Privacy Policy

From this website. If you use the contact form, we collect the name, firm, role, purpose and message you submit, and the email address or telephone number you give us (one of the two is required so that we can reply), together with the first page you opened on this site (with its campaign tag, if any) and, where your browser supplies it, the external site that sent you here, so we know which page or search engine brought you to us, and the approximate country of your connection, the device class (phone, tablet or desktop) and the time zone of your connection, so we can tell where and when a note was written. If you email or call us directly, we receive whatever contact details you choose to share. We run cookieless traffic measurement (Vercel Web Analytics) to see which pages are read: for each page view it records the page, the referring site, an approximate location (country, region and city), and the device type, operating system and browser; it sets no cookie and builds no cross-site profile. We run no advertising and no third-party tracking, no other party collects information through this site about your activity across other websites, and we set no cookies of our own (see our Cookie Statement).

Your choice on this website. If your browser sends a Global Privacy Control or Do Not Track signal, we treat it as an objection: page views are not counted, nothing about how you arrived is kept, and an enquiry from you carries no record of how you arrived and no time zone, only a note that they were withheld and why. Anyone can make the same choice for their browser under Privacy Choices, and the contact form works the same either way. For visitors in the European Union, page counting and the note of how you arrived start off, and anyone there can turn them on in the same place.

For rate-limiting and security. When the contact form is submitted, your IP address is used as a short-lived key to limit repeat submissions and prevent abuse, and our hosting provider uses it to estimate the country and time zone shown on your enquiry. The address itself is not added to your enquiry or used to build a profile of you. Our hosting provider also keeps routine request logs, which include IP addresses, for a limited period for security and operations.

For our search work. In the course of executive search we may collect and hold professional information about candidates and about other professionals relevant to a search or to our knowledge of the market: name, contact details, current and past roles, employment and compensation history, CV, references, and notes relevant to a search. This data is typically obtained directly from the person, from publicly available professional sources, from third-party business-data providers, or from a referral, and is held in our recruitment records.

We use personal data to respond to enquiries, to assess and represent candidates for relevant roles, to advise clients on searches, and to meet our legal and contractual obligations.

For visitors and clients in the UK and EU, our lawful bases under the UK GDPR and EU GDPR are: (a) our legitimate interests in operating a recruitment business, in matching candidates with appropriate roles, and in understanding how this website is used and which pages lead people to contact us, balanced against your interests and rights; (b) taking steps at your request prior to entering an engagement; and (c) your consent, where we ask for it (for example, before sharing your profile with a specific firm). You can withdraw consent at any time without affecting prior processing.

We do not sell contact details or databases of personal data, and we do not share or disclose personal data for cross-context behavioural advertising. What we share with client firms is described in section 3.

We share personal data only as needed to do our work and run the site:

• Client firms: a candidate’s profile is shared with a prospective employer only with that candidate’s knowledge and consent, and only where there is a genuine role fit.
• Client firms, for market advice: when we advise a client on a search, our advice can name people in relevant roles and describe their professional background, drawn from public and professional sources. We do not give a client firm anyone’s personal contact details without that person’s agreement.
• Service providers: our website is hosted on Vercel, which also holds a private backup copy of each contact-form message so that none is lost in delivery; contact-form messages are delivered by email through Resend, and our email is hosted by Google. These providers process data on our behalf.
• Recruitment systems and data providers: candidate and client records are held in our own access-controlled recruitment database, and to find or verify professional contact details we may query a third-party business-data provider with a person’s name and firm. We send such a provider only what that lookup needs.
• Legal and regulatory: where we are required to disclose data by law or to establish, exercise, or defend legal claims.

Bayes Group is headquartered in New York, with Hong Kong and London coverage, and serves clients and candidates across the United States, the United Kingdom, the European Union, Hong Kong, Singapore, and the Gulf. Personal data may therefore be transferred to and processed in countries other than your own, including the United States. Where we transfer data out of the UK, EU, Hong Kong, or Singapore, we rely on appropriate safeguards, such as the relevant standard contractual clauses or an adequacy basis, and we limit transfers to what is necessary for the search or the enquiry.

Contact-form enquiries are kept in our email and recruitment records for as long as they may be relevant to a search or to our relationship with the sender, and are reviewed periodically with our other records. The private backup copy held with our website host is deleted within 30 days of the message reaching our inbox. Candidate records are retained for as long as you may plausibly be relevant to current or future searches, and are reviewed periodically; we delete or anonymise records that are no longer needed. You can ask us to delete your data at any time (see your rights below).

Depending on where you are, you have rights over your personal data. We honour these requests regardless of jurisdiction:

• Access: a copy of the personal data we hold about you.
• Rectification: correction of inaccurate or incomplete data.
• Erasure: deletion of your data where there is no overriding reason to keep it.
• Portability: your data in a portable format, where applicable.
• Objection and restriction: to object to or restrict certain processing, including processing based on legitimate interests. For this website’s visit measurement, that is one click under Privacy Choices, or automatic if your browser sends Global Privacy Control or Do Not Track.
• Withdraw consent: where processing relies on your consent.

For visitors covered by the UK GDPR or EU GDPR, you also have the right to lodge a complaint with your supervisory authority (in the UK, the Information Commissioner’s Office). For Hong Kong residents, the Office of the Privacy Commissioner for Personal Data (PCPD) oversees the PDPO; for Singapore residents, the Personal Data Protection Commission (PDPC) oversees the PDPA. For residents of mainland China, the Personal Information Protection Law (PIPL) applies to the personal information we process about you, and the rights above are available to you on request. California residents have rights under the CCPA/CPRA, including the right to know, delete, and correct, and the right not to receive discriminatory treatment for exercising them. We do not share personal data for cross-context behavioural advertising. Wherever you are, a Global Privacy Control or Do Not Track signal from your browser switches off this website’s visit measurement and the note of how you arrived, as described above. If you would rather we did not put you forward or describe you to client firms, write to the privacy address below and we will record it. We do not discriminate against anyone for exercising any of these rights.

The site is served over HTTPS with a restrictive content-security policy and modern security headers. Personal data we hold for search work is kept on access-controlled systems and shared only on a need-to-know basis. No method of transmission or storage is perfectly secure, but we take reasonable and appropriate measures to protect the data we hold.

This site and our services are directed to finance professionals and are not intended for anyone under 18. We do not knowingly collect data from children.

We may update this policy from time to time. The “last updated” date above reflects the current version. Material changes will be reflected on this page.

To exercise any right, including your right to see and correct the personal data we hold about you, or to ask a question, contact our data protection officer, who handles all privacy requests, at the address below. The same officer acts for the purposes of the Singapore PDPA.

Bayes Group
Privacy requests: privacy@bayes-group.com or richard@bayes-group.com
New York headquarters · Hong Kong and London coverage