Privacy Policy

1About this Policy

This Privacy Policy (the Policy) is issued by and on behalf of the group of companies trading as CV Warehouse, together with its affiliates, subsidiaries and associated undertakings. Where this Policy says "we", "us" or "our", that is who it means.

We operate globally through legal entities registered in a number of jurisdictions, and we maintain operational presences and representative arrangements across the GCC, Europe and Singapore. Which of our entities acts as controller of your personal information depends on the Service you are using, where you are located, and the contractual arrangements that apply between us. If you need to know which entity is responsible for a particular processing activity, write to the contact point in section 29 and we will confirm it.

Services means our websites, applications, platforms, assessments, calculators, tools, communications channels and professional services. The Policy applies to all of them, however you reach them and whatever device or medium you use.

2Who and what it covers

This Policy applies to personal information about any of the following people. Wherever it says "you", it means one of them:

• visitors to our websites and other digital properties;
• registered users and account holders;
• customers who buy or subscribe to any Service;
• anyone whose CV, résumé or professional profile we prepare, review, optimise or distribute;
• users of our job-search, AutoPilot and automated application services;
• recruiters, employers and their representatives, where relevant;
• anyone who writes to, contacts or otherwise communicates with us; and
• people applying for a job or engagement with CV Warehouse itself.

3Information we collect

What we collect depends on how you use the Services. It may include any of the categories below.

4Sensitive details in CVs

CVs and career documents often carry information that the law treats as special, sensitive or deserving of extra protection, and it is usually the individual who chose to put it there. Depending on the market and the document, that can include date of birth, nationality, photographs, gender, health or disability information, religious information and identification details.

We process information of that kind only where it appears in the materials you supply, where it is needed to deliver the Service you asked for, or where the law otherwise allows it.

5Information about other people

Sometimes you will give us information about somebody else, such as a referee, a recruiter contact or an employee. When you do, you confirm that you have the authority, consents or other lawful basis needed to hand that information to us for processing under this Policy, and you take responsibility for it being accurate and lawfully provided.

6What we use it for

We use personal information to:

• deliver, administer and fulfil CV and résumé services, including writing, editing and optimisation;
• deliver LinkedIn and professional-profile services;
• deliver job-search, AutoPilot and automated application services;
• run CV distribution and recruitment-related services;
• run our assessments, calculators and career tools;
• answer support requests and send service messages;
• take payments and keep transaction records;
• prevent, detect and investigate fraud, abuse and security incidents;
• maintain, improve and develop the Services;
• run analytics and aggregated reporting, and personalise what you see;
• send marketing messages, where the law permits them (see section 16); and
• meet our legal, regulatory, accounting and audit obligations.

7Our legal grounds

Where the law requires us to identify a legal basis for processing, we rely on one of four:

• our contract with you, or steps you asked us to take before entering into one;
• your consent, where we have asked for it and you have given it;
• our legitimate interests in operating, securing and improving the Services, weighed against your own interests and rights; and
• legal obligations we are subject to.

8Automation and AI

Some Services use automated tools and AI-assisted systems. Examples include CV and profile analysis, keyword and suitability matching, automatically identifying vacancies that may suit you, submitting applications on your instruction, and scoring assessments.

What these systems produce is probabilistic and assistive: recommendations, scores, drafts and similar outputs. They do not by themselves produce decisions that have a legal or similarly significant effect on you. Decisions about hiring, interviewing and engagement rest at all times with the independent employers, recruiters and platforms concerned. Where a Service provides for human review of material outputs, that review happens.

9What we do not guarantee

Our Services are discretionary professional and digital services, offered into employment markets that are uncertain by nature.

Please read the description, process, inclusions and limitations of each Service carefully before you buy, and go ahead only if you are satisfied it suits your circumstances and objectives. Career outcomes depend on things we do not control, including market conditions and the independent decisions of employers, recruiters and platforms. No employment, interview or engagement outcome is warranted or guaranteed. To the fullest extent the law allows, our liability in connection with the processing described in this Policy is limited accordingly. Nothing in this Policy excludes or limits any right or remedy that cannot lawfully be excluded or limited.

10Service providers

We use third-party service providers who act on our documented instructions. They fall into these categories:

• cloud hosting and infrastructure;
• payment processing;
• email and communications;
• CRM and customer support;
• analytics;
• security and fraud prevention;
• AI and automated-service providers;
• recruitment and job platforms, where we engage them to deliver a Service you asked for; and
• marketing platforms, where the law permits.

A service provider may use personal information only for the purpose we engaged it for, under contractual confidentiality and data-protection obligations, and never for its own independent purposes. The exception is a provider that acts as an independent controller in its own right under applicable law, which section 11 and section 12 describe.

11CV distribution and applications

This section covers what happens when you ask us to distribute your CV, submit applications for you, approach employers or recruiters, use recruitment platforms, or run automated job-search or application services on your behalf.

You also acknowledge the following, which follow from the nature of that instruction:

1. The recipients are independent third parties, and they act as independent controllers of the information disclosed to them.
2. How they subsequently handle, keep, evaluate and use that information is governed by their own policies and by the laws that apply to them.
3. Sending information to independent recipients cannot be undone. Once it is done, it is beyond recall and beyond our continuing supervision.
4. We are not responsible for the acts, omissions, decisions or data-handling practices of those independent recipients.

To the fullest extent the law allows, our responsibility for instructed distribution is limited to making the disclosure in line with your instructions and this Policy. This section does not limit any obligation that cannot lawfully be limited, and it does not affect any right you may have against the recipient itself.

12LinkedIn and other platforms

When we perform a Service relating to LinkedIn or another professional platform, we are working on a platform owned and run by an independent third party that we have no affiliation with. Those platforms set their own terms of service, privacy policies, algorithms and enforcement practices. They can change any of it without notice, and we have no control over it. Your use of such a platform, including in connection with one of our Services, is governed by that platform's own terms and policies, which it is up to you to read.

13Transfers across borders

We operate globally, so your information may be transferred to, stored in and processed in countries other than the one you live in, including countries whose data-protection rules differ from your own.

Where a transfer is subject to legal requirements, we use safeguards the law recognises. Depending on the transfer, that may include contractual data-protection clauses with recipients, intra-group transfer arrangements, transfers to countries recognised as offering adequate protection, and additional technical and organisational measures proportionate to the transfer concerned.

14Controller or processor

Our role under data-protection law is not the same for every activity.

We do not claim a single role for everything we do. The role that applies to any given activity is determined by the nature of that activity and by the contractual arrangements behind it.

15Cookies and tracking

The Services use cookies and similar technologies in four categories:

Where the law requires consent for non-essential cookies, we set them through the consent mechanisms made available to you. You can also manage cookies in your browser settings, though turning some of them off may stop parts of the Services working properly.

16Marketing emails

Where the law permits, we may send you promotional emails and newsletters about the Services. You can opt out whenever you like, either through the unsubscribe link in any such message or by contacting us under section 29.

Opting out of marketing does not stop transactional, service or administrative messages that are reasonably necessary to run your account or deliver a Service. Those are not marketing messages for the purposes of this Policy.

17How we protect information

We maintain technical and organisational measures matched to the nature, scope and risks of what we process. They include:

• access controls operated on a need-to-know basis;
• encryption where appropriate;
• authentication controls;
• monitoring of our systems and infrastructure;
• secure infrastructure arrangements with our hosting providers;
• confidentiality obligations binding on our personnel; and
• documented incident-management procedures.

No system can be warranted as absolutely secure, and sending information over public networks is something you choose to do. We review and develop our safeguards on an ongoing basis.

18Security incidents

If we suspect or confirm an incident affecting personal information, we assess and manage it under our incident-management procedures. Those cover containment, investigation, remediation and documentation. Where the law requires a personal-data breach to be notified to a supervisory authority or to the people affected, we make that notification in the manner and within the timeframe that law sets.

19Your account credentials

Keeping your account credentials confidential is your responsibility, as is everything that happens under your account. If you suspect unauthorised access or use, tell us without undue delay. To the extent the law allows responsibility to be allocated this way, we are not responsible for loss that arises because credentials were not kept safe.

20Payments and card details

Payments are handled by independent third-party payment providers. You give your full payment-card details directly to the relevant provider, which processes and stores them under its own terms and security certifications. We do not store complete payment-card numbers.

What we do keep are transaction records, such as the amount, the date, the Service purchased and confirmation identifiers, for the purposes described in this Policy.

21How long we keep it

We work out how long to keep information by reference to factors including:

• the purpose it was collected for, and whether that purpose still exists;
• whether we have a contractual relationship with you, and for how long;
• legal and regulatory retention requirements;
• accounting, tax and audit requirements;
• bringing, exercising or defending legal claims, and resolving disputes; and
• security, fraud prevention and abuse prevention.

We maintain and apply internal retention schedules that reflect these criteria. When a period ends, the information is deleted, de-identified or irreversibly aggregated.

22Your privacy rights

Depending on where you are and which law applies, you may have some or all of these rights:

Send rights requests to the contact point in section 29. We handle them under the law that applies to the request, including any verification, timing, exemption and fee provisions that law contains.

23Deleting your account and CVs

You can ask us to delete your account, your CVs and the personal information that goes with them through the contact point in section 29. Once we have verified the request, we delete the information concerned.

Two limits apply. First, we may keep specific information for as long as retention is required or permitted for legal or regulatory compliance, accounting and tax purposes, bringing, exercising or defending legal claims, resolving disputes, or security and fraud prevention, in line with section 21. Second, deletion cannot reach information already disclosed on your instructions to independent recipients under section 11. For that information, the deletion request has to go to the recipient holding it.

24Rules where you live

Some regimes add to what the rest of this Policy says. Open the one that applies to you.

25Children and young people

The Services are for adults of working age and are not intended for children. We do not knowingly collect personal information from anyone below the age at which they can lawfully consent to the processing of their personal information where they live. If you believe a minor has given us personal information, contact us under section 29 and we will take appropriate steps to delete it.

26Links to other websites

The Services may link to third-party websites, platforms and resources. Those links are there for convenience. We do not control, endorse or take responsibility for the content or the privacy practices of any third party, and using them is at your own risk and subject to their terms and policies.

27Changes to this Policy

We may amend this Policy from time to time. The effective date and the date of the last update are shown at the top of the page. Where the law requires it, we will tell you about material changes through the Services or by other appropriate means before they take effect. If you keep using the Services after an amended Policy takes effect, that counts as acknowledgement of the amended Policy, to the extent the law permits.

28Making a complaint

Send privacy complaints to the contact point in section 29 and we will review them under our internal complaint-handling procedures. We ask for the chance to put things right first. Where the law provides for it, you also have the right to complain to the supervisory or data-protection authority for your country or for the place where the alleged infringement happened.

29How to contact us

Questions, rights requests and complaints about this Policy, or about how we handle personal information, go to our privacy contact, marked for the attention of the Privacy Office.