Privacy Policy

Last updated: 23 October 2026

This notice explains what personal data Lechley Associates collects through this website and in the course of its executive search work, why, what happens to it, how long it is kept and what your rights are. It is written to meet the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations (PECR).

Who I am

Lechley Associates Limited is a UK executive search and talent advisory firm for construction and infrastructure. I am Scott Lechley, and I run it myself. Lechley Associates Limited is the controller of the personal data described in this notice; where this notice says "I" or "me", it means the firm.

For anything to do with your personal data, including any of the rights below, email me at scott@lechley.com. There is no separate data protection officer: I deal with every request personally.

What I collect and why

When you send an enquiry

The contact form asks for your name, email address and message, and optionally your company, phone number and LinkedIn profile URL. I use these to reply to you and, if it becomes a working relationship, to keep a record of it. The enquiry is stored in the website's database and emailed to me so I can answer it.

When you apply for a role

The application form asks for your name, email address, phone number and CV, and optionally your LinkedIn profile URL and a message. I use these to consider you for the role you applied for and, if you agree, for other suitable roles. The application and CV are stored in the website's database and file storage, emailed to me with the CV attached, and added to Atlas, the recruitment system in which I keep candidate records. A CV holds whatever you choose to put in it; please leave out details I do not need, such as your date of birth, a photograph or health information.

When you subscribe to The Lechley Brief

The signup form takes your email address only. It is passed to Kit, the service that sends The Lechley Brief each Monday, and used for nothing else. Every issue has an unsubscribe link.

When you use the chat

The chat at the foot of each page is answered by an AI assistant, provided by Anthropic, which works only from what is published on this site. What you type, the page you started on, your IP address and browser type are stored in the website's database, and I can read the conversation. If you ask to speak to me, or agree to your details being passed on, the conversation is also sent to my business Slack so I can reply, and your name, contact details and a summary are added to Atlas. Please do not put anything sensitive in the chat that you would not put in an email.

When you book a call

The booking calendar on the contact page is provided by Cal.com. If you book a call, Cal.com collects the name, email address and any notes you give it, and passes them to me so the call can take place.

If you are invited to a Search Room

People in a live search may be invited to a private Search Room on this site. You sign in with your email address, using a one-time link emailed to you. Inside, you can see the search you are part of and send messages and documents to me. Your sign-in, messages and documents are stored in the website's database and file storage and copied to your record in Atlas.

Information from elsewhere

Executive search means approaching people who have not applied. To do that I use information that is professionally public, such as LinkedIn profiles, company websites and industry press, along with professional contact data providers and introductions from people who know you. If I hold information about you that you did not give me, I will tell you so the first time I contact you, and you can ask me to stop at any time.

Spam protection and security

Every form on this site is protected by Cloudflare Turnstile, which checks that a person rather than a script is submitting it. Turnstile processes technical information about your browser and device to do so. With each enquiry, application and Search Room message the site also records your IP address and browser type, to deal with abuse and to investigate problems.

How visitors use the site

Only if you accept analytics cookies, the site uses Google Analytics to show which pages are read and how people find them. It records information such as the pages you visit, roughly where you are (to the level of town or region), and the device and browser you use. I do not use it to identify you, and no advertising features are switched on. If you reject analytics cookies, Google Analytics does not load. See Cookies below.

Comments on insights

Comments under the insight pieces are provided by Replybox. If you post a comment, Replybox processes the name and email address you sign in with and the comment itself, which is published under your name.

Lawful bases

UK GDPR requires a lawful basis for each use of personal data. Mine are:

Legitimate interests for recruitment and business contact: replying to enquiries, considering applicants, approaching and assessing people for retained searches, keeping candidate and client records, running the Search Room, and protecting the site from spam and abuse. My interest is in running an executive search business, and yours is usually in hearing about roles and being considered for them. I have weighed these against your privacy, and you can object at any time (see Your rights).
Steps before a contract, where you ask me about a search for your organisation, or ask me to represent you to a client.
Contract, where I am working for a client under agreed terms.
Consent for The Lechley Brief and for analytics cookies. You can withdraw it at any time: by unsubscribing from the Brief, or through the "Cookie settings" link at the foot of every page.
Legal obligation, for the business and tax records the law requires the firm to keep.

How long it is kept

Candidate records (applications, CVs, Search Room messages and documents, and profiles built from other sources) are kept while they are relevant to your career and to the searches I run. I review them at least every two years, and if there has been no meaningful contact in that time I delete or anonymise them, unless you have asked me to keep them.
Enquiries and business contacts are kept while the relationship is active and reviewed on the same two-year cycle.
The Lechley Brief: your email address stays on the list until you unsubscribe. Kit may keep a record that you unsubscribed, so you are not added back by mistake.
Chat conversations are kept for 12 months, then deleted, unless they become part of a candidate or client record, which is then kept as above.
Google Analytics data is kept for 14 months, then deleted automatically.
Search Room sign-in: your session lasts up to 30 days, and access ends when the search you were invited to closes.
Contracts and invoices with clients are kept for six years after the end of the financial year they relate to, as UK tax law requires.

I do not sell personal data, and I do not share it for anyone else's marketing.

Clients. A CV or a person's details go to a client only after I have discussed the role with that person and they have agreed to be put forward. The client receives only what it needs to consider them for that role.

Service providers. These companies process personal data on my behalf, under contracts that require them to keep it secure and to use it only on my instructions:

Atlas, the recruitment system, which holds candidate, client and contact records.
Supabase, which hosts the website's database and file storage, including enquiries, applications, CVs and Search Room content, and runs the Search Room sign-in.
Vercel, which hosts this website.
Resend, which sends the website's notification emails, including the email that passes an application and CV to me.
Google, for business email (Google Workspace) and, only with your consent, Google Analytics.
Kit, which sends The Lechley Brief.
Cal.com, for booking calls.
Cloudflare, for Turnstile spam protection.
Anthropic, which provides the AI model that answers the chat. Chat messages are sent to it to generate replies and are not used to train its models.
Slack, where chat conversations you ask to be passed to me are sent so I can reply.
Replybox, for comments on insight pieces.
Apple and Expo, which deliver the Lechley app's notifications to your phone.

Personal data may also be disclosed where the law requires it, or to protect someone's rights or safety.

International transfers

Some of these service providers are based in the United States or store data there. Where personal data leaves the UK, it is protected by the UK government's adequacy regulations, including the UK Extension to the EU-US Data Privacy Framework where the provider is certified under it, or by the UK International Data Transfer Agreement or the UK Addendum to the EU standard contractual clauses. You can ask me which safeguard applies to a particular provider.

Your rights

Under UK GDPR you have the right to:

Access the personal data held about you and receive a copy of it.
Rectification: have anything inaccurate or incomplete corrected.
Erasure: have your data deleted where there is no good reason to keep it.
Restriction: ask me to limit how your data is used, for example while a correction is checked.
Objection: object to any use of your data that relies on legitimate interests. If you object to being contacted about roles, I will stop.
Portability: receive the data you gave me in a structured, commonly used format, or have it sent to someone else.
Withdraw consent at any time, where consent is the basis. This does not affect anything done before you withdrew it.

To use any of these rights, email scott@lechley.com. I will answer within one month, and there is no charge. I may need to confirm your identity first.

Complaints

If you are unhappy with how your data has been handled, please tell me first so I can put it right. You also have the right to complain to the Information Commissioner's Office, the UK regulator for data protection, at ico.org.uk or on 0303 123 1113.

Cookies

Cookies are small files a website stores in your browser. This site uses as few as it can. On your first visit a banner asks whether you accept analytics cookies; Accept and Reject are equally available, and nothing optional is set until you choose. You can change your choice at any time with the "Cookie settings" link at the foot of every page.

Strictly necessary

These are needed for the site to work, so they do not need your consent.

lechley_consent: remembers whether you accepted or rejected analytics cookies, so the banner does not ask again. Kept for 12 months.
Search Room session cookies (names beginning "sb-"): keep you signed in to a Search Room. Set only if you sign in, and kept for up to 30 days.
lechley_chat and lechley_brief_prompt (stored in your browser, not sent to the site): keep a chat you have started open as you move between pages, and remember that you have closed or answered the newsletter prompt so it does not ask again. Cleared when you clear your browser's site data.
Cloudflare Turnstile may set a cookie while it checks a form submission, for spam protection only.

Analytics, only with your consent

_ga and _ga_<id>: set by Google Analytics to tell visits apart and measure how the site is used. Kept for up to two years. If you reject analytics cookies, or change your mind later, Google Analytics does not run and these cookies are removed.

Third-party features

The booking calendar on the contact page (Cal.com) and the comments under insight pieces (Replybox) are provided by those companies and may set their own cookies when you use them. Their own privacy notices explain how.

You can also block or delete cookies in your browser's settings. Blocking strictly necessary cookies may stop parts of the site, such as the Search Room, from working.

Children

This site and the firm's services are for working professionals. I do not knowingly collect personal data from anyone under 16.

Links to other websites

This site links to other websites, including the Lechley community site. They have their own privacy notices, and I am not responsible for how they handle your data.

The Lechley app

The Lechley iPhone app shows the roles published on this website and the posts and weekly question on the Lechley community site. It stores nothing about you on my systems unless you turn on notifications, answer the weekly question, register interest in a role or sign in to your room.

Notifications. If you turn notifications on, the app sends me a push token issued by Apple and Expo for your device, together with your notification preferences. I use it only to send the notifications you switch on: new roles, the weekly question, a Friday read and Movers. Turning notifications off stops the sending; deleting the app invalidates the token and I stop sending to it when the next notification fails to deliver. The token identifies the app installation, not you.

Saved roles are kept on your device only and never sent to me.

Registering interest in a role from the app uses the same form as this website, and the "When you apply for a role" section above applies.

Your room. If Scott has set up a Lechley Rooms page for you, the app can show it to you after you sign in with the email address he holds for you. Signing in sends a six-digit code to that address; the app then keeps a sign-in token on your phone so you stay signed in. The token identifies your sign-in to Lechley Rooms and nothing else. Lechley Rooms keeps your email address, the type of phone and app version you signed in from, and when you last used the app, until you use Delete account. Sign-in codes are deleted within a day. The room itself is the same page you can open from the link Scott emails you, and what you do there (messages, uploads, the form) is part of your candidate record with Lechley, kept as described under How long it is kept. Sign out ends the sign-in on that phone, and an ended sign-in is deleted after 30 days; Delete account in the app deletes every sign-in and code for your address and nothing more: your room, your CV and anything you have shared with Scott stay until you ask him to remove them.

The weekly question and notification choices. If you answer the weekly question in the app, your answer is stored against a scrambled version of the app's random install number, never your name or email address, so we can count one answer per phone. Notifications for the weekly question, a Friday read and Movers are each off until you switch them on, and you can switch them off in the app at any time.

Error reports. If the app hits an error, it sends me an anonymous report so I can fix it: what went wrong, the app and iOS version, and which screen you were on. It contains no name, email address or anything that identifies your phone, and reports are deleted after 90 days.

To have a push token removed sooner, email scott@lechley.com with the approximate date you installed the app.

Changes to this notice

This notice is updated when the way personal data is handled changes, and the date at the top changes with it. Significant changes will be made clear on this page.

Contact

Scott Lechley, Lechley Associates Limited
scott@lechley.com