Privacy Policy

Last updated July 2026

1. About this policy

This Privacy Policy explains how The River Partnership Executive Search Limited (“River Partnership”, “we”, “us” or “our”) collects, uses, shares and protects personal data. It also explains the rights you have over your personal data and how to exercise them, including how to make a complaint to us.

River Partnership is an executive search firm based in London, operating globally. We help organisations across the UK, EU, Americas, Asia-Pacific and the Middle East identify and hire senior leaders. Most of the personal data we handle relates to:

• Candidates we identify, contact, assess and put forward for roles
• Our clients and their representatives — the individuals at organisations we work with
• Suppliers, partners and other professional contacts
• Visitors to our website at riverpartnership.com

If you are a candidate, client or employee of River Partnership, more detailed information about how we process your personal data is set out in a Privacy Notice for your group, available on request from the contact details in Section 15.

We comply with applicable data protection laws in the territories in which we operate, including the UK General Data Protection Regulation (“UK GDPR”) and the Data Protection Act 2018 (as amended by the Data (Use and Access) Act 2025) for our UK activities, the EU General Data Protection Regulation (“EU GDPR”) for our activities involving individuals in the European Economic Area, and equivalent laws in other regions where they apply.

2. Who we are

The River Partnership Executive Search Limited is the data controller for personal data processed in connection with our executive search and consultancy services.

3. Information we collect about you

The personal data we collect depends on your relationship with us.

3.1 Candidates

If you are a candidate (or potential candidate) for an executive search assignment, we typically collect:

• Identity and contact details — name, email and phone, location
• Career information — current and previous roles, employer, education, professional qualifications, public commentary or thought leadership
• Compensation information — current and historical remuneration (if relevant), where shared with us
• Information about your suitability for a role — your aspirations, motivations, references and feedback from interviews
• Work authorisation and right-to-work status — which we collect where relevant to a role, and which is typically relevant given the nature of executive search
• Where you choose to provide it: nationality, languages spoken

We may collect this information from you directly, from publicly available sources (such as professional networking sites, employer websites or published articles), or from your professional network where they have introduced you to us.

3.2 Clients and other professional contacts

If you work at one of our clients or are otherwise a professional contact, we typically collect:

• Identity and business contact details — name, job title, employer, business email and phone
• Records of our interactions — meeting notes, correspondence, briefs and other communications
• Information relevant to the search assignment, such as your views on candidates, organisational context and decision-making criteria

3.3 Website visitors

When you visit riverpartnership.com or contact us through the website, we collect any information you choose to provide (for example, your name, email and message). We also use cookies and similar technologies — see Section 11.

4. How we use your information

We use personal data to provide our executive search and consultancy services. Specifically, we use it to:

• Identify potential candidates for roles and assess their suitability
• Contact candidates about specific opportunities and discuss their interest and suitability
• Present shortlisted candidates to our clients, where the candidate has consented to that presentation
• Manage the search process through interview, offer, resignation and acceptance
• Maintain and develop our relationships with clients, candidates and other professional contacts
• Carry out market mapping, benchmarking and other research that supports our search work
• Respond to enquiries and provide information about our services
• Operate, secure and improve our business — including internal administration, security, accounting, billing, regulatory compliance and our use of professional advisers
• Meet our legal and regulatory obligations

We do not use artificial intelligence to make automated decisions about candidate selection or shortlisting. Where AI tools assist our research (for example, helping us search publicly available information), final decisions about who to approach, present or progress are always made by our consultants.

5. Our legal basis for processing your information

Under the UK GDPR and EU GDPR we must have a lawful basis to process your personal data. The lawful bases we rely on are:

Legitimate interests

Most of our processing of candidate, client and professional contact data is carried out under our legitimate interests — primarily to operate our executive search business effectively. This includes identifying candidates, assessing suitability, contacting potential candidates about relevant opportunities, and maintaining relationships with clients and professional contacts.

We have considered the impact this processing has on you and have concluded that it does not unduly affect your rights or interests. You have the right to object to processing on this basis (see Section 9).

Consent

We rely on consent where you have given us specific, informed and freely-given permission, for example, when you ask to be presented to a specific client for a specific role, or when you give us permission to share information that would otherwise be considered sensitive.

You can withdraw consent at any time by contacting us at [email protected], although withdrawing consent does not affect the lawfulness of any processing we carried out before you withdrew it.

Contract

Where we have entered into an engagement with a client, we process the client’s data and that of relevant candidates as necessary to perform our obligations under that engagement.

Legal obligation

Where we are required to process personal data to meet a legal or regulatory obligation – for example, in connection with tax, anti-money laundering or right-to-work checks – we do so on the basis of that legal obligation.

Special category data

We do not seek to collect special category data (such as data revealing racial or ethnic origin, religious beliefs, health or sexual orientation) and recommend that you do not provide it to us unsolicited. Where we do process such data – for example, because you have chosen to share information about a health condition relevant to a role’s requirements – we will rely on an additional condition under Article 9 of the UK GDPR or EU GDPR, typically your explicit consent.

6. Who we share your information with

We share personal data only where necessary to provide our services or meet our obligations. The categories of recipients are:

• Our clients: where you are a candidate and we are presenting you for a role. We share information necessary for the client to assess your suitability, and only where you have consented to that presentation (subject to limited exceptions for highly confidential mapping exercises, which we explain to candidates when relevant).
• Suppliers and service providers: including providers of our candidate database and applicant tracking system, cloud hosting, IT services, accounting and payroll services, background and reference checking providers, and professional advisers (lawyers, accountants and consultants). We require all suppliers to handle personal data in accordance with applicable law and our instructions.
• Authorities and regulators: where we are required by law to disclose personal data, or to defend our legal rights.
• Other third parties in connection with a sale or restructuring: if we sell, merge or restructure our business, personal data may be transferred as part of that transaction.

We do not sell, rent or licence your personal data, and we do not share it with third parties for their own marketing purposes.

7. International transfers

Because we operate globally, your personal data may be transferred to and stored in countries outside the United Kingdom or the European Economic Area. This is most often necessary when we present candidates to clients located outside the UK or EEA, or when our service providers (such as our candidate database) host data in those countries.

Where we transfer personal data outside the UK or EEA, we rely on one of the following safeguards:

• Transfer to a country that the UK Government or European Commission has determined provides an adequate level of protection (an “adequacy decision”)
• The UK International Data Transfer Agreement (IDTA), or the UK Addendum to the EU Standard Contractual Clauses, where required
• The UK Extension to the EU-US Data Privacy Framework, where the recipient is a US organisation certified under that framework
• Your explicit consent, where appropriate (typically only for transfers connected with putting you forward to a specific overseas client)

Where we ask for your explicit consent to a specific international transfer – for example, before sharing your candidate details with a client in a country outside the UK and EEA – we will tell you which country the transfer is to and the safeguards in place.

8. How long we keep your information

We keep personal data only for as long as we need it for the purposes for which we collected it, taking into account applicable legal and regulatory retention requirements.

Indicative retention periods are:

9. Your rights

You have a number of rights in relation to your personal data. The rights available to you depend on the law that applies to your processing, but typically include the following:

• The right to be informed about how we use your personal data – which this policy is intended to provide.
• The right of access – to ask us for a copy of the personal data we hold about you.
• The right to rectification – to ask us to correct inaccurate or incomplete personal data.
• The right to erasure – to ask us to delete your personal data in certain circumstances.
• The right to restrict processing – to ask us to stop using your personal data while we look into a concern.
• The right to data portability – to ask us to provide your personal data in a structured, commonly used and machine-readable format.
• The right to object – to processing we carry out under our legitimate interests, including any direct marketing.
• Rights in relation to automated decision-making – although, as set out in Section 4, we do not use AI to make automated decisions about candidate selection.

To exercise any of these rights, please contact us at [email protected].

We will respond within one month of receiving your request. If your request is particularly complex or you have made a number of requests, we may extend this period by up to a further two months – we will tell you within the first month if this applies. We may need to ask for additional information to verify your identity or to clarify your request, in which case the response period will pause until we receive what we have asked for.

There is no charge for exercising your rights in most circumstances, but we may charge a reasonable fee, or decline to act, where a request is manifestly unfounded or excessive.

10. How to make a complaint

If you are unhappy with how we have handled your personal data, we want to know about it. You have the right to make a complaint to us, and we will look into it.

How to complain to us

You can make a data protection complaint in any of the following ways:

What we will do

When we receive a complaint, we will:

• Acknowledge receipt of your complaint within 30 days
• Investigate without undue delay and keep you informed of progress
• Tell you the outcome of our investigation, including any steps we are taking as a result

You can make a complaint through any channel – including informally through any member of our team – and we will treat it as a data protection complaint. You do not need to use a particular form of words or label your complaint in any specific way.

Your right to escalate

You always have the right to complain to a data protection supervisory authority, whether or not you have raised the issue with us first:

• If you are in the United Kingdom: Information Commissioner’s Office (ICO) — ico.org.uk, or 0303 123 1113.
• If you are in the European Economic Area: the data protection authority in your country of residence, place of work or where the alleged infringement took place. A list of EEA authorities is maintained by the European Data Protection Board (edpb.europa.eu).
• Elsewhere: the data protection authority in your jurisdiction, where one exists.

11. Cookies and similar technologies

Our website at riverpartnership.com uses cookies and similar technologies to help the site function properly, keep it secure, and improve your experience.

When you first visit the site you will see a cookie banner that lets you choose which categories of cookies you accept. You can change your preferences at any time by clicking the “Consent Preferences” link on the site, or by adjusting your browser settings.

The categories of cookies we use are:

• Necessary – required for the site to function, including bot protection, form security and consent management
• Functional – enable additional features such as embedded video content
• Analytics – help us understand how visitors use the site

The full list of cookies, including names, providers, purposes and durations, is set out in our Cookie Policy at https://www.riverpartnership.com/cookie-policy/.

12. Links to other websites

Our website may contain links to other websites. We are not responsible for the privacy practices of those websites, and they are not governed by this policy. Please review the privacy policy of any website you visit through a link from ours.

13. Children’s personal data

Our services are aimed at executive-level professionals, and we do not knowingly collect personal data from anyone under the age of 18. If you believe we hold personal data relating to a child, please contact us and we will delete it.

14. Changes to this policy

We may update this policy from time to time to reflect changes in our practices, services or applicable law. The “Last updated” date at the top of this policy will indicate when it was most recently changed. Material changes will be brought to your attention where appropriate.

15. Contact us

If you have any questions about this policy or how we handle personal data, or if you would like to exercise any of your rights, please contact us:

End of policy.