Last updated: [DATE] Version: 1.0
1. Who we are
Yaffle Limited ("we", "us", "our") is a company registered in England and Wales, company number 17480997, registered office [Address] We operate the applicant tracking service available at yafflehire.com (the Service).
We are registered with the Information Commissioner's Office, registration number [ICO REGISTRATION NUMBER].
Contact for privacy matters: dpo@yafflehire.com.
2. The most important thing in this notice
We do two different things with personal data, and which one applies changes who you need to talk to.
When an employer uses our Service to recruit, that employer is the data controller and we are their processor. They decide what to ask candidates, why, and for how long to keep it. We hold and process that information on their written instructions, under a contract that meets Article 28 of the UK GDPR.
If you are a candidate and you want to know what is held about you, have it corrected, or have it deleted, your rights are against the employer you applied to, not against us. You can use the candidate dashboard in the Service to exercise those rights directly, and we will assist the employer in responding — but we cannot make decisions about their data. Section 6 explains what we do and do not do here.
We are the controller for a narrower set of information: visitors to our website, people who enquire about the Service, the staff accounts our customers create, and our own billing and business records. Sections 3 to 5 are about that.
3. What we collect as controller, and why
| Who you are | What we hold | Why | Lawful basis |
|---|---|---|---|
| Website visitor | Pages requested, IP address, browser and device information, and information in strictly necessary cookies | To serve the site securely and keep it available | Legitimate interests (running and securing our own website) |
| Enquirer or prospective customer | Name, work email, telephone, employer, and the content of your enquiry | To answer you and, if you ask, to demonstrate the Service | Legitimate interests (responding to a business enquiry you initiated) |
| Customer contact | Name, work contact details, role | To manage the contract, provide support, and send service notices | Contract |
| Staff user of a customer | Name, work email, display name, role and permissions, sign-in timestamps, second-factor enrolment, and — where single sign-on is used — the identifier your employer's identity provider gives us | To create and secure the account through which you use the Service | Contract with your employer, and our legitimate interests in securing it |
| Anyone | Security and audit records: sign-ins, administrative actions, IP address and user agent at the time | To detect and investigate misuse, and to give customers an audit trail | Legitimate interests (security), and legal obligation where applicable |
| Customer billing contact | Billing details, invoices, payment records | To take payment and keep statutory records | Contract, and legal obligation (tax and company law) |
We do not sell personal data, and we do not use candidate data to train any machine learning model — ours or a third party's.
Marketing
If you have enquired about the Service or are a customer contact, we may send you information about the Service on the basis of our legitimate interests or the soft opt-in in the Privacy and Electronic Communications Regulations. Every message carries an unsubscribe link, and you can object at any time by writing to dpo@yafflehire.com. We do not send marketing to candidates.
4. How long we keep it (as controller)
| Record | Retained |
|---|---|
| Website and security logs | [RETENTION, e.g. 12 months] |
| Enquiries that do not become customers | [RETENTION, e.g. 24 months from last contact] |
| Customer contract records | The term of the contract plus [6] years, for limitation and tax purposes |
| Staff user accounts | While the account is active; removed when the customer deletes it or the contract ends |
| Audit records | Set by each customer between 30 days and one year; each entry carries its own expiry at the moment it is written |
| Billing and accounting records | 6 years, as required by law |
5. Your rights
Where we are the controller, you have the right to: access a copy of your data; have inaccurate data corrected; have data erased; restrict or object to processing; data portability; and — where we rely on consent — to withdraw it at any time without affecting processing already carried out.
Exercise any of these by writing to dpo@yafflehire.com. We will respond within one month. We will not charge you, and we will not ask for more identifying information than we need to be sure it is you.
If you are unhappy with how we have handled your information you can complain to the Information Commissioner's Office — ico.org.uk, 0303 123 1113, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF. We would rather you told us first so we can put it right.
6. Candidate data — where we are the processor
This section is for transparency. It does not make us your controller.
What the Service holds about candidates
| Category | Examples |
|---|---|
| Identity and contact | Name, email address, telephone, postal address |
| Application content | CV files, the structured data extracted from them, application form answers, covering text |
| Assessment | Interview notes, scorecards, reference responses, and — where the employer uses them — video interview recordings and their transcripts |
| Correspondence | Messages between the employer and the candidate, including a compliance copy of each email |
| Offer and contract | Offer terms, signed documents, signature images |
| Equal opportunities monitoring | Answers about ethnicity, disability and sexual orientation — special category data under Article 9 |
| Criminal records declarations | Where the employer's application form asks for them — also Article 9 data |
Equal opportunities data is deliberately kept apart from identity. It is collected under separate explicit consent, stored against the application identifier only, and cannot be read alongside the candidate record anywhere in the product. No report, export or API response can put the two back together.
Consent, as the Service records it
When a candidate applies, the Service records data-processing consent (required) and, where the employer has enabled it, talent-pool consent (optional). It stores a snapshot of the exact wording shown, the terms URL, the time, the IP address and the browser — so what was agreed to is evidenced, not merely that a box was ticked. Consent is sought afresh on each application.
What a candidate can do directly
The candidate dashboard allows a candidate to download everything held about them, and to request erasure. An erasure request is scheduled 14 days ahead and may be refused by the employer with a reason, which the candidate is told — because an employer sometimes has a lawful ground to retain, such as a legal hold. If nobody decides, the request executes on the date.
Talent-pool consent can be withdrawn from the same dashboard at any time.
Automated decision-making
The Service uses a large language model to read a CV and turn it into structured fields, and offers recruiters a matching score with reasons. These produce information for a person to consider; they do not make hiring decisions and are not permitted to. No candidate is rejected, ranked into or out of a process, or otherwise dealt with by automated means alone. That keeps the processing outside the Article 22 prohibition on solely automated decisions with legal or similarly significant effects — and employers using the Service agree to keep a human in the decision.
7. Who else processes the data (sub-processors)
We use the following. Each is bound by a written contract meeting Article 28, and we remain responsible to our customers for what they do.
| Sub-processor | What it does | Where |
|---|---|---|
| Amazon Web Services — compute, database, object storage, key management, queues, email delivery | Hosts the entire Service | Ireland (eu-west-1) |
| Amazon Transcribe (AWS) | Transcribes video interview audio, where the employer uses video interviews | Ireland (eu-west-1) |
| Amazon Bedrock (AWS) | Reading uploaded CVs, and — where enabled by the employer — extracting signals from interview notes, answering in-product questions, and talent-pool search | Ireland (eu-west-1) |
| Amazon Bedrock (AWS) | Reads uploaded CVs and returns structured fields | Ireland (eu-west-1) |
| [APM / MONITORING PROVIDER] | Application performance monitoring, which may incidentally capture identifiers present in diagnostic data | [REGION] |
| [EMAIL / PAYMENT / OTHER — COMPLETE BEFORE PUBLISHING] |
We tell customers before we add or change a sub-processor, and a customer may object under their contract.
8. Transfers outside the UK
Processing takes place in the United Kingdom and the European Economic Area, with the exception below.
All processing, including the AI processing, takes place in the United Kingdom and the European Economic Area. Uploaded CVs are read by Amazon Bedrock in Ireland (eu-west-1) under our agreement with AWS. The content is not used to train any model.
We would not move that processing outside the UK or EEA without a lawful transfer mechanism — an International Data Transfer Agreement or the UK Addendum to the Standard Contractual Clauses, and a transfer risk assessment — and we would tell customers before doing it.
9. How we protect it
In summary: everything is encrypted in transit; personal data is encrypted at rest under a separate encryption key for each customer, so one customer's data cannot be read with another's key; access is role-based and every administrative action is recorded in an audit trail; and when a customer leaves, their data is purged and then their key is destroyed, which closes off any copy a row-by-row delete could not reach.
SECURITY_OVERVIEW.md is the full description, and we will share it with customers and prospective customers on request.
No system is perfectly secure. If a breach affects your personal data and is likely to result in a risk to your rights, we will tell the ICO within 72 hours and, where the risk is high, tell you.
10. Cookies
The Service uses cookies that are strictly necessary for it to work: to keep you signed in, to protect the sign-in process, and to carry a session between our hosts. These do not require consent under the Privacy and Electronic Communications Regulations, and we do not use them to track you.
We do not use advertising or third-party analytics cookies on the Service.
Careers pages are different. An employer embedding our careers widget or standalone careers page on their own website may add their own tracking tag to that page. Those cookies are the employer's, set under their own privacy notice and cookie banner, and are not ours. [IF YOU ADD ANALYTICS TO THE MARKETING SITE, DESCRIBE IT HERE AND ADD A CONSENT BANNER.]
11. Changes to this notice
We will update this page when the Service changes. Where a change materially affects how we handle personal data, we will tell customers in advance through the Service or by email. The version and date at the top tell you which version you are reading.
12. How to contact us
dpo@yafflehire.com Yaffle Limited, Address TBC
If you are a candidate asking about an application, please contact the employer you applied to — they hold the decision about your data. If you cannot reach them, write to us and we will do what we properly can to help.
Subscribe for Updates
Stay in the loop with everything you need to know.