Privacy Policy

1. Information We Collect

Candidate Application Information

When you submit a candidate application through our website, we collect the following information:

• Full name, email address, and phone number
• Your current location and the role you are seeking
• Your postcode district, which we use to gauge how practical each role's location would be for you
• How you usually get to work (public transport, car, motorbike or moped, bike, e-bike or e-scooter, walking, or any of these), which we use with your postcode district to estimate your journey time to each role
• Years of experience in the hospitality industry
• Your salary or pay expectations, and whether you are seeking full time or part time work, which we use to gauge how practical each role would be for you
• A written statement describing your career background and what you are looking for in your next role
• CV or résumé (uploaded as a PDF or Word document, or provided as a LinkedIn profile URL)
• Qualifications and certifications (uploaded documents or images, optional)
• Portfolio photographs of your work (up to three images, optional)
• Your public Instagram handle, where provided as an alternative portfolio link (optional)
• Your right to work status. If you hold a visa or pre settled status, we also ask for the month it expires, your Home Office share code and your date of birth (see Right to Work Information below)
• Any other information you choose to include about your right to work in the UK or visa requirements

Right to Work Information

If you tell us you hold a visa or pre settled status, we ask for your Home Office share code and your date of birth. The Home Office online service needs both together before it shows us your right to work details. We also ask for the month your visa expires. We ask visa holders only: we do not ask British or Irish citizens, or people with settled status, for a date of birth. You give these details on your application form, or on the update page linked from our availability check in emails if your status changes. We do not save your share code or date of birth on your candidate profile. They reach us in the email we receive when you apply or update your details.

Employer and Business Enquiry Information

When a business submits an enquiry through our website, we collect the contact person's name, email address, phone number, business or venue name, region, and hiring timeframe. In the course of follow-up communications, we may also collect further details of the role or roles they are seeking to fill.

Additional Recruitment Information

During the recruitment process we may collect additional information. This includes employment history, right to work documents, and references from previous employers. We collect only what is relevant to assessing suitability for a role. Where references are requested, we send a secure tokenised link directly to the referee nominated by the candidate. This means we may receive personal information about a candidate from a third party who did not submit information to us directly.

Age Requirement

Our services are intended for individuals aged 18 and over. We do not knowingly collect personal information from anyone under the age of 18. If you believe we have inadvertently collected information from a minor, please contact us and we will delete it promptly.

Account Information (Candidates and Clients)

If you sign in to your Cookaburra account, we collect and hold the following. We do not use passwords: you sign in with a one time code sent to your email.

• Your sign in email address and when you signed in
• The settings you choose, such as the roles, areas, pay and travel distance you prefer, and your alert choices
• The roles you view or say you are interested in
• Photos you add to your portfolio, and their captions
• Your answers to introduction requests from venues, and a record of exactly what you agreed to share and when
• If you turn on notifications, a device address supplied by your browser's push service
• For clients: your business and contact name, and the briefs and introductions linked to your account. When you ask for an account we also collect your position, business address, phone number, company number (if you have one), VAT number (if you have one) and website, which we use to check the business before we approve the account and to fill in our terms of business and data sharing agreement for you to sign. Your signed copies are kept in your account.

Website Usage Information

We collect anonymised information about interactions with our website, including pages visited, time spent on pages, and general device and browser information, for the purpose of improving user experience. This data does not identify you personally.

2. How We Collect Your Information and Why

• Directly from you: We collect information when you submit a candidate application, make a business enquiry, use our live chat, or communicate with us by any means.
• CVs sent to us by email: If you email your CV to us directly rather than applying through the website, we add it to our candidate database and assess it in the same way as a website application.
• From third parties: We may receive information from references, former employers, or background screening agencies as part of the recruitment process.
• From social media platforms: As part of our recruitment activities, we may review publicly available profiles and information on LinkedIn, Facebook, Instagram, X (formerly Twitter), and WhatsApp to assess candidate suitability or identify potential candidates. We only collect information that is publicly available or that you have shared with us directly through these platforms.
• Legitimate interests: We collect and process personal information to conduct recruitment activities, assess candidate and client suitability, facilitate placements, and comply with our legal obligations under UK law.

3. How We Use Your Information

• Candidate assessment: We use application information, including written statements, CVs, portfolio photographs, qualifications, and social media handles, solely to assess your suitability for permanent hospitality roles. Portfolio materials are reviewed by our recruitment team and are never published or shared publicly.
• Merit scoring and fit: Candidates are scored on merit. Personality and team fit differ from venue to venue and depend on human judgement, which can be affected by bias and cannot be measured with complete accuracy, so we may not always get it right. We take precautions to reduce that risk, including fairness audits of our scoring and a personal review of every shortlist, and we use feedback after interviews and trial shifts to improve future matches.
• Right to work checks: We use your share code and date of birth only to check your right to work in the UK through the Home Office online service, and to keep a record that we did. We do not use them for scoring, matching or marketing. UK immigration law requires a right to work check before someone starts a job, and we carry out or support that check for the roles we place. Our lawful basis is our legal obligation, and our legitimate interest in putting forward only people who can lawfully work.
• Visa limits on roles: We use your visa type and expiry month to match you to roles you can start in and stay in. Candidates on a visa other than a Skilled Worker visa need at least 12 months left on it, because our clients rely on people staying in a role for at least a year. Candidates on a student visa are matched to part time roles of up to 20 hours a week until their visa changes, and only the venue they work for can offer them more hours in official holidays and breaks.
• Candidate presentation: With your explicit consent, we may share your profile (including relevant application materials) with prospective employers. We will always speak with you before presenting you to any client.
• Introductions through your account: We may show a client an anonymous profile of you for a role: your area, your years of experience, your most recent role and the type of venue, your availability, and your right to work category. It never includes your name, contact details, past venue names, scores or our written summary. If the client is interested, we ask you through your account, and the request names the venue so you know exactly who you are agreeing to share with. Only if you say yes (your explicit consent, which you can decline without any effect on your other applications) are your name, contact details, CV and the portfolio photos we have approved shown to that one client, for that one role. If you say no, nothing is shared and the client is only told that you are not available. We keep a record of your answer and the wording you agreed to. When a client later offers you interview or trial times, you will see where to go, what to bring and the times offered, and your chosen time is shared with that client. You can take your yes back at any time from your account: the venue then can no longer see your details, any interview or trial time is cancelled, and we record that you withdrew. Details a venue has already seen or copied cannot be taken back, so tell us if you are worried.
• Alerts: We send alerts only if you turn them on in your account, by notification on your device or by email, and your consent is the basis for them. They are limited to 10 a week for introductions and shortlists and 2 a week for new roles, they never contain a venue, client or person's name, and you can pause or stop them at any time from your account.
• Availability check-ins: We periodically send availability check-in messages to candidates in our database via email and WhatsApp, asking whether they are actively looking, open to opportunities, or settled in a role. These check-ins occur no more than once every 8 weeks. You may opt out at any time by selecting the relevant option in any check-in message or by contacting us directly.
• Employer matching: We use employer enquiry information to identify and propose suitable candidates for their vacancies.
• Job advertising: When advertising a role on behalf of a client, we may include publicly available details about the client's business in the job description, such as their Instagram handle, website URL, or venue name. We will only include information that is already publicly available or that the client has provided to us for this purpose.
• Communication and direct marketing: We use your contact details to correspond with you about your application or enquiry, and to keep you informed of relevant opportunities. If you no longer wish to receive marketing communications, you may opt out at any time by clicking the unsubscribe link in any email or by contacting us directly.
• Website improvement: We use anonymised usage data to analyse trends and improve the performance and content of our website.

4. Information Sharing and Third-Party Services

We do not sell your personal information. We share it only as described below.

• Prospective employers (candidates only): With your prior consent, we may share relevant application materials with client businesses for the purpose of facilitating a placement. Through your account, this happens only after you say yes to that specific role.
• Cookaburra sister companies: We may share personal information with affiliated companies where relevant to recruitment activities or business operations. Any such sharing is conducted under confidentiality obligations and in accordance with the UK GDPR.
• Mailchimp (contact records): When a business submits an enquiry through our website, their contact details are stored in Mailchimp as a non-subscribed contact, for our own record-keeping. We do not add enquirers to any marketing list and do not send them marketing emails unless they subscribe themselves. Mailchimp is operated by The Rocket Science Group LLC (Intuit), a US-based service, and use of this service involves the transfer of data outside the UK. We rely on Standard Contractual Clauses for this transfer. Mailchimp's privacy policy is available at mailchimp.com/legal/privacy.
• Scratchy AI Chat (website chatbot): Our website features Scratchy, an AI-powered chat assistant. Messages you send through the chat are processed via the Anthropic API (Claude) to generate responses. Anthropic, Inc. is a US-based company, and use of this service involves the transfer of data outside the UK. Conversation records are stored securely on our servers for up to 30 days, after which they are automatically deleted. Active chat session tokens expire after 4 hours of inactivity. No personally identifiable information is collected through the chat unless you voluntarily provide it. When a visitor starts an enquiry, our team is notified through WhatsApp. The notification includes the visitor's message and any name or email address they choose to give us, and a member of our team may then reply to the chat directly. We rely on Standard Contractual Clauses for this transfer. Anthropic's privacy policy is available at anthropic.com/privacy.
• AI-powered job description generation (employers): When an employer completes our role brief questionnaire, the answers provided are sent to the Anthropic API (Claude) to generate a draft job description. This information includes business details and role requirements supplied by the employer, such as venue name, location, and role specifics. No candidate personal information is involved in this process. The generated job description is stored on our servers and returned to the employer for review and editing. Anthropic, Inc. is a US-based company and use of this service involves the transfer of data outside the UK. We rely on Standard Contractual Clauses for this transfer. Anthropic's privacy policy is available at anthropic.com/privacy.
• Home Office right to work service: To check your right to work we enter your share code and date of birth into the Home Office online service. The Home Office is a UK government department and no transfer outside the UK is involved. The Home Office's guidance is available at gov.uk/view-right-to-work.
• Social media platforms: We maintain business profiles on LinkedIn, Facebook, Instagram, X (formerly Twitter), and WhatsApp. If you interact with us through these platforms, the relevant platform's privacy policy applies to that interaction. These platforms are operated by US-based companies (Meta Platforms, Inc.; LinkedIn Corporation; X Corp) and your information will be subject to their respective terms and privacy policies.
• WhatsApp (candidate communications): We use WhatsApp to send availability check-ins and notifications to candidates who have provided their phone number. Messages are sent from our business WhatsApp account. WhatsApp is operated by Meta Platforms, Inc., a US based company. Use of this service involves the transfer of data outside the UK. We rely on Standard Contractual Clauses for this transfer. Meta's privacy policy is available at facebook.com/privacy/policy.
• Calendly (appointment scheduling): Our website uses Calendly to allow clients and candidates to book discovery calls. Calendly collects names, email addresses, and scheduling information. Calendly is a US-based service. Calendly's privacy policy is available at calendly.com/privacy.
• Granola (meeting recording): We use Granola to record and transcribe sessions with clients and candidates. Audio recordings and transcripts may contain personal information discussed during these sessions. Granola is a US-based service. We will inform participants before recording any session. Granola's privacy policy is available at granola.ai/privacy.
• Slack (internal communications): We use Slack for internal team communications. Personal information relating to candidates or clients may be referenced in Slack channels as part of our recruitment workflow. Slack is operated by Slack Technologies LLC (Salesforce), a US-based company. Slack's privacy policy is available at slack.com/privacy-policy.
• Streak (CRM and email management): We use Streak, a Gmail-integrated CRM platform, to manage candidate and client pipelines, track email communications, and store contact information. Streak may process personal information including names, email addresses, phone numbers, and the content of email communications. Streak is a US-based service operated by Streak Technologies Inc. Streak's privacy policy is available at streak.com/privacy-policy.
• Artificial intelligence tools: We may use AI-powered tools including Grok (xAI Corp), Claude (Anthropic), and Dia (The Browser Company) to assist with tasks such as drafting communications or summarising information. Where personal information is used in conjunction with these tools, we take care to use only what is necessary. These tools are operated by US-based companies and are subject to their respective privacy policies. Our team may also use an AI assistant (Claude, by Anthropic) connected to our candidate and employer records to help staff search records, summarise pipeline activity and prepare follow up messages. Records shared this way may include names, contact details, work history and notes. Anthropic is a US based company, so this involves a transfer of personal data outside the UK, and we take reasonable steps to protect it. A member of our team reviews every output, and no placement, rejection or ranking decision is made by AI alone.
• Meta Pixel and Conversions API (Facebook advertising): Our website uses the Meta Pixel to track conversions from Facebook and Instagram advertising campaigns and to support remarketing. The Meta Pixel only loads if you accept our cookie notice. It collects information about your visit to our website and shares it with Meta Platforms, Inc., a US-based company. We also use the Meta Conversions API, which sends certain data directly from our servers to Meta. We send it only if you accepted our cookie notice before you submitted the form. If you declined, or did not make a choice, nothing is sent to Meta from our servers. When you have accepted, it is sent when you submit a candidate application or an employer enquiry. For a candidate who applied, it is also sent later if a member of our team marks that candidate as qualified or placed, so that Meta can see which adverts lead to real results. This server side data includes your hashed email address and, where you gave them, your hashed phone number and hashed name, together with your IP address, browser user agent and, where available, identifiers set by the Meta Pixel or taken from the advert you clicked. Your email address, phone number and name are hashed using SHA-256 before transmission. Your IP address and browser user agent are sent as they are. If you accept our cookie notice and arrive from a Facebook or Instagram advert, the advert click identifier in the link is also kept in your browser's session storage for the length of your visit and sent to Meta with your form submission, so that Meta can match the visit to the advert. If you accept our cookie notice and arrive from one of our adverts, we also keep the advert's campaign name, advert ID and placement in your browser's session storage for the length of your visit and, if you apply, save them with your application so that we can see which adverts lead to applications. We use them only to measure our advertising. If you decline the cookie notice we do not record them. Meta's privacy policy is available at facebook.com/privacy/policy.
• Google Analytics (website analytics): Our website uses Google Analytics to collect anonymised data about how visitors interact with our website, including pages visited and time spent on pages. Google Analytics uses cookies and may transfer data to Google LLC servers in the United States. You can opt out of Google Analytics tracking via your browser settings or the Google Analytics opt-out browser add-on.
• Microsoft Clarity (behaviour analytics): Our website uses Microsoft Clarity to record anonymised user sessions, including clicks, scrolls, and mouse movements, to help us improve the website experience. Session recordings may incidentally capture information entered into forms. We have configured Clarity to mask sensitive form fields. Clarity is operated by Microsoft Corporation, a US-based company. Microsoft's privacy policy is available at privacy.microsoft.com/privacystatement.
• Google Workspace (email): We use Google Workspace to send and receive email communications, including form enquiries and candidate applications submitted through our website. Emails and their attachments are processed and stored by Google LLC, a US-based company. This includes the application and update emails that carry your share code and date of birth, where you have given them. Google's privacy policy is available at policies.google.com/privacy.
• Xero (accounting and payroll): We use Xero to manage our accounting, invoicing, and payroll obligations. Information relating to placed candidates and client businesses (such as names, contact details, and financial information) may be stored in Xero. Xero is a New Zealand-based company and may process data outside the UK. Xero's privacy policy is available at xero.com/uk/legal/privacy.
• Vercel Blob (CV storage): CVs uploaded through our website or added by our team are stored as private, encrypted files on Vercel Blob, a file storage service operated by Vercel, Inc. Storage nodes for this service are located in London, United Kingdom. CV files are accessible only via authenticated, time-limited API routes and are never publicly accessible. Vercel, Inc. is a US-based company, and we rely on Standard Contractual Clauses for any processing of this data outside the UK. Vercel's privacy policy is available at vercel.com/legal/privacy-policy.
• Upstash Redis (candidate database): Candidate profile information, including name, email address, phone number, location, postcode district, how you usually get to work, applied role, your written application statement, a structured summary of the work history extracted from your CV (employers, roles, and dates), and AI-generated suitability scores, is stored in Upstash Redis, a managed cloud database service hosted on AWS infrastructure in London, United Kingdom (AWS eu-west-2). No international transfer of this data takes place. Upstash's privacy policy is available at upstash.com/trust/privacy.pdf.
• Supabase (account sign in and account data): Your sign in, account settings, alert choices, introduction records and consent records are stored with Supabase, a service operated by Supabase, Inc., a US based company. The data is stored in London, United Kingdom. Where Supabase staff or sub processors outside the UK can access it, the transfer is covered by the UK International Data Transfer Addendum to the standard contractual clauses. Portfolio photos are stored as private files on Vercel Blob (see above). Supabase's privacy policy is available at supabase.com/privacy.
• Resend (sign in emails): When you ask for a sign in code, your email address and the code are sent through Resend, an email delivery service operated by Resend, Inc., a US based company. Our account sends from servers in Ireland. Where Resend's staff or sub processors outside the UK can access the data, the transfer is covered by the UK International Data Transfer Addendum. Resend keeps a delivery record (the address, the time and whether the email was delivered) for a short period. Resend's privacy policy is at resend.com/legal/privacy-policy.
• Browser push services (notifications): If you turn on notifications, the message is delivered through the push service of your browser or phone (for example Google, Apple, Mozilla or Microsoft). They receive the message and a device address, not your name or account details. Some of these providers are outside the UK and are covered by their own transfer safeguards.
• Journey time services (postcodes.io, Transport for London and Google Routes): To estimate how long your journey to a role would take, we send your postcode district and the role's venue postcode to postcodes.io, a postcode lookup service, to turn them into map coordinates. We then send those coordinates to the Transport for London Journey Planner (for public transport, cycling and walking) or, if you told us you usually travel by car, motorbike or moped, to the Google Routes API (Google LLC, a US based company) to get a journey time. No name, email address, phone number or other personal details are sent. The journey time is used only as one input to how well a role suits you, and a long journey never rules you out of a role on its own.
• Cultural fit questionnaire (Premium roles): For Premium placements, after we have spoken with you and before we put you forward, we may email you a short working style questionnaire. Your answers, our notes from our call with you, and the venue's own description of its culture are used to prepare a short summary for the client. The answers are processed by the Anthropic API (Claude) to help draft that summary. Anthropic is a US based company, and we rely on Standard Contractual Clauses for this transfer. A member of our team reviews and approves the summary before it is shared, and nothing is scored automatically or used to rank you. The questionnaire does not ask about protected characteristics. Our lawful basis is our legitimate interest in placing candidates in roles that suit them, and you may object to it at any time. You can ask to see or delete your answers by contacting us.
• Retention check in feedback (Premium roles): For Premium placements, our 4, 12 and 20 week check in emails include a short private feedback form for the candidate and for the client. Candidates tell us how the role is going and what their experience of the venue is against our published Standard. Clients tell us how the placement is going and how the venue is doing against the Standard. Candidates choose whether their answers may be shared with the venue. The default is that they are not, and we will not share their answers or anything that could identify them unless they say yes. Our team reads the answers to prepare for the check in call, and we may use the Anthropic API (Claude) to help draft a private preparation brief. Anthropic is a US based company, and we rely on Standard Contractual Clauses for this transfer. A member of our team reads and checks the brief, and nothing is scored automatically or used to rank anyone. Our lawful basis is our legitimate interest in helping placements last, and you may object at any time. You can ask to see or delete your answers by contacting us.
• AI-powered candidate scoring: CVs submitted through our website, emailed to us directly, or added by our recruitment team are processed by the Anthropic API (Claude) to generate a numerical suitability score against our active job descriptions and to extract key contact details (name, email address, phone number, and location) and a structured summary of your work history (employers, roles, and dates). Your written application statement, where provided, is also sent to Anthropic and is used to inform the written assessment (the summary, strengths, and gaps); it does not affect the numerical score. We separately use your stated location, postcode district, availability, salary or pay expectations, and preference for full time or part time work to estimate how practical each role would be for you, which forms one part of the overall match score. The AI-generated score, a brief written summary, the strengths and gaps identified, and extracted contact details are stored in our candidate database. These scores support, but do not replace, human judgement: a member of our recruitment team always reviews a candidate before they are presented to any client. Where a recruiter reviews and manually adjusts a score, we also record the adjusted score, a written reason for the adjustment, and the date it was made. We periodically run fairness audits on the automated scoring to check that it is not influenced by characteristics unrelated to job suitability. The CV document is stored separately on Vercel Blob. Anthropic, Inc. is a US-based company and we rely on Standard Contractual Clauses for this transfer.
• Vercel Analytics: Our website uses Vercel Analytics for anonymised, aggregate website performance data. No personally identifiable information is collected by this service.
• Employer acknowledgements: When an employer proceeds with our services, we collect a digital acknowledgement of our terms of business via a secure, tokenised link sent by email. We record the fact of acknowledgement, the timestamp, and the employer's email address. This information is stored on our servers and used only for our own records.
• Other service providers: We may share information with other trusted service providers who assist us in business operations (e.g., IT support, background screening) under confidentiality obligations.
• Legal compliance: We may disclose personal information when required by law or in response to lawful requests from government authorities.

Forms on our website are processed via Vercel infrastructure. CVs are stored on Vercel Blob with storage nodes in London, United Kingdom. Candidate profiles and scores are stored in Upstash Redis, with its primary node in London, United Kingdom. Some of the other third-party tools we use are based outside the UK. Where your data is transferred internationally, we take steps to protect it. We rely on Standard Contractual Clauses or adequacy decisions where required by the UK GDPR.

5. Portfolio Materials and Creative Work

Photographs, documents, and other portfolio materials submitted as part of a candidate application are used only for internal assessment purposes. They are not published, displayed publicly, or shared with any party other than prospective employers (with your consent). You may request deletion of your portfolio materials at any time by contacting us.

6. Data Security

We employ reasonable industry-standard security measures to protect your personal information from unauthorised access, use, or disclosure. However, no transmission or storage method is 100% secure. We encourage you to contact us immediately if you believe your information has been compromised.

7. Data Breaches

We are subject to the data breach notification obligations under the UK GDPR. If we become aware of a personal data breach that is likely to result in a risk to the rights and freedoms of individuals, we will notify the Information Commissioner's Office (ICO) within 72 hours of becoming aware of it, and where required, notify affected individuals without undue delay. We maintain an internal data breach response procedure to ensure we meet our obligations.

8. UK GDPR and Data Protection Act 2018 Compliance

Cookaburra Ltd complies with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and other applicable data protection laws and regulations.

Cookaburra Ltd is registered with the Information Commissioner's Office (ICO) as a data controller. Registration reference: ZB664160.

9. Data Retention

We retain personal information for as long as necessary to fulfil the purposes outlined in this Policy, or as required by law. In practice:

• Website chat: conversation records are deleted automatically after 30 days, and chat session tokens expire after 4 hours of inactivity.
• Employer role briefs: unfinished brief links expire after 14 days. Completed briefs, live vacancies, and the role specific match scores and rankings generated for them are deleted automatically after 90 days. Venue details saved to speed up future briefs are deleted after 12 months.
• Candidate profiles and CVs: kept while we may still consider you for opportunities, and deleted when you ask us to. You may request deletion at any time by contacting us.
• Account records: if you delete your account, your sign in, settings, alert choices, interest in roles and portfolio photos are deleted straight away. If you delete your account, any details a venue could see stop being shown to them at once. A short record of what you agreed to share (the date, the wording, the venue and an internal reference, but not your name, email or contact details) is kept without your sign in, as evidence that we asked properly. Logs of alerts we sent are deleted after 90 days, and closed introductions and the list of roles you have viewed are deleted after 12 months. A client's signed agreement and briefs are kept as business records.
• Cultural fit questionnaires: your answers and any summary are deleted automatically 12 months after the questionnaire was sent.
• Retention check in feedback: answers and any preparation brief are deleted automatically 12 months after the check in email was sent.
• References: the contact details of referees we ask for a reference, and any replies they send, are deleted automatically 24 months after the last activity on that request, which is normally the date of the last reply.
• Right to work details: your share code and date of birth are held in our email records only as long as we need them to evidence the check. Where a placement goes ahead, we keep that evidence for the length of the employment plus two years, as Home Office guidance asks. You may ask us to delete them at any time, unless the law requires us to keep them.
• Placement records: kept for as long as we need them to meet our legal, tax, and record keeping obligations.

10. Your Data Protection Rights

Under the UK GDPR and Data Protection Act 2018, you have the following rights:

• Right of access: You may request copies of the personal information we hold about you.
• Right to rectification: You may ask us to correct personal information that is inaccurate or incomplete.
• Right to erasure: You may ask us to delete your personal information in certain circumstances.
• Right to restrict processing: You may ask us to limit how we process your personal information in certain circumstances.
• Right to object: You may object to the processing of your personal information in certain circumstances.
• Right to data portability: You may ask us to transfer your personal information to another organisation or directly to you in certain circumstances.
• Rights in relation to automated decisions: We use automated scoring to help assess and rank candidates, but a member of our team always reviews you before any decision to put you forward. You may ask us to explain how a score was reached, to have it reviewed by a person, or to contest it.
• Download and delete in your account: If you have an account, you can download a copy of the information your account holds, and delete your account, from the Account tab at any time. Internal assessments we make while recruiting (such as match scores, written summaries and recruiter notes) are not in the download, but you can ask us for them under your right of access, and we may decline only where the law allows. If you ask us to delete your recruitment record as well, we will do so within 30 days unless the law requires us to keep it.

There is no charge for exercising these rights. We will respond to requests within a reasonable timeframe and no later than 30 days.

11. Cookies

Our website uses cookies and similar technologies for the following purposes:

• Consent: A cookie records whether you have accepted or declined our cookie notice.
• Analytics: Google Analytics and Microsoft Clarity use cookies to collect anonymised data about how visitors interact with our website, including pages visited, session duration, and user behaviour.
• Session recording: Microsoft Clarity records anonymised session replays (clicks, scrolls, mouse movements) to help us improve the website.
• Advertising: The Meta Pixel (Facebook) uses cookies to track conversions and support advertising on Facebook and Instagram.
• Advert tracking: If you accept cookies and arrive from one of our adverts, your browser's session storage holds the advert's campaign name, advert ID and placement until you close the tab. They are sent with your application if you submit one. Meta's advert click identifier from the link is held in the same way, once you accept cookies, and sent to Meta with a form submission.
• Chat assistant: Scratchy, our AI chat assistant, sets two cookies that are strictly necessary for the chat to work and are not used for tracking. One proves that a saved conversation belongs to your browser and is kept for up to 30 days. The other is set when you start a live chat with our team, proves that the live chat belongs to your browser, and is kept for up to 4 hours. A session token is also stored in your browser's session storage to maintain chat continuity during your visit. Conversation records are stored on our servers for up to 30 days.
• Account: If you sign in to your account, strictly necessary cookies keep you signed in, and a small service worker file lets the account work as an installed app and show notifications you have chosen. They are not used for tracking and the service worker stores no pages or personal information.
• Booking: Calendly sets cookies when you use the booking widget to schedule a call.

You can control cookies through your browser settings. Declining cookies via our cookie notice will prevent analytics, session recording, and advertising cookies from being set. Some functionality (such as live chat and booking) may be affected if cookies are disabled. For more information, see the privacy policies of the respective third-party services listed in section 4.

12. How to Complain

If you have any concerns about our use of your personal information, please contact our Privacy Officer in the first instance using the details in section 13. We will endeavour to resolve your concern promptly.

If you remain unsatisfied, you may lodge a complaint with the Information Commissioner's Office (ICO):

13. Contact Us

To exercise your rights, request deletion of your data, or raise a privacy concern, please contact our Privacy Officer:

14. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. The effective date at the top of this page indicates when it was last revised. We encourage you to review this Policy periodically.