How TruRole handles personal data

Controller: Not configured.

Address: Not configured.

Privacy contact: Not configured.

This notice is intended to address the UK GDPR and Data Protection Act 2018 as amended, including relevant changes made by the Data (Use and Access) Act 2025, together with applicable Privacy and Electronic Communications Regulations 2003 requirements.

Account data can include name, email, account type, authentication status, legal acceptance versions and timestamps. Candidate data can include contact details, CV files, employment/education history, skills, qualifications, work preferences, salary expectations, applications, match outputs, candidate-controlled introduction decisions and optional verification results such as organisation-email, student-email or identity-verification status. Anonymous talent discovery can expose the earned badge label to authorised hiring users but does not expose the underlying verification email or domain.

Hiring-side data can include employer/recruiter identity, company information, corporate-domain evidence, recruiter mandates, vacancy details, application decisions, trust reports and billing records. Company verification may use information provided by the hiring user and lawful public/company-register sources.

Technical, security and operational data can include timestamps, session identifiers, page/request events, audit events, access-control records, fraud/security signals, reliability telemetry and infrastructure logs needed to initialise, operate, secure, diagnose and improve service reliability. This operational telemetry is not used by TruRole to create behavioural advertising profiles. TruRole does not receive full card numbers from Stripe.

Contract / steps at your request: creating and operating an account, providing CV tools requested by a candidate, presenting jobs, and transmitting a direct TruRole application only when the candidate deliberately submits it for the specific vacancy, together with operating hiring workflows and processing paid hiring publication.

Legitimate interests: preventing fraud and abuse, verifying companies/recruiter authority, maintaining vacancy freshness, protecting users and the service, keeping appropriate audit records, improving reliability and defending legal claims. Where legitimate interests are relied on, they must be balanced against the individual's rights and reasonable expectations.

Legal obligation: tax/accounting records, regulatory cooperation, valid legal requests and compliance records where UK law requires them.

Consent where specifically required: optional anonymous candidate discoverability, vacancy-specific identity/CV introduction where the product treats that as a candidate-controlled permission, marketing communications or non-essential cookies where consent is the appropriate lawful mechanism. Consent is not bundled into the Terms and can be withdrawn for future processing.

TruRole is not designed to collect race/ethnicity, religion or belief, health/disability, sexual orientation, political opinions, trade-union membership, genetic or biometric data for candidate ranking or hiring decisions. It does not intentionally infer such characteristics from names, CV text or other evidence for matching.

Candidates should avoid adding unnecessary special-category information, identity documents, bank details, passwords or unrelated secrets to a CV. If sensitive information is inadvertently provided, it must not be repurposed for matching and may be removed or restricted where appropriate.

If equality-monitoring or reasonable-adjustment data is introduced later, it must be separated from ordinary application/CV decision data and handled under an appropriate lawful condition and access model.

CV files are private. Structured extraction is used to identify career evidence such as role history, education, certifications and skills. Candidates can review and correct extracted information.

Matching/profiling may compare work-related evidence and stated preferences with vacancy requirements, such as skills, experience, job titles, location, work pattern, employment type and salary. Match scores and CV suggestions are decision-support outputs, not final employment decisions.

TruRole is not intended to make a solely automated decision that rejects a candidate or has a legal/similarly significant effect. If that product design changes, the controller must perform the required assessment, transparency and safeguards before enabling it. Candidates can challenge inaccurate source data and request human review of platform-administered issues.

Only information reasonably needed for the stated recruitment, trust, billing, security and compliance purposes should be collected. Indefinite speculative candidate databases are not an acceptable purpose.

Hiring users are contractually prohibited from using TruRole candidate data or match outputs to unlawfully discriminate or filter on protected characteristics. TruRole must regularly review matching logic, data inputs and observed outcomes for material accuracy, bias and disproportionate effects.

A Data Protection Impact Assessment should be maintained for AI-assisted recruitment/matching and updated when the processing, models, data sources or risks materially change.

Base44 and relevant subprocessors support hosting, authentication, storage and application execution. Stripe processes hiring payments. Google processes information when a user chooses Google sign-in. Other processors may be used only where needed for the service and subject to appropriate contractual/security controls.

Verified employers/recruiters receive candidate application information needed for the relevant vacancy only through the applicable candidate-controlled process. For TruRole Easy Apply, selecting, saving, matching with or viewing a vacancy does not send a CV; the candidate must deliberately submit the application. Anonymous talent discovery deliberately excludes direct identity. Private CV/identity access is exposed to a hiring account only through the applicable candidate-controlled process, except where authorised administration, security, legal compliance or a valid rights request requires access.

When a candidate intentionally submits an application to an employer or authorised recruiter, that receiving hiring organisation will normally be an independent controller for the recruitment processing it determines after receipt. It must provide its own privacy information where required and is responsible for its own lawful basis, access controls, retention, candidate rights and recruitment decisions. TruRole remains responsible for the platform processing for which TruRole determines the purposes and means.

For an external discovery result, selecting Apply sends the user to the employer, ATS or other identified external destination. TruRole does not receive or transmit that external application merely because it indexed or linked to the vacancy. Personal data entered at the external destination is governed by the receiving organisation's privacy information and practices.

Information may also be disclosed to professional advisers, courts, regulators, payment providers or law-enforcement bodies where legally required or reasonably necessary to establish, exercise or defend legal rights or investigate serious abuse.

Administrators can access account, company, recruiter and candidate data for support, compliance, security, fraud investigation, data-rights handling and platform administration. Private CV access and bulk personal-data exports require an entered business reason and are recorded in the administrative audit trail.

Administrative access does not give permission to browse CVs out of curiosity or use personal data for unrelated purposes. Exported ZIP/CSV files must be stored securely, access-limited and deleted when no longer required.

Some technology providers or subprocessors may process data outside the UK. Where a restricted international transfer occurs, the controller must use a lawful UK transfer mechanism where required, such as adequacy regulations or appropriate contractual safeguards, together with any required transfer-risk assessment.

Candidate profile/CV data should be kept while the account is active and only for as long afterwards as needed to complete deletion, resolve disputes or comply with law. Application, introduction and trust records should normally be reviewed for deletion or anonymisation after 24 months of inactivity unless a live dispute, fraud/security issue or legal/regulatory need justifies longer retention.

Payment, invoice and tax records are retained for the statutory accounting/tax period applicable to the legal controller, normally up to six years where UK record-keeping rules require it. Legal acceptance, compliance and security-audit records may be retained for the period reasonably needed to demonstrate compliance, investigate incidents or defend claims.

Retention periods and criteria must be reviewed periodically rather than treating “keep forever” as a default. Where a statutory record-keeping rule applies to a particular TruRole work-finding activity, the relevant compliance record will be retained for at least the legally required minimum even if an ordinary product-retention period would otherwise be shorter; unnecessary personal data should still be minimised or removed where lawful.

Depending on the circumstances and lawful basis, UK data-protection law may give you rights of access, rectification, erasure, restriction, objection, portability and rights relating to automated decision-making. Identity may need to be verified before a request is fulfilled.

Requests are handled without undue delay and within the applicable statutory time limits. Where a request is refused or limited, the controller must record and communicate the lawful reason where required.

Your right to object: where processing relies on legitimate interests, you may object. The controller must consider the objection and stop the processing unless there are compelling legitimate grounds that override your interests/rights or the processing is needed for legal claims.

Sign in to submit an in-app rights request, or contact Not configured if you cannot access your account.

You may complain to the UK Information Commissioner's Office if you believe your personal data has been handled unlawfully. You may contact TruRole first so the issue can be investigated, but you do not have to do so.

TruRole uses access controls, private file storage, short-lived signed CV links, server-side authorisation, audit logging, payment-provider delegation and dependency/security review as part of its security baseline. No online service can guarantee absolute security.

Suspected personal-data breaches must be contained, assessed and logged promptly. Where a breach is likely to create a risk to people's rights and freedoms, the controller must notify the ICO without undue delay and, where feasible, within 72 hours of becoming aware. High-risk breaches may also require direct communication to affected individuals without undue delay.

See Security & responsible disclosure.

Strictly necessary authentication/session technology, limited interface/browser storage and proportionate hosting/application telemetry may be used to provide, secure and diagnose the service. The initial launch does not use TruRole behavioural-advertising profiles or optional advertising pixels.

If non-essential behavioural analytics, advertising or similar storage/access technology is introduced, it must be classified and controlled separately under current PECR/UK GDPR requirements. Continuing to use the site is not treated as consent where consent is required. Marketing email/text consent is also separate from Terms acceptance and must use its own lawful opt-in/opt-out process where required.

See the Cookie Notice.

Privacy information must stay accurate and reflect actual processing. Material changes are published as a new version/effective date and brought to users' attention before materially new processing where required. A new Terms version or change requiring fresh permission will trigger the legal gate again.