Privacy Notice

This notice covers visitors to millerandwoodall.com, people who send a brief, a benchmark request or a message, client contacts, and subscribers to the Friday brief. If we hold your details as a possible candidate for a role, the candidate data notice has the detail.

Who we are

The controller of your personal data is M A W HUMAN RESOURCES CONSULTANCY L.L.C, trading as Miller & Woodall, Dubai, United Arab Emirates (trade licence 1348977).

Contact for anything in this notice: lloyd@millerandwoodall.com.

What we collect and why

Data	Why	Basis
Name, work email, phone, company, role, and what you tell us in a brief, benchmark request or message	To reply, prepare a benchmark, scope a search and send terms	Your request, and the box you tick agreeing that we may store the details
Client contact details, correspondence and contracts	To run a search, invoice and keep records	Our contract with your organisation, and the tax and contract records the law requires
Email address, optional sector and market	To send the Friday brief	Your consent, confirmed by email; unsubscribe at any time
Campaign tags, referring site and landing page	To see which channels bring enquiries	Sent only with a form you choose to send
Call and meeting recordings, transcripts and notes	To keep an accurate record of what was agreed	Our legitimate interest in accurate records; you are told when a call is recorded and can ask for it not to be
IP address, browser and security signals	To keep the site and forms secure	Our legitimate interest in security

We do not sell personal data.

Cookies and browser storage

This site sets no advertising or tracking cookies. What it does store:

Campaign record (local storage, mw_first_touch): the campaign tags in the link that first brought you here. It stays in your browser until you clear it and is sent to us only if you send a form.
Visit record (session storage, mw_last_touch, mw_session): the referring site and landing page for this visit, cleared when you close the tab, and sent only with a form.
Your analytics choice (local storage, mw_analytics_consent): stored only if you answer the banner.
Hiring or leaders (local storage, mw_audience): which version of the site you chose, so the menu matches next time. It is never sent to us.
Security: Cloudflare, which hosts the site, may set strictly necessary security cookies (such as __cf_bm) to tell people from bots, and its spam check may run when you send a form.

No consent-based analytics. The analytics banner and PostHog are switched off on this site at present.

We use these providers to run the business. Each processes data on our instructions:

Cloudflare: hosts this website, protects it from abuse, receives the forms you send, and stores submissions briefly if our database is unavailable.
Google Workspace: email, calendar and documents.
Supabase: the database behind our search records.
Anthropic: drafts and summarises text, such as call notes and emails, for a person to review; it does not make decisions.
Twilio: phone calls and messages.
Deepgram: transcribes recorded calls.
Fathom: records and summarises video meetings.
Prospeo: finds business contact details for people we want to approach.
MillionVerifier: checks that email addresses are valid before we write.
Buffer: schedules our posts on LinkedIn and other networks.

We also share data with professional advisers under confidentiality, and with authorities where the law requires it, including the Ministry of Human Resources and Emiratisation in the UAE.

Where your data is processed

We are based in the UAE and work across the GCC, the UK and Europe, and the US. Your data is processed in the UAE and by the providers listed in this notice, whose servers may be in the UAE, the EU, the UK, the US or elsewhere. Each provider handles data under its own published terms, which include data protection and security commitments. When we introduce you to an employer in another country, with your permission, your details go to that employer in that country.

How long we keep data

Client contact data: for the relationship, plus 6 years for tax and contract records.
Enquiries and benchmark requests that do not lead to work: 24 months from the last contact.
Inbox and call records (emails, call recordings, transcripts and notes): 24 months.
Web analytics: 26 months.
Friday brief: until you unsubscribe, then only a record that you unsubscribed, so we do not email you again.

Security

Data is encrypted in transit, forms go through our own server, files are kept in private storage, and access is limited to the people who need it. If a breach is likely to put you at risk, we will tell you and the relevant authority.

Your rights

Under the UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021) you can ask to:

be told what data we hold about you, why, and who it has been shared with;
receive a copy of your data, and have it sent to another organisation where that is technically possible;
have inaccurate data corrected, and have data erased when we no longer need it;
restrict or stop our processing, and object to decisions made by software alone.

Under the UK GDPR and the EU GDPR you can ask to:

access your data and receive a copy;
have it corrected or completed;
have it erased;
restrict its use, or object to it, including any use for direct marketing;
receive data you gave us in a portable format;
withdraw consent at any time, where we rely on consent.

We do not make decisions about you by software alone. Every decision about a search or a person is made by a person.

How to use these rights

Your page. If you are in our talent network or a search, ask for a sign-in link on the candidates page. Your page shows what you have agreed to, and lets you ask for a copy of your data or for its erasure.
Email. Write to lloyd@millerandwoodall.com with "copy of my data", "correct my data" or "delete my details". Replying "delete my details" to any email from us also works.

We reply within one month. We may ask you to confirm who you are before we act. There is no charge.

Complaints

Please tell us first so we can put it right. You can also complain to the UAE Data Office, to the Information Commissioner's Office in the UK (ico.org.uk), or to the data protection authority where you live or work in the EU.

Children

This site and our services are for adults. We do not knowingly collect data from anyone under 18.

Changes

We post any change here with a new date. If a change affects how we use data you have already given us, we tell you directly.