What personal data we collect, why we collect it, how we use it, and your rights under UK GDPR.
Last updated: 21 May 2026
This notice explains what personal data cvshared collects, why we collect it, how we use it, who we share it with, and the rights you have under UK GDPR.
If you have any questions about this notice or want to exercise any of your rights, email privacy@cvshared.com.
CVSHARED LTD (“we”, “us”, “our”) is the data controller for personal data collected through cvshared.com.
We collect personal data from two groups:
When you sign up, we collect the information needed to build a profile recruiters can match against. This includes:
When you register as a recruiter, we collect basic business contact and company information so we can verify you and communicate with you about the service.
When you visit cvshared.com, our hosting provider and analytics tools collect limited technical information including IP address, browser type, device type, pages viewed and referring URL. See the Cookies and analytics section below.
| Purpose | Lawful basis (UK GDPR Art. 6) |
|---|---|
| Creating and maintaining your candidate profile | Performance of a contract |
| Sharing your profile with verified recruiters when they unlock it | Consent (given at sign-up) |
| Paying out reward credit when your profile is unlocked, and sending you an Amazon gift voucher when you qualify for and request a payout | Performance of a contract |
| Contacting you about your profile, account, or rewards | Performance of a contract |
| Sending recruiters access to candidate profiles they have paid to unlock | Performance of a contract |
| Communicating with recruiters about their account and our service | Legitimate interests (business-to-business communication with a recruiter who has registered with us) |
| Understanding how the site is used so we can improve it | Legitimate interests |
| Meeting our legal and accounting obligations | Legal obligation |
Consent to share your profile with recruiters is the core mechanic of the service. You give this consent when you submit the candidate sign-up form. You can withdraw your consent at any time by emailing privacy@cvshared.com — see Your rights below.
The whole point of cvshared is to share candidate profiles with recruiters who pay to unlock them. When a recruiter unlocks your profile, they receive the information on your profile (subject to any employer blocks you have set). Profiles are only shown to recruiters who have registered an account with us.
We do not sell candidate data in bulk. Recruiters access individual profiles on an unlock-by-unlock basis.
We use the following third-party services to run cvshared. Each one processes some personal data on our behalf, under a data processing agreement:
| Provider | What they do | What data they see |
|---|---|---|
| Tally.so | Hosts our sign-up forms | Form submissions from candidates and recruiters |
| Vercel | Hosts our website, serves it to visitors, and provides cookieless site analytics (page views, referrers, browser/device type, country) | Visitor IP (used to derive country, not stored), request logs, page views, referrer |
| Google (Workspace) | Email, shared documents | Email correspondence, candidate/recruiter records held in Google Sheets |
| Google (Fonts) | Web fonts loaded on every page | Visitor IP |
| Airtable | Our candidate and recruiter database | Profile data, contact details, unlock history |
| Amazon (UK) | Gift card fulfilment, when you qualify for and request a payout | The email address we send your voucher to |
We share only the minimum data each provider needs to do its job.
We may share personal data with:
Some of our service providers (notably Vercel, Tally, Google and Airtable) are US-headquartered companies and may process data outside the UK and EEA. Where this happens, we rely on the safeguards put in place by those providers (such as the UK Extension to the EU–US Data Privacy Framework, or Standard Contractual Clauses) to make sure your data is protected to UK standards.
We keep candidate and recruiter records for 24 months from the last point of activity (your last sign-in, unlock, voucher payout, or communication with us). After that, we delete or anonymise your data unless we are required to keep it longer for legal or accounting reasons.
Tally form submissions are retained for the same period and then deleted from Tally.
You can ask us to delete your data sooner — see Your rights below.
We use Vercel Analytics to understand how the site is used. It collects page views, referrers, browser and device type, and approximate country. It does not use cookies, does not track individuals across sessions, and does not store IP addresses. No cookie consent banner is required.
Google Fonts is also loaded on every page, which means Google receives your IP address as part of serving the web fonts.
We do not use any other analytics tools or tracking cookies.
Under UK GDPR you have the right to:
To exercise any of these rights, email privacy@cvshared.com. We will respond within one month.
We protect personal data using appropriate technical and organisational measures, including access controls on our database, encrypted connections to our website and forms, and limits on who within cvshared can see candidate and recruiter records.
No system is ever 100% secure, but if a breach affects your personal data and is likely to result in risk to your rights, we will notify you and the ICO as required by law.
cvshared is not intended for anyone under 18. We do not knowingly collect data from children. If you believe we have, email privacy@cvshared.com and we will delete it.
We will update this notice as the service evolves. The “Last updated” date at the top reflects the most recent change. Material changes that affect how we use your data will be communicated directly where we hold a contact address for you.