1. Who We Are

Jobsophy Ltd trading as CV Atlas (“we”, “us”, “our”) operates CV Atlas, an AI-powered CV and document screening service available at www.cvatlas.co.uk. We are registered in England and Wales under company number 16340965 with our registered office at Suite A, 82 James Carter Road, Mildenhall, Suffolk, United Kingdom, IP28 7DE

CV Atlas provides recruitment agencies, HR departments, and organisations with an automated tool for processing, scoring and shortlisting candidate CVs and other documents. We act as a Data Processor on behalf of our customers, who are the Data Controllers in respect of the candidate personal data they upload to our platform.

We take privacy extremely seriously. Our product is built around a privacy-first principle: we process data for the purpose requested, then delete it permanently. We do not retain, share, or sell personal data.

2. What Data We Collect and Why

2.1 Data You Provide to Us (Account Data)

When you create a CV Atlas account we collect:

• Your name and email address — to create and manage your account
• Your organisation name — to identify your agency or company account
• Billing information — processed and stored securely by Stripe. We do not store full card details on our servers.
• Your agency brand settings (logo, colours, contact details) — to generate branded candidate profiles if you use that feature

2.2 CV and Document Data (Candidate Personal Data)

When you upload CVs or other documents for processing, those documents contain personal data about candidates. This data is processed on your behalf under your instruction as the Data Controller. We act as a Data Processor.

Candidate documents typically contain: names, contact details, employment history, education, qualifications, professional registration numbers (e.g. NMC PIN), and skills information.

2.3 Usage Data

We automatically collect limited technical data when you use CV Atlas:

• IP address and approximate location — for security, fraud prevention and regional compliance
• Browser type and device information — for technical compatibility
• Pages visited and features used — to improve our service
• Session timestamps — for security and support purposes

We use standard analytics tools to collect anonymised usage statistics. Individual usage data is not shared with third parties for marketing purposes.

3. How We Use Your Data

3.1 Account Data

We use your account data to:

• Provide and maintain your CV Atlas account
• Process payments via Stripe
• Send you service emails (account confirmation, report delivery, invoices, support responses)
• Notify you of important product or policy changes
• Provide customer support
• Comply with our legal obligations

We do not use your account data for unsolicited marketing without your explicit consent.

3.2 Candidate Document Data

We use candidate document data solely to:

• Extract structured information for AI scoring and ranking
• Generate your screening report and shortlist
• Detect duplicate submissions within a batch
• Identify professional registration numbers (e.g. NMC PIN) where present
• Generate branded candidate profile PDFs if you request this feature

Candidate data is never used for any other purpose. It is never used to train AI models. It is never shared with third parties except the sub-processors listed in Section 6. It is permanently deleted after report delivery.

3.3 Legal Basis for Processing (UK and EU Users)

Under UK GDPR we process data under the following legal bases:

• Contract — processing account data to deliver the service you have subscribed to
• Legitimate interests — usage analytics to improve our service, security monitoring, fraud prevention
• Legal obligation — retaining billing records as required by HMRC and applicable law
• Consent — any marketing communications where you have opted in

For candidate personal data processed on your behalf, the legal basis for processing is your instruction as Data Controller. You are responsible for ensuring you have a valid legal basis to share candidate data with us (typically the candidate’s consent obtained through their job application, or your legitimate interests as their prospective employer).

4. How Long We Keep Your Data

5. Your Rights

Depending on your location you have some or all of the following rights regarding your personal data. To exercise any right contact us at privacy@cvatlas.co.uk. We will respond within 30 days.

5.1 Rights Available to All Users

• Right to be informed — you have the right to know what data we hold about you and how we use it. This Privacy Policy fulfils that obligation.
• Right of access — you can request a copy of the personal data we hold about you.
• Right to rectification — you can ask us to correct inaccurate data we hold about you.
• Right to erasure — you can ask us to delete your account and all associated data. Note: candidate CV data is already deleted after report delivery, so there is typically nothing to erase on a candidate’s behalf after processing.
• Right to data portability — you can request your account data in a machine-readable format.
• Right to object to direct marketing — you can opt out of any marketing communications at any time.

5.2 Note for Candidates

If you are a candidate whose CV was processed through CV Atlas, your personal data was uploaded by a recruitment agency or employer (the Data Controller). Your primary rights in relation to that data should be exercised with the agency or employer who submitted your CV. They are responsible for obtaining your consent and handling your rights requests.

If you believe your data has been mishandled during processing on our platform, contact us at privacy@cvatlas.co.uk and we will assist where we are able.

6. Who We Share Data With

We do not sell your data. We do not share your data with third parties for marketing purposes. We share data only with the following categories of sub-processors who help us deliver the service:

7. International Data Transfers

Our primary hosting is on Microsoft Azure UK South (London). Some data is transferred internationally to the following locations for the purposes described:

• United States — OpenAI API (redacted, anonymised content only) and Stripe (billing data only). Transfers are protected by Standard Contractual Clauses (SCCs) approved by the European Commission and adopted under UK law.
• European Union — where applicable for EU-based users. Protected under the UK-EU adequacy decision.

We do not transfer candidate personal data outside the UK except in the redacted, anonymised form described in Section 6. No full CV content is transmitted internationally.

8. Security

We implement appropriate technical and organisational measures to protect personal data against unauthorised access, loss or destruction. Our security measures include:

• All data transmitted to and from CV Atlas is encrypted using TLS 1.2 or higher
• Data at rest is encrypted using AES-256 encryption on Azure storage
• Access to production systems is restricted to authorised personnel only and requires multi-factor authentication
• We undergo regular security reviews and vulnerability assessments
• All employees and contractors with access to personal data are bound by confidentiality obligations
• We are working towards Cyber Essentials Plus certification

Despite these measures, no system is completely secure. If you become aware of a security concern related to CV Atlas, please contact us immediately at security@cvatlas.co.uk.

9. Cookies

CV Atlas uses a minimal set of cookies necessary to operate the service:

• Session cookies — to keep you logged in during your session. These are deleted when you close your browser.
• Security cookies — to prevent cross-site request forgery attacks. Strictly necessary.
• Analytics cookies — anonymised usage statistics. You can opt out via your browser settings.

We do not use advertising cookies. We do not use third-party tracking cookies. We do not share cookie data with advertisers.

10. Children

CV Atlas is a professional business service and is not directed at children under the age of 16. We do not knowingly collect personal data from children. If you believe we have inadvertently collected data from a child, please contact us at privacy@cvatlas.co.uk and we will delete it promptly.

11. Regional Supplements

The following supplements provide additional information and rights specific to your country or region. Please read the section that applies to you.

🇬🇧 🇪🇺 United Kingdom and European Union — UK GDPR / EU GDPR

This supplement applies to users located in the United Kingdom or European Union.

Data Controller

Jobsophy Ltd trading as CV Atlas is the Data Controller for account data. For candidate CV data, your agency or organisation is the Data Controller and we act as Data Processor under Article 28 UK GDPR.

Article 28 Data Processing Agreement

A Data Processing Agreement (DPA) compliant with Article 28 UK GDPR is presented to every customer before they may upload any data to CV Atlas. Signing this DPA is mandatory. It sets out our processing obligations, security commitments, sub-processor disclosures, deletion obligations and your rights as Data Controller.

Your Rights Under UK GDPR

In addition to the rights listed in Section 5, UK and EU users have the right to:

• Restrict processing of your data in certain circumstances
• Object to processing based on legitimate interests
• Not be subject to solely automated decision-making that produces legal or similarly significant effects
• Lodge a complaint with the Information Commissioner’s Office (ICO) at ico.org.uk or your local EU supervisory authority

Lawful Basis Summary

Our processing activities and their lawful bases are: account management (contract), payment processing (contract), service improvement analytics (legitimate interests), security monitoring (legitimate interests), marketing with opt-in (consent), legal compliance (legal obligation).

🇺🇸 United States — California Consumer Privacy Act (CCPA) / CPRA

This supplement applies to residents of California, USA. If you reside in California, the CCPA gives you specific rights regarding your personal information.

Categories of Personal Information We Collect

In the preceding 12 months we have collected the following categories of personal information from California residents:

• Identifiers — name, email address, IP address, account credentials
• Commercial information — subscription plan, payment history
• Internet or electronic network activity — pages visited, features used, session data
• Professional or employment-related information — organisation name, job role

We Do Not Sell Your Personal Information

CV Atlas does not sell, rent, or share your personal information with third parties for commercial purposes. We do not sell personal information as defined under the CCPA. California residents may submit a “Do Not Sell or Share” request to privacy@cvatlas.co.uk — we will confirm that no sale or sharing occurs.

Your California Privacy Rights

• Know — request disclosure of the categories and specific pieces of personal information we have collected about you
• Delete — request deletion of personal information we have collected from you, subject to certain exceptions
• Correct — request correction of inaccurate personal information
• Opt-Out — opt out of the sale or sharing of personal information (we do not sell data but you may submit this request)
• Non-Discrimination — we will not discriminate against you for exercising your CCPA rights

How to Submit a California Privacy Request

Submit requests by email to privacy@cvatlas.co.uk with the subject line California Privacy Request. We will verify your identity and respond within 45 days. We may extend this period by a further 45 days where necessary, with prior notice.

Authorised Agents

You may designate an authorised agent to make a CCPA request on your behalf. We will require written proof of authorisation and may verify your identity directly.

🇦🇺 Australia — Privacy Act 1988 (Cth) — Australian Privacy Principles (APPs)

This supplement applies to users located in Australia. We comply with the Privacy Act 1988 (Cth) and the 13 Australian Privacy Principles (APPs).

Collection of Personal Information

We collect personal information that is reasonably necessary for our functions. We collect information directly from you when you create an account or contact us. We collect candidate personal information indirectly via your upload of CV documents. We will not collect more information than is necessary.

Cross-Border Disclosure — APP 8

Some personal information may be transferred outside Australia as described in Section 7 of this policy. Specifically, redacted and anonymised document content is processed via the OpenAI API (USA) and billing data is processed via Stripe (USA/EU). We take reasonable steps to ensure overseas recipients handle data in accordance with the APPs. By using CV Atlas, you consent to these transfers.

Access and Correction

You have the right to access personal information we hold about you and to request correction of inaccurate information. Submit requests to privacy@cvatlas.co.uk. We will respond within 30 days. We may charge a reasonable fee for access requests where permitted by law.

Complaints — Australia

If you believe we have breached the APPs, please contact us first at privacy@cvatlas.co.uk. If you are not satisfied with our response, you may lodge a complaint with the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.

🇨🇦 Canada — Personal Information Protection and Electronic Documents Act (PIPEDA)

This supplement applies to users located in Canada. We comply with the Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial privacy laws.

Accountability

We are responsible for personal information under our control. Our Privacy Officer is responsible for our compliance with PIPEDA. Contact: privacy@cvatlas.co.uk.

Consent

We obtain consent before collecting, using or disclosing personal information, except where otherwise permitted by law. By creating an account and agreeing to our Terms of Service, you consent to our collection and use of your personal information as described in this policy. You may withdraw consent at any time, subject to legal and contractual restrictions, by contacting privacy@cvatlas.co.uk.

Limiting Collection

We collect only the personal information necessary for the purposes identified in this policy. We do not collect information indiscriminately.

Individual Access — Canada

Upon written request, we will inform you of the existence, use and disclosure of your personal information and give you access to that information within 30 days. Contact privacy@cvatlas.co.uk.

Complaints — Canada

Direct privacy complaints or concerns to our Privacy Officer at privacy@cvatlas.co.uk. If you are not satisfied with our response you may contact the Office of the Privacy Commissioner of Canada at priv.gc.ca.

🇸🇬 Singapore — Personal Data Protection Act 2012 (PDPA)

This supplement applies to users located in Singapore. We comply with the Personal Data Protection Act 2012 (PDPA) and the guidelines issued by the Personal Data Protection Commission (PDPC).

Data Protection Officer — Singapore

We have appointed a Data Protection Officer (DPO) as required by the PDPA. The DPO can be contacted at privacy@cvatlas.co.uk. Our DPO is responsible for ensuring compliance with the PDPA.

Purpose Limitation

We collect, use and disclose personal data only for purposes that a reasonable person would consider appropriate in the circumstances and only for purposes we have notified you of. The purposes for which we collect data are set out in Sections 2 and 3 of this policy.

Transfer Limitation

Where we transfer personal data outside Singapore, we ensure the recipient provides a standard of protection comparable to the PDPA, through contractual arrangements or other binding legal instruments.

Access and Correction — Singapore

You have the right to access personal data we hold about you and to request correction of any inaccurate data. Submit requests to privacy@cvatlas.co.uk. We will respond within 30 days. We may charge a reasonable fee for access requests.

Withdrawal of Consent

You may withdraw consent for our collection, use or disclosure of your personal data at any time by contacting privacy@cvatlas.co.uk. Please note that withdrawal of consent may mean we are unable to provide certain services to you.

Complaints — Singapore

If you have concerns about our data protection practices, contact our DPO at privacy@cvatlas.co.uk. If unresolved, you may lodge a complaint with the PDPC at pdpc.gov.sg.

🇩🇪 Germany — EU GDPR / Bundesdatenschutzgesetz (BDSG)

This supplement applies to users located in Germany. In addition to the EU GDPR rights described in the UK & EU section above, German users benefit from additional protections under the Federal Data Protection Act (Bundesdatenschutzgesetz — BDSG).

Supervisory Authority — Germany

You have the right to lodge a complaint with the Federal Commissioner for Data Protection and Freedom of Information (Bundesbeauftragte für den Datenschutz und die Informationsfreiheit — BfDI) or with the data protection authority of your German federal state (Bundesland). The BfDI can be contacted at bfdi.bund.de.

Telecommunications & Telemedia Data Protection (TTDSG)

Our use of cookies and similar tracking technologies complies with the Telecommunications and Telemedia Data Protection Act (Telekommunikations-Telemedien-Datenschutzgesetz — TTDSG). Non-essential cookies are only placed with your prior consent, obtained through our cookie consent banner.

🇫🇷 France — RGPD / Loi Informatique et Libertés

This supplement applies to users located in France. In addition to EU GDPR rights, French users benefit from protections under the Loi Informatique et Libertés (French Data Protection Act), as amended to incorporate the RGPD.

Supervisory Authority — France

You have the right to lodge a complaint with the Commission Nationale de l’Informatique et des Libertés (CNIL) at cnil.fr.

Exercising Your Rights — France

All material changes to this policy that affect French users will be communicated in advance. For privacy queries in relation to French data protection law, contact us at privacy@cvatlas.co.uk.

🇪🇸 Spain — RGPD / Ley Orgánica de Protección de Datos (LOPDGDD)

This supplement applies to users located in Spain. In addition to EU GDPR rights, Spanish users benefit from protections under the Ley Orgánica 3/2018 de Protección de Datos Personales y garantía de los derechos digitales (LOPDGDD).

Supervisory Authority — Spain

You have the right to lodge a complaint with the Agencia Española de Protección de Datos (AEPD) at aepd.es.

Digital Rights (LOPDGDD)

The LOPDGDD extends EU GDPR rights to include specific digital rights protections. If you believe your digital rights have been infringed, you may contact the AEPD or reach us directly at privacy@cvatlas.co.uk.

🇳🇿 New Zealand — Privacy Act 2020

This supplement applies to users located in New Zealand. We comply with the Privacy Act 2020 and the 13 Information Privacy Principles (IPPs) set out therein.

Collection of Personal Information — New Zealand

We collect personal information only for a lawful purpose connected with our functions and activities, and only to the extent necessary for that purpose. We collect information directly from you and, in the case of candidate CV data, indirectly via your uploads.

Access and Correction — New Zealand

You have the right to request access to personal information we hold about you and to request correction of that information if it is inaccurate. Submit requests to privacy@cvatlas.co.uk. We will respond within 20 working days.

Complaints — New Zealand

If you have a complaint about our handling of your personal information, please contact us first at privacy@cvatlas.co.uk. If you are not satisfied with our response, you may contact the Office of the Privacy Commissioner of New Zealand at privacy.org.nz.

12. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements or other factors. When we make material changes we will:

• Update the ‘Last updated’ date at the top of this policy
• Notify active users by email at least 30 days before the change takes effect
• Where required by law, obtain fresh consent

Your continued use of CV Atlas after the effective date of any change constitutes acceptance of the updated policy. If you do not agree to any change, please cease using CV Atlas and close your account.

13. Contact Us

For any privacy-related questions, requests or complaints, contact us at:

14. Regulatory Bodies

If you are not satisfied with our response to a privacy complaint you may contact the relevant regulatory body for your country:

CV Atlas Privacy Policy · Jobsophy Ltd trading as CV Atlas · privacy@cvatlas.co.uk · Version 1.0 · July 2026