This notice explains how Wykeham Strategy collects and uses personal data when you apply for a role with us or register your interest as a Domain Specialist. It explains what we collect, why, who sees it, how long we keep it and your rights.
Who we are
Wykeham Strategy Ltd, registered in England and Wales (company number 17436251, registered office 71-75 Shelton Street, Covent Garden, London WC2H 9JQ, United Kingdom), is responsible for your personal data as the controller. It acts together with its affiliate, Wykeham Strategy LLC, registered in Delaware, United States. Both are referred to as "we" and "us" in this notice.
If you are offered a role, the Wykeham entity you contract with becomes responsible for your data from that point.
For any question about this notice or your data, email privacy@wykehamstrategy.com or write to us at our registered office.
Who this notice covers
This notice applies if you:
- apply for an open role through our website, by email or through a recruiter
- register your interest as a Domain Specialist
- are approached by us about a role
Our website Privacy Policy covers all other use of our website.
What we collect
- Contact details: your name, email address and, where the form asks for them, your phone number and location.
- Application details: your CV, covering message, the role you applied for, your experience, qualifications and sector expertise, your professional profile link, and your answers to our application questions, including how you use AI in your work, whether you are legally able to provide these services in the US or the UK, and whether you are open to our working arrangements and an approved public profile.
- Recruitment records: interview notes, our assessment of your application, our emails with you, and a record that you confirmed reading this notice.
- Your preferences: whether you agree to us contacting you about future roles.
- References: if we make you an offer, the references you give us.
- Security data: our forms use Cloudflare Turnstile to block automated traffic, which processes your IP address and browser details.
We do not ask for sensitive information such as health, ethnicity or religion. If you need adjustments to our process, please tell us. We will use that information only to make the adjustments.
Where we get it
- From you, through your application and our conversations.
- From recruiters, if you apply through one.
- From people who recommend you to us.
- From public professional profiles such as LinkedIn.
- From referees, only after an offer and with your knowledge.
Why we use it, and our lawful basis
- Assessing your application and deciding whether to make an offer: legitimate interests, and steps you ask us to take before a contract.
- Communicating with you about the process: legitimate interests.
- Keeping records of our recruitment process: legitimate interests.
- Responding to or defending legal claims: legitimate interests.
- Contacting you about future roles: your consent, which you can withdraw at any time.
- Meeting legal requirements: legal obligation.
We will not use your data for any other purpose.
How we use AI
We use AI tools, Claude (Anthropic) and ChatGPT (OpenAI), to help review and summarize applications. People make every decision about your application. We do not make decisions about you by automated means alone.
Who sees your data
Your data is seen only by the people involved in assessing your application, on a need-to-know basis.
We use the following service providers under contract:
- Cloudflare, Inc.: website hosting, form processing, CV storage and bot protection
- Resend (Plus Five Five, Inc.): delivery of application notifications
- Google LLC: business email (Google Workspace)
- Anthropic PBC and OpenAI: AI tools used to review applications
We may also share your data with our professional advisers, or with regulators or law enforcement where the law requires it. We do not sell your personal data.
International transfers
We work from the United Kingdom and the United States, so your data may be accessed from either country. Several of our service providers are based in the United States. Where your data is transferred outside the UK, we rely on the UK International Data Transfer Addendum to the EU Standard Contractual Clauses, or on an adequacy decision where one applies.
How long we keep it
- If your application is unsuccessful: we delete your data, including your CV, 6 months after you apply.
- If you agree to future contact: we keep it for 12 months after you apply, unless you ask us to delete it sooner.
- If you join us: your application data becomes part of your working record, and we will give you a separate notice about it.
We may keep data for longer if the law requires it, or if it is needed for a legal claim.
Security
We use appropriate technical and organisational measures to protect your data. Our website is served over HTTPS, CVs are held in secure storage, and access is limited to those who need it.
If you do not provide your data
You do not have to give us any information. Without it, we may not be able to consider your application.
Your rights
You have the right to:
- access your personal data and get a copy of it
- have it corrected if it is wrong or incomplete
- have it deleted
- restrict or object to our use of it
- receive it in a portable format
- withdraw your consent to future contact at any time
Depending on where you live, you may have other rights under local law.
To use any of these rights, email privacy@wykehamstrategy.com. We will respond within one month, and there is normally no fee.
If you are not satisfied with how we have handled your data, you can complain to the Information Commissioner's Office at ico.org.uk. Our ICO registration number is ZC254497.
Changes
We will update this notice when our practices change and will show the date of the latest update at the top of this page.