Privacy Policy

Effective Date: 3.09.2025

Privacy policy

Data Controller
Keystone Executive Solutions [Company Number 16675726 ]
45 Albemarle Street
London, W1S 4JL
Email: hello@keystoneexecutivesolutions.com

At Keystone Executive Solutions (“we,” “our,” or “us”) respects your privacy and we are candidates, clients and users of our website. This Privacy Policy explains how we collect, use, disclose, store and protect personal information when you:

  • visit or use our website;

  • contact us about our services;

  • become or act on behalf of a client;

  • use our executive, private-office, operational or travel-support services;

  • apply for, or are considered for, a role through our recruitment services;

  • provide a reference or other information about a candidate;

  • communicate with us as a supplier, business contact or professional adviser; or

  • otherwise interact with Keystone.

We process personal information in accordance with applicable UK data protection law, including the UK General Data Protection Regulation (“UK GDPR”) and the Data Protection Act 2018.

This Privacy Policy should be read together with any specific privacy information we provide to you at the point we collect your information.

1.Who we are

Legal name: Keystone Executive Solutions
Trading name: Keystone Executive Solutions
Registered/business address: 45 Albemarle Street, London, W1S 4JL
Email: hello@keystoneexecutivesolutions.com
Website: www.keystoneexecutivesolutions.com

For most of the processing described in this Privacy Policy, Keystone acts as the data controller.

If you have any questions about how we use your personal information, please contact us using the details above.

ICO registration: ZC019858

2.What personal information we collect

The information we collect depends on your relationship with Keystone and the services involved.

Website visitors and enquiries

We may collect:

  • name;

  • job title and company;

  • email address;

  • telephone number;

  • information contained in your enquiry or message;

  • information you provide through forms on our website;

  • information about how you use our website;

  • IP address and technical information where applicable; and

  • cookie and similar technology information, subject to our cookie settings and applicable law.

Clients and prospective clients

Depending on the services we provide, we may collect:

  • name and contact details;

  • job title and business information;

  • information about your organisation;

  • information about your requirements and preferences;

  • diary, scheduling and logistical information;

  • travel-related information;

  • information concerning events, meetings and appointments;

  • billing and payment information;

  • information required to provide executive or private-office support;

  • information contained in correspondence and instructions; and

  • other information you provide to us in connection with our services.

Because executive and private-office support can involve sensitive or highly confidential information, we only seek and use information that is reasonably necessary for the relevant service.

Recruitment candidates

Where Keystone provides recruitment services, we may collect information such as:

  • name and contact details;

  • CV and employment history;

  • education and qualifications;

  • professional memberships;

  • skills, experience and career preferences;

  • salary or remuneration information where relevant;

  • references and information provided by referees;

  • information obtained during interviews or assessments;

  • right-to-work information where applicable;

  • information relevant to background or pre-employment checks where those checks are justified and lawful;

  • information obtained from professional networking sites, job boards or other publicly available sources where appropriate;

  • communications between you and Keystone; and

  • information provided by a prospective employer or other recruitment client.

We will only undertake background, vetting or other checks where they are relevant, justified and lawful for the particular role or recruitment process. Where applicable, we will tell candidates what checks are being undertaken, why they are required, the information involved and who may have access to it. The ICO's recruitment guidance specifically requires transparency around pre-employment vetting.

Referees and other third parties

If you provide a reference or other information about another individual, you should only provide information that you are entitled to share.

We may collect:

  • your name and contact details;

  • your relationship with the candidate;

  • information contained in a reference;

  • information relevant to the candidate's employment or suitability; and

  • other information reasonably required for the recruitment process.

Suppliers and business contacts

We may collect:

  • name and contact details;

  • company and job title;

  • correspondence;

  • contractual and commercial information;

  • invoicing and payment information; and

  • information necessary to manage our business relationship.

3. How we collect personal information

We may obtain personal information:

  • directly from you;

  • when you contact us;

  • when you complete a website form;

  • when you engage our services;

  • during meetings, telephone calls or correspondence;

  • when you apply for or are considered for a role;

  • from a client or prospective employer;

  • from referees;

  • from recruitment platforms and job boards;

  • from professional networking platforms;

  • from publicly available sources;

  • from service providers acting on our behalf;

  • from suppliers and professional advisers; or

  • from other third parties where this is lawful and appropriate.

Where we obtain personal information from a source other than the individual concerned, we will provide the relevant privacy information required by law, subject to any applicable exception. The ICO requires organisations to explain the categories and source of personal information obtained from another source.

4. How we use personal information

We may use personal information to:

Provide our services

  • provide executive support;

  • provide private-office support;

  • provide operational and administrative support;

  • coordinate travel and related arrangements;

  • manage meetings, schedules and appointments;

  • communicate with clients and contacts;

  • respond to instructions and requests;

  • coordinate with relevant suppliers and service providers; and

  • otherwise perform services agreed with our clients.

Manage client relationships

  • respond to enquiries;

  • prepare proposals and quotations;

  • establish and manage client relationships;

  • administer contracts;

  • manage billing and payments;

  • maintain business records;

  • communicate service updates; and

  • resolve queries, complaints or disputes.

Recruitment

  • identify and source potential candidates;

  • assess candidates against relevant requirements;

  • communicate with candidates;

  • arrange interviews and assessments;

  • obtain references where appropriate;

  • conduct appropriate and lawful background checks;

  • introduce candidates to recruitment clients;

  • manage recruitment processes;

  • communicate recruitment decisions and next steps; and

  • maintain appropriate recruitment records.

Business administration

  • maintain accounting and financial records;

  • obtain professional advice;

  • manage suppliers;

  • protect our systems and information;

  • detect and prevent fraud or misuse;

  • comply with legal and regulatory obligations;

  • establish, exercise or defend legal claims; and

  • manage and improve our business.

Website and communications

  • operate and secure our website;

  • respond to website enquiries;

  • understand how our website is used;

  • improve website functionality and content; and

  • send marketing communications where permitted and, where required, with your consent.

5.Our lawful bases for using personal information

We will only process personal information where we have a lawful basis to do so.

Depending on the circumstances, we may rely on:

Contract

We may process information where it is necessary to enter into or perform a contract with you. For example, this may apply when providing services to a client or managing a contractual relationship.

Legitimate interests

We may process information where it is necessary for our legitimate interests, or those of a third party, provided those interests are not overridden by your rights and interests.

Our legitimate interests may include:

  • operating and developing our business;

  • managing client and business relationships;

  • providing and improving our services;

  • identifying and communicating with prospective clients;

  • carrying out recruitment activities;

  • identifying and assessing candidates;

  • maintaining appropriate business records;

  • protecting our business, systems and information;

  • preventing fraud or misuse; and

  • establishing, exercising or defending legal claims.

Where we rely on legitimate interests, we consider whether the processing is necessary and whether your interests and rights override our legitimate interests.

Legal obligation

We may process personal information where necessary to comply with a legal or regulatory obligation.

This may include accounting, tax, financial, employment or other legal requirements.

Consent

Where required, we may rely on your consent.

For example, this may apply to certain marketing communications or non-essential cookies.

Where we rely on consent, you may withdraw it at any time. Withdrawing consent does not affect the lawfulness of processing carried out before you withdrew your consent.

Vital interests

In limited circumstances, we may process information where necessary to protect someone's vital interests.

6.Special category information

Some information is treated as particularly sensitive under data protection law. This can include information concerning health, racial or ethnic origin, religious beliefs, political opinions, biometric information and other categories defined by law.

Because of the nature of some executive, private-office, travel or recruitment services, we may occasionally receive sensitive information.

We will only process special category information where we have both:

  1. a lawful basis under Article 6 UK GDPR; and

  2. an applicable condition under Article 9 UK GDPR or other relevant law.

Where we do not need sensitive information, please do not provide it to us.

7. Criminal offence information and background checks

Where a recruitment assignment requires appropriate pre-employment checks, we may process information concerning criminal convictions or offences only where the processing is lawful and necessary for the particular circumstances.

We will not routinely request or process criminal offence information without appropriate justification and legal grounds.

Where vetting is undertaken, we will explain the nature and purpose of the checks where appropriate and restrict access to the information to those who need it.

Information obtained solely for vetting purposes will not be retained longer than necessary and will be securely deleted or destroyed when appropriate.

The ICO's guidance states that criminal offence information requires specific legal conditions and that intrusive vetting should be justified and proportionate.

8. Who we share personal information with

We may disclose personal information where necessary and lawful to:

  • clients and prospective employers in connection with recruitment;

  • candidates and referees where appropriate;

  • travel providers and other suppliers needed to provide requested services;

  • professional advisers, including lawyers, accountants and insurers;

  • IT, hosting, communications and cloud-service providers;

  • payment and accounting providers;

  • recruitment platforms and relevant service providers;

  • background or verification providers where appropriate;

  • regulators, government bodies or law-enforcement authorities where legally required;

  • courts or other parties where necessary to establish, exercise or defend legal claims; and

  • other service providers who process information on our behalf.

We require service providers who process personal information for us to handle that information appropriately and in accordance with applicable data protection requirements.

We do not sell personal information.

9. Recruitment clients and candidate information

Where Keystone acts as a recruiter or recruitment consultant, candidate information may be shared with a client where this is necessary and lawful for the recruitment process.

We aim to share only information that is relevant to the particular opportunity.

Candidates should be aware that information included in a CV, application or candidate profile may be provided to a prospective employer or client as part of the recruitment process.

Where appropriate, we will explain how candidate information will be used and shared.

We will not mislead candidates or third parties into providing personal information about a candidate.

10. International transfers

Some of the service providers we use may process personal information outside the United Kingdom.

Where personal information is transferred outside the UK, we will ensure that the transfer is made in accordance with applicable data protection law and that appropriate safeguards are in place where required.

Depending on the circumstances, this may include an adequacy decision, appropriate contractual safeguards or another lawful transfer mechanism.

If you would like further information about relevant international transfers and safeguards, please contact us using the details in section 1.

11. How long we keep personal information

We keep personal information only for as long as reasonably necessary for the purposes for which it was collected, including to satisfy legal, accounting, regulatory or reporting requirements.

Our retention periods vary depending on the type of information and our relationship with you. We securely delete, anonymise or otherwise dispose of information when it is no longer required.

12. Your data protection rights

Depending on the circumstances and applicable law, you may have rights in relation to your personal information, including the right to:

  • request access to your personal information;

  • request correction of inaccurate or incomplete information;

  • request erasure of your personal information;

  • request restriction of processing;

  • object to certain processing;

  • request data portability in applicable circumstances;

  • withdraw consent where we rely on consent; and

  • object to direct marketing.

The availability of these rights depends on the circumstances and the lawful basis on which we process your information.

Your right to object

Where we process your personal information based on legitimate interests, you may have a right to object to that processing.

You also have an absolute right to object to the processing of your personal information for direct marketing purposes.

13. Marketing communications

We may contact you about our services, business developments or other information that may be relevant to you where this is lawful.

Where consent is required, we will ask for it before sending relevant marketing communications.

You can unsubscribe from marketing communications at any time by:

  • using the unsubscribe facility included in the communication; or

  • contacting us directly.

Withdrawing consent or opting out of marketing will not affect other communications that we are entitled or required to send, such as service-related communications.

14. Cookies and similar technologies

Our website may use cookies and similar technologies.

Some cookies are necessary for the website to function properly. Other technologies may be used for analytics, preferences or other purposes.

Where consent is required, we will obtain consent before using non-essential cookies or similar technologies.

You can manage your preferences through our cookie controls where available.

Our use of cookies and similar technologies may be described in more detail in our Cookie Policy.

The ICO states that organisations generally need to tell users what cookies or similar technologies do and obtain consent for non-exempt uses, subject to applicable exceptions.

15. Website security

We take reasonable technical and organisational measures designed to protect personal information against:

  • unauthorised access;

  • accidental loss;

  • destruction;

  • misuse;

  • alteration; and

  • unauthorised disclosure.

However, no method of transmitting or storing information is completely secure.

If we become aware of a personal data breach that requires notification under applicable law, we will take the required steps to investigate, contain and report the breach and, where required, notify affected individuals.

16. Contact Us

For any privacy-related questions, please contact:

Keystone Executive Solution
📧 Email: hello@keystoneexecutivesolutions.com
📍 Address: 45 Albemarle Street, London W1S 4JL