Privacy Policy

Last updated: 1 September 2026 · Effective: 1 September 2026

This Privacy Policy explains what personal data Job For My CV Ltd ("Job For My CV", "we", "us") collects, why we collect it, how we use and protect it, who we share it with, and the rights you have over it. It applies to jobsformycv.com, our mobile applications, our email communications and any service we provide through them.

We are the data controller for the personal data described here. Job For My CV Ltd is registered in England and Wales, company number 09482137, at 27 Rivington Street, London EC2A 3DU, United Kingdom.

1. Scope and who this applies to

This policy applies to three groups of people:

• Candidates — anyone who creates a candidate account, uploads a CV, applies to a role or subscribes to job alerts.
• Employer users — individuals acting on behalf of an organisation that publishes vacancies or buys services from us.
• Visitors — anyone browsing the site without an account, including people who complete the contact form.

Where an employer uses our platform to process candidate data for their own recruitment purposes, that employer acts as an independent controller for their own use of that data. We provide contractual terms governing this relationship, but we cannot control how an employer handles data once they have lawfully received it through an application. Their own privacy notice governs that processing.

2. Personal data we collect

Data you give us directly

Data collected automatically

• Device and connection data — IP address, browser type and version, operating system, screen size, language settings.
• Usage data — pages viewed, searches run, filters applied, jobs saved, time on page, referring URL.
• Cookies and local storage — see the Cookie Policy for the full list, purposes and durations.
• Email interaction data — whether an email was opened and which links were clicked, where you have not opted out of this.

Data from third parties

• Sign-in providers — if you use a social or single sign-on option, we receive your name, email and profile picture from that provider.
• Company registries — for employer verification we check publicly available registry data.
• Referrals — if someone refers you, we receive the email address they provided.

Special category data

We do not ask for special category data (such as health, religion, ethnicity, trade union membership or sexual orientation). Some candidates include such information in a CV voluntarily — for example a disability relevant to reasonable adjustments. Where you do, you are explicitly consenting to us storing it as part of your CV, and you may remove it at any time by re-uploading an edited file. Where an employer runs a voluntary diversity monitoring survey, participation is always optional and responses are separated from your application.

3. Why we use it, and our legal basis

Under the UK GDPR and EU GDPR we must have a lawful basis for each processing purpose. Ours are set out below.

Where we rely on legitimate interests, we have carried out a balancing assessment to confirm that our interest does not override your rights and freedoms. You can ask for a summary of any such assessment by writing to us.

4. How your CV reaches employers

This is the part candidates ask about most, so we set it out explicitly.

1. By default, your profile is private. Employers cannot search it, and no one sees your CV until you apply for something.
2. When you apply, the employer receives your CV, your profile, your answers to their screening questions and anything else you attach. From that point the employer is an independent controller of that copy and their retention policy applies.
3. If you switch on "open to offers", verified employers can find your profile in candidate search. You can turn this off at any time; doing so removes you from future searches but does not recall copies already downloaded.
4. We never sell candidate data and we do not provide bulk exports of candidate databases to third parties under any circumstances.
5. You can withdraw an application from your dashboard. We notify the employer and flag the record for deletion, though we cannot force deletion from their own systems.

5. Who we share data with

We share personal data only in the circumstances below, and only with the minimum necessary scope.

Every processor acts under a written contract that restricts them to our documented instructions, requires appropriate security measures and prohibits any use of your data for their own purposes. We do not permit our processors to sell data or use it to train general-purpose models.

6. International transfers

Our primary infrastructure is located in the European Economic Area. Some of our processors operate in other countries, including the United States. Where personal data leaves the UK or EEA we rely on one of the following safeguards:

• An adequacy decision by the European Commission or the UK Government covering the destination country;
• The European Commission's Standard Contractual Clauses, together with the UK International Data Transfer Addendum where relevant; or
• Another mechanism permitted by applicable law, supported by a transfer risk assessment.

Employers based outside the EEA may receive your application when you choose to apply to their vacancy. Where a role is advertised from a country outside the EEA, this is shown on the listing before you apply.

7. How long we keep data

When a retention period ends we delete the data or irreversibly anonymise it so that it can no longer be linked to you. Anonymised statistics — such as "43% of applicants to engineering roles were based outside the country of the employer" — may be kept indefinitely.

8. How we protect data

• Encryption — TLS 1.3 in transit, AES-256 at rest, including CV files and database backups.
• Access control — role-based access on a least-privilege basis, mandatory multi-factor authentication for all staff, and access logging that is reviewed monthly.
• Segregation — production data is never copied to development environments; testing uses synthetic records.
• Testing — annual independent penetration testing, continuous dependency scanning and a documented patching schedule.
• Staff — background checks where lawful, confidentiality obligations and annual data-protection training.
• Incident response — a documented plan with defined roles. Where a breach is likely to result in a risk to your rights, we notify the relevant supervisory authority within 72 hours and inform affected users without undue delay.

No system is perfectly secure. You also play a part: use a unique password, enable two-factor authentication in your settings, and be sceptical of any email asking you to "reconfirm" account details — we never ask for your password.

9. Your rights

Subject to the conditions in applicable law, you have the following rights.

• Access — a copy of the personal data we hold about you, together with information about how it is processed.
• Rectification — correction of inaccurate or incomplete data. Most fields can be edited directly in your account.
• Erasure — deletion of your data where we no longer have a lawful reason to keep it. Self-service deletion is available in Settings → Account → Delete account.
• Restriction — to limit processing while an accuracy dispute or objection is resolved.
• Portability — your data in a structured, machine-readable format (we provide JSON and PDF), or transmitted directly to another provider where technically feasible.
• Objection — to processing based on legitimate interests, and an absolute right to object to direct marketing.
• Withdraw consent — at any time, without affecting the lawfulness of processing before withdrawal.
• Automated decisions — not to be subject to a decision based solely on automated processing that produces legal or similarly significant effects, and to request human review.

To exercise any right, use your account settings or email [email protected]. We respond within one month and may extend by two further months for complex requests, telling you why. We may ask for proof of identity where we cannot otherwise verify who is asking. Exercising your rights is free unless a request is manifestly unfounded or excessive.

10. Automated processing and matching

We use automated processing in three places, and we are explicit about the limits of each.

1. CV parsing — extracting structured fields from your uploaded file so you do not have to retype them. You can review and correct every field.
2. Job matching — ranking vacancies against your profile, preferences and salary floor to decide what appears in your alerts and recommendations. This affects what you are shown; it never rejects you from anything.
3. Candidate ranking for employers — where an employer enables it, applications are ranked against their published criteria. The ranking is advisory. Employers using our platform agree contractually that a human makes every rejection decision.

We do not use facial analysis, voice analysis or emotion detection in any assessment, and we do not permit such tools to be integrated with our platform. We review our matching models for disparate impact across protected characteristics at least annually and document the outcome. If you believe an automated process has affected you unfairly, write to us and a member of the team will review your case manually.

11. Cookies and tracking

We use strictly necessary cookies to run the site, and — only with your consent — preference, analytics and marketing cookies. You choose when the cookie banner first appears and can change your mind at any time from the link in the footer of any page.

The complete list of cookies, including names, providers, purposes and durations, is set out in our Cookie Policy.

12. Children

Our services are not directed at children. You must be at least 16 years old to create an account, or older where your country sets a higher minimum working or digital-consent age. We do not knowingly collect data from children below that age. If you believe a child has provided us with personal data, contact us and we will delete it promptly.

13. Third-party sites and employer content

Job adverts, company profiles and other employer content may link to external application systems, career sites and assessment providers. Once you follow such a link you are subject to that organisation's privacy notice, not ours. We review adverts for accuracy and legitimacy, but we cannot audit the data practices of every employer or their suppliers. Read the destination's own notice before submitting personal data there.

14. Changes to this policy

We update this policy when our processing changes or when the law requires it. The "last updated" date at the top always reflects the current version. For material changes — a new purpose, a new category of recipient, or a change in lawful basis — we notify registered users by email at least 14 days before the change takes effect, and where the change requires consent we ask for it again. Previous versions are available on request.

15. Contact and complaints

Data protection contact: [email protected]
Post: Data Protection, Job For My CV Ltd, 27 Rivington Street, London EC2A 3DU, United Kingdom
Phone: +44 20 7946 0321

If you are unhappy with how we have handled your personal data, please tell us first — most issues are resolved quickly. You also have the right to complain to a supervisory authority:

• United Kingdom — the Information Commissioner's Office (ICO).
• European Union — the data protection authority in your country of residence, work, or where the alleged infringement took place.

Complaining to a regulator does not affect any other legal remedy available to you.

---

This document is provided for information and does not constitute legal advice. Where a translated version of this page exists and differs from the English text, the English version prevails.