Legal
Privacy Policy
Last updated October 1, 2026 · Version 2026-10-01
DRAFT — requires legal review
On this page
- 1. Who we are
- 2. Scope
- 3. Personal data we collect
- 4. What we do not collect
- 5. How we use your data, and lawful basis
- 6. Automated decision-making
- 7. Who we share data with
- 8. International transfers
- 9. How long we keep data
- 10. How we protect data
- 11. Your rights
- 12. Cookies and local storage
- 13. Children
- 14. Changes to this policy
- 15. Contact and complaints
Who we are
Candidates Bridge is operated by [Legal entity name] (registered address and company number: [Q-04]). For privacy questions, contact support@candidatesbridge.com.
If a UK or EU representative is required, their details will be published here [Q-05]. We do not currently appoint a Data Protection Officer; privacy requests are handled by our support team.
Scope
This policy describes how we handle personal data when you visit our website, submit an application, or receive career support from us. It does not describe how employers process data if you apply to them directly.
Personal data we collect
We collect the information you provide in your application and information generated by our systems to operate the service securely. Do not include photos, date of birth, ID numbers, health information, or other sensitive data in your resume.
| Category | Examples | Source |
|---|---|---|
| Identity and contact | Full name, email, country of residence, city (optional) | You |
| Professional profile | LinkedIn URL, GitHub or portfolio URL, specialty, seniority, years of experience, skills, employment status (optional), resume file and its contents | You |
| Career goals | Target job titles, target markets, work arrangements, work authorization per market, sponsorship need, salary expectation (optional), job-search stage, challenges, how you heard about us (optional) | You |
| Consent records | Privacy notice acknowledgement time and version | You / system |
| Technical and security | Hashed IP address, browser user agent, bot-check result, rate-limit counters, web-server logs (may contain raw IPs) | System |
| Communications | Emails we send you and delivery status; emails you send us | System / you |
| Assessment | Internal review notes and scores about your application | Our team |
| Engagement (if applicable) | Agreement version and acceptance, focus areas, support notes | Our team / you |
What we do not collect
We do not ask for age, date of birth, gender, ethnicity, photos, citizenship documents, or passport numbers as part of the application form.
How we use your data, and lawful basis
We use personal data only for the purposes described below. Lawful bases are stated for UK/EU GDPR and must be confirmed with counsel [CONFIRM: Q-02].
| Purpose | Lawful basis (draft) |
|---|---|
| Assessing your application | Steps at your request before entering a contract (Art. 6(1)(b)) |
| Screening, fraud prevention, security, service improvement | Legitimate interests (Art. 6(1)(f)) with balancing assessment |
| Record-keeping where required | Legal obligation (Art. 6(1)(c)) where applicable |
| Delivering agreed engagement services | Contract (Art. 6(1)(b)) |
For Canada, we will describe PIPEDA-consistent purposes and consent where required.
Automated decision-making
We do not make automated decisions about candidates. Every application is reviewed by a person. Internal scorecards are a reviewer aid only and are not used as automatic accept or reject thresholds.
International transfers
Where data is processed outside the UK or EU (for example by US-based email or security providers), we rely on appropriate safeguards such as EU Standard Contractual Clauses, the UK IDTA or Addendum, or the EU-US Data Privacy Framework where the provider is certified [VERIFY per provider]. Primary hosting region: [Q-07].
How long we keep data
| Data | Default retention (draft, Q-03) |
|---|---|
| Declined or withdrawn applications | 12 months after the decision |
| Waitlisted applications | 12 months after last activity |
| Engaged candidates | 6 years after the engagement closes |
| New / under-review applications | Until a decision, then as above |
| Email delivery logs | Same as the related candidate record |
| Rate-limit counters | Up to 24 hours |
| Web-server logs | [PROPOSE: 14 days], then deleted |
| Encrypted backups | Rolling retention (7 daily, 4 weekly, 6 monthly). Deleted data may persist in backups for up to about 6 months until backups expire. |
How we protect data
We use TLS in transit, mandatory multi-factor authentication for admin access, malware scanning of uploads, storage outside the public web root, encrypted off-site backups, and access logging.
Your rights
Depending on where you live, you may have rights to access, correct, delete, restrict, or object to processing, and to data portability. UK and EU residents may complain to the ICO or their local supervisory authority. Canadian residents may request access and correction under PIPEDA. US state privacy laws may apply in some states [CONFIRM thresholds].
To exercise your rights, email support@candidatesbridge.com with “Privacy request” in the subject line. We may need to verify your identity. We aim to respond within one month, extendable where permitted by law.
Children
Our services are not directed at people under 18. We do not knowingly collect children's personal data.
Changes to this policy
We version this policy (YYYY-MM-DD). The version you acknowledge when applying is stored with your application. Material changes may be notified by email to active candidates where required.
Contact and complaints
Email: support@candidatesbridge.com. Postal address: [Q-04]. You may also contact your supervisory authority where applicable.
See also our Terms.