Privacy Policy

Last updated: 14 September 2026

Sarnha ("we," "us," "our") is a senior interim leadership placement business operated by Andrew Smith. This policy explains what personal data we collect, why, and what rights you have over it, whether you're a visitor to this website, a candidate we work with, or a client we support.

We are the data controller for the personal data described in this policy. If you have any questions, you can contact us at andrew@sarnha.com.

Who this policy covers

This policy applies to three groups of people, and different parts of it will be relevant depending on which one describes you:

• Website visitors, browsing this site without submitting any information
• Candidates, individuals we're in contact with regarding interim leadership opportunities
• Clients, businesses and individuals engaging Sarnha to place an interim leader

What we collect from website visitors

This website does not use cookies, analytics, or tracking scripts. We do not run advertising, and we do not sell or share any data with third parties for marketing purposes.

The site loads fonts from Google Fonts. When your browser requests these fonts, your IP address is shared with Google as part of that request, in the same way it would be for any external resource a website loads. Google's own privacy policy governs how they handle this. We do not control this data or receive it ourselves.

Where this site includes a link to email us directly (for example, "Email Andrew"), clicking it opens your own email application. No information is transmitted to us, or stored by us, until you choose to send an email.

What we collect from candidates

If you're a candidate we're working with, we may collect and process:

• Contact details (name, email, phone number)
• CV, career history, and professional qualifications
• Details of your availability, day rate or salary expectations, and preferred assignment types
• References and information gathered during reference checks, with your knowledge
• Right-to-work status, where relevant to a specific placement
• Any other information you choose to share with us in the course of our working relationship

We collect this information directly from you, and sometimes from publicly available professional sources such as LinkedIn, or through introductions from people in our network.

We only share your details with a client when we believe there's a genuine, relevant opportunity, and we'll always aim to speak with you before doing so.

What we collect from clients

If you're a client or prospective client, we may collect and process:

• Contact details (name, email, phone number, job title)
• Company name and details relevant to a placement brief
• Correspondence relating to a specific mandate or engagement

Why we process this data

We rely on the following legal bases under UK GDPR, depending on the situation:

• Contract: to perform our obligations when we're actively working on a placement for you
• Legitimate interests: to identify and approach suitable candidates for a role, and to maintain our professional network, in a way that's proportionate and doesn't override your own rights
• Consent: where we ask for it specifically, for example before sharing your CV with a named client
• Legal obligation: where we're required to retain or disclose information by law

Who we share data with

We share candidate information with clients only where there's a genuine placement opportunity, and generally with your knowledge beforehand. We may also share information with:

• Reference providers, where you've given references and consented to checks
• Professional advisers (accountants, solicitors) where necessary for our own compliance
• Service providers who support how we operate, such as email or hosting providers

We do not sell personal data, and we do not share it for third-party marketing.

International transfers

Some of our service providers may process personal data outside the UK. Where personal data is transferred internationally, we take appropriate steps to ensure it remains protected in accordance with UK data protection law. This may include relying on UK adequacy regulations or appropriate contractual safeguards, such as the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, where applicable.

How long we keep data

We retain candidate and client data for as long as it's relevant to our ongoing relationship, and for a reasonable period afterward in case a future opportunity arises or we need to respond to a query. As a general guide:

• Candidate data: retained for 2 years from the last meaningful contact or interaction, unless you remain actively engaged with Sarnha, are involved in an assignment, a longer period is required for legal, regulatory or contractual reasons, or you ask us to delete it sooner
• Client data: retained for 6 years following the end of the relevant client relationship or transaction, where required for contractual, accounting, tax or legal purposes. For general business-contact data where there is an ongoing legitimate business relationship, it may be retained while that relationship remains active and reviewed periodically.

You can ask us to delete your data at any time; see "Your rights" below.

Your rights

Under UK GDPR, you have the right to:

• Ask what personal data we hold about you, and get a copy of it
• Ask us to correct inaccurate data
• Ask us to delete your data
• Ask us to restrict or object to how we use it
• Ask for your data in a portable format
• Withdraw consent at any time, where we're relying on consent
• Complain to the Information Commissioner's Office (ICO) if you think we've handled your data incorrectly

To exercise any of these rights, contact us at andrew@sarnha.com. We'll respond within one month, as required by law.

The ICO can be contacted at ico.org.uk, or on 0303 123 1113.

Security

We take reasonable technical and organisational steps to protect the personal data we hold, including restricting access to it and using reputable, secure service providers. No system is completely infallible, but we take this seriously and will notify affected individuals and the ICO where required by law if a data breach occurs.

Children

This website and our services are not directed at, or intended for, children, and we do not knowingly collect data from anyone under 18.

Changes to this policy

We may update this policy from time to time, for example if our services or the tools we use change. The date at the top of this page shows when it was last updated. Significant changes will be reflected here.

Contact us

If you have any questions about this policy or how we handle your data, contact Andrew Smith at andrew@sarnha.com.