How we handle your data.

Who we are

The data controller is hackajob Limited, a company registered in England under number 09279930, with its registered office at 3rd Floor, 1 Ashley Road, Altrincham, Cheshire, WA14 2DT. For any privacy question, you can reach our Data Protection Officer at dpo@hackajob.com, or the hiring team at careers@hackajob.com.

What this notice covers

Applying to one of our open roles, anything we do with your data while we consider your application, and what happens to your data afterwards. If we hire you, your time at hackajob is governed by a separate employee privacy notice that we will provide on day one.

What we collect

• Your application: name, email, phone (optional), LinkedIn (optional), and your CV.
• Your answers to the screening questions for the role you applied to.
• UTM parameters from the link that brought you to the careers site, if any.
• A first-party cookie recording your cookie consent decision.
• Basic technical data in our server logs (IP address, user agent, request time) for security and reliability.

We do not ask for diversity or other special-category data on the application form.

How we use it, and our lawful basis

We use your application to decide whether to invite you to interview, to communicate with you about the role, to arrange interviews, and to make a hiring decision. Our lawful basis is legitimate interest in running a fair recruitment process (UK GDPR Article 6(1)(f)). Cookies and analytics that are not strictly necessary are used only with your consent (Article 6(1)(a)).

Pre-employment and right-to-work checks are not covered by this notice. If you accept an offer, those checks are described in the separate employee privacy notice.

AI and automated decisions

We do not use AI to screen applications. There is no profiling, no match score, and no automated rejection beyond the explicit knockout questions you see on the application form (for example, the right-to-work confirmation). When a knockout applies, the reason is shown on the page.

Who sees your data

Internally, only the hiring panel for the role you applied to: typically the recruiter, the hiring manager, and the interviewers assigned to your interviews. Confidential roles are restricted further to named collaborators.

We also use service providers acting as our processors, in the following categories: cloud hosting and database providers; object-storage providers for your CV; transactional email providers; e-signature providers (only if you reach offer stage); product-analytics providers (only with your cookie consent); error-monitoring providers; and internal team messaging tools used for staff notifications about your application. All processors are bound by written agreements and process data only on our instructions.

We do not sell your data, and we do not share it with third-party advertisers.

International transfers

We process your data primarily in the United Kingdom and the European Economic Area. Where a service provider processes data outside the UK or EEA (for example, some transactional email and analytics providers operate from the United States), we rely on the UK International Data Transfer Addendum to the European Commission’s Standard Contractual Clauses, or another safeguard recognised under UK GDPR Article 46.

How long we keep it

• If we hire you: your application is moved into your employee record on your start date, and the employee privacy notice applies from then on.
• If we do not hire you: 6 months from our decision, then deleted.
• If you withdraw your application: 30 days, then deleted.
• If you ask us to erase your data: deleted within 30 days of your request.

Your rights

Under UK GDPR you have the right to access your data, to ask us to correct it, to ask us to delete it, to restrict or object to how we use it, to receive a portable copy, and to withdraw any consent you have given. To exercise any of these rights, email careers@hackajob.com or dpo@hackajob.com. We will respond within one month.

If you are unhappy with how we have handled your data, you can also complain to the Information Commissioner’s Office at ico.org.uk.

Cookies

We use essential cookies to keep the site working, including a session cookie when you sign into the candidate portal and a CSRF token on form submissions. With your consent we also use product-analytics cookies to understand how the careers site is used. Your consent decision is recorded in a first-party cookie that lasts 12 months; you can change it at any time by clearing the cookie or by emailing us.

Security

Your data is encrypted in transit (HTTPS) and at rest. Access is restricted on a need-to-know basis to the staff involved in the role you applied to. Your CV is stored in an EU-region object store and served to staff only via short-lived, signed URLs.

Children

This service is intended for adults. Please do not apply if you are under 18.

Changes to this notice

We may update this notice from time to time. Material changes will be announced on the careers site; minor wording or formatting changes will not.