AAA GLOBAL
Privacy Notice
How we collect, use, share and delete personal data about candidates, clients and our other contacts.
1 Who we are
1.1 AAA Global, is a specialist recruitment business working in quantitative and discretionary finance. We are the controller of the personal data described in this notice.
1.2 For anything to do with your personal data, including any of the requests in section 12, contact our Data Protection Lead.
Contact Detail
Data Protection Lead Hugo Aiken
Email hugo@aaaglobal.co.uk
Telephone 020 7887 6265
Post Data Protection Lead, AAA Global, Office G01, 118 Piccadilly, Mayfair, London W1J 7NW
2 What this notice covers
2.1 This notice covers all personal data we hold about you, however we obtained it — through our website, by speaking to you, from a CV you sent us, or from research we carried out ourselves.
2.2 It applies whether you are a candidate, a prospective candidate we have identified but not yet spoken to, a contact at a client or prospective client, a referee, or a supplier.
2.3 Using our website does not amount to your agreement to this notice, and this notice is not a contract. It is information we are required to give you, and giving it does not depend on you accepting anything.
3 The personal data we hold
3.1 If you are a candidate or prospective candidate
– Your name, contact details and location.
– Your CV, and everything in it.
– Your employment history, job titles, qualifications and professional track record.
– Your current and expected compensation, your notice period, and your reasons for considering a move.
– Your right to work and, where a placement requires it, your immigration status.
– Any restrictions on you, such as a non-compete.
– Notes of our calls and meetings with you, our assessment of your suitability for particular roles, and records of CVs sent, interviews, offers and placements.
– Correspondence with you, including email.
– References, where you have asked us to take them.
– Where we found you — for example a referral, an application, or a public professional profile.
3.2 If you are a client or prospective client contact
– Your name, job title, employer and business contact details.
– Records of our calls, meetings, mandates and terms.
– Notes on our working relationship with you.
3.3 If you visit our office
– Reception records, and building access records where the building operates them.
4 Where we get it
4.1 Most often, from you — when you send us your CV, speak to us, or fill in a form.
4.2 Where you are a candidate we have identified ourselves, we may also collect information from: public professional profiles such as LinkedIn; employer and fund websites; reputable news and industry sources; specialist market data providers; and referrals from people who know your work.
4.3 From referees, former colleagues or education providers, where you have asked us to approach them.
4.4 If we have found you rather than the other way round, we will tell you where we got your details when we first contact you, and we will send you a link to this notice.
5 Why we use it, and our lawful basis
What we do — Why — Lawful basis
Hold your profile and match it against roles
This is what a recruitment business is. Being on our database is how you hear about roles that are not advertised.
Our legitimate interests, and yours
Contact you about a role
To find out whether it is of interest and whether you are a fit.
Our legitimate interests, and yours
Send your CV to a client
To put you forward for a role. Your agreement, recorded before we send it. We never send a CV without it.
Manage a placement and invoice for it
To deliver the service and get paid.
Performance of a contract, and our legitimate interests
Right-to-work and similar checks
Because the law requires them.
Legal obligation
Keep in touch with client contacts
To run the client relationship.
Our legitimate interests
Send you market reports, event invitations and similar
To keep you informed about the market you work in.
Our legitimate interests for business contacts, with an opt-out on every message. Your consent where the law requires it.
Keep records of what we did and when
To run the business, and to defend or bring legal claims.
Our legitimate interests, and legal obligation
5.1 Where we rely on our legitimate interests, we have considered whether what we are doing is fair to you and whether it overrides your rights. You can ask us for that assessment, and you can object — see section 12.
5.2 Where we rely on your consent, you can withdraw it at any time, and it is as easy to withdraw as it was to give.
6 Special category data
6.1 Special category data means information about health, racial or ethnic origin, religion, political opinions, trade union membership, sex life or sexual orientation, genetic and biometric data, and criminal offence data.
6.2 We do not ask for any of it, and our systems have no field for it. Our people are instructed never to record it.
6.3 However, a CV is stored exactly as you wrote it. If your CV includes a date of birth, a photograph, your nationality, a health disclosure or anything else in these categories, we will be holding it because you sent it to us. We would rather you did not include it, and it plays no part in how we assess you.
6.4 Where a client's process lawfully requires diversity information, we collect it separately, with your explicit consent, and it is held apart from your profile.
7 Automated and AI-assisted processing
7.1 When a CV is uploaded to our database, it is sent to an automated service provided by Google, which reads it and extracts structured details such as your name, contact details, current employer and job title. This happens automatically, at the point of upload.
7.2 We also use automated matching to suggest which candidates on our database may be relevant to a role.
7.3 Neither of these makes a decision about you. No candidate is rejected, ranked or excluded by a system. A person reads your profile and decides, every time, and you are entitled to ask us to explain any decision that affected you.
7.4 If you would prefer your CV not to be processed this way, tell us and we will handle your record manually.
8 Who we share it with
8.1 Clients. We share your details with a client only to put you forward for a role, and only once you have agreed to that specific submission. Our clients decide for themselves how they then use your data, and their own privacy notices govern that.
8.2 Suppliers who process data on our behalf. These include the providers who host our systems, our email and document platform, and the service described in section 7. They act only on our instructions and are bound by written contracts requiring them to protect your data.
8.3 Referees, where you have asked us to approach them.
8.4 Law enforcement and regulators, where we are legally required to disclose.
8.5 A buyer or investor, if we sell or restructure the business. Information is anonymised where possible, and the recipient is bound by confidentiality obligations.
8.6 We do not sell personal data, and we never have.
9 Where your data goes
9.1 Our offices in London, Amsterdam, Mumbai, Gurgaon, Hong Kong and Dubai work from the same candidate database. Colleagues in any of them may see your record if it is relevant to work they are doing. Access is limited by role, so people see what their work requires.
10 How long we keep it
10.1 We keep personal data only as long as we have a genuine need for it. Recruitment relationships are long-term, and knowing your history helps us bring you the right roles — but keeping data indefinitely is not lawful and is not our policy.
What — How long
Candidate records where we have actually engaged — a call, a submission, an interview
6 years from our last meaningful contact with you
Records of candidates we identified but never spoke to
2 years from when the record was created, then deleted or anonymised
Placement records, contracts and invoices
7 years from the end of the placement, for tax and accounting
Right-to-work and identity documents
Only as long as the law requires for that placement
Diversity information
12 months, then deleted or anonymised
A record that you asked us to stop contacting you
Indefinitely, and kept to the minimum needed — we have to remember that you asked
Client contact records
The length of the relationship, then 6 years
10.2 When a period ends we delete the data, or anonymise it so that it can no longer be linked to you.
11 How we protect it
11.1 Access to our systems requires a named individual account. Permissions are set by role, so people can reach only what their work requires.
11.2 Our staff are bound by confidentiality obligations that continue after they leave, and taking candidate or client data on leaving is a disciplinary matter.
11.3 We keep our security arrangements under review and improve them as our systems develop.
11.4 No system is perfectly secure, and information sent over the internet always carries some risk. If a breach happens that is likely to put you at risk, we will tell you.
12 Your rights
12.1 You have the following rights over your personal data. They are free to exercise, and asking will never count against you.
Right — What it means
Access
Ask what we hold about you and get a copy of it, including our notes.
Rectification
Ask us to correct anything inaccurate or incomplete.
Erasure
Ask us to delete your data. We will, unless we have to keep something — for example for a legal claim, for invoicing, or to remember that you asked us to stop contacting you. We will tell you what we kept and why.
Objection
Object to our using your data where we rely on legitimate interests. For marketing, this right is absolute and we will stop immediately.
Restriction
Ask us to pause using your data while something is being resolved.
Portability
Ask for the data you gave us in a portable format.
Withdraw consent
Where we rely on your consent, withdraw it at any time.
12.2 You do not need to use any particular form of words. An email saying “what do you have on me?” or “please delete my details” is a valid request.
12.3 We will respond within one month. If a request is complex we may take up to two further months, and we will tell you within the first month if that applies and why.
12.4 We may ask you to confirm your identity before we release anything, and we will keep that proportionate — usually replying to the address we already hold for you is enough.
12.5 There is no charge. We may charge a reasonable fee, or decline, only where a request is manifestly unfounded or excessive, and we will explain if we do.
13 Complaints
13.1 If you are unhappy with how we have handled your data, tell our Data Protection Lead first. We would rather put it right.
13.2 You also have the right to complain to the Information Commissioner's Office, the UK's data protection regulator, at ico.org.uk or on 0303 123 1113. You do not have to come to us first.
13.3 If you are in the European Economic Area you may instead complain to your own national data protection authority.
14 Cookies
14.1 Our website uses cookies that are necessary for it to work. Where we set any cookie that is not strictly necessary — for analytics, for example — we ask your permission first, and you can withdraw it at any time through the cookie settings on the site.
15 Changes to this notice
15.1 We review this notice at least once a year, and whenever our systems or suppliers change materially.
15.2 The current version is always on our website, with the date it took effect. Where a change materially affects how we use your data, we will tell those we hold contact details for.