Kalpa Ltd ("Kalpa", "we", "us", "our") handles personal data with the same rigour and discretion we apply to every search mandate. This Privacy Policy explains how we collect, use, store, share, and otherwise process personal data when you visit our website, contact us, or engage with us in a professional, business, or recruitment context.
We are committed to the responsible use of personal data and to full compliance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. Where our work extends to individuals based in the European Union, the EU GDPR applies in respect of that processing.
Who We Are
Kalpa is a specialist search firm operating across investment and trading technology. We identify and connect exceptional technical talent — engineers, quant researchers, and adjacent specialists — with leading hedge funds, proprietary trading firms, and high-performance technology businesses.
Kalpa Ltd
Email: contact@kalpa.co
Registered office: [to be inserted]
Company number: [to be inserted]
Who This Privacy Policy Applies To
This Privacy Policy applies to:
- visitors to our website;
- individuals who contact us directly;
- clients and prospective clients, including individuals within client organisations;
- candidates and prospective candidates, including individuals we have identified through our own research and who have not yet been contacted by us;
- referees, sources, and other professional contacts; and
- other individuals whose personal data we process in the course of providing search and recruitment services.
If you are a candidate whose data we hold but who has not yet been contacted by us, Section 4(b) and Section 13 (Your Rights) are of particular relevance.
What Personal Data We Collect
We may collect and process the following categories of personal data, depending on the nature of our relationship with you:
Identity and contact data
- name, email address, telephone number, and professional contact details.
Professional and career data
- employer, job title, seniority, career history, technical skills and specialisations, educational background, compensation history or expectations where relevant, and other information bearing on suitability for a specific role or mandate.
Communications and interaction data
- records of emails, calls, meetings, introductions, referrals, notes, and professional assessments arising from our interactions with you or relating to you.
Inferred and interpreted data
- professional assessments, summaries, and evaluations we create in the course of our work. These are created by us, sometimes with the assistance of AI-enabled tools, and are subject to human review before any consequential use (see Section 6).
Website and enquiry data
- information submitted through our website contact form or provided when you contact us directly.
Publicly available professional information
- data drawn from professional profiles, publications, conference appearances, company websites, and similar sources relevant to the markets and roles we work across.
We do not seek to collect special category personal data (such as health, disability, religion, political views, trade union membership, or racial or ethnic origin) and ask that you do not provide such information unless clearly necessary. Where special category data is inadvertently received, we will handle it in accordance with applicable law and delete it where no lawful basis for retention exists.
How We Collect Personal Data
We collect personal data through the following means:
(a) Directly from you
- when you complete our website contact form, send us an email, call us, or otherwise contact us directly;
- during conversations, meetings, interviews, introductions, or other professional interactions; and
- when you provide your details or CV in connection with a specific role or mandate.
(b) Through our own research
A significant part of our work involves identifying candidates who have not approached us. We may collect personal data about you from publicly available professional sources, including professional networking platforms, company websites, publications, conference records, and other openly accessible professional information.
Where we hold data about you that was not collected directly from you, we will provide you with the information required by applicable law — including the source of the data and the purposes for which it is held — at the point of first contact, or as soon as reasonably practicable thereafter.
(c) From third parties
- from clients, colleagues, referees, and professional contacts who recommend or introduce individuals;
- from service providers who support our website or business operations; and
- from professional data sources and research platforms used in the course of our work.
Why We Use Personal Data
We process personal data for the following purposes:
- responding to website enquiries and other communications;
- providing search, recruitment, and advisory services;
- identifying, researching, and approaching candidates relevant to specific mandates — as an initial, internal research step that informs whether contact is appropriate;
- understanding and supporting client hiring requirements;
- preparing, sharing, and discussing candidate profiles and materials with clients in the context of specific search engagements;
- maintaining a professional network and market knowledge base relevant to the sectors and roles we cover;
- managing and developing professional relationships with clients and candidates;
- operating, managing, improving, and securing our business and website;
- complying with legal, regulatory, and contractual obligations; and
- establishing, exercising, or defending legal claims where necessary.
AI-Assisted and Automated Processing
In the course of our work, we use AI-enabled tools to support research, summarisation, organisation, and analysis of professional information. This processing may include:
- identifying individuals who may be relevant to a specific search mandate, as an initial step in determining whether contact is appropriate;
- summarising professional background, experience, and technical specialisation from available sources;
- organising and maintaining our internal records and candidate database; and
- drafting internal profile materials for use in our work.
Profiling
Some of this processing constitutes profiling within the meaning of Article 4(4) of the UK GDPR — specifically, the automated evaluation of professional characteristics, experience, and apparent relevance to a mandate. We are transparent about this and have assessed that such processing is proportionate to our legitimate business purposes (see Section 8).
Human oversight
We do not make solely automated decisions that produce legal or similarly significant effects on individuals. All AI-assisted outputs used in the furtherance of a search mandate are subject to meaningful human review before being acted upon or shared with clients.
Lawful basis
The lawful basis for AI-assisted processing is our legitimate interests in operating an effective search business (see Sections 7 and 8). We have assessed that this processing is proportionate and does not override the interests, rights, or freedoms of the individuals concerned, having regard to the professional context, the nature of the data processed, and the human oversight applied.
Lawful Bases for Processing
Depending on the context, we rely on one or more of the following lawful bases under the UK GDPR:
Legitimate interests (Article 6(1)(f))
This is our primary lawful basis for most processing activities, including sourcing and researching candidates, maintaining professional networks, sharing candidate information with clients in the context of active mandates, and using AI-assisted tools in our work. We have assessed that these interests are not overridden by the rights, interests, or freedoms of the individuals concerned.
Contract (Article 6(1)(b))
Where processing is necessary to take steps at your request prior to entering into a contract, or to perform a contract with you.
Legal obligation (Article 6(1)(c))
Where we are required to process personal data to comply with a legal or regulatory obligation.
Consent (Article 6(1)(a))
Where we ask for and obtain your consent for a specific processing activity. Where we rely on consent, you may withdraw it at any time by contacting us at contact@kalpa.co. Withdrawal of consent does not affect the lawfulness of processing carried out before withdrawal.
Our Legitimate Interests
Where we rely on legitimate interests as our lawful basis, those interests include:
- operating and growing a specialist search and recruitment business;
- building and maintaining professional networks and sector-specific market knowledge;
- identifying and approaching individuals who may be relevant to a specific search mandate;
- assessing professional relevance and fit for roles or mandates, as an initial internal step that informs whether contact is appropriate;
- sharing candidate materials with clients in the context of specific, active engagements;
- using AI-assisted tools to support research, summarisation, and analysis in connection with our services;
- maintaining accurate internal records and communications; and
- protecting our business, website, and users from misuse, fraud, or risk.
We have documented our legitimate interests assessments and periodically review them. If you would like further information about the basis on which we rely on legitimate interests in a specific context, contact us at contact@kalpa.co.
We operate in a professional context where the identification and introduction of relevant individuals is a standard and expected part of the market. We take care to ensure our processing remains proportionate and respectful of those expectations.
Sharing Candidate Data with Clients
In the course of providing search services, we may share candidate profile materials and other personal data with clients or prospective clients. This is central to our business model and is addressed separately here given its significance to candidates.
We share candidate data with clients:
- only in connection with a specific, active search mandate;
- at a stage in the process where doing so is proportionate to the purpose — generally after an initial assessment of relevance and, where practicable, having made or attempted contact with the candidate; and
- subject to appropriate confidentiality obligations and data handling expectations communicated to clients.
Clients who receive candidate data act as independent data controllers in respect of their own use of that information. Their handling of personal data is governed by their own privacy policies and applicable law.
Who Else We Share Personal Data With
In addition to clients (addressed in Section 9), we may share personal data with:
- service providers and processors who support our business operations — including providers of website hosting, form handling, email infrastructure, document and communications tools, CRM systems, data research and sourcing platforms, and AI-assisted research tools — each engaged under appropriate contractual protections in accordance with Article 28 of the UK GDPR;
- professional advisers, including legal, compliance, and accounting advisers, where reasonably necessary and subject to professional confidentiality obligations; and
- courts, regulators, law enforcement, or other authorities where disclosure is required by law or is reasonably necessary to protect our rights or the rights of others.
We do not sell personal data. We do not share personal data for third-party marketing purposes.
International Data Transfers
Kalpa operates globally. Personal data processed in connection with our services may be transferred to, accessed from, or processed in countries outside the United Kingdom, including countries where we operate or engage service providers.
Where we transfer personal data to countries that have not been the subject of UK adequacy regulations, we put in place appropriate safeguards in accordance with Chapter V of the UK GDPR. Depending on the destination and nature of the transfer, we rely on one or more of the following:
- adequacy regulations made under section 17A of the Data Protection Act 2018, where the destination country or territory has been assessed to offer adequate protection;
- International Data Transfer Agreements (IDTAs) issued by the ICO, or the UK Addendum to the EU Standard Contractual Clauses, where no adequacy finding applies; or
- other lawful transfer mechanisms available under UK data protection law.
We conduct transfer risk assessments where required and apply supplementary measures where the legal framework of the destination country so requires.
If you would like information about the transfer mechanism applicable to your personal data, contact us at contact@kalpa.co.
Retention of Personal Data
We retain personal data only for as long as is necessary for the purposes for which it was collected, taking into account our legitimate business needs, applicable legal and regulatory obligations, and the reasonable expectations of the individuals concerned.
| Category | Retention period |
|---|---|
| Candidates engaged in an active search process | Up to 5 years from the date of last interaction, to support relationship management, record-keeping, and potential future mandates. |
| Candidates sourced but not yet contacted | Up to 5 years from the date of collection, subject to periodic review. Deleted or anonymised earlier where no active, documented purpose remains. |
| Candidates who have not progressed or who have exercised their right to object or erasure | Deleted or suppressed promptly following confirmation that no further processing purpose exists. A suppression record is retained to prevent re-processing. |
| Client contacts and professional relationships | Up to 5 years from the date of last interaction for relationship management and record purposes. |
| Website enquiries | Up to 12 months from the date of submission, unless the enquiry develops into an ongoing engagement. |
| Legal, compliance, and financial records | As required by applicable law, regulation, or professional obligation — typically up to 6 years for financial and contractual records under UK law. |
Retention periods are reviewed periodically and may be updated to reflect changes in our business or applicable law. You may request erasure of your data at any time (see Section 13). Where we are unable to comply in full — for example, due to a legal obligation — we will explain the reason. We may de-identify or aggregate data for internal research or analysis purposes, at which point it ceases to constitute personal data.
Your Rights
Subject to applicable law and the circumstances of the processing, you have the following rights in respect of your personal data:
| Right | What it means |
|---|---|
| Access | The right to request a copy of the personal data we hold about you and information about how we use it. |
| Rectification | The right to request correction of inaccurate or incomplete personal data. |
| Erasure | The right to request deletion of your personal data in certain circumstances — for example, where it is no longer necessary for the purpose for which it was collected. |
| Restriction | The right to request that we restrict our processing of your data in certain circumstances. |
| Object | The right to object to processing based on legitimate interests. This right is particularly relevant to candidates whose data we hold through our own research. Where you object, we will cease processing unless we can demonstrate compelling legitimate grounds that override your interests, rights, and freedoms. |
| Portability | The right to receive your personal data in a structured, commonly used, machine-readable format where processing is based on consent or contract and is carried out by automated means. |
| Human review | The right to request human review of any AI-assisted assessment or output that has been used in a consequential decision relating to you. |
| Withdraw consent | Where we rely on consent, the right to withdraw it at any time without affecting the lawfulness of prior processing. |
How to exercise your rights
To exercise any of the above rights, contact us at contact@kalpa.co. Please provide sufficient information to allow us to identify you and the data concerned. We will respond within one month of receipt of a valid request, extendable by a further two months in complex cases. We may ask you to verify your identity before acting on a request. There is no charge for exercising your rights in ordinary circumstances.
Right to Object — Sourced Candidates
If you are a candidate whose data we hold as a result of our own research — and who has not proactively contacted us — you have the right to object to our processing of your personal data under Article 21 of the UK GDPR.
You can exercise this right at any time, including at the point of first contact from us. Contact us at contact@kalpa.co. On receipt of a valid objection, we will cease processing your data unless we can demonstrate compelling legitimate grounds that override your interests, rights, and freedoms.
We maintain a suppression list of individuals who have objected to our processing to ensure their data is not re-processed in future.
Security
We take appropriate technical and organisational measures to protect personal data against unauthorised or unlawful processing, accidental loss, destruction, damage, or unauthorised disclosure. These measures are designed to reflect the sensitivity of the data we process and the risks to individuals if security were to be compromised.
Access to personal data within Kalpa is limited to those with a legitimate need to access it in the course of their duties.
In the event of a personal data breach that is likely to result in a risk to individuals, we will notify the Information Commissioner's Office without undue delay and, where required, notify affected individuals directly.
Third-Party Services and Website Functionality
Our website and business operations make use of third-party service providers, which may include providers of website hosting and infrastructure, contact form processing, email services, document and communications platforms, CRM and candidate management systems, data research and enrichment platforms, and AI-assisted research tools.
Where these providers process personal data on our behalf, we engage them under written data processing agreements that impose obligations consistent with Article 28 of the UK GDPR. We do not authorise processors to use personal data for their own purposes.
Some providers operate under their own terms as independent controllers in respect of certain processing activities. Where that is the case, their own privacy policies govern that processing.
Cookies and Analytics
Our website may use cookies or similar technologies where necessary to operate, secure, or improve the website. We do not currently use non-essential tracking cookies or analytics tools without appropriate disclosure and, where required by law, consent.
If we introduce non-essential cookies, analytics, or similar tracking technologies in the future, we will update our website notices and obtain any required consents before deploying them.
Complaints
If you have a concern about how we handle your personal data, please contact us at contact@kalpa.co and we will do our best to resolve it promptly.
You also have the right to lodge a complaint with the UK supervisory authority:
If you are based in an EU member state and consider that our processing of your data is governed by the EU GDPR, you may also have the right to complain to the supervisory authority in your country of residence.
Changes to This Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or business operations. Any material changes will be posted on this page with an updated effective date. We will take reasonable steps to bring significant changes to your attention.
Contact Us
If you have any questions about this Privacy Policy or about how we handle personal data, please contact:
Kalpa Ltd
Email: contact@kalpa.co
Registered office: [to be inserted]
Company number: [to be inserted]