Privacy Policy

Who we are

GradTalent operates a graduate hiring platform connecting candidates with employers. For the personal data described in this policy, GradTalent is the data controller — except where we process candidate data on behalf of an employer using the platform to run their own hiring, in which case that employer is the controller and we act as their processor.

What we collect

We collect only what the platform needs in order to work.

• Account data: name, email address, password (stored only as a hash), and role — candidate, recruiter or administrator.
• Profile data: education, skills, work and project history, certifications, and any resume you upload.
• Application data: the roles you apply to, your application status, and messages exchanged with employers through the platform.
• Employer data: company details, job postings, team members and the applicant tracking system connections you configure.
• Technical data: IP address, browser type and pages visited, used to keep the service secure and working.
• Communications: messages you send us through the contact form on this site, including the contact details you supply so we can reply.

How we use it, and on what basis

Profile and application data is used to match candidates to roles, to show employers the candidates who fit what they are hiring for, and to give candidates a clear view of where each application stands. We rely on performance of a contract for this: it is the service you signed up for.

Technical data is used for security, fraud prevention and keeping the service available. We rely on legitimate interests, balanced against your right not to be monitored beyond what running the service requires.

Where we ask for consent — for optional communications, for example — you can withdraw it at any time without affecting anything done before you withdrew it.

Automated processing and AI

GradTalent uses automated processing to rank and recommend roles to candidates and candidates to employers, and to extract structured information from uploaded resumes.

These are recommendations for a human to act on. The platform does not automatically reject an application, and no hiring decision is made solely by automated means. Every recommendation carries the reason it was made, and you can ask for a human review of anything that affects you.

Who we share it with

Employers see the profile and application data of candidates who apply to them, or who choose to be discoverable. Candidates control what is on their profile.

We use third-party providers for hosting, email delivery, file storage and AI processing. They act on our instructions and may not use your data for their own purposes. Where an employer has connected an applicant tracking system such as Greenhouse or Lever, data you submit to that employer may be pushed into their system at their instruction.

We do not sell personal data.

How long we keep it

Account and profile data is kept for as long as your account is open, and deleted within 30 days of you closing it. Application records are kept for the period the employer needs to defend a hiring decision, then deleted. Contact form submissions are kept for up to 24 months so we can follow up on a conversation. Technical logs are kept for 90 days.

Your rights

Depending on where you live, you can ask us to:

• Give you a copy of the personal data we hold about you.
• Correct anything inaccurate, or complete anything incomplete.
• Delete your data, where we have no overriding reason to keep it.
• Restrict or object to how we process it, including profiling.
• Export your data in a portable, machine-readable format.
• Withdraw consent you previously gave.

Security

Passwords are hashed and never stored in a readable form. Credentials for third-party integrations are encrypted at rest. Access to production data is limited to the people who need it to operate the service, and is logged. Data is encrypted in transit using TLS.

No system is perfectly secure. If a breach affects your personal data and is likely to put your rights at risk, we will tell you and the relevant regulator within the time the law requires.

Contacting us about your data

Use the contact form on this site to make any of the requests above, and say which one you are making so we can route it properly. We will respond within one month. If you are not satisfied with our answer, you can complain to your local data protection authority.