qUorate Website Privacy Policy
1. Who we are
qUorate Limited (“qUorate”, “we”, “us”) runs a specialised platform designed to match financial services companies with ideal board members efficiently and effectively. We are the controller of the personal data described in this policy. This policy explains how we collect and use personal data about candidates, client organisations, referees and visitors to our website, and the rights you have under the EU General Data Protection Regulation (EU GDPR), the Irish Data Protection Act 2018, the UK GDPR and the UK Data Protection Act 2018.
qUorate Limited is registered in Ireland with the Companies Registration Office (company number 789009). Its registered office is at 13 The Spires, Innishannon, Cork, T12 P8WP, Ireland. You can contact us about privacy at human@quorate.io.
Please send any question about this policy or your personal data to the privacy contact above.
Because we are established in Ireland, the EU GDPR applies to everything we do, and our lead supervisory authority is the Data Protection Commission. Because we offer our service to people and organisations in the United Kingdom, the UK GDPR also applies. We have appointed Lunis Partners Limited, The Hayloft, Spudworks, Sway, SO41 6BA, United Kingdom, as our UK representative under Article 27 of the UK GDPR. You and the Information Commissioner’s Office can contact Lunis Partners about any matter relating to our processing of UK personal data.
2. Personal data we collect
The personal data we collect depends on how you deal with us. Most of it comes from you directly. Some comes from referees, our clients, public registers and professional networks.
| Who you are | What we collect | Where it comes from |
|---|---|---|
| Candidate (prospective or appointed NED, chair or committee member) | Name, contact details, CV, career history, board and committee experience, qualifications, skills, current and past directorships, regulatory approvals (e.g. PCF, SMF or fit and proper status), availability, fee expectations, conflicts of interest, interview notes, assessments, and references | You; referees; our clients; public sources such as company registers, regulator registers, professional networking sites and press reports |
| Due diligence (candidates being put forward for appointment, with your knowledge) | Results of identity, directorship, disqualification, insolvency, regulatory enforcement and adverse media checks; where the role requires it and the law allows, criminal record information | You; public registers; screening providers acting for us |
| Client contact (board members, company secretaries, HR and nominations committee contacts) | Name, job title, organisation, contact details, the brief for the role, and our correspondence | You; your organisation; public sources |
| Referee | Name, contact details, relationship to the candidate, and the reference you give | You; the candidate who named you |
| Website visitor and enquirer | Details you enter in contact or registration forms, newsletter preferences, IP address, device and browser data, and pages visited (see section 9 on cookies) | You; your device |
If you create an account on our platform, we also collect your login details, profile and visibility settings, the roles you view or express interest in, and messages you send through the platform.
We may ask for special category data (such as health, ethnicity, religion or sexual orientation), for example where a client runs a board diversity programme. Giving it is always optional, and we ask for your explicit consent first.
If we collect your details from a source other than you (for example, when we identify you as a potential candidate from a public register or professional network), we will send you a privacy notice within one month, or when we first contact you if that is sooner. You can ask us to remove you at that point.
If you give us personal data about someone else, such as a referee, please make sure they know you have done so and point them to this policy.
3. How we use your data and our lawful bases
We use personal data only for the purposes below, and each use has a lawful basis under Article 6 of the EU GDPR and the UK GDPR.
| Purpose | Lawful basis |
|---|---|
| Identifying, approaching and assessing candidates for board roles, and matching them with client vacancies | Legitimate interests: running an executive search service and helping boards find suitable directors |
| Registering you as a candidate and putting you forward for roles you agree to be considered for | Taking steps at your request before entering into a contract; legitimate interests |
| Taking up references and carrying out due diligence on shortlisted candidates | Legitimate interests (ours and our client’s) in making sure appointees are fit and proper; legal obligation where a regulated firm must assess fitness and probity |
| Providing our service to client organisations, and managing our contracts with them | Performance of a contract; legitimate interests |
| Responding to enquiries made through our website | Legitimate interests; taking steps at your request before a contract |
| Sending newsletters and market updates | Consent, which you can withdraw at any time; for existing clients, legitimate interests under the e-privacy rules on similar services |
| Running, securing and improving our website | Legitimate interests; consent for non-essential cookies |
| Keeping records, meeting legal and regulatory obligations, and handling legal claims | Legal obligation; legitimate interests |
Running your platform account, including showing your profile to registered firms in line with your visibility settings and suggesting roles that may suit you, is necessary to perform our contract with you.
Where we rely on legitimate interests, we have balanced our interests against your rights. Board appointments are senior, public-facing roles, and we limit what we collect to what is relevant to them. You can ask us for details of this balancing test, and you can object at any time (see section 8).
Criminal records and special category data
We process criminal record information only for a shortlisted candidate, only where the role requires it (for example, a regulated financial services appointment), and only as permitted by Article 10 GDPR, section 55 of the Irish Data Protection Act 2018 and Schedule 1 of the UK Data Protection Act 2018. We tell you before any such check takes place.
We process special category data only with your explicit consent under Article 9(2)(a). We share it with clients only in anonymised, aggregate form, unless you agree otherwise.
Automated decisions
Our platform uses automated tools to suggest matches between candidates and roles. These are suggestions only: people at qUorate and our clients review them, and we do not make decisions about you based solely on automated processing, including profiling, that have legal or similarly significant effects.
4. Who we share your data with
We do not sell personal data. We share it only as follows:
- Client organisations. Firms registered on our platform can see the parts of your profile you choose to make visible. We share your full profile and contact details with a firm only after you have agreed to be considered for its role.
- Service providers acting for us. These include IT and cloud hosting, our candidate database, email and video conferencing, background screening and identity verification providers, and professional advisers. They act on our instructions under written contracts and may not use your data for their own purposes.
- Regulators, authorities and courts. We share data where the law requires it or where it is needed to establish, exercise or defend legal claims.
- A buyer or successor. If our business is sold or reorganised, personal data may transfer to the new owner. This policy will continue to apply.
5. International transfers
We store personal data in the EEA. Some service providers, and some clients, are outside the EEA or the UK. When we transfer personal data outside the EEA or the UK, we make sure it is protected by one of the following:
- an adequacy decision (for example, transfers between the EEA and the UK, or to US organisations certified under the EU-US Data Privacy Framework and its UK Extension);
- the European Commission’s Standard Contractual Clauses, together with the UK International Data Transfer Addendum where UK data is involved; or
- a derogation in Article 49, such as your explicit consent or a transfer needed to take steps you have requested, for example being put forward to a board based outside Europe.
You can ask us for a copy of the safeguards we use.
6. How long we keep your data
We keep personal data only for as long as we need it.
We keep all personal data for six years from our last contact with you, or from the end of the relevant search or contract if later, unless the law requires us to keep it for longer. After that we securely delete or anonymise it. The exception is criminal record and other background check results, which we keep for 12 months from the appointment decision and then delete. You can unsubscribe from our newsletter at any time.
7. Security
We use appropriate technical and organisational measures to protect personal data. These include access controls, encryption in transit and at rest, multi-factor authentication and staff confidentiality obligations. If a personal data breach is likely to result in a risk to you, we will notify the relevant supervisory authority within 72 hours and, where the risk is high, we will tell you without undue delay.
8. Your rights
Under the EU GDPR and the UK GDPR you have the following rights. Some of them apply only in certain circumstances.
- Access: to get a copy of your personal data.
- Rectification: to have inaccurate or incomplete data corrected.
- Erasure: to have your data deleted, for example when we no longer need it.
- Restriction: to ask us to limit how we use your data.
- Portability: to receive data you gave us in a machine-readable format, or have it sent to another organisation.
- Objection: to object to processing we base on legitimate interests, including candidate sourcing. You have an absolute right to object to direct marketing.
- Withdrawing consent: where we rely on consent, you can withdraw it at any time. This does not affect processing that took place before.
To exercise any of these rights, email human@quorate.io. We may need to verify your identity. We will respond within one month, which we can extend by two further months for complex requests. There is normally no charge.
If you choose not to give us information we need to consider you for a role, we may not be able to put you forward.
9. Cookies and third-party sites
Our website uses strictly necessary cookies to work. We use analytics and other non-essential cookies only with your consent, which you can give or withdraw through the cookie banner at any time.
Our website may link to other websites, such as LinkedIn. We are not responsible for how those sites handle personal data, so please read their privacy policies.
10. Children
Our service is for adults seeking or making board appointments. We do not knowingly collect personal data from anyone under 18.
11. How to complain
Please contact us first so we can try to put things right. You also have the right to complain to a supervisory authority, in particular in the country where you live or work or where you believe an infringement took place.
| Where you are | Supervisory authority |
|---|---|
| Ireland (our lead authority) | Data Protection Commission |
| United Kingdom | Information Commissioner’s Office |
| Another EU or EEA country | Your national data protection authority, listed by the European Data Protection Board |
12. Changes to this policy
We may update this policy from time to time. We will post the new version on this page with its effective date, and we will tell you directly about any significant change.
This policy was last updated on 4 November 2026.