Privacy Notice

2. Information we collect

The information we collect depends on how you use the platform.

2.1 Jobseeker accounts

If you create an optional jobseeker account, we may collect:

• Your email address.
• Your name, where provided.
• Authentication and account information.
• Saved jobs.
• Followed companies.
• Optional application-profile information.
• A reusable CV, if you choose to upload one.
• Account activity required to operate and secure the service.

Saved jobs, followed companies and private application-profile information are not publicly visible.

Your reusable CV is stored within your account and is not made available to employers simply because you have created a profile.

An employer receives your CV only when you submit it as part of an application to that employer.

You do not need to create an account to browse job listings.

2.2 CV Magic

If you are granted access to CV Magic, we may process:

• Career journal entries and Master Career Profile details you enter (such as employment history, projects, education, skills and certifications).
• Generated Master CV documents and previous document versions you choose to save, including any manual edits to those documents.
• Optional CV files you upload for import, including extracted text used to propose structured career records for your review.
• AI conversation and suggestion records created when you use Experience Builder, CV import, or Master CV generation.
• Product credit balances and ledger entries used to meter AI operations.

AI features send relevant career text to our configured AI provider via Vercel AI Gateway to generate questions, statements, import suggestions, or Master CV wording. Nothing from an import or AI suggestion is written into your career profile until you approve it. Generating or editing a Master CV does not silently change your Career Journal or Master Career Profile.

Master CV PDFs are generated on demand for your authenticated download and are not published at a public URL. CV Magic career data and Master CV documents are deleted when your account is deleted (cascade with your Auth identity). Uploaded CV Magic import files in private storage are removed as part of full account closure.

2.3 Job applications

If you submit an application through Find a Startup Job UK, we may collect:

• Your name.
• Your email address.
• Your CV or résumé.
• Your application message.
• Your LinkedIn profile, where provided.
• Other information you voluntarily include in your application.
• Technical information necessary to process and secure the submission.

The information contained in your CV may include your employment history, education, qualifications, skills, professional experience and other details you choose to provide.

We collect this information to process your application and provide it to the employer associated with the vacancy you selected.

2.4 Employer accounts

If you register or act on behalf of an employer, we may collect:

• Your email address.
• Authentication information.
• The company you represent.
• Your relationship to that company.
• Information submitted for company verification.
• Job listings you create or manage.
• Communications with us.
• Information required to administer and secure your account.

We use this information to provide employer functionality, manage accounts, verify company submissions and protect the platform against misuse.

2.5 Contact and contribution forms

If you contact us or submit a contribution enquiry, we may collect:

• Your name.
• Your email address.
• The subject of your enquiry.
• Your message.
• Other information you voluntarily provide.

We use this information to respond to your enquiry and maintain appropriate records of our communications.

2.6 Technical and usage information

When you access the website, we may process technical information including:

• IP addresses.
• Browser and device information.
• Pages requested.
• Access timestamps.
• Authentication and security events.
• Diagnostic information.
• Website usage information where analytics is enabled.

This information is used to operate and secure the platform, troubleshoot technical problems, prevent abuse and understand how the service is used.

The use of cookies and analytics technologies is explained separately in Section 12.

3. Where we obtain information

Most personal information is collected directly from you when you create an account, submit an application, contact us or use the website.

We may also obtain information from other sources.

3.1 Employer submissions

Employers may provide information about their company, its representatives and available vacancies.

This may include the names and professional contact information of individuals authorised to represent the employer.

3.2 Publicly available sources

We use automated and manual processes to identify vacancies and maintain company profiles.

Information may originate from:

• Official company websites.
• Company careers pages.
• Publicly accessible recruitment platforms.
• Applicant tracking systems.
• Public company registers.
• Other publicly available business information.

Most of this information concerns companies and vacancies rather than individuals.

However, some publicly available information may identify individuals, such as founders, directors or recruitment contacts.

Where we process such information, we limit its use to relevant company identification, directory information, vacancy sourcing, verification and related platform operations.

We do not treat information as exempt from data protection law merely because it is publicly available.

Where Article 14 of the UK GDPR applies, we provide the required privacy information within the applicable period unless a lawful exception applies.

Individuals whose information appears in our directory may contact findastartupjob@proton.me to request access, correction, removal or exercise another applicable data protection right.

Companies may also request complete removal from the platform through the procedure described in our Terms of Use.

4. How we use personal information

We process personal information for specific purposes connected with operating Find a Startup Job UK.

These include:

• Providing the platform. We provide access to vacancies, company profiles, jobseeker accounts and employer functionality.
• Processing applications. We collect and transmit applications to the employer selected by the applicant.
• Managing accounts. We authenticate users, maintain account information and provide optional functionality such as saved jobs and reusable CVs.
• Verifying employers. We use relevant information to assess company submissions and administer employer access.
• Responding to enquiries. We process contact and contribution enquiries and respond to requests for assistance.
• Protecting the platform. We process relevant technical information to prevent fraud, spam, unauthorised access and other misuse.
• Maintaining and improving the service. We analyse appropriate operational and usage information to identify technical problems, improve functionality and understand how the platform is used.
• Meeting legal obligations. We process information where necessary to comply with applicable law, respond to lawful requests and fulfil our data protection responsibilities.
• Handling disputes and legal claims. Where necessary, we retain and use relevant information to establish, exercise or defend legal claims.

We do not sell candidate personal information.

We do not distribute applications to unrelated employers or recruitment agencies for their independent recruitment or marketing purposes.

5. Our lawful bases for processing

Under the UK General Data Protection Regulation (UK GDPR), we must have a lawful basis for collecting and using personal information.

The table below explains why we process personal information, the lawful basis we rely on and what this means for people using Find a Startup Job UK.

5.1 Contract

We rely on Article 6(1)(b) when processing personal information is necessary to provide a service you have requested under our Terms of Use.

This includes creating and maintaining your jobseeker account, providing saved jobs and reusable CV functionality, and transmitting applications to your selected employer.

For applications submitted through our platform, we process the information necessary to deliver the application to the employer associated with the vacancy.

5.2 Legitimate interests

We rely on Article 6(1)(f) where processing is necessary for our legitimate interests and those interests are not overridden by your rights and interests.

Our legitimate interests include:

• Operating and maintaining Find a Startup Job UK.
• Providing employer account functionality.
• Verifying companies and their representatives.
• Preventing fraud, spam and unauthorised access.
• Maintaining the security and reliability of the platform.
• Identifying technical problems and improving the service.
• Responding to enquiries.
• Establishing, exercising or defending legal claims.

You may object to processing based on legitimate interests by contacting findastartupjob@proton.me.

5.3 Legal obligations

We rely on Article 6(1)(c) where processing personal information is necessary to comply with applicable legal requirements.

This includes responding to statutory data protection requests and complying with other obligations imposed by law.

5.4 Consent

We rely on Article 6(1)(a) for processing activities where we request and obtain your consent.

Where processing is based on consent, you may withdraw it at any time.

Withdrawing consent does not affect processing that was lawful before withdrawal.

5.5 Special-category information

Where personal information contains special-category data, such as health information, an Article 6 lawful basis alone is insufficient. An applicable condition under Article 9 of the UK GDPR is also required.

Our handling of sensitive personal information is explained in Section 6.

6. Sensitive personal information

We do not ask candidates to provide unnecessary sensitive personal information.

However, a CV or application may voluntarily contain information relating to health, disability, racial or ethnic origin, religious beliefs or other matters classified as special-category personal data under the UK GDPR.

Candidates should avoid including information that is not relevant to their application.

We do not use this information to make our own recruitment decisions or independently assess candidates.

Where special-category information is submitted, our processing is limited to the purposes associated with handling the application, subject to an applicable Article 9 condition and any additional legal requirements.

We do not treat the act of uploading a CV or accepting our Terms of Use as automatically constituting explicit consent to special-category processing.

We do not use special-category information for unrelated marketing, profiling or candidate scoring.

Where we identify unnecessary sensitive information that we cannot lawfully retain or process, we may remove it in accordance with applicable law and our data protection obligations.

7. Job applications and sharing with employers

There are two ways to apply for vacancies discovered through Find a Startup Job UK.

7.1 Applications made directly to employers

Some vacancies direct you to an employer's official careers website or applicant tracking system.

When you follow that link and complete an application externally, the application is handled by the employer or its recruitment service.

Find a Startup Job UK does not receive or store the CV or application you submit through that external process.

The employer's privacy information applies to its collection and subsequent processing of your application.

7.2 Applications submitted through Find a Startup Job UK

For vacancies supporting applications through our platform, we collect the information you provide and transmit it to the employer associated with the selected vacancy.

By submitting an application, you request that we provide your information to that employer for consideration.

Your application is not made publicly available.

Authorised representatives of the relevant employer may access applications through their private employer area while access remains permitted under our retention rules.

We do not make your reusable profile CV available to employers merely because you have saved it to your account.

We do not send your application to unrelated employers, recruiters or other organisations for their independent recruitment or marketing purposes.

7.3 Responsibilities of employers

Once an employer receives your application, it may process the information for its own recruitment purposes.

The employer is responsible for its subsequent handling of information it controls, including complying with applicable data protection law.

An employer may download an application or transfer it to its own applicant tracking system.

Copies held independently by the employer are subject to the employer's own privacy arrangements and retention obligations.

Find a Startup Job UK cannot directly delete information held independently by an employer.

If you wish to exercise rights concerning an employer's independently held copy, you should contact that employer.

You may still contact us about information held by Find a Startup Job UK.

8. Application data and CV retention

We limit the retention of application information according to the vacancy's original publication window and the operation of the platform.

8.1 Applications submitted for individual vacancies

Application information is retained while the relevant vacancy remains within its original publication window.

If an employer temporarily unpublishes a vacancy, the vacancy will not appear publicly or accept new applications.

However, authorised employer representatives may continue to access applications already received until the vacancy's original expiry deadline or permanent closure, whichever occurs first.

Temporary unpublishing does not extend the original retention period.

When a vacancy permanently closes, expires or otherwise reaches the end of its applicable retention window, employer access to the application through our platform ends.

Our automated deletion process then removes the application information held by us for that vacancy, including associated CVs and application documents.

8.2 Permanent deletion of job listings

An employer may permanently delete a closed job posting.

This removes the job record and remaining job-specific platform data associated with that vacancy.

It does not automatically delete a candidate's separate jobseeker account or reusable profile CV.

8.3 Reusable profile CVs

If you create a jobseeker account, you may choose to store a reusable CV in your application profile.

This CV is separate from copies submitted with individual applications.

Deleting or replacing your reusable profile CV does not automatically delete copies already submitted to employers.

Likewise, deleting applications associated with an expired vacancy does not automatically delete the reusable CV held within your account.

You may delete or replace the reusable CV using the available account functionality.

Reusable profile information is retained while it is required to provide the account functionality you have requested, subject to account deletion and any applicable legal retention obligations.

8.4 Employer-held copies

Employers may have downloaded application information before a vacancy closes.

Our Employer Terms require employers to stop using and securely delete application information when it is no longer required for the relevant recruitment process, unless another lawful reason permits or requires retention.

An employer may retain information where, for example:

• The candidate has separately agreed to retention for another clearly stated purpose.
• Retention is necessary to comply with a legal obligation.
• Limited retention is necessary to establish, exercise or defend legal claims.

Employers must not treat an application submitted for one vacancy as permission to retain the applicant in a general candidate database without appropriate transparency and a lawful basis.

The employer remains responsible for independently held copies.

9. Other retention periods

We retain personal information only for as long as necessary for the purposes for which it was collected or where further retention is required or permitted by law.

The following retention criteria apply:

When personal information is no longer required, we delete or anonymise it, subject to applicable legal requirements.

Where information is held in technical backups, deletion is subject to the applicable backup retention and deletion arrangements.

Backup information is not treated as active application data or made available through the ordinary employer application interface.

We do not retain personal information indefinitely merely because storage capacity is available.

You can contact us to request further information about the retention criteria applicable to your personal information.

10. Employer accounts and company information

Employer account information is used to provide and secure employer functionality.

This includes:

• Creating and managing company profiles.
• Submitting companies for verification.
• Publishing and managing vacancies.
• Accessing applications associated with the employer.
• Managing employer account access.
• Communicating about account and platform matters.

Some company information is intended to be publicly available.

This may include company names, websites, descriptions, locations, industry information and published vacancies.

Where a public company profile contains personal information identifying an individual, the relevant data protection rights continue to apply.

Employer authentication information, private applications and internal account records are not intended to be publicly available.

Companies can request corrections or complete removal from Find a Startup Job UK by contacting findastartupjob@proton.me.

The company removal procedure is described in our Terms of Use.

11. Who we share information with

We share personal information only where necessary for the purposes explained in this notice or where required or permitted by law.

11.1 Employers

When you submit an application through our platform, we provide the application to the employer associated with the vacancy you selected.

The employer may act as a separate data controller for its subsequent recruitment activities.

11.2 Technical service providers

We use third-party services to operate the platform.

These include:

These providers may process relevant personal information in providing their services.

Depending on the service and processing activity, a provider may act on our behalf as a processor or have separate legal responsibilities.

We use service providers for purposes connected with operating the platform and do not authorise them to use candidate applications for unrelated recruitment or marketing purposes.

11.3 Legal and regulatory disclosures

We may disclose personal information where necessary to:

• Comply with applicable law.
• Respond to a lawful regulatory or judicial request.
• Investigate suspected fraud or security incidents.
• Protect users and the platform.
• Establish, exercise or defend legal claims.

Any disclosure will be limited to what is appropriate and legally permitted in the circumstances.

We do not sell personal information.

12. Cookies and analytics

Find a Startup Job UK uses cookies and similar technologies where necessary to operate the service or provide permitted analytics functionality.

12.1 Essential technologies

Essential technologies may support:

• Authentication.
• Session management.
• Account security.
• Fraud prevention.
• Protection against automated abuse.

Where these technologies are strictly necessary to provide a service requested by the user, consent is not required under the applicable cookie rules.

12.2 Analytics

We may use analytics technologies, including Google Analytics, to understand how visitors use the platform.

This may include information about page visits, website usage, technical performance and interactions with the service.

Where analytics technologies require consent under applicable law, we obtain consent before activating them.

Where an applicable statutory exception permits analytics without consent, the relevant conditions must be satisfied, including providing clear information and a simple, free mechanism for users to object where required.

Analytics information is used for the purposes explained in this notice and in accordance with applicable law.

Any analytics configuration must reflect the choices available to users through the website's implemented consent or objection mechanism.

13. International processing and transfers

Some of our technical service providers may process personal information outside the United Kingdom.

This may occur through hosting, support, email delivery, security infrastructure or other services necessary to operate the platform.

Where an international transfer is subject to the UK GDPR's restricted-transfer rules, it must be covered by an appropriate legal mechanism.

Depending on the destination and relevant contractual arrangements, this may include:

• Applicable UK adequacy regulations.
• The UK International Data Transfer Agreement.
• The UK Addendum to the EU Standard Contractual Clauses.
• Another applicable mechanism permitted by UK data protection law.

Where appropriate safeguards are used, the relevant legal requirements, including any required transfer risk assessment, must be satisfied.

You may contact findastartupjob@proton.me to request information about the safeguards applicable to transfers of your personal information and how to obtain a copy of relevant safeguards, subject to appropriate redaction.

We do not assume that information is processed exclusively within the UK simply because the platform is operated by a UK company.

14. Security

We use technical and organisational measures designed to protect personal information against unauthorised access, disclosure, alteration, loss and other inappropriate processing.

These measures include, where appropriate:

• Access controls.
• Authentication.
• Database-level access policies.
• Private file storage.
• Short-lived authorised download links.
• Bot and abuse protection.
• Secure transport using HTTPS.
• Restricted administrative access.
• Automated deletion processes for application data.

Employer access to candidate information is restricted to the applications associated with the relevant employer.

Private application documents are not intended to be publicly accessible.

We review security controls as the platform develops.

No internet service can guarantee absolute security, but we take reasonable steps to protect the information entrusted to us.

15. Your data protection rights

Under UK data protection law, you may have the following rights, depending on the circumstances.

• Access. You may request confirmation of whether we process your personal information and ask for a copy of information to which you are entitled.
• Rectification. You may ask us to correct inaccurate personal information or complete information that is incomplete.
• Erasure. You may ask us to delete personal information where the applicable legal conditions are met.
• Restriction. You may ask us to restrict certain processing activities in circumstances provided for by law.
• Objection. You may object to certain processing of your personal information. In particular, where we rely on legitimate interests as our lawful basis, you have the right to object to that processing. We will assess your objection and stop the processing unless we can demonstrate applicable compelling legitimate grounds or another relevant legal basis for continuing.
• Data portability. Where the applicable conditions are met, you may request certain personal information in a structured, commonly used and machine-readable format.
• Withdrawal of consent. Where we rely on your consent, you may withdraw it at any time. Withdrawal does not affect the lawfulness of processing carried out before consent was withdrawn.

How to exercise your rights. Email: findastartupjob@proton.me

You do not need to create an account or use a specific form to exercise your rights.

We may request information to verify your identity where necessary and proportionate.

We will respond without undue delay and ordinarily within one calendar month, subject to applicable extensions or other legal provisions.

We do not charge a fee for ordinary requests. A reasonable fee may be permitted in limited circumstances provided for by law.

Not every right applies to every processing activity, and certain lawful exemptions may apply.

If we cannot fulfil a request, we will explain the relevant reason where required by law.

16. Data protection complaints

If you have a concern or complaint about how Find a Startup Job UK collects, uses, stores, shares or otherwise processes your personal information, you can contact us directly.

Email: findastartupjob@proton.me

Please provide enough information to help us understand and investigate your complaint.

We may request additional information where reasonably necessary.

We will:

• Acknowledge receipt of your complaint within 30 days.
• Take appropriate steps to investigate your complaint without undue delay.
• Keep you informed of the progress of our investigation without undue delay.
• Explain the outcome and any appropriate action taken without undue delay.

Complaints to the ICO

You also have the right to complain to the Information Commissioner's Office (ICO), the UK's data protection regulator.

You do not have to contact us before raising a complaint with the ICO.

ICO website: https://ico.org.uk

ICO telephone: 0303 123 1113

We will not restrict your right to raise a complaint with the ICO.

17. Artificial intelligence and automated processing

Find a Startup Job UK may use artificial intelligence and automated systems to process information associated with job listings and provide related platform functionality.

This may include generating shorter summaries of published job descriptions.

These summaries are intended to help jobseekers understand vacancies and are not recruitment decisions made about individual candidates.

AI-generated job summaries may be incomplete or inaccurate. Users should refer to the employer's original vacancy for complete information.

Where AI functionality processes personal information, that processing is subject to the purposes, lawful bases and data protection requirements explained in this notice.

Find a Startup Job UK does not currently use solely automated decision-making that produces legal or similarly significant effects on candidates.

We do not make hiring decisions on behalf of employers.

Employers are responsible for their own recruitment decisions.

If we introduce processing that materially changes how personal information is used, we will update our privacy information and provide any additional information required by law before commencing that processing.

18. Children

Find a Startup Job UK is intended for people seeking employment and for employers.

The service is not designed for children under 16.

We do not intentionally operate the platform as a service directed at children under 16.

If we become aware that personal information has been collected from a child in circumstances where it should not have been collected or cannot lawfully be retained, we will take appropriate action, including deletion where required.

19. Third-party websites

The platform may contain links to external websites, including:

• Employer careers pages.
• Applicant tracking systems.
• Company websites.
• LinkedIn profiles.
• Other relevant external services.

These websites are operated by third parties and may have their own privacy practices.

We do not control the processing of personal information carried out independently by those organisations.

You should review their privacy information before providing personal information directly to them.

This does not affect our responsibility for personal information processed by Find a Startup Job UK.

20. Changes to this Privacy Notice

We may update this Privacy Notice to reflect:

• Changes to the platform.
• Changes in how we process personal information.
• Changes to relevant service providers.
• Changes in applicable law.
• Changes to our data protection practices.

The latest version will be published on this page with its updated publication date.

Where a material change affects how we use personal information, we will provide any additional information or notification required by law.

We will not treat publication of an updated notice as permission to carry out processing that requires a separate lawful basis or consent.

21. Contact and legal information

You can contact us at findastartupjob@proton.me with any questions about this notice, how your information is used or your data protection rights.

For complaints concerning data protection, you may also contact the Information Commissioner's Office at https://ico.org.uk.