ICO REGISTRATION · ZA087037 · LAST UPDATED · AUGUST 2026
CiiVSOFT Limited, a company registered in England and Wales under company number 09061018, whose registered office is at HLB House, 68 High Street, Tarporley, Cheshire, United Kingdom, CW6 0AT (“CiiVSOFT” or “we” or “us”), has prepared this Privacy Policy to help you understand our practices with respect to the collection, use, and disclosure of information we collect from you through: (i) CiiVSOFT.com, its subdomains, and any other website owned and operated by us; (ii) any online hosted services we provide; and (iii) our “Software,” meaning, collectively, our recruitment automation tools, applications, application programming interfaces (“APIs”), technology, tools and documentation, collectively, our or the “Services”.
CiiVSOFT and personal information: We are committed to lawful, fair and transparent processing of all personal information about our employees, customers, suppliers and other third parties during the course of our business activities. We will always comply with any applicable data protection legislation and we will ensure that collection and use of personal information is carried out in accordance with applicable data protection laws. The main laws governing data protection for our business are the UK GDPR and the Data Protection Act 2018 and, where our processing falls within its scope, the EU General Data Protection Regulation (Regulation (EU) 2016/679) (together, the “GDPR”).
What this policy is: This policy (and any other documents referred to in it, together with any privacy notice displayed on our website) sets out the basis on which we will process any personal information about you or individuals generally, whether it’s information we collect from those individuals or that is provided to us from other sources. This policy sets out rules on data protection and the legal conditions that must be satisfied when we obtain, handle, process, transfer or store personal information.
Registration: We are registered with the Information Commissioner’s Office under registration number ZA087037, and will comply with any successor notification requirements. Please note that, as explained below, we may only be processing your personal data on behalf of another party, who will be the data controller in respect of that information.
Controlling and processing information: We are the controller of all personal information used in our business for our own commercial purposes. Sometimes though, we will process personal information on behalf of another data controller, such as one of our clients, and when this is the case, we will do so only in accordance with the instructions of that data controller and otherwise in accordance with the GDPR. If we are processing on behalf of another data controller, that data controller will provide relevant information to you about how your data is being shared.
Why you should read this policy: It is important that you read this policy, together with any other documents referred to in it, so that you are aware of how any personal information relating to you will be dealt with by us.
We are accountable for demonstrating compliance with the GDPR’s six principles of processing personal information. These provide that personal information we deal with must be:
(a) processed fairly, lawfully and in a transparent manner;
(b) collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes;
(c) adequate, relevant and limited to what is necessary;
(d) accurate and, where necessary, kept up to date;
(e) not kept for longer than necessary; and
(f) processed securely, maintaining integrity and confidentiality.
In most instances, CiiVSOFT acts as a data processor, processing personal data on behalf of our business clients who are the data controllers. This applies to all Candidate Information and most Content processed through our Services.
However, CiiVSOFT may act as a data controller in certain limited circumstances, such as:
We ensure appropriate data protection measures are in place whether we are acting as a processor or a controller.
We collect information from you when you:
We may also collect information about you from our business partners, including referral partners and resellers. We may also obtain publicly-available business contact information.
Below is additional information about what we collect, depending on how you interact with the Services:
“Content” means information, data and other material provided to us by or on behalf of a Customer through the Services, other than Candidate Information. In practice this means job descriptions, screening criteria and related job data received from a Customer’s ATS, together with any information provided when connecting a third-party product or service to the Services. Customers retain ownership of their Content, subject to the terms of their Order Form and this Privacy Policy.
For the avoidance of doubt, Candidate Information, as described in section (b) below, is not Content. CiiVSOFT acts solely as a data processor in respect of Candidate Information, and the limitations set out in section (b) and section 4(b) apply to it in place of anything stated about Content elsewhere in this policy.
“Candidate Information” consists of information relating to candidates, job seekers or employees who are being considered for or who are actively involved in a recruitment process with a Customer who has registered a CiiVSOFT Account. As a B2B service provider, CiiVSOFT processes Candidate Information solely on behalf of and under the instructions of our business clients, who remain the data controllers for all Candidate Information at all times.
CiiVSOFT’s architecture is built around data minimisation. A CV, resume, or other application document may contain personal or sensitive information, including a candidate’s name, contact details, national insurance number, protected characteristics, or other identifiers. When such a document is received from a Customer’s ATS, CiiVSOFT processes it only momentarily, for the sole purpose of automatically detecting and redacting any personal or sensitive information it contains, before any further use of that content takes place. CiiVSOFT does not store, retain, analyse, or use any original CV, resume, or other application document, or any of the personal or sensitive information such a document may contain, beyond this immediate redaction step.
Following redaction, CiiVSOFT retains only the following limited technical information, necessary for the Services to function: a Job ID, Candidate ID, and Application ID; the job title; the date and time of relevant candidate, job, or application events; and the recommendation and output generated by CiiVSOFT’s AI in response to that application.
“Customer Information” consists of information related to your access or use of our Services or that otherwise identifies you as a customer or end user of the Services. Customer Information may include:
If you are an end user using the Services through an account created on your behalf by another of our customers (such as an employer, an organisation of which you are an employee or affiliate), we may collect and process Customer Information about you on behalf of the customer with whom your use of the Services is associated.
If you create your account using a service provided by a third party or a single-sign-on service provided by a third party, we may collect Customer Information about you from the third-party service (such as your username or user ID associated with that third-party service). If you create your account using such a third-party service, or if you give us permission, we may also collect, and you authorise us to collect, information about your personal contacts as may be stored within that third-party service, which we may use to facilitate your invitation of collaborators to our Services. By choosing to create an account using a third-party service, you also authorise us to collect Customer Information necessary to authenticate your account with the third party.
Certain aspects of the Services allow you to link or integrate third-party products and services to enable certain features and functionalities with the Services. For example, you can connect your Applicant Tracking System to generate Content in the Services from information and data contained in your Applicant Tracking System or integrate with third-party services using our applications or extensions. If you choose to use these features or functionalities, you may be asked to create an account with a third party that provides such features or functionalities or link your existing third-party service account with the Services (and, by doing so, agree to the privacy policy and/or terms and conditions of that third party). You may also be asked to authorise the Services to collect information from the third party on your behalf. We will then collect information from you and/or that third party as necessary to enable the Services to access your data and content stored with that third-party service. Once the authentication is complete, we have the ability to access information you provided to us or was otherwise collected by the third-party service in accordance with the privacy practices of that third party. We will store the information and data we collect and associate it with your CiiVSOFT Account, and we will use that information and data to enable the integration of the Services with the third-party service and to perform actions requested or initiated by you, or that are reasonably necessary to carry out instructions provided by you.
We collect information about how you use the Services and your actions on the Services, including your IP addresses, browser types, operating systems, ISPs, platform types, device types, and mobile device identifiers such as make and model, and mobile carrier. We may also use tools, including third-party tools, to collect analytics data. Some of this information is collected through cookies. See section 3 below for details of the cookies we use.
This section explains our use of cookies on our marketing website, ciivsoft.com. It does not apply to our product, which operates entirely as a back-office integration within a customer’s own Applicant Tracking System and has no separate website, login page or user interface of its own. Our AI-assisted CV screening product does not set cookies of any kind.
We use only strictly necessary cookies required for basic site functionality. We do not use analytics, advertising, retargeting or social media tracking cookies, and we do not use cookies to build advertising profiles, share data with ad networks or serve targeted advertisements. Because we set no non-essential cookies, no cookie consent is required to use our website. You can control or delete cookies at any time through your browser settings.
Our website loads typefaces from Google Fonts. This does not set cookies, but it does mean your IP address is transmitted to Google when a page loads.
When processing Content on behalf of our business clients, CiiVSOFT acts as a data processor. In limited circumstances, such as for improving our Services or for our legitimate business interests, CiiVSOFT may act as a data controller. We will always clearly communicate our role in relation to specific data processing activities.
Notwithstanding anything to the contrary in this Privacy Policy, we will not use or access your Content except: to provide, maintain, improve, or optimise use of the Services; where you (or the organisation through which you have an account) explicitly approve access; in response to lawful requests by law enforcement or government authorities; in response to court orders, or other legal process or requests, as required by applicable law as determined in our discretion; where necessary (in our sole discretion) to ensure the stability and security of the Services and our systems (e.g., where we have reason to believe specific Content is degrading server stability); and where necessary (in our sole discretion) to protect the rights, privacy, safety, or property of you, us, or others. Notwithstanding the foregoing, you acknowledge and agree that we may retain, take possession of, delete, or deny you access to your Content if we believe, in our sole discretion, that some or all of your Content, or your use of the Services, violates our Terms of Service. We also may analyse metadata related to Content (such as total number of records, file size, API volume, access logs, etc.).
CiiVSOFT acts solely as a data processor in respect of Candidate Information. We process Candidate Information only on the documented instructions of our business client, who is the data controller, and only for the purpose of providing the Services under our contract with that client. We do not process Candidate Information on the basis of our own legitimate interest. Determining and documenting the lawful basis for the processing of Candidate Information is a matter for the data controller.
That processing consists of the momentary redaction of personal and sensitive information from a CV, resume or other application document; the evaluation of the redacted content against the screening criteria for the role applied for; and the generation of an evaluation output which is returned to the client’s own systems.
We do not use Candidate Information, or any content derived from it, to train, fine-tune or improve any AI model, and we do not use it for market insights, research, product development or any other purpose of our own. We do not sell Candidate Information or share it with any third party for any purpose other than providing the contracted Services.
We use the information we collect for a variety of purposes, and how we use it depends on what we collect and which Services (or features of the Services) you use. These purposes may include:
We disclose information we collect for specific purposes, including:
We may transfer to and process your personal information in countries outside of the United Kingdom or the European Economic Area, (“EEA”) or jurisdiction where your data is hosted, for the various purposes described above. When required by law, we will ensure that we rely on an appropriate legal mechanism for the transfer, such as your consent, standard contractual clauses (or their equivalent), or adequacy decisions. You may ask us, using the contact information in Section 16 of this policy, for more information about the specific basis we use for transferring your data.
When transferring personal data outside the EEA, we rely on appropriate safeguards such as Standard Contractual Clauses approved by the European Commission, or other legally approved mechanisms. Details of these safeguards can be obtained by contacting us at privacy@ciivsoft.com.
If we use a third party data subprocessor to process personal information on our behalf, we will obtain contractual commitments to safeguard the security of the personal information to ensure that the third party only acts on our instructions when using that personal information and that the third party has in place appropriate technical and organisational security measures to safeguard the personal information. Details of our current Subprocessors are published at https://ciivsoft.com/subprocessors and are also set out in our Information Security & Compliance Document.
We retain personal data only for as long as necessary to fulfill the purposes for which it was collected, usually for the duration of any contractual relationship and for any period thereafter as legally required or permitted by applicable law. For specific retention periods for different types of data, please contact us at privacy@ciivsoft.com.
Customers retain ownership of their Content. Content may be held in routine system backups. For questions about Content held by CiiVSOFT, or to request its deletion, please contact us at privacy@ciivsoft.com.
Following redaction, the limited technical information we retain (Job ID, Candidate ID, Application ID, job title, event timestamps, and the AI evaluation output) may be held in routine system backups. No original CV, resume or application document, and no personal or sensitive information contained in one, is retained or backed up by CiiVSOFT. For questions about this information, please contact us at privacy@ciivsoft.com.
We may use some of the information we collect for marketing purposes, including to send you promotional communications about new Services features, products, events, or other opportunities. If you wish to stop receiving these communications or to opt out of use of your information for these purposes, please follow the opt-out instructions by clicking “Unsubscribe” (or similar opt-out language) in those communications. You may also contact us at privacy@ciivsoft.com to opt out.
You also may have certain rights with respect to your data depending on the jurisdiction in which you live. Please see the jurisdiction-specific sections below for a description of those rights.
Our Services are not intended for use by children under the age of 16 (or other age as required by local law) and we do not knowingly collect personal information from children. If we learn that we have collected personal information from a child, we will take reasonable steps to delete such information from our files as soon as is practicable. If you learn that your child has provided us with personal information without your consent, you may contact us at privacy@ciivsoft.com.
While CiiVSOFT primarily processes personal data on behalf of our business clients, we respect and support the data subject rights outlined in the GDPR. These rights include:
If you wish to exercise any of these rights in relation to personal data we process on behalf of our business clients, please contact the relevant client directly. They will then instruct us on how to proceed. If you have any questions about how we support our clients in responding to data subject rights requests, please contact us at privacy@ciivsoft.com.
Some of our Services include AI-powered resume and job matching, candidate analysis and language inference using AI, (“CiiVSOFT AI”). Where we process data using CiiVSOFT AI, we process data solely on behalf of and under the instructions of our business clients for the purposes of fulfilling a contract between us and them. Where CiiVSOFT AI is used in the Services this includes output content, (“Output”) generated by CiiVSOFT AI which provides fully transparent reasoning behind any recommendations or analysis which are made by CiiVSOFT AI. This Output is recorded and logged both in our systems and our Customer’s systems.
For any Services where CiiVSOFT AI is used, Customer users and employees are required to make a corresponding human-decision in order to confirm an outcome or decision, which includes but is not limited to, progressing with a candidate application, inviting a candidate to interview, rejecting a candidate, requesting candidates to undergo testing or assessment, extending an offer of employment to a candidate or hiring a candidate, together, (“Outcomes”) which may impact any individual or Data Subject. For the avoidance of doubt, CiiVSOFT and CiiVSOFT AI does not make any solely automated decisions that produce legal effects or similarly significant Outcomes or effects on individuals or Data Subjects. Our Customers, as data controllers, are responsible for providing information to their candidates about such processing and for handling any requests related to automated decision-making.
Where CiiVSOFT processes Personal Data on behalf of a Customer as a Data Processor, our Data Processing Addendum (“DPA”) applies. The DPA is published at ciivsoft.com/dpa, forms an integral part of the agreement between us and that Customer, and takes effect automatically from the effective date of that agreement without requiring separate signature. Where a Customer requires a countersigned or bespoke version, we will provide one on request. In the event of any conflict between this Privacy Policy and the DPA, the terms of the DPA shall prevail with respect to the processing of Personal Data.
Given the nature of some of our Services, specifically in relation to those Services which may use AI for the purposes of resume and job matching, candidate analysis and language inference, we conduct Data Protection Impact Assessments (DPIAs) when introducing new technologies or processing activities that are likely to result in a high risk to the rights and freedoms of individuals. These assessments help us identify and minimise data protection risks. We review and update our DPIAs regularly to ensure ongoing compliance and protection of personal data. In addition, we maintain an up-to-date list of our sub-processors at ciivsoft.com/subprocessors.
We have implemented procedures to deal with any suspected personal data breach and will notify affected individuals and applicable regulators of a breach where we are legally required to do so. If we become aware of a data breach that affects personal data we process on behalf of our business clients, we will notify the relevant client within 48 hours. Our clients, as data controllers, are responsible for notifying affected individuals and regulators as required by applicable law.
Any information that we collect is subject to the Privacy Policy in effect at the time such information is collected. We may, however, revise the Privacy Policy from time to time. If a revision is material, as determined solely by us, we will notify you via email. The current version will always be posted to our Privacy Policy page.
If you have any questions about our privacy practices, including this policy, you may contact us by email at privacy@ciivsoft.com or by mail at CiiVSOFT Limited, HLB House, 68 High Street, Tarporley, Cheshire, CW6 0AT, UK.
Questions, comments and requests regarding this privacy policy are welcomed and should be addressed to privacy@ciivsoft.com.
You have the right to make a complaint at any time to the Information Commissioner’s Office, the UK supervisory authority for data protection issues (www.ico.org.uk). We would, however, appreciate the chance to deal with your concerns before you approach the Information Commissioner’s Office, so please contact us in the first instance.
The person nominated to oversee how CiiVSOFT deals with personal information, our Data Protection Officer, is responsible for ensuring compliance with GDPR and with this policy. The post of Data Protection Officer is held by Adam Butwilowski, Chief Executive Officer, +44 (0)330 223 2411, privacy@ciivsoft.com. Any questions about the operation of this policy or any concerns that the policy has not been followed should be referred in the first instance to the Data Protection Officer.
The disclosures in this section apply solely to residents of the European Economic Area (“EEA”), Switzerland, and the United Kingdom (“UK”), and describe how we collect, use, disclose, and otherwise process personal data about you. Unless otherwise expressly stated, all terms in this section have the same meaning as defined in the General Data Protection Regulation (“GDPR”). We are the controller of the personal data we hold about you in connection with your use of the Services.
We collect and process your personal data for purposes set forth in this Privacy Policy. Where required by law, we obtain your consent to use and process your personal data for these purposes. Otherwise, we rely on another authorised legal basis (including but not limited to the performance of a contract or legitimate interest) to collect and process your Personal Data.
From time to time we may contact you directly with information about our products and services. You can unsubscribe at any time by clicking the unsubscribe link at the bottom of any such email, or by contacting us at privacy@ciivsoft.com. We do not use your personal data for targeted or interest-based advertising, and do not share your information with third parties for advertising purposes. For details of the cookies we use on our website, please see section 3 above.
You have the following rights in respect of your personal data that we hold: (i) right of access; (ii) right of portability; (iii) right to rectification; (iv) right to erasure; (v) right to restriction; (vi) right to withdraw consent; and (vii) right to object.
You also have the right to lodge a complaint to your local data protection authority.
If you wish to exercise one of these rights, please submit a request by emailing privacy@ciivsoft.com with the subject line “European Rights Request”
Due to the confidential nature of data processing we may ask you to provide proof of identity when exercising the above rights.
While CiiVSOFT is primarily focused on compliance with GDPR and UK data protection laws, we recognise that our B2B clients may operate globally. As such, we strive to adhere to internationally recognised data protection principles.
For clients or data subjects in specific regions:
If you are a client based in these regions, or if you process data of individuals from these regions, please contact us at privacy@ciivsoft.com for specific information regarding compliance with local data protection requirements.
Please note that as a B2B service provider, our direct obligations under these laws may be limited. However, we are committed to supporting our clients in meeting their compliance obligations when using our services.