1. Who we are
Baxter Wells Ltd ("Baxter Wells", "we", "us") is a specialist Vulnerability Management recruitment business. We help US companies hire senior Vulnerability Management professionals. We are the data controller for the personal information described in this policy, which means we decide how and why it is used.
- Company: Baxter Wells Ltd, registered in England and Wales, company number 17486314
- Registered office: Dairy Farm, Halliwells Brow, High Legh, Cheshire, WA16 0QS, United Kingdom
- Privacy contact: Charlotte Barber, Founder — charlotte@baxterwells.com
We are registered with the UK Information Commissioner's Office (ICO), registration number ZC265347. We are a small business and do not need a Data Protection Officer. Charlotte is responsible for data protection and will deal with any privacy questions personally.
2. Who this policy covers and what we collect
This policy covers four groups of people. We only collect what we need to recruit well.
| Who | What we collect |
|---|---|
| Candidates (people we contact about roles, or who contact us) | Name, job title, employer, work history, skills, certifications, education, location, professional profile links, contact details (email, phone), CV, salary and package details, notice period, job preferences, right-to-work status where a client needs it, interview notes and feedback, and our messages with you |
| Client contacts (hiring managers and others at companies we work with or approach) | Name, job title, company, business contact details, notes of our conversations, and details of roles you are hiring for |
| Referees | Name, job title, contact details and the reference you give |
| Website visitors | Basic technical data such as IP address, browser type and pages visited, and anything you send us through the site |
We do not ask for special category data (such as health, ethnicity, religion or sexual orientation). If you choose to tell us something like this, for example to request adjustments for an interview, we will only use it for that purpose and with your agreement.
3. Where we get your information
Most of what we hold comes from you or from professional information you have made public.
- From you: when you send us a CV, speak to us, reply to a message, or contact us through our website.
- Public professional sources: LinkedIn and other professional networking sites, company websites, conference speaker lists, published articles, and professional community pages.
- Business data providers: services that supply business contact details, such as work email addresses and phone numbers (for example Apollo.io and FullEnrich).
- Other people: referrals from colleagues or contacts, and referees you name.
- Clients: interview feedback and hiring decisions about you.
If we collect your details from a source other than you, we will point you to this policy when we first contact you, and within one month at the latest.
4. How and why we use your information
We use your information to match the right people with the right roles. UK data protection law requires a lawful basis for each use, set out below.
| What we do | Lawful basis |
|---|---|
| Find and contact professionals who may be interested in Vulnerability Management roles | Legitimate interests: running a specialist recruitment business |
| Assess your suitability for roles and keep notes of our conversations | Legitimate interests; and steps you ask us to take before entering a contract |
| Introduce you to a client and send them your CV or profile | Legitimate interests, and we always tell you and get your agreement before sharing your details with a client for a specific role |
| Arrange interviews, collect feedback and support offers | Legitimate interests; steps towards a contract |
| Contact client businesses about hiring needs and our services | Legitimate interests |
| Deliver our services to clients, invoice and keep business records | Contract; legal obligation (tax and accounting) |
| Check right to work or references when a client asks us to | Legal obligation or legitimate interests, with your knowledge |
| Keep our website working and secure | Legitimate interests |
When we rely on legitimate interests, we have weighed our interests against yours. We only approach people about roles relevant to their professional experience, we use business contact details, and you can ask us to stop at any time.
We do not make decisions about you by automated means alone. We may use software, including AI tools, to help us search, organise notes and draft messages, but a person always makes the decisions.
5. Who we share your information with
We never sell your information. We share it only where needed to recruit or run the business.
- Clients: hiring companies, mostly in the United States, when you have agreed to be put forward for a specific role.
- Service providers that store or process data for us under contract:
| Service | What it does for us |
|---|---|
| Spott | Recruitment database (candidates, clients, notes) |
| Google Workspace | Email, calendar and document storage |
| Apollo.io, FullEnrich | Business contact data |
| Exa | Searching public professional information |
| Professional networking and messaging | |
| Ringover | Business calls and text messages |
| Anthropic (Claude) | AI assistant used for research, notes and drafting |
| Netlify | Website hosting |
| Wise | Business banking and payments |
| Our accountant | Bookkeeping and tax |
- Professional advisers: such as our accountant, lawyers and insurers, where needed.
- Authorities: where the law requires it, for example HMRC or the police.
- A buyer or successor: if Baxter Wells is sold or restructured, under the same protections.
6. Sending information outside the UK
Our clients and several of our service providers are in the United States, so your information will be transferred there. When we transfer personal data out of the UK, we make sure it is protected by one of the following:
- the UK–US Data Bridge, where the US organisation is certified under it;
- the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses; or
- another safeguard allowed by UK law, or where the transfer is needed to take steps you have asked for, such as being put forward for a role with a US employer.
You can ask us for details of the safeguard that applies.
7. How long we keep it and how we protect it
We keep information only as long as it is useful for recruitment or required by law.
| Information | How long |
|---|---|
| Candidate records | 2 years from our last meaningful contact with you, then deleted or anonymised unless you ask us to keep you on file |
| Candidates we have placed | 6 years after the placement, for contract and tax records |
| Client contact records | 2 years from our last contact, or 6 years after our last invoice to that client |
| Financial and invoicing records | 6 years, as required by UK tax law |
| Anyone who asks us not to contact them | A minimal record (name and contact detail) kept only so we do not contact you again |
We protect your information with access-controlled accounts, two-factor authentication, encrypted devices and reputable service providers. Only Baxter Wells staff who need your information can see it. If a data breach is likely to put you at risk, we will tell you and the ICO as the law requires.
8. Your rights
You have rights over your information, and exercising them is free. To use any of them, email charlotte@baxterwells.com. We will reply within one month.
- Access: ask for a copy of the information we hold about you.
- Correction: ask us to fix anything inaccurate or incomplete.
- Deletion: ask us to delete your information.
- Objection: object to us using your information for legitimate interests. If you ask us to stop contacting you, we will stop straight away.
- Restriction: ask us to pause using your information while a concern is looked into.
- Portability: ask for information you gave us in a format you can take elsewhere.
- Withdraw consent: where we rely on your agreement, you can withdraw it at any time.
If you live in a US state with its own privacy law, such as California, you may have similar rights. Contact us in the same way and we will help.
9. How we contact you: email, phone and text messages
We contact professionals individually about relevant roles. We do not send bulk marketing.
- Email and LinkedIn: every message tells you who we are and how to ask us to stop.
- Phone calls: we call business numbers, or personal numbers you have given us.
- Text messages (SMS): we only text you if you have given us your mobile number and agreed to receive texts from us, for example to arrange calls and interviews. Message frequency varies. Message and data rates may apply. Reply STOP to opt out at any time, or HELP for help. See our SMS Terms.
If you tell us to stop contacting you by any channel, we will record it and stop.
10. Cookies, changes and complaints
Cookies: our website does not use advertising or tracking cookies. Our hosting provider may keep basic technical logs to keep the site secure. If we add analytics or other cookies, we will update this policy and ask for your consent where required.
Changes: we may update this policy from time to time. The latest version will always be on this page, with the date it was last updated.
Questions and complaints: please contact Charlotte Barber at charlotte@baxterwells.com first, and we will do our best to put things right. You also have the right to complain to the UK Information Commissioner's Office (ICO) at ico.org.uk/make-a-complaint or on 0303 123 1113.
Last updated: 3 October 2026