Legal

Privacy Policy

Effective 17 July 2026 · v2

SureStartJobs is operated by Sure Start Jobs Ltd (“SureStartJobs ”, “we”, “us”). We act as the Data Controller for all personal data we collect through surestartjobs.co.uk. This policy explains what we collect, why, and what rights you have under the UK GDPR and the Data Protection Act 2018.

We are registered with the UK Information Commissioner’s Office (ICO) as a data controller under registration number ZC198341.

In this Privacy Policy, “Affiliated Company” means any company that directly or indirectly controls, is controlled by, or is under common control with Sure Start Jobs Ltd.

1. What we collect

  • Account data: name, email, hashed password, phone number (if you choose to verify one).
  • Candidate profile: CV, qualifications, education, job preferences, salary expectations, location.
  • Activity data: applications submitted, jobs saved, interactions with employers and agencies.
  • Technical data: IP address, browser type, session cookies — see our Cookie Policy.
  • Payment data: if you pay SureStartJobs, billing is handled by Stripe; we never see card numbers.

2. Why we use it (lawful basis)

  • Contract: creating your account, processing applications, running the platform.
  • Consent: making your CV visible to employers and agencies (you can opt out at any time from your profile); marketing emails.
  • Legitimate interest: matching you to relevant jobs, security monitoring, fraud prevention.
  • Legal obligation: tax, accounting, and responding to lawful requests from regulators.

3. Who we share it with

Employers, recruitment agencies, and authorised personnel of Affiliated Companies engaged in recruitment activities that you apply to or that unlock your profile (visibility is controlled by you). Sub-processors used to run the service: Supabase (database + auth, EU region), Vercel (hosting, EU region), Resend (transactional email), Cloudflare (DNS, CDN and inbound email routing), Stripe (payments), Cloudmersive (virus-scanning of uploaded files), and Anthropic (AI processing of CV text for search and matching; processed in the US under Standard Contractual Clauses). Each is bound by a Data Processing Agreement.

Some information published by users on the Platform is intended to be publicly visible, including employer profiles, company information and job advertisements. Publicly available information may be accessed and used by Platform users, including employers, recruiters, candidates and Affiliated Companies operating recruitment businesses, for legitimate recruitment-related purposes such as market analysis and improving recruitment services. Access to private account information, communications, candidate information, commercial information and other non-public Platform data is restricted according to user permissions and is not made available to Affiliated Companies unless separately authorised and permitted under applicable agreements and data protection laws.

4. International transfers

Personal data is stored in the UK / EU. If we ever transfer data outside the UK, we use Standard Contractual Clauses or an adequacy decision.

5. How long we keep it

  • Active accounts: while your account exists.
  • Inactive candidate profiles: warned at 12 months of inactivity, anonymised at 24 months.
  • Application history is retained for 12 months after an application's final status, then anonymised.
  • Billing records are retained for 6 years (UK tax law).

6. Your rights

You can ask us to show you the data we hold, correct it, send it elsewhere, delete it, pause our use of it, or object to how we use it. The fastest way is from your account:

  • Download your data: Profile → Privacy & security → Download my data.
  • Delete your account: Profile → Privacy & security → Delete my account. This is permanent.
  • For anything else email hello@surestartjobs.co.uk.

You can complain to the UK Information Commissioner’s Office at ico.org.uk.

7. Automated matching

We use vector embeddings of your profile to rank job matches. This is a recommendation tool only — no hiring decision is made by the system. You can opt out of appearing in matched results from your profile (CV visibility toggle).

8. Security

Data is encrypted in transit (TLS) and at rest. Access is role-based and audited. We notify the ICO and affected users within 72 hours of a confirmed breach where required.

9. Contact

Data Protection contact: Sure Start Jobs Ltd, hello@surestartjobs.co.uk. We are registered with the ICO as a data controller under registration number ZC198341.