Privacy Policy

Last updated: 21 July 2026

1. Who We Are

BLACKSTONEAND LTD ("Blackstone&", "we", "us", "our") is a company registered in England and Wales.

• Company number: 16168755
• Registered office: 124 City Road, London, England, EC1V 2NX
• ICO registration number: C1894412
• Privacy contact: privacy@blackstoneand.com

We are the data controller for the personal data processed through this website (www.blackstoneand.com) and for personal data we process about candidates and applicants in connection with our recruitment activities (see Section 9).

For information about how we process personal data in the context of our consultancy services, please contact privacy@blackstoneand.com.

2. What Personal Data We Process

Data we do not collect

This website does not collect personal data through forms, account registrations, or user submissions. Our contact page directs you to email us via your own email application. Any personal data you share with us via email is handled outside of this website.

Data processed automatically

When you visit our website, the following data is processed by third-party services that support its operation:

Fathom Analytics

We use Fathom Analytics to understand how visitors use our website. Fathom is a privacy-focused analytics service that:

• Does not use cookies
• Does not collect personal data
• Does not track individual visitors across sessions or sites
• Processes aggregated, anonymised data only

Fathom is compliant with UK GDPR, EU GDPR, and PECR without requiring visitor consent.

Web fonts

Our typefaces are self-hosted: the font files are bundled with the website and served from our own infrastructure (via Cloudflare, described above). No request is made to any third-party font provider, and your IP address is not shared with a font provider.

Cloudflare

Our website is served through Cloudflare's content delivery network. Cloudflare processes limited technical data (including IP addresses) to deliver web pages, protect against malicious traffic, and ensure site availability. Cloudflare sets one cookie:

• __cf_bm — a bot management cookie used to distinguish humans from automated traffic. This is a strictly necessary cookie. It is HttpOnly, Secure, and expires after 30 minutes.

3. Lawful Basis for Processing

We do not rely on consent for any processing carried out through this website, as no personal data is collected that requires it. Where we rely on legitimate interests for recruitment processing, candidates have the right to object (see Section 7).

4. Data Sharing

We do not sell, rent, or trade your personal data. The third-party services listed in Section 2 process data as described above and solely for the purposes of delivering their respective services.

5. International Transfers

• Fathom Analytics processes data in compliance with UK and EU GDPR.
• Cloudflare operates a global network. Cloudflare's Data Processing Addendum covers international transfers and includes Standard Contractual Clauses.

6. Data Retention

• Fathom Analytics: Retains only aggregated, anonymised statistics. No personal data is stored.
• Cloudflare __cf_bm cookie: Expires automatically after 30 minutes.
• Recruitment — unsuccessful candidates: Six (6) months after the decision is communicated, in line with our Data Retention and Disposal Policy and ICO guidance.
• Recruitment — successful candidates (engaged as employees, workers or contractors): Records are transferred to the relevant employee, worker or contractor file and retained in accordance with our Data Retention and Disposal Policy (typically the duration of the engagement plus six (6) years).
• Recruitment — sourcing notes (proactive outreach where no application is made): Up to twelve (12) months from the last meaningful interaction, after which the record is deleted unless the candidate has asked to remain on file.

7. Your Rights

Under UK GDPR, you have the right to:

• Access the personal data we hold about you
• Rectification of inaccurate personal data
• Erasure of your personal data
• Restriction of processing
• Object to processing based on legitimate interest
• Data portability of your personal data
• Complain to the Information Commissioner's Office (ICO)

As this website does not collect or store personal data, these rights are most relevant to any data you share with us directly (for example, by email).

To exercise any of these rights, contact us at privacy@blackstoneand.com.

8. Complaints

If you are unhappy with how we handle your personal data, you have the right to lodge a complaint with the Information Commissioner's Office (ICO):

• Website: ico.org.uk
• Telephone: 0303 123 1113

9. Recruitment & Candidate Data

9.1 When this section applies

This section applies whenever we process personal data about candidates and applicants in connection with our recruitment activities, including:

• Direct applications submitted to us by email or other means;
• Applications received via JobServe, LinkedIn or other job boards;
• Proactive sourcing where we identify potential candidates through LinkedIn, JobServe, professional networks or referrals.

9.2 Categories of personal data we process

Depending on the route through which we engage with you, we may process the following categories of personal data:

• Identification and contact details: name, email address, telephone number, location.
• Professional and employment information: CV, work history, qualifications, certifications, skills, current and past employers, LinkedIn profile, references.
• Application and assessment information: cover letter, interview notes, assessment results, correspondence with us.
• Right-to-work information: passport, visa, or other documentation evidencing the right to work in the UK (collected only at offer stage).
• Diversity information: where voluntarily provided, processed only on an aggregated and anonymised basis.

We do not routinely process special category data. Where it is necessary to do so (for example, to provide reasonable adjustments during the recruitment process), we rely on UK GDPR Article 9(2)(b) and Schedule 1 of the Data Protection Act 2018.

9.3 Source of the data

Where we have not obtained your personal data directly from you, we provide the information required under UK GDPR Article 14. Sources include:

• LinkedIn: publicly available profile information and information accessible through LinkedIn's recruiter features.
• JobServe: CV and profile information made available to us under JobServe's terms.
• Other job boards: profile and application information shared with us under the relevant platform's terms.
• Referrals: information shared by professional contacts who recommend you for a role.

9.4 Why we process recruitment data

• To assess your suitability for current or anticipated roles.
• To contact you about opportunities that match your profile.
• To manage the application, interview and offer process.
• To comply with legal obligations, including right-to-work checks.
• To retain a limited record where necessary for the establishment, exercise or defence of legal claims.

9.5 Lawful basis

• Direct applicants: UK GDPR Article 6(1)(b) — steps taken at your request prior to entering a contract of engagement.
• Proactive sourcing: UK GDPR Article 6(1)(f) — legitimate interest in identifying and approaching suitable candidates. We have completed an internal Legitimate Interests Assessment (LIA) supporting this basis.
• Right-to-work checks: UK GDPR Article 6(1)(c) — legal obligation under the Immigration, Asylum and Nationality Act 2006.
• Defence of legal claims: UK GDPR Article 6(1)(f) — legitimate interest.

9.6 Who we share recruitment data with

We do not sell or trade candidate personal data. We share recruitment data only with:

• Google Workspace: as our processor for email, document storage and collaboration.
• Referees and background screening providers: at offer stage and only with your knowledge.
• Law enforcement, regulators or courts: where we are legally required to do so.

We do not transfer candidate data outside the UK or EEA other than via our processors' standard infrastructure, which is covered by appropriate safeguards under UK GDPR Chapter V.

9.7 Automated decision-making

We do not make recruitment decisions by solely automated processing within the meaning of UK GDPR Article 22. All shortlisting and offer decisions involve a human reviewer.

9.8 Your rights as a candidate

In addition to the general rights set out in Section 7, candidates have the right to:

• Submit a subject access request, or request rectification or erasure of your personal data;
• Object to processing carried out on the basis of legitimate interests (including proactive sourcing);
• Opt out of future contact from us about recruitment opportunities.

To exercise any of these rights, please email privacy@blackstoneand.com.

9.9 Complaints

If you are unhappy with how we handle your candidate personal data, you can complain to the Information Commissioner's Office (see Section 8). We would prefer the opportunity to address your concerns first, so please contact us before lodging a complaint where possible.

10. Changes to This Policy

We may update this policy from time to time. Any changes will be posted on this page with an updated "Last updated" date.

11. Contact

• Email: privacy@blackstoneand.com
• Post: BLACKSTONEAND LTD, 124 City Road, London, England, EC1V 2NX