Insight Technology Search

Privacy Policy

Version 2.6  |  May 2026

Clause 1 — Who We Are

Insight Technology Search is a boutique executive recruitment company. Our registered address is: 55 Route Des Angeres, 38410 St Martin D'Uriage, France. We are the data controller for the personal data we collect and process about candidates and clients. For any enquiries regarding this policy, please contact us at info@intechsearch.com.

Clause 2 — Our Commitment to GDPR

Insight Technology Search is committed to protecting the personal data of all individuals with whom we work, in full compliance with the General Data Protection Regulation (EU) 2016/679 (GDPR). We are registered with, and supervised by, the Commission Nationale de l'Informatique et des Libertés (CNIL), our lead supervisory authority.

Clause 3 — What Data We Collect

We may collect and process the following categories of personal data:

• Identity data: full name, date of birth, nationality, photograph (if provided voluntarily by candidate as part of their CV)

• Contact data: home address, email address, telephone number

• Professional data: CV, employment history, qualifications, references, salary information

• Client data: name, job title, company, contact details, hiring requirements

• Supplier data: contact details and, where applicable, bank account information for payment purposes, in connection with services provided to Insight Technology Search

• Communications data: notes and records from calls, emails, and meetings

• Technical data: IP address, browser type, and usage data collected via cookies on our website

We do not collect special category data (such as health, racial origin, political opinions, religious beliefs, or biometric data) unless strictly necessary and with your explicit consent. Our website and services are not directed at children under the age of 13 and we do not knowingly collect personal information about children. 

Clause 4 — How We Collect Data

We collect personal data directly from individuals (via application, registration, email, or telephone), from our clients, from professional networking platforms such as LinkedIn, from referrals, and from publicly available sources. We will always inform you at the point of first contact of our identity and the purpose for which we are processing your data.

Clause 5 — Lawful Basis for Processing

We process personal data on the following lawful bases under GDPR Article 6:

• Legitimate interests (Article 6(1)(f)): matching candidates to suitable roles, managing client relationships, and running our business operations.

• Contractual necessity (Article 6(1)(b)): fulfilling our obligations to clients and candidates under placement or service agreements.

• Consent (Article 6(1)(a)): where we rely on consent, we will seek it explicitly and you may withdraw it at any time without detriment.

• Legal obligation (Article 6(1)(c)): compliance with applicable law.     

Where consent is used as the lawful basis, individuals may withdraw consent at any time. Notwithstanding the above text regarding Legitimate Interest, we do not rely on legitimate interest or contractual necessity to record conversations, generate automated transcripts, or perform AI-driven conversational analysis because these processing activities utilize automated speaker attribution and process natural voice characteristics (which may constitute biometric identifiers under applicable local laws), such processing is strictly conditional upon your explicit, freely given consent under GDPR Article 6(1)(a) and Article 9(2)(a).

Clause 6 — How We Use Your Data

We use personal data for the following purposes:

• Matching candidates to suitable employment opportunities

• Communicating with candidates and clients throughout the recruitment process

• Preparing candidate profiles, briefing documents, and placement reports

• Conducting reference checks and verifying qualifications

• Managing our business relationships and obligations

• Complying with legal and regulatory requirements

• Internal workflow management and administration

Clause 7 — Who Do We Share Your Personal Data With     

We will only share your personal data with third parties where necessary and lawful. Recipients may include:

• Clients to whom you have consented to be introduced

• Third-party technology platforms we use to operate our business (see Clause 15 for full details)

• Professional advisers such as legal and financial advisers, who are bound by confidentiality obligations

• Regulatory or law enforcement authorities where required by law

We do not sell personal data to third parties and do not share it for advertising purposes.

Clause 8 — International Data Transfers

We store the Personal Data with some vendors and service providers that are based in     the United States & Canada therefore, your Personal Data may be processed in countries with privacy laws that are different from privacy laws in your country. Whenever we make such transfers, we will use appropriate safeguards to implement an appropriate level of protection to your Personal Data by implementing at least one of the following safeguards:           

• Ensuring the destination country has been deemed to provide an adequate level of protection for Personal Data; and/or

• By executing and implementing data onward transfer instruments such as data processing and protection agreements.

Clause 9     — Data Security

We deploy industry standard measures to ensure the security, confidentiality, integrity and availability of the Personal Information we process. We implement appropriate technical and organisational measures to protect personal data against unauthorised access, loss, or disclosure. These include access controls, encrypted communications, contractual data processing agreements with all technology providers, and regular staff training. We endeavour to restrict access to Personal Information on a ’need to know’ basis for the provision of services to you; however, no such measures are perfect or impenetrable. In the event of a data breach that is likely to result in risk to individuals, we will notify the CNIL within 72 hours of becoming aware of it.

Clause 10 — Data Retention

We retain personal data only for as long as necessary for the purposes for which it was collected:

• Candidate data is retained for up to three years from last contact, or from the date of placement where applicable.

• Client data is retained for the duration of our business relationship and for a reasonable period thereafter.

• Where we have placed a candidate, we retain evidence of that placement as required by law.

• Conversations and prompts processed via Claude (Anthropic) on the Team plan are retained by Anthropic for 30 days before being permanently deleted, in accordance with Anthropic's Commercial Terms of Service.

• Data processed via other third-party tools is subject to the retention settings applicable to each platform, as described in Clause 15.

You may request erasure of your data at any time — please see Clause 11.

Clause 11 — Your Rights

Under GDPR, you have the following rights in relation to your personal data:

• Right of access: to obtain a copy of the data we hold about you

• Right to rectification: to have inaccurate data corrected within 30 days

• Right to erasure: to request deletion of your data, subject to legal exceptions

• Right to restriction: to request that we limit how we process your data

• Right to data portability: to receive your data in a structured, machine-readable format

• Right to object: to object to processing based on legitimate interests

• Rights in relation to automated decision-making: we do not use automated decision-making that produces legal or significant effects on individuals

To exercise any of these rights, please email info@intechsearch.com. We will verify your identity before releasing any data — we will ask for a copy of a passport or driving licence and a recent utility bill as proof of address — and will respond within 30 days. When requesting erasure, please make clear whether you wish to be completely removed from our database or simply marked as not currently seeking new opportunities, as these are handled differently.

Clause 12 — Cookies

Our website may use cookies to improve user experience and to analyse site traffic. A cookie notice is displayed on the first visit. You may adjust your cookie preferences at any time via your browser settings.

Clause 13 — Complaints

If you have a concern about how we handle your personal data, please contact us first at info@intechsearch.com or write to: Directrice Générale, 55 Route Des Angeres, 38410 St Martin D'Uriage, France. Tel: 00 33 986 69 22 31.

If you remain dissatisfied, you have the right to lodge a complaint with the CNIL: www.cnil.fr  |  3 Place Fontenoy, TSA 80715, 75334 Paris Cedex 07  |  Tel: 00 33 153 73 22 22.

Clause 14 — Changes to This Policy

This policy may be updated from time to time to reflect changes in our operations, technology providers, or legal obligations. Material changes will be communicated to data subjects where required by law. The current version is always available on our website and on request. For questions, please email info@intechsearch.com.

Clause 15 — Use of Third-Party Processors and AI Providers

Insight Technology Search may share personal data with trusted third-party service providers to support our operations. These may include:

• Customer relationship management (CRM) systems;

• Recruitment and applicant tracking systems (ATS);

• Cloud hosting providers;

• Communication and collaboration tools;

• AI and transcription service providers.

These providers process data only on our instructions and are subject to contractual safeguards under Article 28 GDPR.

15.1 - Use of AI Tools and Transcription Services

Insight Technology Search uses AI-powered large language model (LLM) platforms, an AI desktop agent, and meeting transcription services to support our internal business operations. All such tools are used under commercial agreements that include contractual data protection obligations, and where a Data Processing Agreement (DPA) with Insight Technology Search is in place.

15.1.1 — AI Language Model Tools

Claude (Anthropic) and ChatGPT (OpenAI) are used to assist with activities including drafting candidate profiles and client briefs, summarising documents and reports, internal workflow automation, and general administrative tasks.

Insight Technology Search uses the Claude Team plan, which operates under Anthropic's Commercial Terms of Service incorporating a Data Processing Agreement under GDPR Article 28. Anthropic Ireland Limited contracts with EEA customers.

We also use Claude Cowork, an agentic desktop feature that can read, create, and edit files stored locally on authorised staff computers. Claude Cowork is used only within folders containing business documents and is not used to autonomously process unredacted personal data of candidates or clients without human oversight and approval.

Safeguards in place:

• We operate exclusively under commercial plan agreements. DPAs are in place with both Anthropic Ireland Limited and OpenAI Ireland Limited.

• Neither provider uses customer data submitted under commercial agreements to train their AI models.

• Candidate and client data provided with consent to process may be used in full, with the exception of special category data (including health, disability, racial origin, religion, sexual orientation, trade union membership, and biometric data including photographs) which must be removed before any document is uploaded to or processed by any AI tool.

• AI tools are used only to assist human decision-making. No automated decisions with legal or significant effect are made using AI outputs alone, in accordance with GDPR Article 22.

• Claude conversations and prompts are retained by Anthropic for 30 days and then permanently deleted under the Team plan commercial terms.

15.1.2 — Transcription Tools

Insight Technology Search uses two transcription tools for distinct purposes:

Fireflies (Fireflies.ai Corp.) is used exclusively for internal meetings between company staff. It is not used on any calls involving candidates, clients, or other external parties. A Data Processing Agreement is in place with Fireflies, signed April 2026.

Quil (SalesQ Technologies Inc. / CoRecruit) is used for external calls with candidates and clients in the context of executive recruitment. A Data Processing Agreement incorporating EU Standard Contractual Clauses and the UK International Data Transfer Addendum is in place with Quil.

Safeguards in place for all transcription tools:

• Data subjects (call participants) are informed before any call is recorded and must give explicit verbal consent. If consent is withheld, the recording function is not activated.

• Consent is obtained verbally at the start of each recorded call using a standard opening script, and is captured within the transcript itself. The existence of a transcript constitutes the record of consent. Where consent is refused, the recording is stopped immediately and no transcript is created — the absence of a transcript serves as the record that consent was not given.

• Neither provider uses recordings or transcripts to train AI models.

• Access to transcripts is limited to relevant team members on a need-to-know basis.

15.2      — Data Transfers

The AI and transcription tools described in this clause process data on infrastructure located in the United States. The following transfer mechanisms are in place:

15.3      — Data Subject Rights

The use of AI and transcription tools does not affect your rights as a data subject under GDPR. If you wish to exercise any right — including access, rectification, erasure, restriction, portability, or objection — in relation to data that may have been processed via these tools, please contact info@intechsearch.com and we will coordinate your request with the relevant provider as required.