Version 4.01 – Effective 15 September 2026. Russell Williams Limited trading as Cruxx.
1. Who we are
Cruxx is a trading name of Russell Williams Limited, a company registered in England and Wales with company number 11841858, whose registered office is at 3-5 Eastgate, Louth, Lincolnshire, England, LN11 9NB (“Cruxx”, “we”, “us”).
We are an executive and board search firm specialising in medical technology. We are the controller of the personal data described in this notice. We are registered with the Information Commissioner’s Office under registration number ZA833669.
You can contact us about anything in this notice at privacy@thisiscruxx.com, or in writing to 3-5 Eastgate, Louth, Lincolnshire, LN11 9NB.
2. Why you are receiving this notice
We hold information about senior professionals working in medical technology and adjacent sectors. In most cases we obtained that information from sources other than you, typically professional networking sites, public company information, industry events, published material, or a referral from someone in our network. This notice tells you what we hold, why, and what you can require us to do about it.
3. What we collect
Depending on how we came to hold your information, we may process:
- Identity and contact data — name, title, telephone number, email address, city and country of residence, professional networking profile.
- Professional data — CV or résumé, employment history, current and previous employers, job titles, responsibilities, qualifications, professional memberships and registrations, publications, patents, board appointments, languages spoken.
- Search and assessment data — our notes of conversations with you, interview feedback, competency assessment scores, psychometric results where you have completed an assessment, market intelligence you have shared, references given by or about you, and our record of the roles we have discussed with you.
- Remuneration and engagement data — current and target salary, bonus, equity holdings and expectations, notice period, availability, willingness to relocate, and visa or work authorisation status.
- Eligibility data — documents evidencing your right to work in a relevant jurisdiction, where required.
- Correspondence — our email, message and call records with you.
We may also process the following, and where we do, we will tell you and where required we will ask for your explicit consent:
- Special category data — information about your health or disability where you tell us about an adjustment you need for an interview or a role, and information about your racial or ethnic origin, religion, sexual orientation or trade union membership where you volunteer it or where a client asks us to collect diversity monitoring data. Where we process this data, we rely on your explicit consent under Article 9(2)(a) UK GDPR, or on Article 9(2)(b) with Schedule 1 Part 1 of the Data Protection Act 2018 where the processing is necessary in connection with employment.
- Criminal offence data — only where a specific role requires a check, and only with a lawful basis and a Schedule 1 condition identified at the time.
We do not seek special category data as part of ordinary sourcing, and we ask you not to send it to us unsolicited.
4. Where we get it
- From you — when you contact us, apply for a role, send us your CV, speak to one of our consultants, or complete an assessment.
- From publicly available and professional sources — professional networking sites (principally LinkedIn), company websites, regulatory filings, conference and speaker listings, published papers, patent registers, industry press and awards listings.
- From referrals — where someone in our network, including a client or another candidate, suggests we speak to you.
- From our clients — where a client tells us about a person they have identified or gives us feedback on you following an interview.
- From referees — people you have nominated, whom we contact with your agreement.
- From job boards and CV databases — where you have made your profile available on them.
Where we did not obtain your data from you, this notice is the information we are required to provide under Article 14 UK GDPR. We provide it when we first contact you, and in any event within one month of obtaining your data.
5. What we use it for, and our lawful basis
| What we do | Lawful basis |
| Building and maintaining a database of senior professionals in medical technology, including market mapping and talent pooling | Legitimate interests — operating a search business, and assembling the market knowledge our clients engage us for |
| Assessing whether you may be a fit for a search we are running, and contacting you about it | Legitimate interests — as above, and the interest of professionals in our sector in hearing about relevant senior opportunities |
| Screening and scoring applications against the requirements of a role in our applicant tracking system | Legitimate interests — assessing candidates efficiently and consistently, with human decision-making throughout |
| Discussing your career, taking your brief, and representing you to a client | Legitimate interests, and where a placement is in prospect, taking steps at your request prior to entering into a contract |
| Sharing your profile with a client for a specific search, with your agreement | Legitimate interests, and Article 6(1)(b) UK GDPR where relevant |
| Taking up references and verifying qualifications | Legitimate interests, with your agreement to the specific referees |
| Assessment and psychometric testing | Legitimate interests, and your consent where the assessment is optional |
| Checking your right to work where we place you on a temporary or contract basis | Legal obligation — Immigration, Asylum and Nationality Act 2006 |
| Keeping records of the placements we make and the terms of them | Legal obligation, including the Conduct of Employment Agencies and Employment Businesses Regulations 2003, and tax and accounting requirements |
| Sending you market intelligence, our podcast and industry content | Consent where you are an individual subscriber, in accordance with regulation 22 of the Privacy and Electronic Communications Regulations 2003; otherwise legitimate interests |
| Investigating complaints, and establishing, exercising or defending legal claims | Legitimate interests, and legal obligation |
Where we rely on legitimate interests, we balance our interests against your rights and freedoms before we process your data. You can ask us about our assessment at any time, and you can object to that processing. See section 9.
Automated processing. Our applicant tracking system, provided by Atlas Recruitment Technology Ltd, parses CVs and applications and scores them against the requirements of a role, so that our consultants can see relevant evidence quickly. That scoring is an input to a human decision and nothing more. No shortlisting, rejection or placement decision is made about you by automated means alone, and you can ask us for a human review of any assessment and for an explanation of how a role’s requirements were set.
Under our contract with Atlas, your personal data is not used to train Atlas’s or any third party’s general-purpose AI models.
6. Who we share it with
- We share your profile with a client only in connection with a specific search and, other than in the initial anonymised form we may use to test interest, only where you have agreed. When we share your data with a client, the client becomes a separate controller of it and its own privacy notice applies. Our terms of business require clients to use your data only for the search in question, not to retain it for their own future recruitment, and to delete it within 60 days if you are not appointed. Where a client contracts with us on its own terms, we ask for equivalent commitments, and we will tell you on request what applies to a particular search.
- Referees you have nominated.
- Our service providers, who process your data on our instructions under written terms. These are Atlas Recruitment Technology Ltd, which supplies our applicant tracking system and recruitment CRM; Microsoft, which supplies our email, storage and productivity environment; and our IT support and hosting providers.
- Our professional advisers — lawyers, accountants, insurers and auditors, where necessary.
- Regulators, courts and law enforcement, where we are required to disclose.
- A buyer or successor, if our business is sold or reorganised.
We do not sell your personal data.
7. Sending data outside the UK
We work with clients in the United States, the European Union, Switzerland and Asia, and we may share your profile with a client outside the UK in connection with a search. Some of our service providers also process data outside the UK.
Where we transfer your personal data outside the UK we rely on one of the following:
- the country having UK adequacy status, which covers our clients in the European Union, Switzerland and other adequate countries;
- the UK International Data Transfer Agreement, or the UK Addendum to the EU Standard Contractual Clauses, together with a transfer risk assessment. This is the mechanism we put in place for clients and service providers in the United States and other countries without adequacy status, and we will not share your profile with such a client until it is in place; or
- an exception under Article 49 UK GDPR, where the transfer is occasional and necessary for the performance of a contract or for legal claims.
You can ask us for details of the mechanism applying to a particular transfer, and for a copy of the relevant safeguards, at privacy@thisiscruxx.com.
Where you are located in the European Union, the EU General Data Protection Regulation also applies to our processing of your data, alongside the UK GDPR.
8. How long we keep it
| Data | Retention |
| Candidate database records where we have had no meaningful contact with you | 24 months from last meaningful contact, then deleted or anonymised |
| Records of an active search you are part of | Duration of the search, then retained as a candidate record |
| Records relating to a placement we made | 6 years from the end of the placement, to meet our record-keeping, tax and limitation requirements |
| Right-to-work documentation | 2 years from the end of the engagement |
| Assessment and psychometric results | 12 months |
| Marketing preferences and unsubscribe records | For as long as we operate the mailing list |
| Special category data | Deleted as soon as the purpose is met, and in any event no later than the underlying candidate record |
We review our database annually and delete records we no longer have a basis to hold.
9. Your rights
You have the right to:
- be told what we hold about you and why, through this notice and on request in more detail;
- access a copy of your personal data;
- have inaccurate data corrected;
- have your data erased, where we no longer have a basis to hold it;
- restrict our processing while a dispute about accuracy or our basis is resolved;
- object to our processing where we rely on legitimate interests, including our holding your profile in our database at all. If you object we will stop unless we can show compelling legitimate grounds that override your interests;
- object to direct marketing at any time, absolutely;
- portability of data you provided to us, where processing is based on consent or contract;
- withdraw consent at any time, where we relied on it.
To exercise any of these, contact privacy@thisiscruxx.com. We will respond within one month, and will tell you if we need longer. There is no charge in ordinary cases.
If you want us to remove you from our database entirely, say so and we will do it. We may retain a minimal suppression record, being your name and a note not to contact you, so that we do not re-add you from a public source later.
You can complain to the Information Commissioner’s Office at ico.org.uk, or on 0303 123 1113. If you are located in the European Union, you may instead complain to the supervisory authority in your country of residence. We would rather you came to us first so we can put it right.
10. Security
We hold your data in Atlas, our applicant tracking system and recruitment CRM, and in Microsoft 365, our email and storage environment, with access limited to consultants who need it. Our measures include access controls, multi-factor authentication, encryption in transit and at rest, secure device management, internal data protection training, and supplier due diligence. We have a procedure for identifying and reporting personal data breaches and, where required, will notify the Information Commissioner’s Office within 72 hours and notify you where the breach is likely to result in a high risk to your rights.
11. Changes
We will update this notice when our processing changes and will change the version and date at the top. Where a change materially affects how we use data about you, we will tell you directly.