Privacy Policy

1. Who we are

The Service is provided by Career Catalyst & Recruitment Ltd, trading as The Career Catalyst, a company registered in England and Wales (number 16689261), registered office 82a James Carter Road, Mildenhall, Suffolk, England, IP28 7DE. You can contact us about anything in this policy through privacy@careercatalystscreener.com.

2. Our two roles

• We are the controller of personal data about our customers and their users (the people who sign up and use the Service), website visitors, and anyone who contacts us.
• We are a processor for the job applicants whose CVs and application forms our customers upload. The organisation that uploads them is the controller and decides why and how that data is used. We only process it on their instructions, under our Data Processing Agreement. If you applied for a job, please contact the organisation you applied to about your data; we will pass on any request we receive.

3. Personal data we collect as controller

• Account details: your name, email address and sign-in method (handled by our sign-in provider, Clerk). If you sign in with Google, we receive your name and email from Google.
• Organisation details: the company name you add in Settings.
• Billing details: your plan, billing period and subscription status. Payments are taken by Paddle, who act as our reseller and merchant of record; we never see or store your full card details.
• Usage information: the jobs you create, how many CVs you screen, reports you generate and emails you send through the Service, so we can provide it, apply plan limits and support you.
• Communications: messages you send us and our replies.
• Feature waitlists: if you ask to hear when a feature that isn't available yet launches (for example from our pricing page), your email address and which plan you were looking at.
• Technical information: IP address, browser and device type, and error logs, which our hosting providers record to keep the Service secure and working.

4. Why we use it and our lawful bases

• To provide the Service and manage your account and subscription: performance of our contract with you (Article 6(1)(b) UK GDPR).
• To keep the Service secure, prevent fraud and misuse, and improve it: our legitimate interests in running a safe, reliable service (Article 6(1)(f)).
• To keep financial and tax records: compliance with our legal obligations (Article 6(1)(c)).
• To tell you when a feature you joined the waitlist for is available: your consent (Article 6(1)(a)). We only email you about that feature, and you can withdraw consent at any time by contacting us.
• To send service messages (for example about your account, billing or important changes): performance of contract. We do not send marketing emails without your consent, and you can opt out at any time.

5. Candidate data and automated scoring

When a customer uploads CVs or application forms, the Service extracts the text and compares it with the customer's job description and criteria. It produces a score, a match category and a list of requirements evidenced or not found. The data processed can include names, contact details, employment history, education, qualifications and anything else the applicant included in their document.

• The scoring is a decision-support tool, not a decision. It ranks applications to help recruiters prioritise their reading. Decisions about who to interview or hire are made by the customer's staff, who can see why each score was given and can change any outcome.
• Customers agree, in our Terms, to keep meaningful human review of every decision, so that no applicant is subject to a decision based solely on automated processing that significantly affects them (Article 22 UK GDPR).
• The Service does not ask for special category data (such as health, ethnicity or religion) or criminal offence data, and does not use it in scoring. Customers should not ask applicants to include it in documents they upload.
• A blind screening approach is supported: anonymised application forms are labelled by reference rather than by name.

6. Who we share personal data with

We use trusted service providers (sub-processors) to run the Service: database and file storage, hosting, sign-in, payments and email delivery. They may only use the data to provide their service to us. The current list, and where each stores data, is in our Data Processing Agreement.

We do not sell personal data. We may disclose information where the law requires it, or to protect our rights or the safety of others.

7. International transfers

Our database and file storage are hosted in the European Union (Frankfurt, Germany), which the UK recognises as providing adequate protection. Some providers, such as our hosting and sign-in providers, are based in the United States. Where personal data is transferred outside the UK, we rely on UK adequacy regulations (including the UK Extension to the EU-US Data Privacy Framework where the provider is certified) or the International Data Transfer Addendum to the EU Standard Contractual Clauses.

8. How long we keep data

• Account data: for as long as your account is open, then deleted within 30 days of closure, except where we must keep it longer.
• Feature waitlists: until we have told you the feature is available, or for 12 months, whichever is sooner, or until you ask us to remove you.
• Billing and financial records: six years, as required by UK tax law.
• Candidate data: until the customer deletes it (deleting a candidate also deletes their uploaded document) or closes their account, after which it is deleted within 30 days. Customers are responsible for setting and following their own retention periods for applicant data.
• Backups: encrypted backups are overwritten on a rolling basis, within 30 days.

9. Your rights

Under UK data protection law you have the right to:

• access the personal data we hold about you;
• have inaccurate data corrected;
• have your data erased;
• restrict or object to how we use it, including objecting to processing based on legitimate interests;
• receive your data in a portable format;
• not be subject to decisions based solely on automated processing that significantly affect you, and to ask for human review.

To use any of these rights, contact us through privacy@careercatalystscreener.com. We will respond within one month. There is normally no charge. If your request is about an application you made to one of our customers, we will pass it to that organisation and help them respond.

10. Security

We protect personal data with encryption in transit and at rest, private file storage, strict access controls and other measures described on our Security page. If a personal data breach occurs we will notify affected customers without undue delay and, where required, the ICO within 72 hours.

11. Cookies

We only use cookies and similar storage that are strictly necessary for the Service to work, such as keeping you signed in. We do not use advertising or analytics cookies. See our Cookie Policy.

12. Children

The Service is for organisations and their staff. It is not intended for anyone under 18, and we do not knowingly collect children's data as controller.

13. Complaints

If you have a concern, please contact us first so we can try to put it right. You also have the right to complain to the Information Commissioner's Office: ico.org.uk/make-a-complaint, telephone 0303 123 1113.

Changes to this policy

We will update this page when our practices change and show the date above. If a change is significant, we will tell account holders by email or in the Service.