Data Protection Policy

This Data Protection Policy sets out the framework Progress Lane applies to personal data across the UK GDPR, EU GDPR and equivalent international regimes (including the UAE PDPL, and applicable US state laws).

1. Principles

• Lawfulness, fairness and transparency
• Purpose limitation
• Data minimisation
• Accuracy
• Storage limitation
• Integrity and confidentiality
• Accountability

2. Controller / processor status

Progress Lane acts as an independent data controller when sourcing, evaluating and introducing candidates. Where we handle client data solely under client instruction (e.g. embedded talent programs), we may act as a processor under a written Data Processing Agreement.

3. Lawful bases

Set out in the Privacy Policy. Legitimate interests balancing tests are documented internally and available on request.

4. International transfers

We use appropriate transfer mechanisms: adequacy decisions, EU Standard Contractual Clauses (2021), the UK International Data Transfer Addendum, or equivalent local mechanisms. A Transfer Impact Assessment is completed where required.

5. Sub-processors

A list of key sub-processors (hosting, CRM/ATS, background screening) is available on request. We assess sub-processors for security posture and require contractual data protection commitments.

6. Security

• Encryption in transit (TLS 1.2+) and at rest for candidate records.
• Role-based access, MFA and least-privilege on all internal systems.
• Vendor security due diligence and periodic review.
• Documented incident response with notification to affected parties and regulators as required (within 72 hours where UK/EU GDPR applies).

7. Data processing & retention

The table below summarises how we process the main categories of personal data and how long each is retained. Where multiple bases apply the strictest retention period governs.

Retention is enforced through documented schedules and automated deletion or anonymisation at the end of each period. Backups are overwritten on a rolling 35-day cycle.

8. Data subject rights

We handle access, rectification, erasure, restriction, objection and portability requests within one month (extendable by two further months for complex requests, with notice).

9. Contact us