Legal
Privacy notice
How we collect, use and store your personal data, and the rights you have over it. Last updated 16 August 2026.
Who we are
CV Ladder is a pre-launch website that is not yet taking applications or payments. It is currently accepting names and email addresses for its application list, and nothing else. The person or legal entity operating the service will be identified here before applications open.
Privacy contact: support.cvladder@gmail.com. Use it for any request under the rights section below, or to complain to us. The registered company name and address will be published alongside it before applications open — until then this address reaches us and is answered, but it is not yet a full trader identity.
What we collect and why
| What | Why | Lawful basis |
|---|---|---|
| Name and email address, from the application form | To send you programme start dates and application details | Consent (UK GDPR Art. 6(1)(a)); consent also under PECR reg. 22 for the email itself |
| Your answers to the eligibility check | To recommend a programme and to tell you if you are not eligible | Consent |
| Application details, interview notes, and the work you submit | To run the programme, supervise you and assess your work | Performance of a contract (Art. 6(1)(b)) |
| Parent or guardian details, where a participant is 16 or 17 | To obtain countersigned consent and take payment lawfully | Performance of a contract; legal obligation |
| Payment records | To take payment and meet accounting and tax duties | Contract; legal obligation (Art. 6(1)(c)) |
| How the site is used: pages viewed, how far down you scrolled, what was clicked, the country your connection comes from, and a short daily code standing in for “a visitor”. No IP address or browser string is kept, and nothing more precise than a country is worked out | To see which pages work and where people give up, and whether the site reaches the regions it is meant to, so we can improve both | Legitimate interests (Art. 6(1)(f)); a documented assessment will be completed before applications open |
| Which advert brought you here, from the labels in the link you clicked. These name the advert, not you | To tell which adverts are worth paying for | Legitimate interests (Art. 6(1)(f)) |
We do not ask for special category data. Please do not send us health, ethnicity or similar information unless we have specifically asked for it in order to make an adjustment for you.
Who we share it with
- Partner companies: if you take a Partner Placement, we share your name, contact details and role brief with the partner hosting you. We tell you which company before you commit, and we do not share your details with any company you have not agreed to.
- Service providers: Cloudflare currently provides hosting, database and bot-protection services. Any email or payment provider will be named here before it receives personal data.
- We do not sell your data, and we do not share it with recruiters or advertisers.
The final notice will identify any international transfers and the safeguard relied upon before applications open.
How long we keep it
These are the planned retention defaults and remain subject to final legal review before applications open:
- Marketing list details: until you unsubscribe, or 24 months of no engagement, whichever comes first.
- Eligibility check answers: 12 months from submission.
- Reference records — your brief, submissions, feedback, assessment and completion record: 15 years, so we can confirm your placement and stand behind your reference for as long as anyone can raise a question about it.
- Other participant records: 6 years.
- Financial records: 6 years, as required for tax.
- Raw anonymous site events (including the country code): 90 days; aggregated campaign reporting: 37 months.
Your rights
Under the UK GDPR you can ask us to give you a copy of your data, correct it, delete it, restrict or object to how we use it, or transfer it to someone else. Where we rely on consent you can withdraw it at any time, which does not affect anything we did beforehand. Every marketing email has a one-click unsubscribe.
We respond within one month.
Complaining to us
If you think we have handled your personal data wrongly, complain to us directly — you do not have to go to the regulator first, and you do not need to use any particular form of words. Email support.cvladder@gmail.com, or write to us at our registered address once it is published. If you would rather not use email, say so and we will agree another route with you.
- We acknowledge every complaint within 30 days of receiving it.
- We look into it, and we tell you how it is going rather than leaving you waiting.
- We tell you the outcome and what we have done about it.
- Complaining costs nothing and does not affect your place, your feedback or your reference.
You can also complain to the Information Commissioner’s Office at any time, whether or not you have come to us first — ico.org.uk or 0303 123 1113. Going to us first usually gets it fixed faster.
Cookies and storage
This site sets no cookies, stores nothing on your device, and runs no third-party analytics or advertising trackers. There is no Meta pixel, no Google Analytics and no advertising tag of any kind. That is why you were not asked to accept cookies: there is nothing to accept.
Optional Google and Meta measurement is disabled. It will not be enabled unless this notice is updated with the relevant cookie details and visitors are offered an equally clear accept or reject choice.
The one exception is the anti-spam check on our two forms. Cloudflare Turnstile runs there to tell a person from a bot. It is loaded only on the pages that carry a form — not on this page — it stores nothing on your device, and it is not used to profile or advertise to you.
We do count visits, using our own software on our own server. To do it we work out a short code from your IP address and browser, mixed with a secret that changes every night, so the same code cannot be produced again the next day or traced back to you. We do not keep your IP address or your browser’s user-agent string. Alongside that code, our network tells us which country a connection comes from — the country only, worked out at our end, kept for the same ninety days and never joined to anything from another day. If your browser sends a “Do Not Track” signal we record nothing at all.
If you reached us from an advert, the link you clicked carries labels naming that advert, for example the campaign it belonged to and which image it used. We record those labels so we can tell which adverts are worth running. They describe the advert, not you, and we do not accept the per-click identifiers that advertising platforms add to links.
Changes
If we change this notice we will update the date at the top, and we will tell people on our list directly if the change is significant.