First+Third Consulting

What Personal Data Do We Collect? First and Third Consulting is a management consulting firm specializing in organizational effectiveness and HR advisory services, and which handles a variety of personal data necessary to provide such services (please see a list of our services here). The type of information collected depends on the specific project our organization has with you. Client If you are a First and Third Consulting client, data collected will typically comprise your contact details (such as name, telephone number, address, email address, job title, and business record related to the services). Reference If you provide a personal reference or feedback for an individual (depending on the circumstances we may classify you as a Reference), we may collect and process your name, contact details, certain professional and employment details (such as title, occupation, qualifications and employment history), references and feedback, and your connection to the individual. We may collect this information directly from you, the individual, or publicly available sources. Any reference or feedback you provide about an individual would not be attributed to you if shared with third parties unless you allow us to do so. Candidate / Participant The categories of personal data we collect may include the following information and identifiers of individuals: name, contact information (e-mail address, address, telephone number), professional experience, individual capabilities, qualifications, peer reviews, competencies, and interview notes. This data may be obtained directly from you, through publicly available sources, your professional networking profile, news reports, and/or third parties such as our clients, professional partners, references, and/or our authorized background check/verification providers. If you are an executive search candidate, in addition to the information listed above, we may collect information regarding your education history, languages, social activities, compensation details (where permitted by applicable legislation), information relating to references, offer letters, identification data (civil/marital status, gender, nationality), and contact history. To align our processes with our commitment to ensuring equal opportunities, we may collect information about you (in the appropriate circumstances and in accordance with applicable local law) which may be classified as diversity information (or protected legal characteristics under federal law), such as your racial or ethnic background, gender, disability, age, sexual orientation, religion or beliefs, and/or socioeconomic background. Additionally, as some of our clients may be subject to employment diversity requirements, First and Third Consulting may be required to share such information insofar as it pertains to the assignment you are a part of. Providing this additional information is voluntary and declining to do so will not affect any assessment or search. How Do We Use Your Personal Data? We will process your personal data in the context of providing our Services and maintaining our business relationship with you. This may include contacting you about an assignment, verifying profile details, identifying, assessing and evaluating individuals, and/or presenting our insights, analysis or reports to our clients. We may also use the data in circumstances such as the following: as part of a press check or background check, including: verification of educational or professional credentials; to help support and improve our business operations (e.g. interview transcription (if applicable), audit procedures, security processes, document storage, maintenance of our systems and infrastructure, data analytics, benchmarking, statistics, creating knowledge pieces, determining the effectiveness of our Services); to share marketing and promotional materials (e.g., intellectual capital, thought leadership pieces, etc.); to invite you to an industry and/or role-specific event (e.g., forum, charity event, etc.); to work with partners, sponsors and vendors, including third-party travel agencies; maintaining business records, including those related to our Services; to exercise our legal rights, protect your interests, or as required by applicable law. We strive to ensure that your personal data is accurate, complete, and current. Your data will only be used in a way that is compatible with its intended use and will not be processed in any way that is contrary to what is outlined in this policy. We will not sell your personal data. What is our Legal Basis for Processing your Personal Data? First and Third Consulting’s legal basis for processing your personal data in the context of providing its services will depend on the personal information and processing activity involved and the specific context in which it was obtained. This can be: our legitimate business interest, provided the processing of such information is not overridden by your own interests or your fundamental rights and freedoms. For example: managing, operating or promoting our business, building and maintaining relationships with you, our clients and vendors, analyzing and improving our Services, managing our IT systems (including audits); your consent, where required by applicable law. For example: for background checks, for any potentially sensitive information that may come to light during interviews, for employment diversity requirements, for recorded interview sessions; or our compliance with legal and regulatory requirements under applicable laws such as: keeping records for tax purposes or for accounting, or providing information to public authorities. Where the Personal Data is Held and How It Is Transferred? Personal information is held on First and Third Consulting’s secure proprietary database, which is accessible to First and Third Consulting office. In order to guarantee that the appropriate and suitable safeguards for the protection of your personal data are in place First and Third Consulting may, in the course of its business, transfer your information to clients, partners, or approved third-party providers or vendors (such as background check providers, or travel/catering related service providers) in the context of the activities outlined in this policy. We may disclose personal information where required by law or in connection with any legal claims, subpoenas, warrants or other governmental/regulatory/judicial requests. If First and Third Consulting receives a lawful access request from a third-country authority, our best efforts will be made to use all legal, technical, organizational, and supplementary measures available to limit the data that can be accessed in order to support the protection of your rights. We may disclose data where necessary to exercise, establish, or defend our legal rights, or to protect your vital interests or those of any other person. Information Security and Integrity. First and Third Consulting has implemented appropriate legal, physical, organizational, and technical security measures and procedures to safeguard personal information collected, ensure its proper use and prevent against accidental loss, unauthorized access, or unlawful processing. These measures are periodically reviewed and updated to remain aligned with legal and technological developments. Such measures include but are not limited to contractual provisions (e.g., Standard Contractual Clauses, standardized data protection clauses), encryption, logical separation, and access security. How Long Do We Retain Your Personal Data? First and Third Consulting will retain your personal data for as long as the data is needed in connection with the purposes for which it is being processed and depending on the nature of our relationship with you. Specifically, we will retain personal data for as long as we have your consent or a legitimate interest to do so. We may also be required to retain certain personal information (i) for our business records (ii) to show that we have fulfilled our obligations towards relevant parties such as our clients and candidates, or to continue meeting any of our obligations once we have completed an assignment in which you may have been involved in, (iii) for us to be able to establish, exercise or defend our legal rights, or (iv) to otherwise comply with our legal obligations. Once the need to retain your data has expired, we will delete or anonymize it in accordance with data minimization principles. If this is not possible at the time, (for example, because your personal information has been stored in backup archives) then we will securely store your personal information and isolate it from any further processing until deletion is possible.