Privacy, in plain terms.

Who is responsible

The data controller is Meertec Ltd, a company registered in England and Wales (No. 09064532), registered office 18 Holly Road, Cove, Farnborough, Hampshire, GU14 0EA. The principal is Dr Stephen D. Jones.

Data-protection questions, access requests and erasure requests: [email protected]. Meertec is a small practice and does not have a statutory Data Protection Officer.

What we hold

Account and workspace

If you hold an account: email address, display name, password hash, role, account and last-login timestamps, tenant membership and per-account interface preferences. API clients store a label, a key prefix and a hash of the key — never the key itself.

CV profile and job scoring

If you upload a CV or use the fit-scoring feature: the CV text, any text extracted from an uploaded PDF, derived embeddings and scoring rules. Your evaluation profile is separate from the public CV download on the marketing site and is never published.

Job alerts

Email address, confirmation status and timestamps. Alerts are double opt-in: nothing is sent until you click the confirmation link, and every email carries a one-click unsubscribe. The lawful basis is consent.

Expressed interest in a role

If you use “Express Interest”: name, email, optional note, and the role you selected. This is used to follow up on the role and is not an application to the employer. The lawful basis is legitimate interests (taking steps at your request before a possible engagement).

Enquiries and bookings

The contact form relays your name, email, chosen mandate focus and brief to the principal inbox by email. It is not written to the site database. Bookings are handled by the scheduler at book.meertec.ltd and hold your name, email and the chosen time slot.

Deliverability tests

The mailtest tool stores test addresses, message headers and bodies, links and attachments so it can analyse deliverability. This is a separate service with its own shorter retention windows.

Server logs

A lightweight analytics pixel records the page, user agent and referring URL. Raw IP addresses are not written to the analytics log; a temporary hash is used only to rate-limit requests. There are no advertising or cross-site tracking cookies.

Lawful bases

• Contract / pre-contract: operating your account, scoring roles against your CV, and responding to a mandate enquiry.
• Consent: job-alert emails. You can withdraw at any time with the unsubscribe link or by asking us.
• Legitimate interests: replying to enquiries, keeping the service secure, preventing abuse, and aggregate analytics. These interests are balanced against your rights.
• Legal obligation: retaining records where company, tax or accounting law requires it.

How long we keep it

Retention is deliberately short and configurable. Defaults are shown below; account deletion removes the associated personal data immediately (see “Your rights”).

Data	Default retention	Notes
Account	Life of the account	Dormant-account deletion is off by default and can only be enabled by an administrator; administrator accounts are exempt.
CV profile	730 days since last login	Deleted immediately when the account or profile is erased.
Job alerts	While subscribed	Unconfirmed subscriptions are pruned after 180 days.
Expressed interest	365 days	Removed sooner on request.
Deliverability tests	7 days metadata / 3 days raw / 2 days guest	Message bodies are removed before the parsed report.
Analytics log	90 days	Also truncated at 5 MB.
Enquiry emails	Held in the principal mailbox	Kept only as long as needed to answer the enquiry and keep a record of the mandate discussion.

Who processes it

Meertec does not sell personal data or share it for advertising. Data is processed by service providers acting on instructions, under their standard data-processing terms:

• Hostinger — web hosting, databases and email delivery.
• eratotime / book.meertec.ltd — scheduling and calendar bookings.
• Google Programmable Search and RapidAPI — querying job sources. These receive search terms, not visitor account data.
• Deliverability providers (for example Proton and SMTP2GO) — only when the mailtest tool is configured to use them.

Some providers may process data outside the UK or EEA. Where they do, transfers rely on the UK International Data Transfer Agreement, the EU Standard Contractual Clauses, or an adequacy decision.

Cookies and local storage

Meertec sets one strictly necessary session cookie (PHPSESSID) so you can sign in and submit forms with CSRF protection. It is not used for advertising or analytics.

The jobs and news readers remember display choices (for example which sources are visible, or sort order) in your browser's localStorage. That data stays on your device and is not sent to the server. You can clear it through your browser settings.

Because no non-essential tracking cookies are used, there is no consent banner.

Your rights

Under UK GDPR you have the right to:

• Access a copy of your personal data.
• Rectify inaccurate data (display name and password are editable on your profile page).
• Erase your data (“right to be forgotten”).
• Restrict or object to processing based on legitimate interests.
• Port your data in a machine-readable format.
• Withdraw consent for job alerts at any time.

Signed-in users can download a JSON export and delete their account from the profile page. You can also email [email protected] and we will respond within one month. We may ask you to verify your identity before acting on a request.

If you are not satisfied with our response, you can complain to the Information Commissioner's Office (ICO), Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF, or at ico.org.uk.

Security and changes

Passwords are stored as one-way hashes. Service credentials are sealed in an encrypted vault outside the web root. Traffic uses TLS, the database is not publicly served, and access to administrative pages is restricted by role.

If a breach is likely to put your rights at risk, we will notify the ICO within 72 hours and tell affected people without undue delay.

This notice may be updated as the service changes. The date below is the effective date of the current version.

Last updated: 18 October 2026