Privacy Policy

1. Introduction

This Privacy Policy explains how JG Core Ltd, trading as Core Careers ("we", "our", or "us"), collects, uses, discloses, and safeguards your personal data when you use our service.

We are committed to protecting your privacy and complying with applicable data protection laws, including the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

2. Data Controller

The data controller for the personal data we process is:

• Company Name: JG Core Ltd
• Trading Name: Core Careers
• Company Number: 16218779
• Registered Address: c/o Burton Varley Ltd, Suite 3, 2nd Floor Didsbury House, 748-754 Wilmslow Road, Manchester, M20 2DW
• ICO Registration: Registered with the Information Commissioner's Office
• Email: privacy@corecareers.io

3. Information We Collect

3.1 Information You Provide

• Account Information: Email address, name, and authentication data
• CV Data: Work history, education, skills, and other professional information you upload or enter
• Job Preferences: Industry, role type, location preferences, salary expectations, and career goals
• Payment Information: Processed securely through Stripe; we do not store card details
• Interview Feedback: Company interview experiences you voluntarily submit

3.2 Information Collected Automatically

• Usage Data: Pages visited, features used, and actions taken within the service
• Device Information: Browser type, operating system, and device identifiers
• Log Data: IP address, access times, and referring URLs
• Email Engagement: Email opens, clicks, and delivery status for service communications

4. How We Use Your Information and Legal Basis

We process your personal data based on the following lawful bases under UK GDPR:

4.1 Contract Performance (Article 6(1)(b))

Processing necessary to provide our services:

• Creating and managing your account
• Storing and processing your CV and job preferences
• Generating tailored CVs and cover letters using AI
• Processing payments for credit purchases
• Sending transactional emails (confirmations, account updates)

4.2 Legitimate Interests (Article 6(1)(f))

Processing necessary for our legitimate interests, balanced against your rights:

• Improving and optimising our service based on usage analytics
• Ensuring security and preventing fraud
• Tracking email engagement for deliverability and service improvement
• Sending marketing emails to existing customers about similar services (soft opt-in)

4.3 Consent (Article 6(1)(a))

Processing based on your explicit consent:

• Marketing emails to new subscribers
• Non-essential cookies and analytics
• Submission of interview feedback for community insights

4.4 Legal Obligation (Article 6(1)(c))

Processing required by law:

• Retaining financial records for tax purposes
• Responding to valid legal requests
• Recording cookie consent preferences

5. AI Processing

Our service uses artificial intelligence (provided by Anthropic and OpenAI) to analyse job descriptions and generate tailored CV content. This processing:

• Analyses your CV data to identify skills and experience
• Compares your profile against job requirements
• Generates optimised content tailored to specific roles

Important: This AI processing is advisory only. You always make the final decision about using generated content. This is not automated decision-making with legal or significant effects under Article 22 of UK GDPR.

AI providers process your data under strict data processing agreements and do not retain your data for their own training purposes.

6. Data Sharing and Recipients

We share your personal data with the following categories of recipients:

Service Providers (Data Processors)

All processors are bound by data processing agreements and only process data on our instructions.

We do not sell your personal information to third parties.

7. International Data Transfers

Your personal data may be transferred to and processed in the United States by our service providers. These transfers are protected by:

• UK-US Data Bridge: Recognised adequacy mechanism for UK-US transfers
• EU-US Data Privacy Framework: For providers certified under DPF (e.g., Stripe)
• Standard Contractual Clauses (SCCs): Available as a fallback mechanism

All our US-based processors are either certified under the Data Privacy Framework or have SCCs in place to ensure adequate protection of your data.

8. Data Retention

We retain your personal data for the following periods:

9. Data Security

We implement appropriate technical and organisational measures to protect your data:

• TLS 1.3 encryption for all data in transit
• AES-256 encryption for data at rest
• Row-Level Security (RLS) policies ensuring you can only access your own data
• OAuth 2.0 / JWT authentication
• Regular security assessments
• Access controls following the principle of least privilege

10. Your Rights (UK GDPR)

Under UK GDPR, you have the following rights:

• Right of Access (Art. 15): Request a copy of your personal data
• Right to Rectification (Art. 16): Correct inaccurate data
• Right to Erasure (Art. 17): Request deletion of your data ("right to be forgotten")
• Right to Restrict Processing (Art. 18): Request limited processing in certain circumstances
• Right to Data Portability (Art. 20): Receive your data in a structured, machine-readable format
• Right to Object (Art. 21): Object to processing based on legitimate interests or for direct marketing
• Rights related to Automated Decision-Making (Art. 22): Not applicable as we do not make solely automated decisions with legal or significant effects

To exercise these rights:

• Email: privacy@corecareers.io
• Self-service: Many rights can be exercised directly in your account settings, including downloading your data and deleting your account

We will respond to your request within 30 days. In complex cases, we may extend this by up to 60 additional days, and we will notify you if this is necessary.

11. Your Rights (US Residents)

If you are a resident of certain US states, you may have additional rights under state privacy laws:

California (CCPA/CPRA)

California residents have the right to:

• Know what personal information we collect and how it is used
• Request deletion of personal information
• Opt out of the "sale" of personal information (we do not sell your data)
• Non-discrimination for exercising privacy rights

Other US States

Residents of Virginia, Colorado, Connecticut, Utah, and other states with privacy laws may have similar rights. Contact us at privacy@corecareers.io to exercise your rights.

12. Cookies and Similar Technologies

We use cookies and similar technologies on our website. For detailed information about the cookies we use and how to manage your preferences, please see our Cookie Policy.

In summary:

• Essential cookies: Required for the website to function (no consent needed)
• Analytics cookies: Help us understand how visitors use our site (consent required)
• Preference cookies: Remember your settings and choices

You can manage your cookie preferences through our cookie banner or your browser settings.

13. Children's Privacy

Our service is not intended for users under 16 years of age. We do not knowingly collect personal data from children under 16. If you believe we have collected data from a child, please contact us immediately at privacy@corecareers.io.

14. Changes to This Policy

We may update this Privacy Policy periodically. We will notify you of material changes via email or through a prominent notice on our website. The "Last updated" date at the top of this policy indicates when it was last revised.

15. Complaints

If you have concerns about how we handle your personal data, please contact us first at privacy@corecareers.io. We will try to resolve your concerns promptly.

You also have the right to lodge a complaint with the Information Commissioner's Office (ICO), the UK supervisory authority for data protection:

• Website: ico.org.uk
• Phone: 0303 123 1113
• Address: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

16. Contact Us

For privacy-related questions or to exercise your rights, contact us at:

• Email: privacy@corecareers.io
• Postal Address: JG Core Ltd, c/o Burton Varley Ltd, Suite 3, 2nd Floor Didsbury House, 748-754 Wilmslow Road, Manchester, M20 2DW