Legal
Privacy Policy
Last updated: 3 June 2026
Draft — pending legal review
This document is a structural scaffold. The wording must be reviewed and finalised by legal counsel before launch.
This policy explains what personal data Plumb processes, why, and the rights you have. [REVIEW: confirm controller details and finalise wording with counsel.]
Who we are
Plumb Hiring Ltd is the data controller for personal data processed through the Plumb marketing site and product. [REVIEW: company number, registered address, ICO registration number.]
What we collect
We process the following categories of personal data:
- Account data for organisation staff (name, email, role).
- Candidate application data (CV, application answers, contact details).
- Optional demographic data, stored separately and never joined to scorecards or applications.
- Usage and audit data (actions taken in the product, timestamps).
Lawful basis
[REVIEW: map each processing purpose to a UK GDPR Article 6 basis — e.g. legitimate interests for product operation, consent for demographic data, contract for service delivery.]
Demographic data
Demographic responses are voluntary, stored in a separate table with separate access controls, aggregated with k-anonymity suppression, and never linked to an individual application or score.
Data residency and transfers
Personal data is hosted in the UK/EEA (Supabase eu-west-2, London). [REVIEW: confirm sub-processor regions and any transfer mechanisms — see the Sub-processors page.]
Retention
[REVIEW: state retention periods per data category and the soft-delete / erasure process.]
Your rights
You have rights to access, rectify, erase, restrict, and port your personal data, and to object to processing. To exercise them, contact us.
[REVIEW: confirm contact route and response SLA.]
Contact
[REVIEW: privacy contact email / DPO details.]