Privacy Policy

1Who we are

1.1 This Privacy Policy explains how FindCV Ltd ("FindCV", "we", "us", "our") collects and uses your personal data when you use our website www.findcv.com, our mobile applications, and related services (the "Platform").

1.2 FindCV Ltd is a private limited company registered in England and Wales under company number 16058967, with its registered office at 20 Wenlock Road, London, United Kingdom, N1 7GU. FindCV Ltd is the data controller for the personal data described in this Policy.

1.3 We are registered with the UK Information Commissioner's Office (ICO) under reference [[ICO REGISTRATION REF]] and pay the annual data protection fee.

1.4 Contacts:

• General privacy queries and data-subject requests: privacy@findcv.com
• Philippine representative (for Filipino jobseekers): [[PHILIPPINE REP CONTACT]]
• Post: Data Protection Team, FindCV Ltd, 20 Wenlock Road, London, United Kingdom, N1 7GU

2Personal data we collect

We collect different categories of personal data depending on how you use the Platform.

2.5 Special-category data

Some personal data is treated as "special category" under UK data protection law and receives extra protection. This includes information about health, religion, ethnicity, biometric data used for identification, and sexual orientation.

• Jobseeker CVs may occasionally contain such information (for example, a health condition, a religious affiliation, an ethnic community).
• Please avoid including special-category information in your CV unless you specifically want an employer to see it.
• Where a role is offered by MediJobs.ph, our future sister brand (currently in build), health-relevant credentials may be requested; we will provide a separate consent process at that point.

We rely on your explicit consent to process any special-category data. You can withdraw that consent at any time by editing your profile or contacting privacy@findcv.com.

2.6 Children's data

The Platform is not intended for anyone under 18. We do not knowingly collect data from children. If we learn we have collected data from a person under 18 we will delete it as soon as possible.

3How we use your data and why (lawful bases)

Under UK GDPR we must have a "lawful basis" to use your personal data. Below is how we use your data and the basis we rely on.

3.1 To create and operate your account (lawful basis: contract)

We process your account, contact and profile data so that we can provide the Services you have agreed to receive under our Terms and Conditions — including hosting your profile, letting you apply to jobs, letting employers post jobs and search candidates, and running your subscription.

3.2 To process payments (lawful basis: contract + legal obligation)

To take your payment for a subscription or verification fee, and to maintain accounting records as required by UK tax and company law.

3.3 To keep the Platform safe (lawful basis: legitimate interests)

For fraud prevention, spam detection, account-abuse detection, and to protect the security of the Platform and its users. We have a legitimate interest in operating a trustworthy service. We keep the impact on you to what is necessary (for example, we log unusual login attempts but do not profile you commercially for security purposes).

3.4 To match jobseekers with employers (lawful basis: contract + legitimate interests)

We use profile and job data to help employers find suitable candidates and vice-versa. This is a core part of the Service. If matching involves any automated ranking, we describe the logic in Section 11.

3.5 To communicate service messages (lawful basis: contract)

We send you emails necessary to run your account: verification, notifications about applications and messages, invoices, and important service updates. You cannot opt out of these while your account is open, as they are essential to the Service.

3.6 To send marketing communications (lawful basis: consent, or legitimate interests for existing customers)

We only send you marketing emails or product-update newsletters if you have given us consent to do so, or (for existing customers about similar services) under the PECR "soft opt-in" rule. You can unsubscribe at any time using the link at the bottom of any marketing email.

3.7 To improve the Platform (lawful basis: legitimate interests)

To analyse how users interact with the Platform in aggregate, spot bugs, prioritise features and improve the user experience. We rely on the minimum data required and where possible use anonymised or aggregated data.

3.8 To comply with law (lawful basis: legal obligation)

To meet our obligations under UK law (for example, tax and accounting law, anti-money laundering, fraud, court orders, and law-enforcement requests where valid).

3.9 To defend legal claims (lawful basis: legitimate interests)

To establish, exercise or defend legal claims where necessary.

3.10 Cookies and analytics

See Section 12. Different lawful bases apply to different cookies. Strictly Necessary cookies rely on our legitimate interest in operating the Platform. Non-essential cookies (Functional, Analytics, Marketing) rely on your consent, which you give via our cookie banner.

4Who we share your data with

We share your data only where necessary and only with recipients who protect it appropriately.

4.1 Employers and Jobseekers

The purpose of the Platform is to connect Jobseekers and Employers. That means:

• Employers can see verified Jobseeker profiles (subject to the paid tier they have subscribed to).
• Jobseekers can see the Employer's job posts and, once a contact reveal is used, the Employer's contact details.
• When you apply for a job, the Employer sees your profile and CV.
• Once you have made a genuine offer, contact between the two sides may move off-platform.

4.2 Licensed Partner Agencies

For a new deployment from the Philippines, or an in-country transfer where an agency is involved, we share the necessary Jobseeker profile information with the relevant Licensed Partner Agency so they can process the hire. Agencies are separate data controllers or joint controllers for the deployment itself. The agency's own privacy notice governs their use of your data.

4.3 Service providers (our sub-processors)

We rely on trusted third-party service providers to run parts of the Platform:

• Stripe — payment processing (US).
• Google — single sign-on, and analytics/advertising (where you consent to non-essential cookies) (US).
• Meta (Facebook / Instagram) — advertising and audience measurement via the Meta Pixel (where you consent to marketing cookies) (US).
• LinkedIn — advertising and conversion tracking via the LinkedIn Insight Tag (where you consent to marketing cookies) (US/Ireland).
• Hotjar — anonymised behavioural analytics and heatmaps (where you consent to analytics cookies) (Ireland/Malta).
• Cloud hosting provider — hosting of the Platform, databases and backups.
• Email delivery — transactional and marketing email sending.
• CRM and customer support tools — to answer your queries and manage business communications.
• Fraud-detection and identity-check providers — where used for verification.
• Analytics providers — for aggregated usage statistics.

A current list of our main sub-processors is available at www.findcv.com/legal/sub-processors. We will provide at least 30 days' notice by email if we add or change a major sub-processor that materially affects our processing of your personal data.

4.4 Legal and regulatory recipients

We may share data with courts, regulators, government agencies or law-enforcement bodies where required by law, in response to a valid legal request, or to protect our rights, users or the public.

4.5 Business transactions

If FindCV Ltd is involved in a merger, acquisition, sale of assets, corporate restructuring or insolvency, personal data may be transferred to the counterparty and their advisers. Where such transfer would result in a change of controller, we will notify affected users in advance.

4.6 We never sell your data

5International data transfers

FindCV operates from the UK. Because our audience is worldwide, some of your data is transferred to countries outside the UK. Not all of those countries have data protection laws that the UK considers "adequate", so we use appropriate safeguards.

5.1 Countries we transfer data to

Depending on your role and the destination employer, your data may be transferred to:

5.2 Your rights

You may ask us for a copy of the safeguards we rely on for any specific transfer of your personal data by contacting privacy@findcv.com.

6How long we keep your data

We keep your personal data only as long as necessary for the purposes we collected it, and to comply with legal obligations. The main retention periods are:

After your account is deleted, some records may be retained for the periods above where required by law. Anything not required for a legal, regulatory or audit purpose is deleted within 30 days.

7Security

7.1 We take appropriate technical and organisational measures to protect your data, including:

• encryption of data in transit (HTTPS) and at rest;
• password hashing;
• role-based access controls;
• routine backups and disaster-recovery planning;
• staff data protection training;
• vendor security due diligence.

7.2 No system is perfectly secure. If we detect a data breach that is likely to result in a risk to your rights, we will notify the ICO within 72 hours and, where the risk is high, notify you as soon as possible.

7.3 You also have a role: keep your account credentials secret, use a strong password, and enable multi-factor authentication when we offer it.

8Your rights

Under UK data protection law you have the following rights. The fastest way to exercise them is via our Data Request page, which routes to privacy@findcv.com. We will acknowledge your request within 3 working days and respond fully within one month (this may be extended by two further months for complex requests, and we will tell you if that applies).

9How to complain

9.1 If you have a concern about how we use your data, please talk to us first. Contact privacy@findcv.com and tell us what happened. We will acknowledge your complaint within one business day and aim to resolve it within 30 days.

9.2 If you are not satisfied with our response, you have the right to lodge a complaint with:

If you are resident in another country, you can also complain to the data protection authority for your country of residence.

10Where we make decisions about you

FindCV Ltd is established in the United Kingdom. The Information Commissioner's Office is our lead supervisory authority.

11AI, automated decisions and profiling

11.1 The Platform uses simple automated matching (for example, ranking candidates by fit to a job's requirements) to help employers find relevant candidates and to surface relevant jobs to jobseekers.

11.2 These automated processes support, but do not replace, human decision-making. Hiring decisions are always taken by the Employer. Whether to apply for a job is always your choice.

11.3 We do not currently make any decisions about you that have "legal or similarly significant" effects on you solely through automated processing.

11.4 If we introduce any solely-automated decision-making in the future, we will update this Policy, describe the logic and consequences, and offer you the right to human review, to express your point of view and to contest the decision.

12Cookies and similar technologies

12.1 We use cookies and similar technologies to make the Platform work, to remember your preferences, and to analyse how it is used.

12.2 When you first visit the Platform, our cookie banner asks whether you accept non-essential cookies (for example, analytics and advertising cookies). "Reject all" is offered on the first layer and is as easy to click as "Accept all". You can change your choices at any time via the "Cookie settings" link in the footer.

12.3 The categories of cookies we use are:

• Strictly Necessary cookies — needed to log you in, keep you signed in, and secure the Platform. These do not require your consent.
• Functional cookies — remember your preferences (language, destination country, saved searches) to improve your experience.
• Analytics cookies — help us understand how visitors use the Platform.
• Marketing cookies — help us measure and optimise our advertising campaigns (Meta, Google, LinkedIn).

12.4 The current list of specific cookies (name, provider, purpose, duration) is available at findcv-cookie-policy.html.

12.5 You can also disable cookies in your browser settings, but doing so may affect the Platform's functionality.

13Third-party links

The Platform may link to third-party sites (for example, government resources on overseas worker rights, or partner agency pages). Those sites have their own privacy notices which we do not control. Please read them before providing any personal data.

14Changes to this Privacy Policy

14.1 We may update this Policy from time to time. Where changes are material, we will notify you by email (at the address you registered) and by a prominent notice on the Platform at least 14 days before the changes take effect.

14.2 The current version and effective date are always visible at the top of this Policy. Older versions are available on request.

15Country-specific rights and notices

This section describes additional rights, complaint routes, and representative contacts that apply if you reside in specific jurisdictions. These rights are in addition to your UK GDPR rights in Section 8, not instead of them. Where the same right is granted by two laws, we treat you as having the more generous version.

15.1 Filipino residents — Philippine Data Privacy Act 2012 (RA 10173)

15.1.1 The Philippine Data Privacy Act may apply to processing of Filipino residents' personal data in addition to UK GDPR.

15.1.2 Your rights under the Philippine DPA include access, correction, blocking or removal, data portability, damages for unlawful processing, and the right to lodge a complaint with the National Privacy Commission (privacy.gov.ph).

15.1.3 For matters relating to the Philippine DPA, contact our Philippine representative at [[PHILIPPINE REP CONTACT]].

15.2 UAE residents — Federal Decree-Law No. 45 of 2021 (PDPL) + DIFC / ADGM regimes

15.2.1 If you reside in the UAE, the UAE PDPL applies to processing of your personal data. Your rights include access, correction, deletion, restriction of processing, portability, objection to processing, and the right to withdraw consent.

15.2.2 The competent supervisory authority is the UAE Data Office. If your data is processed within the DIFC free zone, the DIFC Commissioner of Data Protection applies; within ADGM, the ADGM Office of Data Protection applies. You may complain to the relevant authority for your zone.

15.2.3 Cross-border transfers of UAE PDPL data to the UK rely on the UAE's adequacy assessment for the UK and/or standard contractual clauses.

15.3 Saudi Arabia residents — Personal Data Protection Law (PDPL, Royal Decree M/19 as amended)

15.3.1 If you reside in the Kingdom of Saudi Arabia, the Saudi PDPL (in force since September 2023, enforceable since September 2024) applies. Your rights include the right to be informed, access, correction, destruction, and (in limited cases) portability.

15.3.2 The competent authority is the Saudi Data & Artificial Intelligence Authority (SDAIA). Complaints can be raised with SDAIA at sdaia.gov.sa.

15.3.3 Cross-border transfers from KSA rely on SDAIA-approved transfer mechanisms including the standard contract framework where the destination country is not on the KSA adequacy list.

15.4 Qatar residents — Law No. 13 of 2016 (PDPPL)

15.4.1 If you reside in Qatar, the Personal Data Privacy Protection Law applies. Your rights include access, correction, deletion, withdrawal of consent, and to object to processing for direct marketing.

15.4.2 The competent authority is the National Cyber Security Agency (NCSA) Compliance and Data Protection Department. Complaints: ncsa.gov.qa.

15.5 Other GCC residents — Kuwait, Bahrain, Oman

15.5.1 Bahrain residents are covered by the Bahrain Personal Data Protection Law (Law No. 30 of 2018), supervised by the Personal Data Protection Authority. Rights include access, rectification, erasure and objection.

15.5.2 Oman residents are covered by the Personal Data Protection Law (Royal Decree No. 6/2022), supervised by the Ministry of Transport, Communications and Information Technology. Rights include access, correction, erasure, and to withdraw consent.

15.5.3 Kuwait has issued the Data Privacy Protection Regulation (2021) under the Communications and Information Technology Regulatory Authority (CITRA). Rights include access, correction, and to be informed.

15.5.4 To exercise any GCC PDPL right or to raise a complaint, email privacy@findcv.com — we will route your request to the correct process based on your stated country of residence in the Data Request form.

15.6 California residents — CCPA / CPRA

15.6.1 California residents have the rights to know, delete, correct, opt out of the sale/sharing of personal information, and limit use of sensitive personal information. FindCV does not sell personal information for money. Where third-party advertising cookies are used with your consent, these may qualify as "sharing" under CPRA; you can opt out via the Your Privacy Choices control in the footer of every page.

15.6.2 Complaints can be lodged with the California Privacy Protection Agency at cppa.ca.gov.

16Company details