Legal
Privacy notice
How we collect, use and store your personal data, and the rights you have over it. Last updated 16 August 2026.
Who we are
CV Ladder is currently a pre-launch website. It is not accepting names, email addresses, applications or payments. The person or legal entity operating the service will be identified here before registration opens.
A working privacy contact address will also be published before registration opens.
What we collect and why
| What | Why | Lawful basis |
|---|---|---|
| Name and email address, from the next-cohort form | To send you cohort dates and application details | Consent (UK GDPR Art. 6(1)(a)); consent also under PECR reg. 22 for the email itself |
| Your answers to the eligibility check | To recommend a programme and to tell you if you are not eligible | Consent |
| Application details, interview notes, and the work you submit | To run the programme, supervise you and assess your work | Performance of a contract (Art. 6(1)(b)) |
| Parent or guardian details, where a participant is 16 or 17 | To obtain countersigned consent and take payment lawfully | Performance of a contract; legal obligation |
| Payment records | To take payment and meet accounting and tax duties | Contract; legal obligation (Art. 6(1)(c)) |
| How the site is used — pages viewed, how far down you scrolled, what was clicked, and a short daily code standing in for “a visitor”. No IP address or browser string is kept | To see which pages work and where people give up, so we can improve the site | Legitimate interests (Art. 6(1)(f)); a documented assessment will be completed before registration opens |
| Which advert brought you here, from the labels in the link you clicked. These name the advert, not you | To tell which adverts are worth paying for | Legitimate interests (Art. 6(1)(f)) |
We do not ask for special category data. Please do not send us health, ethnicity or similar information unless we have specifically asked for it in order to make an adjustment for you.
Who we share it with
- Partner companies — if you take a Partner Placement, we share your name, contact details and role brief with the partner hosting you. We tell you which company before you commit, and we do not share your details with any company you have not agreed to.
- Service providers — Cloudflare currently provides hosting, database and bot-protection services. Any email or payment provider will be named here before it receives personal data.
- We do not sell your data, and we do not share it with recruiters or advertisers.
The final notice will identify any international transfers and the safeguard relied upon before registration opens.
How long we keep it
These are the planned retention defaults and remain subject to final legal review before registration opens:
- Marketing list details: until you unsubscribe, or 24 months of no engagement, whichever comes first.
- Eligibility check answers: 12 months from submission.
- Participant records, including your completion record: 6 years, so we can still confirm your placement and provide a reference long after you finish.
- Financial records: 6 years, as required for tax.
- Raw anonymous site events: 90 days; aggregated campaign reporting: 37 months.
Your rights
Under the UK GDPR you can ask us to give you a copy of your data, correct it, delete it, restrict or object to how we use it, or transfer it to someone else. Where we rely on consent you can withdraw it at any time, which does not affect anything we did beforehand. Every marketing email has a one-click unsubscribe.
We respond within one month. If you are unhappy with our response you can complain to the Information Commissioner’s Office at ico.org.uk or on 0303 123 1113.
Cookies and storage
This site sets no cookies, stores nothing on your device, and runs no third-party analytics or advertising trackers. There is no Meta pixel, no Google Analytics and no advertising tag of any kind. That is why you were not asked to accept cookies: there is nothing to accept.
Optional Google and Meta measurement is disabled. It will not be enabled unless this notice is updated with the relevant cookie details and visitors are offered an equally clear accept or reject choice.
We do count visits, using our own software on our own server. To do it we work out a short code from your IP address and browser, mixed with a secret that changes every night, so the same code cannot be produced again the next day or traced back to you. We do not keep your IP address or your browser’s user-agent string. If your browser sends a “Do Not Track” signal we record nothing at all.
If you reached us from an advert, the link you clicked carries labels naming that advert — for example the campaign it belonged to and which image it used. We record those labels so we can tell which adverts are worth running. They describe the advert, not you, and we do not accept the per-click identifiers that advertising platforms add to links.
Changes
If we change this notice we will update the date at the top, and we will tell people on our list directly if the change is significant.