Candidate privacy notice

Who we are

Vitalos Technologies Limited (company number 16696895), registered office 114 High Street, Bentley, Doncaster, England, DN5 0AT, is the controller of the personal data you give us when you apply for a role. You can contact us about it at support@vitalos.co.uk.

What we collect

When you apply through our careers pages we collect your name and email address; optionally your phone number, where you are based, your LinkedIn and portfolio or GitHub links, your notice period and a cover note; your answer to whether you have the right to work in the UK; your CV; the role you applied for, when you applied, and your agreement to this notice and its version.

To protect the form from abuse we store a one-way hash of your IP address and your browser's user agent, and we use Cloudflare Turnstile to check that the application is not from an automated bot.

We do not ask for special-category data such as health, ethnicity or religion. If your CV or cover note includes it, we use it only as part of assessing your application and do not record it anywhere else.

If you apply, our team adds its own notes, a record of the stage your application has reached, and a record of who viewed your CV and when.

Why we use it

We use your application to assess it and to contact you about it. Our lawful basis is taking steps at your request before entering into a contract. If we make you an offer, we check your right to work in the UK because the law requires it. We protect the application form from abuse because we have a legitimate interest in keeping it secure.

We do not use your data for marketing, we do not sell it, we do not send your CV or application to any AI service, and we do not use automated decision-making to decide the outcome of an application.

How long we keep it

We delete your application and CV 6 months after the later of the date we made a decision about it and the date the role closed. If we hire you, your application becomes part of your employment records. Uploads that were never submitted are deleted within 24 hours.

Who we share it with

We use service providers who process your data on our behalf: Microsoft Azure (our internal team console, where applications are stored), Supabase (its database), Cloudflare (private storage for CV files, and bot protection), Vercel (website hosting) and Resend (email delivery). We do not sell your personal data.

International transfers

Some of these providers process personal data outside the UK, including in the United States. Where they do, the transfer is protected by UK adequacy regulations or the UK International Data Transfer Addendum with that provider.

Your rights

You can ask us to access, correct or delete your personal data, to restrict or object to how we use it, or to give you a copy. You can withdraw your application at any time and we will delete it. Email support@vitalos.co.uk. You also have the right to complain to the Information Commissioner's Office at ico.org.uk.

Changes to this notice

If we change this notice we will publish the new version on this page with a new version number and effective date. The application form records which version you agreed to.