AceLeads legal
Privacy notice
What we collect, why we collect it, who sees it, how long it stays and how to get rid of it. Written for the two things this site actually does: sending you alerts, and passing an application you chose to make to one employer.
1. Who we are
This site is run by HDCH Limited, company number 16237398, trading as AceLeads. We decide what happens to the data described below, which makes us the controller for it, except where section 5 says otherwise.
[NEEDS HUMAN SIGN-OFF] The contact address for privacy requests, the registered office to publish, and our Information Commissioner registration number are all outstanding. The domain is not registered yet, so no mailbox exists to print here. Nothing on this site should go live carrying a placeholder contact.
2. Registering for alerts
Registering does one thing: it emails you when an employer advertises a job in a category and an area you picked. It is a notification. It does not create a profile an employer can look at, and it does not put you forward for anything.
We rely on your consent for these emails, which is why there is a box to tick and why it is not pre-ticked. You can withdraw it at any time and the emails stop.
What the form asks for, and why
Email address required
It is where the alert goes. Without it there is no service, because an alert email is the only thing registering does.
Stored in lower case, and used to check against the unsubscribe list before anything is sent.
First name optional
Only so an email can open with your name instead of "Hello". Leave it blank and nothing else changes.
Job categories required
Which kinds of work you want to hear about. This is the filter you set on your own alerts.
Chosen from a fixed list. You are choosing a category of advert, not being assessed against anything.
Areas required
Where you would travel to work. Nothing outside your chosen areas is emailed to you.
Stored as official local authority codes rather than free text, so an area means one thing.
Salary range and availability optional
Narrows your alerts further if you want them narrowed. Leaving them blank means you hear about everything in your categories and areas.
Optional, and no employer sees them.
Notice period optional
Optional context you can choose to give. It changes nothing on our side today.
If a field like this stops earning its place, the right answer is to remove it from the form. [NEEDS HUMAN SIGN-OFF]
Your tick on the consent box, and the wording you were shown required
Consent has to be evidenced, which means recording what the words actually said at the moment you agreed, not what they say today.
The wording is written by the server, not sent up by your browser, so nobody can put words in your mouth by tampering with a form.
IP address, browser, page and time required
Recorded with the consent as evidence of when and where it was given, and used to stop automated abuse of the form.
The IP address is taken from the connection by the server. A form cannot supply its own.
What registering never asks for
- A CV, at any stage of registering.
- Your date of birth, nationality, right to work documents or any identity document.
- Health, disability, ethnicity, religion, sexual orientation or criminal record information.
- A password, because there is no account to log in to.
That list matters more than it looks. A site that collects CVs from people who have not applied to anything is building a database of people, and a database of people invites exactly the behaviour this business is built to stay away from.
3. Applying for a job
You apply on one advert, to the employer who placed it. Your application reaches that employer and nobody else. There is no route in this system that sends it to a second employer, and that is enforced by how the data is stored rather than by a promise.
Your name, email address and phone number required
So the employer can reply to you. An application nobody can respond to is not an application.
Your CV optional
Because employers ask for one. It goes to the employer whose advert you applied to and to nobody else.
This is the sensitive one. See the section on CVs below.
A cover note optional
Anything you want to say to that employer, in your own words.
Which advert you applied to required
It is the thing that decides who receives your application, and the only advertiser who can ever receive it.
Your tick on the consent box, the wording, the time, your IP address and browser required
The evidence bundle for a piece of processing that involves sensitive information. It has to be recorded at the moment it happens.
4. CVs and sensitive information
People put things in a CV without being asked and often without thinking about it: a health condition that explains a gap, a disability, a nationality, a religion, a trade union role, a volunteering history that reveals a belief, sometimes a criminal conviction. None of that is requested by us and none of it is a field on the form. It arrives inside the document.
Information about health, ethnicity, religion, trade union membership, sex life, sexual orientation, genetics and biometrics is treated differently in law from an email address. Criminal conviction information is handled under its own rule again. A CV can carry any of it.
What we do about it
- A CV is only ever asked for on an advert you have chosen to apply to. Never at registration, never speculatively, never "to keep on file".
- The file is stored privately. It is not on a public address, and it is reachable only through a short-lived link issued by the server for one delivery.
- It is delivered to the advertiser of that advert, and there is no route in the system that returns it to any other advertiser.
- It is deleted, along with your contact details, at the end of the retention period, by a job rather than by someone remembering.
The part that is genuinely unresolved
Which condition in Article 9(2) we rely on for the information a CV carries is an open legal question. The consent wording on the form currently relies on your explicit consent, given for one named advert. Whether that is the right condition, whether an employment-related condition is better, and what appropriate policy document is required to sit behind it, are decisions for a solicitor before launch. [NEEDS HUMAN SIGN-OFF]
Conviction information in a CV is not covered by Article 9 at all. It has its own route under Article 10 and Schedule 1 of the Data Protection Act 2018, and it needs its own answer. [NEEDS HUMAN SIGN-OFF]
[NEEDS HUMAN SIGN-OFF] This is the single hardest question in this notice and it is not one a build can answer. Until it is answered, the application form relies on your explicit consent for one named advert, which is the most conservative reading available.
5. Who is responsible for your application
When you send an application, it passes through us to the employer. Two readings of that are possible and they lead to different obligations.
Reading one: we act on the employer's behalf
If we handle the application under the employer's instructions, we are its processor for that step. The employer then has to give us written processing terms, and our advertiser contract needs a full set of Article 28 clauses covering instructions, confidentiality, security, sub-processors, assistance, deletion and audit.
Reading two: we each decide for ourselves
If we decide how the application is collected and delivered, and the employer then decides for itself what to do with it, we are separate controllers in sequence. The advertiser contract then needs controller to controller clauses instead, and the employer needs its own privacy information for what it does next.
Either way, one thing does not change: the employer only ever receives applications made to its own advert, and it is prohibited from using your application for anything other than the job you applied to. That is written into the advertiser terms.
[NEEDS HUMAN SIGN-OFF] Which reading is correct decides the shape of every advertiser contract signed, so it has to be settled before the first one is signed rather than after.
6. If you enquire about advertising
This section is for employers. If you are looking for work, nothing in it applies to you, and nothing you send us as a work-seeker is used for any of it.
The form on our employer pages sends us a business enquiry. We use what you type to reply to it, and to set up an advertiser account if you decide to go ahead. We rely on our legitimate interests rather than on your consent, because the reply is the thing you asked for and asking you to agree to it would be a tick doing no work. You can object to that at any time, and you can ask us to delete the enquiry.
What you write is never shown to anybody looking for work, it is never joined to anything on the job-seeking side of this site, and we do not sell it or pass it to anybody else. Inside our own team it is readable by staff only, on a staff screen that needs a sign-in.
What the enquiry form asks for, and why
Company name and your name required
So a reply is addressed to a business and a person rather than to an inbox.
A named individual at a business is still a person, so this notice covers it.
Work email address required
Where the reply goes. Without it the enquiry cannot be answered, which is the whole purpose.
A second enquiry from the same address within a few minutes is treated as one enquiry, so a double press does not create two records.
Phone number optional
Only if you would rather be rung than emailed. Leave it blank and nothing changes.
Sector, roughly how many vacancies, and anything you want to add required
Enough to give a useful answer in the first reply instead of asking three questions back.
The free-text box is your own words. Nothing reads it automatically and nothing scores it.
Your tick on the optional marketing box, and the wording you were shown required
Recorded whichever way the box went. A box shown and left unticked is a fact about what you decided, and it is a different record from never having been asked.
Leaving it unticked has no effect on the reply to your enquiry.
IP address, browser, page and time required
Taken from the connection by the server as evidence of when the enquiry was made, and used to stop automated abuse of the form.
A form cannot supply its own IP address.
What it never asks for
- Anything about anybody looking for work. This form and the job side of the site do not meet.
- Any special category data. There is no field for it and no document upload.
- Any payment details. Nothing is charged at enquiry stage and there is no payment form on this site.
The optional marketing box
There is one tick box on that form and it is optional, unticked, and about nothing except occasional email from us about advertising here. Leaving it alone has no effect on the reply to your enquiry. Whichever way you leave it, we store the wording you were shown alongside your answer, because a box that was offered and declined is a decision you made and we should be able to show you what you were deciding about.
The wording shown beside the send button at the moment you enquired is stored with your enquiry. Today it reads: “We use these details to reply to your enquiry and to set up an advertiser account if you decide to go ahead. They are not shown to anybody looking for work, and we do not sell or share them. You can ask us to delete them at any time.”
How long we keep it
No period is set, and nothing deletes an enquiry automatically today. That is stated here rather than covered by a number nobody has decided on. Ask us and we will delete it.
[NEEDS HUMAN SIGN-OFF] Three things on this section are outstanding: the legitimate interests balancing test for holding a named individual's work contact details, the retention period for an enquiry that goes nowhere, and whether the marketing box is needed at all for an enquirer who is a limited company rather than a sole trader. None of them should be guessed at.
8. Where your data is held
The database region is not chosen yet. Some of the services above route traffic through their nearest network location by design, so some processing happens outside the United Kingdom even when the data rests here.
[NEEDS HUMAN SIGN-OFF] Choose the database region, then record the transfer safeguard relied on for each provider, whether that is an adequacy finding or the UK addendum to the standard contractual clauses. Until that is done this section cannot say anything specific, and a notice that guesses about transfers is worse than one that admits the gap.
9. How long we keep things
Deletion is done by a scheduled job rather than by someone remembering, and every run is logged so that the deletion can be evidenced rather than asserted.
Your registration and alert preferences
Email address, first name if given, chosen categories and areas, chosen salary bands and availability if given.
How long: While your registration is active. No inactivity cut-off is set yet.
Unsubscribing stops the emails immediately. It does not, on its own, delete the registration. Deletion is a separate request and runs through a single database routine that removes the record and writes an entry to an erasure log. How long a quiet registration should survive is an open decision. [NEEDS HUMAN SIGN-OFF]
Your consent records
The exact wording you were shown, its version, the time, the page, your IP address and browser.
How long: Kept as evidence for as long as we rely on the consent, then for a limitation period after it ends.
This table can be added to but never edited, so a record of what you agreed to cannot be quietly rewritten later. The only route that removes a row is the erasure routine. The length of the limitation period to apply after a consent ends is an open decision. [NEEDS HUMAN SIGN-OFF]
Your application details and your CV
Your name, email address, phone number, cover note, the CV file itself, and the evidence captured with the submission.
How long: Placeholder of 12 months from submission.
The deletion date is stamped on the record when the application is submitted, using the period in force at that moment, so changing the setting later cannot silently extend anything already collected. A database routine deletes the record and the stored file together. That routine is written but is not scheduled yet, which is a launch blocker rather than a detail. The period itself is a storage limitation judgement for the owner and a solicitor. [NEEDS HUMAN SIGN-OFF]
The fact that an application happened
Which advert, when, whether it was billable. No name, no email address, no CV.
How long: Kept after the details are deleted, for billing and audit.
Separating the identifying details from the record of the event is what lets us delete the first without destroying the accounting record or the ability to evidence that an advertiser was charged once and only once. How long this row is kept follows the accounting retention below. [NEEDS HUMAN SIGN-OFF]
Billing records
Advertiser, advert, price, date. No applicant personal data.
How long: Accounting retention period, to be confirmed.
An append-only ledger. Company and tax record keeping requirements set the floor here, and the exact number is for the owner and the accountant to confirm. [NEEDS HUMAN SIGN-OFF]
A record that an alert was sent to you
Which registration, which advert, when, and the provider reference.
How long: Not decided.
This exists so the same alert cannot be sent to the same person twice. Deleting it early would reintroduce exactly the duplicate-send failure it was built to prevent, so any retention period has to be set with that in mind. [NEEDS HUMAN SIGN-OFF]
Your unsubscribe
Your email address and the reason it was suppressed.
How long: Kept indefinitely, on purpose.
The only reliable way to honour an unsubscribe is to remember it. Deleting the suppression record would let a future registration or import start the emails again. If you ask for full erasure we will explain this and agree what happens to the suppression entry, because erasing it works against you. [NEEDS HUMAN SIGN-OFF]
A hirer enquiry about advertising
How long: Not set. Nothing deletes one today.
Deletion and erasure logs
What ran, when, how many records it removed. No personal data beyond an internal reference.
How long: Kept as the audit trail.
A retention policy nobody can evidence is not a retention policy. A gap in these tables is the alarm that the deletion job stopped running.
[NEEDS HUMAN SIGN-OFF] The twelve month figure for application details is a placeholder, not a decision, and the deletion job is written but not yet scheduled. Both have to be closed before a real application is taken.
10. Your rights, and how to use them
Listing rights is easy. What follows is the route that actually exists for each one, so you can tell the difference between a right we have built for and a right we would have to do by hand.
Some of these you do yourself, from the settings page that any alert email links to. The rest need a person here, and are marked as such rather than dressed up as self-service.
None of them has been used by a real person yet, because the site is pre-launch and there is nothing behind it. Every route is tested end to end before that changes.
Stop the emails
Withdraw your consent to job alerts.
Every alert email carries an unsubscribe link and the standard unsubscribe header that mail apps read, so in most email clients their own unsubscribe button does it in one action. The link itself opens a page with a single button, because mail scanners and security gateways open every link in an incoming email and a link that unsubscribed on sight would unsubscribe people who never touched it. No sign-in, no form, no reason asked for. Your address then goes on a do-not-send list, which is what makes the stop stick even if somebody else types it into the form later.
self-serve
UK GDPR Article 7(3), and PECR regulation 22 for the alert emails themselves.
Change what you hear about
Correct or update your categories, areas and details.
The settings link in any alert email opens your own settings page. Change the categories, the areas, the salary bands and the availability there and save. It is the same signed-link mechanism as the unsubscribe, so there is no password to lose, and the token is taken out of the address bar as soon as the page has read it.
self-serve
UK GDPR Article 16.
See what we hold
Ask for a copy of your data.
Email us and we send you what we hold, which for a registration is your email address, your first name if you gave one, your chosen categories and areas, your consent records and the dates alerts were sent. If you have applied for a job, it also includes the application details we still hold for that application.
by email
UK GDPR Article 15. One month to respond, extendable by two months for a complex request.
Get your data deleted
Erase your registration.
Your settings page has a delete button, and it does it for real rather than marking a record as hidden. You type the word delete to confirm, because it cannot be undone. It removes your email address, your first name, your chosen categories and areas and your consent records. One thing survives, and the page says so before you press it: if you had unsubscribed, the do-not-send entry stays, so that a future registration or import cannot start the emails again. You can also ask us by email and we will run the same routine.
self-serve
UK GDPR Article 17.
Pull back an application
Withdraw an application you have already sent.
Email us and we delete the application details and the CV file we hold. We cannot delete the copy the employer already has, because it is theirs once you have sent it, so we will give you their contact details and tell you what we have done at our end.
by email
UK GDPR Articles 7(3) and 17. The employer is a separate organisation and you deal with it directly.
Take your data elsewhere
Get your data in a portable format.
Email us and we send a machine readable file of the data you gave us. This right applies here because everything we hold about you was given by you and is held on consent.
by email
UK GDPR Article 20.
Pause our use of your data
Ask us to restrict processing while something is in dispute.
Email us. In practice this means we stop sending alerts and stop using the data while we sort out whatever is disputed, without deleting anything, so nothing is lost if the dispute resolves in your favour.
by email
UK GDPR Article 18.
Object
Object to what we are doing with your data.
For the emails, the unsubscribe link or your settings page does it immediately. For anything else, email us. Where the objection is to direct marketing there is nothing to weigh up: it stops, and it stops without a reason being given.
self-serve or by email
UK GDPR Article 21.
Complain about us
Go to the regulator.
You can complain to the Information Commissioner at ico.org.uk. You do not have to come to us first, although it usually gets sorted faster if you do. Complaining to the regulator does not affect any application you have made.
straight to the regulator
UK GDPR Article 77.
Using any of these costs you nothing and changes nothing about an application you have already made.
11. Automated decisions and profiling
There is none, and there is not meant to be.
An alert is triggered by the categories and areas you chose yourself. Nothing scores you, ranks you, assesses your suitability or decides anything about you, and no employer can search the registrations. Every decision about whether you are right for a job is made by the employer, after you have decided to apply to it.
UK GDPR Article 22 is not engaged, because no decision producing legal or similarly significant effects is made by automated means.
12. Security
- Forms are submitted to the server rather than written to the database by your browser, so the database is not reachable from a page.
- Registration and application data sit in tables that no public or signed-in role can read at all. Only the server can see them.
- CV files are stored privately and are reached through a short-lived link issued for one delivery, not through a guessable address.
- Every form is rate limited and carries an anti-spam check that is verified by the server, not by your browser.
- No personal data is ever put in a web address, including on the page you land on after submitting a form.
[NEEDS HUMAN SIGN-OFF] The breach procedure is not written yet: who decides whether the Information Commissioner is told within 72 hours, who tells affected people, and how that decision is recorded.
13. Complaining
Come to us first if you want to, and we will tell you what we have done. You do not have to. You can go straight to the Information Commissioner at ico.org.uk, and doing so has no effect on any application you have made through this site.
Our complaints process, including what we do about things that have nothing to do with data protection, is on the complaints page.
14. Changes to this notice
This notice is version draft-v0.1. When you tick a consent box, the version in force at that moment is stored alongside the exact wording you were shown, so a later change to this page cannot rewrite what you agreed to. If we change something that affects how we use data you have already given us, we tell you rather than relying on you noticing a new date at the top of a page.