Privacy Notice

Lusso Consulting Group Ltd, trading as Lusso Consulting Group / Lusso Search / Lusso Advisory / Lusso Transactions or Lusso, is a company registered in England and Wales under company number 14056387.

For the purposes of UK data-protection law, Lusso is the data controller of the personal information described in this Privacy Notice unless we expressly state otherwise.

Our business operates across three principal areas:

• —SEARCH — recruitment, executive search and candidate representation.
• —ADVISORY — commercial, strategic, leadership and organisational advisory services.
• —TRANSACTIONS — introductions and advisory support relating to the acquisition, sale, investment in or other transaction involving recruitment businesses.

References in this notice to “Lusso”, “we”, “us” or “our” mean the relevant Lusso business acting as controller of your personal information.

This notice may apply to you if you are:

• —a candidate, prospective candidate or individual having a career conversation with Lusso;
• —a client, prospective client or someone working for or representing one;
• —a business owner, director, shareholder or employee;
• —a seller or prospective seller of a business;
• —a buyer, prospective buyer or investor;
• —associated with a business that may be relevant to a potential Transaction;
• —a professional adviser or other participant in a Transaction;
• —someone whose information is relevant to an Advisory engagement;
• —a supplier, consultant or professional adviser to Lusso;
• —a referee or other professional contact;
• —a visitor to our website;
• —someone who contacts us, books a meeting, attends an event or subscribes to Field Notes or another Lusso communication.

Employees and workers of Lusso may be covered by separate internal privacy information.

The information we collect depends upon your relationship with Lusso and the reason we are dealing with you.

It may include:

• —Identity and contact information — such as your name, title, business and personal contact details and professional location.
• —Professional information — including your employer, role, responsibilities, career history, experience, qualifications, skills, professional interests, LinkedIn or other professional profile and professional relationships.
• —Recruitment information — including your CV, remuneration and benefits, commission arrangements, notice period, performance or billing information, career aspirations, reasons for considering a move, working preferences, location preferences, previous applications or approaches, interview availability, interview feedback and offer information.
• —Client and vacancy information — including your role within an organisation, hiring requirements, team structure, remuneration arrangements, vacancies, recruitment plans and communications with Lusso.
• —Advisory information — including information relevant to the commercial or organisational issue on which Lusso has been engaged, which may include information concerning directors, employees, contractors, teams, roles, remuneration, performance, business structure, succession or organisational change.
• —Transaction information — including your professional role, ownership or shareholding, business interests, acquisition or disposal preferences, proposed involvement following a Transaction, communications with Lusso and information relevant to assessing, introducing, progressing or completing a potential Transaction.
• —Communications and relationship information — including emails, correspondence, meeting notes, records of conversations and your history of interaction with Lusso.
• —Website and marketing information — including enquiries, meeting bookings, newsletter or Field Notes subscriptions, marketing preferences and information generated through your interaction with our website and communications.
• —Financial and administrative information — where necessary for invoicing, payments, credit control or other legitimate business administration.

We aim to collect only information that is relevant and proportionate to the purpose for which it is required.

We may obtain personal information directly from you, including when you:

• —speak or correspond with Richard or another representative of Lusso;
• —attend a Discovery, Blueprint, Advisory or Transaction meeting;
• —provide a CV or professional profile;
• —apply for or discuss an opportunity;
• —instruct Lusso;
• —make a business enquiry;
• —provide information in connection with an Advisory or Transaction engagement;
• —complete a website form;
• —book a meeting;
• —subscribe to Field Notes or other communications; or
• —otherwise interact with us.

We may also obtain information from legitimate third-party or publicly available sources, including:

• —LinkedIn and other professional networking platforms;
• —employer and company websites;
• —Companies House and other public corporate records;
• —recruitment platforms and job boards;
• —industry directories and databases;
• —publicly available professional information;
• —clients, candidates and professional contacts;
• —business owners, shareholders and directors;
• —counterparties and potential counterparties;
• —professional advisers;
• —referees;
• —suppliers and service providers; and
• —other people within your organisation or professional network where relevant to the Services we provide.

Where we obtain your personal information from someone other than you, we will provide privacy information where required by law. UK GDPR transparency requirements can require this within a reasonable period and generally no later than one month, or earlier where we communicate with the individual or disclose their data, subject to applicable exemptions.

Lusso works with both active candidates and people who are not actively looking for a new role but may be prepared to consider the right opportunity.

We may process candidate information to:

• —understand your career history, experience and results;
• —understand where you are now and what you may want next;
• —assess how your profile and expectations align with the market;
• —discuss potential career opportunities;
• —provide market and career insight;
• —create or improve a professional profile or CV with you;
• —identify businesses or opportunities that may align with your objectives;
• —agree a potential market approach;
• —introduce or represent you to prospective employers;
• —arrange and prepare you for interviews;
• —obtain and provide feedback;
• —assist with remuneration and offer negotiations;
• —maintain an appropriate professional relationship with you;
• —understand your future availability and aspirations;
• —identify other people who may potentially benefit from Lusso's services;
• —maintain records of introductions and recruitment activity;
• —administer and protect our business and contractual rights; and
• —comply with legal and regulatory obligations.

Your confidentiality

We recognise that career conversations are often highly confidential.

Lusso does not ordinarily disclose an identifiable candidate profile or CV to a prospective employer without the candidate's knowledge or agreement.

Where we agree to represent you in the market, our intention is to make controlled, purposeful approaches rather than circulate your information speculatively.

We may use genuinely anonymised candidate information to illustrate the type of talent available in a market, provided that the information does not identify you or make you reasonably identifiable.

We may process information about existing and prospective clients and their representatives to:

• —understand recruitment requirements;
• —assess whether Lusso can realistically assist;
• —provide market intelligence and initial advice;
• —evaluate the attractiveness and viability of an employment proposition;
• —agree and administer Terms of Business;
• —undertake Vacancy Blueprint and other briefing meetings;
• —identify, assess and introduce potential candidates;
• —arrange interviews and manage feedback;
• —assist with offers and negotiations;
• —provide Advisory or Transaction Services;
• —manage our commercial relationship;
• —issue and administer invoices;
• —maintain records of introductions and Services supplied;
• —communicate relevant Lusso services, insights or opportunities; and
• —establish, exercise or defend contractual and legal rights.

We may hold information about prospective clients before a formal contractual relationship exists where there is a legitimate business reason for doing so.

During an Advisory engagement, Lusso may receive information concerning individuals who have not themselves instructed Lusso.

For example, an owner or director may discuss organisational structure, leadership, performance, remuneration, retention, succession, recruitment or other issues involving employees, directors or contractors.

We may process relevant personal information where this is reasonably necessary to understand the issue, provide commercial advice, formulate recommendations or perform the agreed Advisory Services.

This may include information concerning an individual's:

• —role and responsibilities;
• —professional experience;
• —reporting relationships;
• —remuneration;
• —performance;
• —professional behaviour or working relationships; and
• —proposed future role within an organisation.

We ask Advisory clients not to provide unnecessary personal or sensitive information and to limit information supplied to what is reasonably required for the engagement.

Information obtained through an Advisory engagement will be treated as confidential and used only for legitimate purposes connected with that engagement, our business administration, legal obligations and protection of our legal rights.

Transaction conversations are frequently confidential long before a business is formally offered for sale or an acquisition becomes public.

Where you are involved in, considering or connected with a potential Transaction, we may process information including:

• —your identity and professional role;
• —ownership or shareholding;
• —business interests;
• —acquisition, investment or disposal preferences;
• —preferred Transaction structures;
• —your intended future involvement with a business;
• —communications and meetings with Lusso;
• —your relationship with a relevant business;
• —information relevant to identifying or assessing potential counterparties; and
• —information relevant to introducing, progressing or completing a Transaction.

We may receive this information directly from you or from companies, shareholders, directors, prospective counterparties, professional advisers, public corporate records, professional networking platforms and other legitimate business sources.

We use Transaction information to:

• —understand potential seller, buyer or investor objectives;
• —identify possible acquisition, sale, investment, merger or partnership opportunities;
• —assess potential alignment between parties;
• —prepare agreed Transaction or marketing materials;
• —identify and research potential counterparties;
• —make confidential introductions;
• —facilitate conversations;
• —support the commercial progression of a Transaction;
• —administer Transaction mandates and fees; and
• —establish, exercise or defend our contractual and legal rights.

Transaction confidentiality

We treat identifiable Transaction information as confidential.

Where appropriate, an opportunity may initially be discussed or marketed on an anonymised basis.

We will disclose identifiable information to prospective counterparties only where this is appropriate to the Transaction and consistent with the authority or instructions under which we are acting.

Lusso does not sell personal information as a commodity.

UK data-protection law requires us to have a lawful basis for processing personal information. The appropriate basis depends upon the circumstances and purpose.

We principally rely upon:

Legitimate interests

We may process information where this is necessary for our legitimate business interests, or those of a third party, provided those interests are not overridden by your rights and interests.

Those legitimate interests may include:

• —providing recruitment and executive Search Services;
• —identifying and communicating with relevant candidates;
• —representing candidates in the employment market;
• —identifying and communicating with prospective clients;
• —understanding recruitment markets and professional networks;
• —providing Advisory Services;
• —identifying and facilitating potential Transactions;
• —developing and maintaining professional relationships;
• —operating, developing and protecting our business;
• —maintaining accurate business records;
• —preventing fraud or misuse of our Services; and
• —appropriate business-to-business marketing.

Where we rely on legitimate interests, we consider the necessity and proportionality of the processing and its potential impact on individuals.

Contract

We may process information where necessary to:

• —take steps at your request before entering into a contract; or
• —perform a contract with you.

Legal obligation

We may process information where necessary to comply with a legal or regulatory obligation.

Consent

In some circumstances we may ask for your consent.

Where we rely on consent, you may withdraw it at any time. Withdrawal does not affect the lawfulness of processing carried out before consent was withdrawn.

The ICO requires privacy information to explain both the purposes of processing and the applicable lawful bases, including the interests being pursued where legitimate interests are relied upon.

Lusso does not routinely seek or require special-category personal information or criminal-offence information.

Special-category information includes certain information concerning health, racial or ethnic origin, religious or philosophical beliefs, political opinions, trade-union membership, genetic or biometric identification data and information concerning a person's sex life or sexual orientation.

There may be limited circumstances where information of this nature is relevant — for example, where you voluntarily tell us about a reasonable adjustment required during a recruitment process.

Where we need to process special-category or criminal-offence information, we will do so only where there is an appropriate lawful basis and any additional legal condition required by UK data-protection legislation.

We will not retain sensitive information simply because it has been disclosed to us if we have no legitimate reason to do so.

Depending upon the Services concerned, we may share appropriate personal information with:

• —prospective or existing clients;
• —candidates;
• —buyers, sellers, investors and prospective Transaction counterparties;
• —businesses involved in a potential Transaction;
• —authorised representatives of those organisations;
• —professional advisers including solicitors, accountants, tax advisers and corporate-finance advisers;
• —referees and background-checking providers where appropriate;
• —technology, CRM, communications, website, hosting, cloud-storage and other service providers;
• —independent consultants and subcontractors working with Lusso;
• —insurers;
• —payment, accounting and financial-administration providers;
• —regulators, courts, law-enforcement bodies, government agencies or other authorities where required or permitted by law; and
• —another organisation in connection with a genuine sale, acquisition, merger or reorganisation of Lusso's own business.

We disclose only information reasonably required for the relevant purpose.

Where a third party processes personal information on our behalf, we require appropriate contractual and security arrangements.

Lusso is based in the United Kingdom, but some of our technology and service providers may process or store information outside the UK.

Our Search and Transaction work may also involve organisations or individuals outside the UK.

Where personal information is transferred internationally, we will ensure that the transfer is made in accordance with applicable UK data-protection law. Depending upon the destination and circumstances, this may include relying upon UK adequacy regulations or using an appropriate transfer mechanism and safeguards required by UK law.

Where required, we will undertake any necessary transfer-risk assessment and implement additional safeguards.

When you use our website, contact us or book a meeting, we may process information such as:

• —your name;
• —contact information;
• —company and role;
• —information entered into an enquiry or booking form;
• —meeting preferences;
• —correspondence with us; and
• —technical information relating to your interaction with the website where collected.

We use this information to respond to enquiries, arrange meetings, provide requested Services, administer our website and maintain appropriate business records.

Third-party booking, communications or calendar services may process information in accordance with their own privacy terms and our arrangements with them.

If you subscribe to Field Notes, another Lusso newsletter or request updates, we may use your contact information to send those communications.

We may also send relevant professional or business communications where permitted by law and where we have an appropriate lawful basis.

Depending upon the recipient and method of communication, UK electronic-marketing rules may require consent. We will obtain it where required.

You have the right to object to direct marketing at any time.

You can unsubscribe using the link contained in an email where available or contact us directly.

If you unsubscribe, we may retain limited information on a suppression list so that we can respect your preference and avoid inadvertently contacting you again for marketing purposes.

The ICO confirms that individuals have an absolute right to object to direct marketing, and organisations must respect that preference.

We will not automatically add someone to Field Notes simply because they make an enquiry, book a meeting or become a candidate or client unless we have an appropriate legal basis to do so. Transparency about marketing use is required when contact information is collected.

Our website may use cookies and similar technologies necessary for its operation and, where applicable, for analytics, functionality or other purposes.

Where UK law requires consent for non-essential cookies or similar technologies, we will request that consent before using them.

Further details about the technologies actually used on the Lusso website, their purposes and how you can manage your preferences should be provided through our Cookie Notice and cookie preference controls.

We use appropriate technical and organisational measures designed to protect personal information against accidental or unlawful loss, alteration, disclosure, destruction or unauthorised access.

Access to personal information is limited to people and service providers who have a legitimate business need for it.

Those handling information on our behalf are required to treat it appropriately and confidentially.

We maintain procedures for dealing with suspected personal-data breaches and will notify affected individuals and the Information Commissioner's Office where required by law.

We keep personal information only for as long as reasonably necessary for the purpose for which it was collected and for legitimate legal, regulatory, contractual, accounting and business-record purposes.

For candidate and professional relationship information, our general working retention period is two years from our last substantive contact with you, after which we will review whether there remains a legitimate reason to retain it.

A new substantive conversation or active engagement with Lusso may restart that period.

Certain records may need to be retained for longer. For example, records relevant to contracts, fees, Transactions, accounting, taxation, compliance or actual or potential legal claims may ordinarily be retained for up to six years after the relevant relationship or transaction, or longer where required or justified by law.

Transaction records may need to be retained for an appropriate period following completion or termination to protect the legitimate interests and legal rights of the parties and Lusso.

When determining retention periods we consider:

• —why the information was collected;
• —whether it remains necessary;
• —the nature and sensitivity of the information;
• —applicable legal and contractual requirements;
• —limitation periods;
• —potential disputes or claims; and
• —the risk associated with retaining or deleting it.

Where appropriate, information may instead be securely anonymised so that it can no longer identify an individual.

Lusso may use software and technology to assist with activities such as administration, research, organisation, scheduling, drafting, analysis and maintaining business records.

Technology may support Richard and Lusso in carrying out their work, but we do not make solely automated decisions about individuals that produce legal or similarly significant effects without meaningful human involvement.

Recruitment recommendations, candidate representation, Advisory judgements and decisions about whether Lusso believes a Transaction or introduction is appropriate involve human judgement.

If this changes materially, we will update this Privacy Notice and provide any additional information required by law. The ICO requires organisations to tell individuals where solely automated decision-making with legal or similarly significant effects takes place.

Depending upon the circumstances and the lawful basis on which we process your information, you may have the right to:

• —access personal information we hold about you;
• —correct inaccurate or incomplete information;
• —request erasure of your personal information;
• —request restriction of processing;
• —object to processing based upon legitimate interests;
• —object to direct marketing at any time;
• —request data portability where the legal conditions for that right apply;
• —withdraw consent where processing is based upon consent; and
• —raise concerns about how we use your personal information.

These rights are not absolute and exemptions may apply.

For example, we may need to retain certain information despite an erasure request where it is necessary to comply with law or to establish, exercise or defend legal claims.

We may ask for reasonable information to verify your identity before responding to a request. This is to ensure that personal information is not disclosed to someone who is not entitled to receive it.

We will respond to valid requests within the time required by applicable law.

The right to object is particularly important where processing relies on legitimate interests or is used for direct marketing, and we will respect that right in accordance with applicable law.

If you have concerns about the way Lusso has handled your personal information, we would appreciate the opportunity to address them directly.

You also have the right to complain to the UK's data-protection regulator:

Information Commissioner's Office (ICO)

You do not have to contact Lusso before making a complaint to the ICO.

Please tell us if information we hold about you materially changes or you believe it is inaccurate.

In recruitment and Transaction work in particular, circumstances can change quickly, and accurate information helps us avoid inappropriate or unwanted approaches.

We may update this Privacy Notice from time to time to reflect changes in our Services, technology, business practices or applicable law.

The latest version will be published on our website with the date it was last updated.

Where a change materially affects the way we use existing personal information, we will take reasonable steps to bring that change to the attention of affected individuals where required.

Current ICO guidance emphasises that privacy notices should be kept under review and that material new uses of personal information should be brought to individuals' attention before the new processing begins.

If you have a question about this Privacy Notice, want to exercise a data-protection right or have concerns about how your information is being handled, please contact:

Data Protection Manager

Lusso Consulting Group

Telephone: 0208 050 6504

Email: hello@lussoconsultinggroup.com

Correspondence:

Data Protection Manager

Lusso Consulting Group

6-7 St Mary At Hill, London,

England, EC3R 8EE