided by applicable data protection legislation, individuals may exercise the following rights:
11.2.1. Right to be informed
Individuals have the right to receive clear, transparent and easily accessible information regarding the processing of their personal data. This Privacy Policy forms part of Moonwalk’s commitment to meeting its transparency obligations under Articles 12, 13 and 14 UK GDPR.
11.2.2. Right of access
Individuals have the right to obtain confirmation as to whether Moonwalk processes their personal data and, where this is the case, to obtain access to that personal data together with the information required by Article 15 UK GDPR.
11.2.3. Right to rectification
Individuals may request the correction of inaccurate or incomplete personal data without undue delay.
11.2.4. Right to erasure
Individuals may request the deletion of their personal data where one of the grounds set out in Article 17 UK GDPR applies.
11.2.5. Right to restriction of processing
Individuals may request that Moonwalk restrict the processing of their personal data in the circumstances described in Article 18 UK GDPR.
11.2.6. Right to data portability
Where applicable, individuals may receive the personal data they have provided to Moonwalk in a structured, commonly used and machine-readable format and may request that such data be transmitted to another controller where technically feasible.
11.2.7. Right to object
Individuals have the right to object, on grounds relating to their particular situation, to processing carried out on the basis of Article 6(1)(f) UK GDPR. Individuals also have the right to object at any time to the processing of their personal data for direct marketing purposes.
11.2.8. Rights relating to automated decision-making
Individuals have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning them or similarly significantly affects them, except where permitted under Article 22 UK GDPR.
11.3. Moonwalk will respond to requests concerning the exercise of data subject rights without undue delay and, in any event, within the time limits prescribed by applicable law.

XII. Subject Access Requests
12.1. Individuals may exercise their right of access by submitting a written Subject Access Request ("SAR") using the contact details provided in this Privacy Policy.
12.2. Upon receipt of a valid request and subject to satisfactory verification of identity, Moonwalk will respond without undue delay and, in any event, within one month of receipt, unless the response period is lawfully extended in accordance with Article 12(3) UK GDPR due to the complexity or number of requests.
12.3. The right of access under Article 15 UK GDPR entitles individuals to obtain confirmation as to whether their personal data is being processed, obtain access to their personal data, 
12.4. The right of access does not constitute a general right to obtain internal correspondence, internal emails, interview deliberations or recruitment discussions, legal advice protected by legal professional privilege, confidential references where an exemption applies, commercially confidential information, trade secrets or intellectual property, information relating to other individuals or business records that do not constitute the requester’s personal data.
12.5. Where disclosure would adversely affect the rights and freedoms of others or where another exemption under applicable legislation applies, Moonwalk may withhold, redact or otherwise limit the information disclosed, including in accordance with Article 15(4) UK GDPR, the Data Protection Act 2018 and other applicable legal requirements.
12.6. Where a request is manifestly unfounded or excessive, particularly because of its repetitive nature, Moonwalk reserves the right, where permitted by Article 12(5) UK GDPR, to refuse to act on the request or to charge a reasonable administrative fee.

XIII. Identity Verification
13.1. Moonwalk is committed to ensuring that personal data is disclosed only to the individual to whom it relates or to a person lawfully authorised to act on that individual’s behalf.
13.2. Where Moonwalk has reasonable doubts concerning the identity of the person submitting a request, Moonwalk may, pursuant to Article 12(6) UK GDPR, request additional information necessary to verify the identity of the requester before processing the request.
13.3. Depending upon the circumstances, Moonwalk may request one or more of the following:
13.3.1. a electronically signed written request by identified signature tool;
13.3.2. a copy of a valid government-issued identity document;
13.3.Moonwalk will process only the minimum information necessary for identity verification and will retain such information only for as long as necessary to comply with its legal obligations and to demonstrate compliance with applicable data protection legislation.
13.4. Where sufficient information is not provided to verify identity, Moonwalk may decline to process the request until appropriate verification has been completed.
13.5. The statutory response period under Article 12 UK GDPR will commence once Moonwalk has received sufficient information to verify the identity of the requester.

XIV. Cookies and Similar Technologies

14.1. Moonwalk uses cookies and similar technologies to ensure the proper functioning of its website, enhance user experience, maintain website security and analyse website usage.
14.2. Where required by the Privacy and Electronic Communications (EC Directive) Regulations 2003 ("PECR") and the UK GDPR, non-essential cookies and similar technologies will only be placed on a user’s device following the user’s informed and freely given consent.
14.3. Detailed information regarding the categories of cookies used, their purposes, retention periods and methods for managing cookie preferences is available in Moonwalk’s separate Cookie Policy.
14.4. Individuals may withdraw or amend their cookie preferences at any time through the cookie consent management tool available on the website.

XV. Complaints

15.1. Moonwalk is committed to resolving any concerns regarding the processing of personal data promptly and fairly.
Individuals who have questions or concerns regarding this Privacy Policy or the processing of their personal data are encouraged to contact Moonwalk in the first instance using the contact details provided in this Privacy Policy.
15.2. Without prejudice to any other administrative or judicial remedy available under applicable law, individuals have the right to lodge a complaint with the Information Commissioner’s Office ("ICO") if they believe that Moonwalk has processed their personal data in breach of applicable data protection legislation.

XVI. Changes to this Privacy Policy

16.1. Moonwalk reserves the right to amend, update or revise this Privacy Policy from time to time to reflect changes in applicable legislation, developments in regulatory guidance and changes to our business operations as well as technological developments, changes to our processing activities; or improvements to our privacy governance framework.
16.2. Any updated version of this Privacy Policy will be published on Moonwalk’s website together with the revised effective date and version number.
16.3. Where required by applicable law, Moonwalk will take appropriate steps to notify affected individuals of material changes to this Privacy Policy.
16.4. Individuals are encouraged to review this Privacy Policy periodically to remain informed about how Moonwalk protects and processes personal data.