Privacy notice
How Bridge & Talent handles account details, private CVs, applications and recruitment enquiries.
Draft updated: 1 October 2026. This notice covers the current Bridge & Talent recruitment website in Nottingham. It should be read before creating an account, uploading a CV, applying for a role or sending an enquiry.
Who is responsible?
Bridge & Talent is the existing website name. The registered controller identity, business address and dedicated privacy contact have not yet been confirmed. For this local version, use the contact form to raise a privacy question. These details must be completed before public use.
Information the site collects
Account forms collect your name, email, selected sector, password and optional phone number. Candidate accounts can include a CV. Applications record the vacancy, supporting note, submitted CV, date and status. Employer submissions include the role, company, location, pay information and contract type. Enquiries include your name, reply address, topic and message.
What that information is used for
The implemented functions use it to maintain an account, handle an application, review a vacancy, display application progress and save enquiries. Passwords use WordPress password hashing. A terms/privacy acknowledgement is recorded; that acknowledgement is not treated here as blanket consent for every possible use.
Who can access CVs and applications?
Profile CV downloads are limited to the candidate and authorised site administrators. A submitted application is available to its candidate, the employer account responsible for that vacancy and authorised administrators. Unrelated accounts are denied access. CV files are stored outside the public website folder and are served only through an authenticated download check; they are not public media-library files.
Sharing and external services
The current recruitment features do not publish CVs or distribute them to other employers. A candidate application is shared with the employer responsible for that role. Google sign-in is unavailable until an approved provider and credentials are configured. Hosting, email providers and any future transfers or analytics must be identified and assessed before launch; this draft does not assume them.
Cookies and operational records
WordPress login cookies maintain your session. A short-lived form cookie supports security checks for signed-out visitors. The recruitment forms also limit repeated attempts using a hashed network-address key. Web-server and installed-plugin logging require review before public launch. No marketing-cookie consent is implied by account registration.
Local website statistics
This local site uses Koko Analytics for anonymous counts of public page views. It uses no analytics cookie or device fingerprint, discards referrers and campaign details, and does not send these counts to an external analytics service. Logged-in visits, account and sign-in pages, contact forms, private downloads and pages containing query parameters are excluded. Counts cannot reliably identify returning visitors. Aggregate statistics are configured for removal after one month through WordPress scheduled processing. This period applies only to website statistics; the separate retention schedule for CVs, applications and accounts still requires business approval.
Job alert emails
If you sign up for job alerts, we use your email address and chosen sector to send you emails about new vacancies we publish. We only send alerts after you confirm your sign-up by clicking the link in our confirmation email. The lawful basis is your consent. You can unsubscribe at any time using the link in any alert email, and we will then delete your email address from our alert list. We do not share your alert details with anyone else.
Retention and deletion
A business-approved retention schedule is still required for accounts, profile CVs, application snapshots, enquiries, logs and backups. The local implementation has no automatic retention expiry. Replacing a profile CV leaves the CV attached to an earlier application unchanged. A deletion request therefore needs review across these records and backups; no fixed deletion period is promised in this draft.
Your requests and rights
Depending on the applicable law and circumstances, rights can include access, correction, erasure, restriction, objection and portability, plus withdrawal of consent where processing relies on it. Contact Bridge & Talent to make a request. A response may require proportionate identity checks. You can also raise a concern with the UK Information Commissioner or the relevant EU authority where EU GDPR applies.
Think about what a document contains
A CV can contain information about other people as well as your own experience. Include only what is useful for recruitment. For example, do not add a referee’s private contact details unless sharing them is appropriate for the stage of the process. Remove unnecessary identity documents, financial information and unrelated sensitive details.
Tell us which record your request concerns
An account profile, a submitted application and a general enquiry are separate records. If you ask about your information, identifying the relevant account or vacancy helps locate the right record. Do not send a password. The appropriate identity checks and handling of requests still need to be confirmed as part of the business review before public launch.
UK and EU review
The business must confirm the lawful basis for each purpose, controller responsibilities, retention criteria, recipients and safeguards. The Nottingham context requires UK data-protection review; EU GDPR applicability must also be assessed where relevant. See our data-protection page and the ICO privacy-information checklist.