Privacy Policy

From this website. If you use the contact form, we collect the name, firm, role, and message you submit. We do not require an email address through the form; if you email or call us directly, we receive whatever contact details you choose to share. We do not operate site analytics, advertising, or third-party tracking, and we do not set advertising or analytics cookies (see our Cookie Statement).

For rate-limiting and security. When the contact form is submitted, your IP address may be processed transiently to prevent abuse and spam. It is used only as a short-lived rate-limit key and is not used to build a profile of you.

For our search work. In the course of executive search we may collect and hold professional information about candidates — name, contact details, employment and compensation history, CV, references, and notes relevant to a search. This data is typically obtained directly from the candidate, from publicly available professional sources, or from a referral, and is held in our recruitment records.

We use personal data to respond to enquiries, to assess and represent candidates for relevant roles, to advise clients on searches, and to meet our legal and contractual obligations.

For visitors and clients in the UK and EU, our lawful bases under the UK GDPR and EU GDPR are: (a) our legitimate interests in operating a recruitment business and in matching candidates with appropriate roles, balanced against your interests and rights; (b) taking steps at your request prior to entering an engagement; and (c) your consent, where we ask for it (for example, before sharing your profile with a specific firm). You can withdraw consent at any time without affecting prior processing.

We do not sell personal data, and we do not share or disclose personal data for cross-context behavioural advertising.

We share personal data only as needed to do our work and run the site:

• Client firms— a candidate’s profile is shared with a prospective employer only with that candidate’s knowledge and consent, and only where there is a genuine role fit.
• Service providers — our website is hosted on Vercel, and contact-form messages are delivered by email through Resend. These providers process data on our behalf under contractual data-protection terms.
• Legal and regulatory — where we are required to disclose data by law or to establish, exercise, or defend legal claims.

We do not sell or rent personal data to anyone.

Bayes Group operates between New York and Hong Kong and serves clients and candidates across the United States, the United Kingdom, the European Union, Hong Kong, Singapore, and the Gulf. Personal data may therefore be transferred to and processed in countries other than your own, including the United States. Where we transfer data out of the UK, EU, Hong Kong, or Singapore, we rely on appropriate safeguards — such as the relevant standard contractual clauses or an adequacy basis — and we limit transfers to what is necessary for the search or the enquiry.

Contact-form enquiries that do not lead to an engagement are retained only as long as needed to respond and for a reasonable follow-up period, then deleted. Candidate records are retained for as long as you may plausibly be relevant to current or future searches, and are reviewed periodically; we delete or anonymise records that are no longer needed. You can ask us to delete your data at any time (see your rights below).

Depending on where you are, you have rights over your personal data. We honour these requests regardless of jurisdiction:

• Access — a copy of the personal data we hold about you.
• Rectification — correction of inaccurate or incomplete data.
• Erasure — deletion of your data where there is no overriding reason to keep it.
• Portability — your data in a portable format, where applicable.
• Objection and restriction — to object to or restrict certain processing, including processing based on legitimate interests.
• Withdraw consent — where processing relies on your consent.

For visitors covered by the UK GDPR or EU GDPR, you also have the right to lodge a complaint with your supervisory authority (in the UK, the Information Commissioner’s Office). For Hong Kong residents, the Office of the Privacy Commissioner for Personal Data (PCPD) oversees the PDPO; for Singapore residents, the Personal Data Protection Commission (PDPC) oversees the PDPA. California residents have rights under the CCPA/CPRA, including the right to know, delete, and correct, and the right not to receive discriminatory treatment for exercising them — and, because we do not sell or share personal data for behavioural advertising, no “Do Not Sell” action is needed. We do not discriminate against anyone for exercising any of these rights.

The site is served over HTTPS with a strict content-security policy and modern security headers. Personal data we hold for search work is kept on access-controlled systems and shared only on a need-to-know basis. No method of transmission or storage is perfectly secure, but we take reasonable and appropriate measures to protect the data we hold.

This site and our services are directed to finance professionals and are not intended for anyone under 18. We do not knowingly collect data from children.

We may update this policy from time to time. The “last updated” date above reflects the current version. Material changes will be reflected on this page.

To exercise any right, ask a question, or make a privacy request, contact:

Bayes Group
Privacy requests: privacy@bayes-group.com or richard@bayes-group.com
New York · Hong Kong