Privacy Notice

Important - Please Read This Privacy Notice explains how Restart Talent Ltd collects, uses, stores, and shares your personal data. It applies to all users of the Restart Talent platform - candidates and employers alike. By registering and using the platform you confirm you have read and understood this notice. Separate Terms of Business are available for Candidates and Employers respectively.

1. Who We Are

Restart Talent Ltd is the Data Controller in respect of all personal data processed through the Restart Talent platform (the "Platform"). Our details are:

As Data Controller, Restart Talent Ltd determines the purposes and means of processing your personal data. Where third-party service providers process data on our behalf, they act as Data Processors under written agreements that require them to protect your data in accordance with UK GDPR.

2. How Our Platform Works - Privacy by Design

Understanding how Restart Talent operates is essential to understanding how your data is used. Our platform is built around a privacy-first architecture:

For Candidates You create your profile for the purpose of being found by employers. Your profile is active and discoverable by all verified employers by default. Employers browsing the platform can see your initials and your professional information - including your skills, work history, education, languages, certificates, portfolio projects, and CV - but they cannot see your references, full name, email address, phone number, LinkedIn profile, photographs, or introduction video until they unlock your profile. Your CV is visible before unlock but your name is automatically redacted on it so you cannot be identified from your CV alone prior to unlock. If you are no longer looking for work, you can set your profile to inactive at any time, which immediately removes it from employer search results. Sensitive supporting documents (such as proof of identity, proof of address, right-to-work documents, and your DBS certificate) are locked at all times and can only be viewed by a specific employer when you individually choose to release them.

For Employers You browse candidate profiles filtered by skills, role, and location. Before unlocking, you can see a candidate's initials (not their full name) and their full professional background - the candidate's name is automatically redacted on their CV so they cannot be identified from it prior to unlock - skills, experience, work history, education, languages, certificates, uploaded projects, and CV. You cannot see a candidate's email address, phone number, LinkedIn profile, photographs, or introduction video until you spend one credit to unlock their profile. Unlocking gives you the candidate's full name, email address, phone number, LinkedIn profile URL if provided, professional references, and reveals any photographs and introduction video they have uploaded. Supporting documents (identity, DBS, certificates etc.) remain locked even after profile unlock - the candidate must individually choose to release each document to you specifically.

This means:

• Candidates create profiles in order to be discovered - every active candidate on the platform has opted in to being found by employers. Before unlock, only their initials are shown alongside their professional information.
• Employers can assess a candidate's professional suitability from their profile before spending any credits.
• Contact details (email address, phone number, LinkedIn URL), photographs, and introduction videos are only revealed after a paid unlock - a candidate's name is visible to employers during browsing.
• Sensitive documents are an additional layer - they require separate, explicit, per-document consent from the candidate regardless of whether the employer has already unlocked the profile.
• This approach reflects the principles of data minimisation, purpose limitation, and privacy by design under UK GDPR Article 25.

3. Personal Data We Collect - Candidates

3.1 Profile and Account Data (Visible to Employers Before Unlock)

When you register and build your profile, we collect the following information. The items marked as visible are shown to all verified employers browsing the platform - this is intentional, as you create your profile in order to be found:

• Initials and professional headline - visible before unlock; full name revealed only after unlock
• Email address and telephone number - revealed to employer only after unlock
• LinkedIn profile URL (if provided) - revealed to employer only after unlock
• Date of birth (for age verification only - never shown to employers)
• Location and work availability (remote, hybrid, on-site) - visible before unlock
• Current and target job title, industry, and years of experience - visible before unlock
• Skills summary and career preferences - visible before unlock
• Employment and work history - visible before unlock
• Educational history and academic qualifications - visible before unlock
• Professional, educational, and personal references - visible before unlock
• Languages spoken and proficiency levels - visible before unlock
• Professional certifications, licences, and accreditations - visible before unlock
• Curriculum Vitae (CV) - visible before unlock
• Uploaded portfolio pieces and project work (as a skills showcase) - visible before unlock
• Any other professional information you voluntarily add to your profile

What employers see before and after unlocking BEFORE UNLOCK: Employers can see your name and all professional and skills-related information listed above - this is the purpose of your profile. They cannot see your full name, email address, phone number, LinkedIn URL, photographs, or introduction video.AFTER UNLOCK (one credit spent): The employer gains access to your email address, telephone number, and LinkedIn profile URL (if provided), and your photographs and introduction video are revealed. Supporting documents remain locked until you separately and individually choose to release them.

3.2 Supporting Documents (Locked by Default - Candidate-Controlled Release)

In addition to your profile, you may optionally upload supporting documents that employers may request during a hiring process. These are locked to all employers by default and are only accessible when you choose to release them:

• Proof of identity (e.g. passport, driving licence, national identity card)
• Proof of address (e.g. utility bill, bank statement)
• Right-to-work documentation
• DBS (Disclosure and Barring Service) certificate - if you choose to upload one
• Professional references
• Educational certificates and degree transcripts
• Professional qualification certificates and licences
• Any other documents you choose to upload

Your control over documents You decide which documents to unlock, for which employer, and when. You can unlock individual documents one at a time - you are never required to share all documents at once. We recommend only unlocking documents when you are confident you are progressing toward a job offer with that employer. Unlocking a document for one employer does not unlock it for any other employer.

3.3 Introduction Video and Photographs

You may optionally upload an introduction video and photographs to your profile. These are not visible to employers during anonymous browsing - they are only revealed to an employer once they have spent a credit to unlock your profile.

If you wish to remove your photographs or introduction video, you must do so manually yourself via your account settings. We do not automatically remove this content. Please be aware that once an employer has unlocked your profile and viewed your photographs or video, they will have already seen that content - removing it from the platform does not affect what has already been viewed.

Please be aware that photographs and videos may reveal characteristics that constitute special category data under UK GDPR (such as racial or ethnic origin). By uploading such content you provide explicit consent to its storage and display to employers who unlock your profile. You may withdraw this consent at any time by removing the content from your account settings.

3.4 Usage and Technical Data

We automatically collect certain technical data when you use the Platform:

• Device type, operating system, and browser
• IP address and approximate location
• Pages visited, features used, and session duration
• Profile view notifications (you are notified when a company views your profile - you will see the company's name)
• In-app messaging history
• Documents shared within messaging threads

4. Personal Data We Collect - Employers

When an employer registers and uses the Platform, we collect:

• Business name, company registration number, and registered address
• Contact person's name, job title, and work email address
• Billing details and payment information (processed via Stripe - we do not store card details)
• Credit purchase history and profile unlock records
• Search and filtering activity on the Platform
• In-app messaging history with candidates
• Interview link activity and hiring stage records
• Documents uploaded within messaging threads
• Device, browser, and usage data

Employer verification All employers are admin-verified before gaining access to candidate profiles. We collect the information necessary to confirm that an employer is a legitimate registered business. This protects candidates from being contacted by fraudulent or unverified parties.

5. Special Category Data

UK GDPR Article 9 imposes stricter requirements on data that reveals sensitive characteristics. The following types of special category data may be present on the Platform:

Our lawful basis for processing special category data is:

• Explicit consent (UK GDPR Article 9(2)(a)) - you provide this by voluntarily uploading photographs, videos, or documents containing such data. You may withdraw consent at any time by removing the relevant content from your account.
• Substantial public interest - employment-related processing where required (Article 9(2)(g) and DPA 2018 Schedule 1 Part 2).

What we do NOT do We do not use photographs or videos for automated biometric identification or profiling. We do not require you to upload any special category data - all such uploads are entirely voluntary. We do not make any hiring decisions based on special category data.

6. Criminal Conviction Data - DBS Certificates

Under UK GDPR Article 10 and the Data Protection Act 2018, criminal conviction data requires specific legal authority to process. Restart Talent handles DBS certificates as follows:

Important - how DBS data works on this platform Restart Talent does not commission, request, or process DBS checks. Candidates choose to upload their own DBS certificate if they wish to make it available to employers. The certificate is locked by default and can only be viewed by a specific employer when the candidate explicitly unlocks it for that employer. We act as a secure document repository, not as a DBS checking organisation.

Our lawful bases for storing and facilitating the sharing of DBS certificates are:

• Explicit consent (UK GDPR Article 6(1)(a) and Article 9(2)(a)) - the candidate voluntarily uploads their DBS certificate and explicitly chooses which employer may view it;
• Employment purposes (DPA 2018 Schedule 1 Part 2, Paragraph 6) - the processing is necessary for the purposes of performing obligations and exercising rights in connection with employment;
• Substantial public interest (DPA 2018 Schedule 1 Part 2, Paragraph 6) - facilitating safer recruitment and employment practices.

In relying on the employment purposes condition under Schedule 1 Paragraph 6, Restart Talent maintains an Appropriate Policy Document (APD) as required by DPA 2018 Schedule 1 Paragraph 39. A copy of this document is available on request at privacy@restarttalent.co.uk.

Candidates are under no obligation to upload a DBS certificate. Doing so is entirely voluntary. Candidates may remove their DBS certificate from the Platform at any time.

7. Lawful Bases for Processing

7.1 Candidates

7.2 Employers

8. How We Use Your Data

We use personal data collected through the Platform for the following purposes:

• Operating and providing the Platform - creating accounts, displaying profiles, enabling searches, processing credits and payments;
• Verification - admin-verifying candidate profiles and employer accounts before they appear on the Platform;
• Communications - sending you notifications about profile views, messages, interview invitations, and account activity;
• Security - detecting, preventing, and investigating fraud, unauthorised access, and misuse of the Platform;
• Legal compliance - complying with our obligations under applicable law, including tax, employment, and data protection law;
• Improving the Platform - analysing usage patterns to improve features, performance, and user experience;
• Dispute resolution - investigating and resolving disputes between users where necessary.

What we do NOT do with your data We do not sell your personal data to third parties. We do not use your data for targeted advertising. We do not make automated hiring decisions. We do not share your data with employers beyond what you have explicitly consented to via the profile unlock and document unlock mechanisms.

9. In-App Messaging, Interview Links, and Document Sharing

9.1 Once an employer has unlocked a candidate's profile, both parties may communicate directly through the Platform's built-in messaging system. Messages, interview links, and documents shared within these conversations are stored by us in order to:

• Provide the messaging service;
• Allow both parties to access their conversation history;
• Investigate complaints or disputes if they arise;
• Ensure compliance with Platform policies.

9.2 Both candidates and employers may upload documents to messaging threads (for example, an employer may share a job description or contract; a candidate may share additional work samples). By uploading a document to a message thread, you consent to that document being visible to the other party in that conversation.

9.3 Please be careful about what personal data you share in messages. We are not responsible for how the other party uses information you voluntarily share in conversations outside of the Platform's controlled document-unlock mechanism.

9.4 We reserve the right to monitor messaging activity on the Platform for the purposes of safety, fraud prevention, and ensuring compliance with our Terms of Business. Any monitoring is conducted in accordance with UK GDPR and only to the extent necessary.

10. Data Retention

After the applicable retention period, data is securely deleted or irreversibly anonymised. You may request early deletion of your data at any time - see Section 13 (Your Rights) for details. Note that we may be required by law to retain certain records beyond the periods stated above.

11. Who We Share Your Data With

11.1 Other Platform Users

Candidate data is shared with employers strictly in accordance with the Platform's tiered visibility model:

• Professional profile data (initials, skills, work history, education, languages, certificates, portfolio projects, CV with name redacted) is visible to all verified employers browsing the platform - this is the purpose for which candidates create their profiles;
• Full name, email address, phone number, LinkedIn URL, photographs, introduction video, and professional references are revealed only to an employer who has spent one credit to unlock that specific candidate's profile;
• Supporting documents (identity, DBS, proof of address etc.) are shared only with the specific employer that the candidate has individually and explicitly chosen to unlock them for - this is a separate act from the profile unlock and must be initiated by the candidate;
• Employers' company names are visible to candidates when an employer views their profile.

11.2 Data Processors

We use trusted third-party service providers who process data on our behalf under written Data Processing Agreements:

11.3 Other Disclosures

We may also share personal data in the following circumstances:

• Legal obligation - where required by law, court order, or regulatory authority (such as HMRC, the ICO, or law enforcement);
• Professional advisors - solicitors, accountants, and compliance advisers acting under duties of confidentiality;
• Business transfer - in the event of a merger, acquisition, or sale of Restart Talent Ltd, your data may be transferred to the successor entity. We will notify you in advance of any such transfer.

We never sell your data Restart Talent Ltd does not sell, rent, or trade personal data to any third party for commercial purposes. We do not permit any third party to use your data for their own marketing. Our only revenue comes from employer credit purchases and success fees.

12. International Data Transfers

As Restart Talent operates globally, your personal data may be transferred to and processed in countries outside the United Kingdom. We ensure that all international transfers comply with UK GDPR by putting appropriate safeguards in place:

You may request a copy of the relevant safeguard documents for any specific transfer by contacting us at privacy@restarttalent.co.uk.

13. Your Data Protection Rights

Under UK GDPR and the Data Protection Act 2018, you have the following rights:

To exercise any of these rights, contact us at privacy@restarttalent.co.uk. We will respond within one calendar month. In complex cases we may extend this by a further two months - we will inform you if this is the case.

There is no charge for exercising your rights in most circumstances. If a request is manifestly unfounded or excessive, we may charge a reasonable administrative fee or decline to respond - we will explain our reasoning if we do so.

14. Children and Minimum Age

Minimum age - 18 The Restart Talent platform is a recruitment service intended solely for adults. You must be at least 18 years of age to register as a candidate or employer. By registering, you confirm that you are 18 or over. If we become aware that a person under the age of 18 has registered, we will immediately delete their account and all associated data. If you believe a child has registered, please contact us at privacy@restarttalent.co.uk without delay.

15. Automated Decision-Making and Profiling

Restart Talent does not carry out any automated decision-making that produces legal or similarly significant effects for candidates or employers. Specifically:

• We do not use algorithms to rank, score, or filter candidates in a way that prevents them from being seen by employers;
• We do not make automated hiring or rejection decisions;
• Search and filter results are based on the criteria entered by the employer (skills, location, availability) and reflect candidate profile information - they do not involve automated scoring or profiling;
• All hiring decisions are made exclusively by employers based on information they access through the Platform.

16. Cookies

We use cookies and similar tracking technologies on our website and application. A full explanation of the cookies we use, their purpose, and how to manage your preferences is provided in our separate Cookie Policy, available at www.restarttalent.co.uk/cookies.

In summary, we use:

• Strictly necessary cookies - essential for the Platform to function (login sessions, security tokens). These cannot be disabled.
• Functional cookies - remembering your preferences and settings.
• Analytics cookies - understanding how users interact with the Platform, used to improve performance (anonymised data only).

You can manage non-essential cookie preferences at any time via the cookie settings banner on the Platform.

17. Security

We take the security of your personal data seriously, particularly given the sensitive nature of the documents held on the Platform. Our technical and organisational security measures include:

• Encryption of data in transit (TLS/HTTPS) and at rest;
• Secure access controls - supporting documents are locked at the database level and only accessible via the candidate-controlled unlock mechanism;
• Regular security assessments and penetration testing;
• Access restrictions - only authorised Restart Talent personnel can access personal data for the purposes of admin verification and platform operation;
• Incident response procedures - in the event of a data breach affecting your rights and freedoms, we will notify the ICO within 72 hours and affected users without undue delay, in accordance with UK GDPR Article 33 and 34.

No system is completely secure. We cannot guarantee the absolute security of your data, but we take all reasonable steps to protect it. You are responsible for keeping your account credentials confidential.

18. Changes to This Privacy Notice

We may update this Privacy Notice from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes, we will:

• Display a prominent notice on the Platform at least 14 days before the changes take effect;
• Send an email notification to all registered users;
• Update the 'Last updated' date at the bottom of this notice.

Your continued use of the Platform after the effective date of any changes constitutes acceptance of the updated Privacy Notice. If you disagree with any changes, you may close your account and request deletion of your data.

19. How to Complain

If you have any concerns about how we handle your personal data, please contact us first:

If you are not satisfied with our response, or if you believe we are processing your data unlawfully, you have the right to lodge a complaint with the Information Commissioner's Office (ICO):

Last updated: 1 June 2026 | Version 1.0 | Restart Talent Ltd | Company No. 15945851