Effective from 19 October 2026

1. Who we are

Peyote Morgan Consultancy Pvt. Ltd. (“Peyote Morgan”, “we”) is an executive search firm based in Bangalore, India. We help organisations find senior leaders, and help leaders consider new roles. This policy explains how we handle personal data in that work.

Our Data Privacy lead and Grievance Officer is Vivek Khanna, Managing Director.

Email: vivek@peyotemorgan.com

Address: S-922, Manipal Centre, 47 Dickenson Road, Bangalore – 560042, Karnataka, India

2. Whom this policy covers and binds

This policy covers personal data about:

  • candidates and potential candidates
  • referees
  • the people we work with at our clients
  • client employees whose information a client shares with us for a search

It binds everyone who works at the firm or on our searches. The firm is responsible for how all of them handle personal data.

3. What we collect and where it comes from

We collect, or create:

  • identity and contact details
  • career information: CV, roles, employers, education and achievements
  • compensation: current, expected and offered, and our own market estimates
  • references
  • our own notes, observations and assessments, including from interviews
  • information our clients share about their organisation and people, such as organisation charts
  • anything else you choose to tell us in the course of a search

It comes from:

  • you, when you apply, reply to us or speak with us
  • people who refer you
  • job portals and professional networks
  • public profiles and other information available online
  • our consultants’ market knowledge
  • referees
  • our clients

4. Why we use it

We use it to:

  • identify and approach people for roles we are recruiting for
  • map the market for a client’s search, including listing people who may suit the brief and
    estimating their compensation
  • assess suitability and present candidates to clients
  • consider you for future roles
  • approach people at organisations about working with us
  • run our business, including contracts, invoicing, accounts and legal obligations

We share anything you have told or given us only with your agreement, and your full profile only once you have agreed to that client and role (see Section 5). Where the EU or UK GDPR applies, we otherwise rely on our legitimate interests: conducting executive searches and meeting our legal obligations in India. Where EU or UK law itself requires us to use data, for example to answer your data protection requests, we rely on that legal obligation.

5. Who we share it with

– Clients. What we share with a client about you depends on how far you have agreed to it:

  • We may include you in a list of people in the market who may suit the client’s brief, whether or not we have spoken to you. This is based on public profiles and other
    information available online, and on our consultants’ own observations, opinions and market knowledge, including from any conversation with you. It may include an
    approximate compensation benchmark, which is our market estimate, not a figure you have given us and not a verified figure.
  • Anything you have told or given us, such as your CV, your compensation details or personal information, is shared only with your agreement, and only as far as you have agreed.
  • Your full profile – everything you have told or given us, references, and our full assessment – goes to a client only after you have agreed to that client and role, and know where the role is based. Our shortlist for a client includes only candidates at this stage.

– Our service provider, Google. Google provides our email, storage, documents and Gemini through Google Workspace, and holds that data under its Cloud Data Processing Addendum.

– Communication services you and we use, such as WhatsApp and video-call platforms.

– Professional advisers, and authorities where the law requires it.

We do not sell personal data. We contact people individually, never through bulk or automated campaigns. If you ask us not to contact you again, we stop.

6. Where your data is held, and transfers abroad

Our records are held mainly in Google Workspace, on a plan that does not let us choose a data region.

What we share about you under Section 5 may go to a client outside India. Many of our clients are global companies, so the people reviewing what we share may be outside India. Google, and communication services we use such as WhatsApp, may store data outside India.

7. Use of AI

For any work involving candidate or client personal data, we use only Google Gemini within our firm Google Workspace accounts. A named consultant reviews every AI-assisted output against its source, and makes and owns every decision about a candidate. We do not make decisions about you by automated means alone. Where a client’s terms restrict AI use, we follow them.

8. Call recordings

We may record a call with a candidate, client or referee to help us take accurate notes. We do this only with your explicit permission, which we ask for at the start of the recording so that your arecordings outside the firm.

9. How long we keep it

How long we keep your details depends on our relationship with you: whether you have worked with us on a search, agreed to stay on file, or been identified only from public profiles and other information available online; whether your details remain relevant to the senior roles we recruit for; and what the law requires us to keep. We review our records from time to time and delete what is out of date or no longer relevant to our work. You can ask us to remove your details at any time.

Referees’ details and the references they give are kept with the candidate’s record and deleted with it.
Details of people we work with at our clients are kept until they ask us to remove them, except where they appear in our financial records or client contracts (see below).
Information our clients share about their organisation and people is used only for work for that client, including later searches, and is kept until the client asks us to return or delete it, or as our contract with that client requires.
Financial records such as invoices and contracts are kept for at least eight financial years, in line with Indian company law, and after that for as long as we need them for our business or for legal claims. These records may include a placed candidate’s name and offered compensation.

10. Security

Each person uses an individual firm login. Data we hold in Google Workspace is covered by Google’s Cloud Data Processing Addendum, under which Google maintains ISO/IEC 27001, 27017 and 27018 certification and annual SOC 2 and SOC 3 reports for its in-scope services.

11. Your rights

You can ask us to:

  • tell you what personal data we hold about you and how we use it
  • correct or update it
  • delete it, unless the law requires us to keep it, for example financial records
  • stop using it for something you agreed to; this does not affect what we did before you withdrew

If the EU or UK GDPR applies to you, you can also ask us to restrict our use of your data, or to give you a copy in a portable format, and you may complain to your data protection authority.

Your right to object: where the EU or UK GDPR applies, you can object at any time, on grounds relating to your particular situation, to our use of your data based on our legitimate interests. You can also tell us at any time, without giving a reason, to stop contacting you about roles or our services, and we will stop.

Send any request or complaint to our Grievance Officer at vivek@peyotemorgan.com. We acknowledge it within 7 days and give you our full response within one month.

12. If something goes wrong

Any suspected personal data breach is escalated at once to our Data Privacy lead, and we notify affected people, clients and authorities without undue delay, as the law and our contracts require.

13. The law we follow, and changes to this policy

We are subject to India’s Information Technology Act, 2000 and the SPDI Rules, 2011, and the EU and UK GDPR where they apply. We will update this policy as the remaining provisions of India’s Digital Personal Data Protection Act, 2023 and its Rules come into force, and as our practices change. This policy is published at peyotemorgan.com/privacy.

Peyote Morgan Consultancy Pvt. Ltd.  |  Version 2.0 – October 2026