Privacy Policy (last updated 18/08/2026)

1.Introduction

1.1 Gillespie Manners Limited are committed to protecting the personal information and privacy of the candidates we represent and the clients for whom we work. 

1.2 This Information Notice, together with any other documents referred to in it, sets out the basis on which any personal data that we collect from or about you, or that you provide to us, will be processed by us. Please read the following carefully to understand our views and practices regarding your personal data and how we treat it. The collected data will be used lawfully, fairly and in a transparent way.

1.3 For the purpose of the General Data Protection Regulation, the data controller is Gillespie Manners Limited (company number 07139334), whose registered office is at Chiltern House, 184 High Street, Berkhamsted, Hertfordshire, HP4 3AP.

Our EU Representative:

Under Article 27 of the GDPR, we have appointed an EU Representative to act as our data protection agent. Our nominated EU Representative is: Instant EU GDPR Representative Ltd.

Adam Brogden contact@gdprlocal.com

Tel +35315549700

INSTANT EU GDPR REPRESENTATIVE LTD

Office 2,

12A Lower Main Street, Lucan Co. Dublin

K78 X5P8

Ireland

1.4 We may update this Information Notice from time to time. Any changes we make in the future will be posted on our website at www.gillespiemanners.com. Please check back regularly to see any updates or changes.

2.0 Legal Basis for Processing Personal Data under GDPR

We may process personal data about our stakeholders (by which we mean current and former candidates, clients and any other person who has contact with us) in a range of ways, and for a range of purposes. The legal basis for these eventualities is listed below;

• Consent: You have given Your consent for processing Personal Data for one or more specific purposes.
• Performance of a contract: Provision of Personal Data is necessary for the performance of an agreement with You and/or for any pre-contractual obligations thereof.
• Legal obligations: Processing Personal Data is necessary for compliance with a legal obligation to which the Company is subject.
• Vital interests: Processing Personal Data is necessary in order to protect Your vital interests or of another natural person.
• Public interests: Processing Personal Data is related to a task that is carried out in the public interest or in the exercise of official authority vested in the Company.
• Legitimate interests: Processing Personal Data is necessary for the purposes of the legitimate interests pursued by the Company.

In any case, the Company will gladly help to clarify the specific legal basis that applies to the processing, and in particular whether the provision of Personal Data is a statutory or contractual requirement, or a requirement necessary to enter into a contract.

3.0 Your Rights under the GDPR

The Company undertakes to respect the confidentiality of Your Personal Data and to guarantee you can exercise your rights.

You have the right under this Privacy Policy, and by law if You are within the EU, to:

• Request access to Your Personal Data. The right to access, update or delete the information we have on you. This also enables you to receive a copy of the Personal Data We hold about you.
• Request correction of the Personal Data that We hold about You. You have the right to have any incomplete or inaccurate information we hold about you corrected.
• Object to processing of Your Personal Data. This right exists where we are relying on a legitimate interest as the legal basis for our processing and there is something about your particular situation, which makes you want to object to our processing of your Personal Data on this ground. You also have the right to object where we are processing your Personal Data for direct marketing purposes.
• Request erasure of Your Personal Data. You have the right to ask us to delete or remove Personal Data when there is no good reason for us to continue processing it.
• Request the transfer of Your Personal Data. We will provide to you, or to a third-party you have chosen, your Personal Data in a structured, commonly used, machine-readable format. Please note that this right only applies to automated information which you initially provided consent for us to use or where we used the information to perform a contract with you.
• Withdraw your consent. You have the right to withdraw your consent on us using your Personal Data. If You withdraw your consent, we may not be able to provide you with access to certain specific functionalities of the Service.
• Automated decision-making, including profiling. The data subject has the right not to be subject to a decision based solely on automated processing, including profiling, 

4.0 Exercising of Your GDPR Data Protection Rights

You may exercise your rights of access, rectification, cancellation and opposition by contacting us. Please note that we may ask you to verify your identity before responding to such requests. If you make a request, we will try our best to respond to you within 14 days.

You have the right to complain to a Data Protection Authority about our collection and use of your Personal Data.

4.1 If you wish to invoke any of the above rights, please notify us via email at info@gillespiemanners.com. Please include the words DATA PRIVACY REQUEST in the subject line of your email, or at the top of your letter. Alternatively, the contact details of our EU Representative are below:

Our EU Representative:

Under Article 27 of the GDPR, we have appointed an EU Representative to act as our data protection agent. Our nominated EU Representative is: Instant EU GDPR Representative Ltd.

Adam Brogden contact@gdprlocal.com

Tel +35315549700

INSTANT EU GDPR REPRESENTATIVE LTD

Office 2,

12A Lower Main Street, Lucan Co. Dublin

K78 X5P8

Ireland

4.2 How to make a data protection complaint to us. If you have a concern about how we have handled your personal data, please contact us directly in the first instance. We are required by law to have a formal complaints process and will acknowledge your complaint within 30 days. You can submit a complaint in any of the following ways:

• By email: info@gillespiemanners.com — please include ‘DATA PROTECTION COMPLAINT’ in the subject line.
• Online form: gillespiemanners.com/data-protection-complaint
• By post: Data Protection Officer, Gillespie Manners Ltd, Chiltern House, 184 High Street, Berkhamsted, HP4 3AP

We will investigate your complaint and respond to you without undue delay. Once our investigation is complete we will write to you with our findings and any action taken.

4.3 If you remain dissatisfied, you can make a complaint about the way we process your personal information to the supervisory authority. In the United Kingdom, the supervisory authority is the Office of the Information Commissioner, full contact details for which can be found at https://ico.org.uk/global/contact-us/

4.3 Contact details:  You can contact us in the following ways if you have any questions or concerns about personal data and privacy matters:

info@gillespiemanners.com
01442 878138
Chiltern House, 184 High Street, Berkhamsted, Hertfordshire, HP4 3AP

4.2 Please include the words DATA PRIVACY REQUEST in the subject line of your email, or at the top of your letter.

5.0 Particulars of Processing

6. Information Security

6.1 We will use technical and organisational measures to safeguard your data. We have put in place the following security measures to prevent your personal data from being accidentally lost, used, accessed, altered or disclosed in an unauthorised way for example:

6.1a Access to the account where your data is stored is password controlled. We limit access to your personal data to those employees, agents, contractors and other third parties who have a business need to know such data. They will only process your personal data on our instructions, and they are subject to a duty of confidentiality.

6.1b We store your data on secure servers

6.2 We have implemented appropriate technical and organisational measures to deal with any suspected data breach. We will notify affected individuals and the ICO within 72 hours where legally required.  If you suspect any misuse or loss or unauthorised access to your data, please let us know immediately by contacting us via this email address: info@gillespiemanners.com.

7. Our Use of Cookies

7.1 Our Site may place and access certain first party Cookies on your computer or device. First party Cookies are those placed directly by Us and are used only by Us. We use Cookies to facilitate and improve your experience of Our Site and to provide and improve Our services. We have carefully chosen these Cookies and have taken steps to ensure that your privacy and personal data is protected and respected at all times.

• By using Our Site, you may also receive certain third party Cookies on your computer or device. Third party Cookies are those placed by websites, services, and/or parties other than Us. Third Party Cookies are used on Our Site to allow our website to present you with customised Web pages and to also track which pages you may have visited. These Cookies are not integral to the functioning of Our Site and your use and experience of Our Site will not be impaired by refusing consent to them.
• All cookies used on our Site comply with the Privacy and Electronic Communications Regulations (PECR) as amended by the Data (Use and Access) Act 2025, and with the UK GDPR.
• We use cookies in accordance with the Data (Use and Access) Act 2025 (DUAA) and the Privacy and Electronic Communications Regulations (PECR). The rules on consent vary by cookie category as set out below.
• The categories below summarise which cookies require your prior consent and which operate on an opt-out basis under the DUAA 2025. You can manage your preferences at any time using the Cookie Settings panel on our Site.
• The following Cookies may be placed on your computer or device:

Essential Cookies. Essential cookies are strictly necessary for the Site to function and cannot be switched off. They do not require your consent. They are set in response to actions you take, such as setting your cookie preferences or completing forms.

Preference Cookies. Preference cookies remember your settings to provide a more personalised experience. Under the DUAA 2025, these may be placed without prior consent, but you can opt out at any time via the Cookie Settings panel or your browser settings.

Social Media Cookies. Social media cookies allow our Site to integrate with platforms such as LinkedIn. They are set by those platforms under their own privacy policies. These cookies require your prior consent under PECR.

Analytics Cookies. Analytics cookies help us understand how visitors use our Site by collecting information such as pages visited, time spent, and errors encountered. We use this data in aggregate to improve our Site. Under the DUAA 2025, analytics cookies may be placed without prior consent, but you can opt out at any time via the Cookie Settings panel or the Google Analytics opt-out add-on at tools.google.com/dlpage/gaoptout.

Advertising Cookies. Advertising cookies track activity on our Site and other websites to deliver targeted advertising. These require your prior consent under PECR. You can withdraw consent at any time via the Cookie Settings panel.

Pixel tags. Pixel tags (also known as web beacons and clear GIFs) are used to, among other things, track the actions of users of the Site, measure the success of our marketing campaigns, and compile statistics about usage of the Site and response rates.

Adobe Flash.Similar technologies such as pixel tags and web beacons may also be used to track actions on our Site and measure marketing effectiveness. These are subject to the same consent requirements as advertising cookies.

Browser or Device Information. Certain information is collected by most browsers or automatically through your device, such as your Media Access Control (MAC) address, computer type (Windows or Mac), screen resolution, operating system name and version, device manufacturer and model, language, Internet browser type and version, and the name and version of the Site you are using. We use this information to ensure that the Site functions properly.

Google Analytics. We use Google Analytics to measure Site performance and understand visitor behaviour. You can learn about Google’s data practices at www.google.com/policies/privacy/partners/ and opt out via https://tools.google.com/dlpage/gaoptout.

Physical Location. We collect the physical location of your device by, for example, using satellite, cell phone tower, or WiFi signals. We use your device’s physical location to provide you with personalized location-based services and content. We also share your device’s physical location, combined with information about what advertisements you viewed and other information we collect, with our marketing partners to enable them to provide you with more personalized content and to study the effectiveness of advertising campaigns. In some instances, you can allow or deny such uses and sharing of your device’s location, but if you do, we and our marketing partners may not be able to provide you with the applicable personalized services and content.

Device Fingerprinting. To offer you content that we believe may interest you based on your activity on the Site, and for fraud prevention and authentication purposes, we may also use other technologies that are similar to cookies. For example, we may gather device attributes and combine information collected by most browsers or automatically through your device to create a unique ID that identifies your browser or device to us with reasonable certainty. In this context we may collect, use, and combine certain information about your device, including, but not limited to: Last visit, first visit and number of visits; IP address (external and internal), geolocation (latitude/longitude based on IP address); device user-agent (browser type, version), device operating system, keywords used if coming from search engine, pages visited. 

• In addition to the controls that We provide, you can choose to enable or disable Cookies in your internet browser. Most internet browsers also enable you to choose whether you wish to disable all cookies or only third party Cookies. By default, most internet browsers accept Cookies but this can be changed. For further details, please consult the help menu in your internet browser or the documentation that came with your device.
• You can choose to delete Cookies on your computer or device at any time, however you may lose any information that enables you to access Our Site more quickly and efficiently including, but not limited to, login and personalisation settings.
• It is recommended that you keep your internet browser and operating system up-to-date and that you consult the help and guidance provided by the developer of your internet browser and manufacturer of your computer or device if you are unsure about adjusting your privacy settings.

Addendum: Privacy Notice for Swiss Residents

This Notice outlines how Gillespie Manners Limited processes personal data of Swiss residents in compliance with the Swiss Federal Act on Data Protection (FADP) and the Swiss Data Protection Ordinance (DPO).

Data Protection Principles Under FADP

FADP is underpinned by six important principles that Gillespie Manners Limited adheres to. These principles require that personal data must: Be processed lawfully; Be processed in good faith and proportionately; Be collected for a specific purpose that the data subject can recognise; and may only be further processed in a manner that is compatible with this purpose; Be destroyed or anonymised as soon as they are no longer required for the purpose of processing; Be accurate and kept up to date; If processed with consent as a lawful base, the consent is given voluntarily for one or more specific instances of processing based on appropriate information.

Legal Basis for Processing

Gillespie Manners Limited relies on the following legal bases for processing: Your consent, Performance of a contract with you, Compliance with a legal obligation, Protection of your vital interests, Our legitimate interests, provided they do not override your fundamental rights and freedoms, Public interest or exercise of official authority.

Your Rights Under FADP

As a Swiss resident, you have the following rights regarding your personal data:

–         Right of access to personal data (including right to receive the following information: Identity and contact details of the data controller, the personal data processed, purpose of processing, retention period or criteria, source of data (if not collected from the data subject), information about automated individual decisions and their logic, recipients of personal data)

–         Right to data portability (including the right to request from us to deliver your personal data to another controller in a conventional electronic format if: your data is being processed in an automated way and if your data is being processed with your consent or in direct connection with performance of a contract between [Company name] and you.

–         Right to personal data deletion or destruction

–         Right to personal data rectification (including the right to demand correction of inaccurate personal data and the right to request that disputed data be marked as such)

–         Right to personal data processing prohibition

–         Right to personal data non-disclosure

–         Right to be informed of measures taken (including the right to request that measures related to deletion, rectification, prohibition of processing, or non-disclosure of your data be published or communicated to third parties)

To exercise these rights, please contact us at claire.smart@gillespiemanners.com. We will respond to your request within 30 days.

International Data Transfers

Gillespie Manners Limited may transfer personal data outside Switzerland to countries whose law does not ensure an adequate level of data protection, provided that data protection is ensured by other mechanisms, in particular on the basis of standard data protection clauses or other suitable guarantees. In exceptional cases, we may export personal data to countries without adequate or suitable data protection if the specific data protection requirements are met, for example, the express consent of the data subjects or a direct connection with the conclusion or processing of a contract.

We will gladly provide data subjects with information about any guarantees or provide a copy of any guarantees upon request.

Third-Party Services and Data Transfers

Your Right to Object to a Transfer

You have the right to object to the transfer of your personal data to these third parties. To exercise this right, please contact us at claire.smart@gillespiemanners.com.  Please note that objecting to certain data transfers may affect our ability to provide certain services to you.

Swiss Representative

Under Article 14 of the FADP, we have appointed a Swiss Representative to act as our data protection agent. Our nominated Swiss Representative is:

ALTRION Sagl
Via Luigi Lavizzari 8
Mendrisio – Switzerland

Legal Protection

Data subjects have the right to enforce their data protection claims through legal channels or to lodge a complaint with a competent data protection supervisory authority. The data protection supervisory authority for private data controllers and federal bodies in Switzerland is the Federal Data Protection and Information Commissioner (FDPIC). In the case of projects financed by cantons or municipalities in Switzerland, the cantonal data protection commissioners are responsible in some cases.

Privacy Policy Addendum: Regional Privacy Rights

To comply with data protection laws in jurisdictions beyond the UK, EU, and Switzerland, we have included the following regional privacy rights for candidates located in those regions. These apply in addition to the rights outlined in the main body of this privacy policy.

Brazil (LGPD) If you are located in Brazil, we process your personal data under the Lei Geral de Proteção de Dados (LGPD). You have the right to access, correct, delete, and port your data, and to revoke consent. Where applicable, we will request your explicit consent before processing your data. International transfers are safeguarded by contractual mechanisms.

California, USA (CCPA/CPRA) If you are a California resident, you have rights under the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA), including rights to access, delete, correct, and opt-out of the sale or sharing of your personal data. We do not sell candidate data. To exercise your rights, contact us as set out in the main policy.

Saudi Arabia (PDPL) For candidates in Saudi Arabia, we process personal data in accordance with the Personal Data Protection Law (PDPL). We rely on your explicit consent or legal grounds permitted under PDPL. International transfers are carried out in compliance with local regulatory requirements.

Canada (PIPEDA) If you are located in Canada, your data is processed under the Personal Information Protection and Electronic Documents Act (PIPEDA). You may access and correct your personal information. Where we transfer your data internationally, we do so using adequate safeguards.

Australia (Privacy Act) If you are in Australia, we comply with the Privacy Act 1988 and the Australian Privacy Principles (APPs). You may request access to or correction of your data. International transfers are made with adequate protective measures.

Mexico (LFPDPPP) If you are located in Mexico, we adhere to the Federal Law on Protection of Personal Data Held by Private Parties (LFPDPPP). You may access, rectify, cancel, or oppose the processing of your data (ARCO rights). International transfers occur with your consent or through legal safeguards.

Colombia (Law 1581) For candidates in Colombia, your data is handled under Law 1581 of 2012. You have the right to access, update, correct, and delete your personal data. We apply data transfer protections consistent with Colombian law.

Chile We apply GDPR-level protections for candidate data from Chile. You may access and correct your data. We are monitoring local developments for updates to Chile’s data protection laws.

Singapore (PDPA) If you are located in Singapore, we comply with the Personal Data Protection Act (PDPA). You have the right to access and correct your personal data. Data transfers are safeguarded to ensure comparable levels of protection.

Thailand (PDPA) For candidates in Thailand, we process your data under the Personal Data Protection Act (PDPA). You may access, correct, or delete your personal data. Data transfers are made with adequate protections.

Indonesia In anticipation of Indonesia’s Personal Data Protection Law, we adhere to GDPR-comparable principles. You may access or request deletion of your data. We will update this section once implementing regulations are in effect.

Malaysia (PDPA 2010) For candidates in Malaysia, we comply with the Personal Data Protection Act 2010. You have the right to access and correct your data. Cross-border transfers are made in accordance with applicable legal requirements.

Philippines (Data Privacy Act) If you are located in the Philippines, your data is processed under the Data Privacy Act of 2012. You may access, correct, or object to processing of your data. Transfers are subject to adequate safeguards.

UAE (Dubai – DIFC) For candidates within the Dubai International Financial Centre (DIFC), we comply with the DIFC Data Protection Law. You have rights similar to those under GDPR, and we ensure appropriate safeguards for international data transfers.

If you are located in one of these regions and wish to exercise your rights, please contact us at info@gillespiemanners.com with the subject line “DATA PRIVACY REQUEST” or follow the procedures outlined in Section 4.0 of this policy.