Privacy Policy

Last updated: 29 September 2026

Joof ("us", "we", or "our") operates the https://joofhq.com platform (the "Service"). This Privacy Policy explains how we collect, use, store, and protect your personal data when you use our Service, and sets out your rights under the UK General Data Protection Regulation ("UK GDPR") and the Data Protection Act 2018.

By using the Service, you agree to the collection and use of information in accordance with this policy. Terms used but not defined here have the same meanings as in our Terms of Service.

This policy covers two distinct groups of people whose data we process: Customers and Users (employers, recruiters, and hiring team members who subscribe to and use the platform) and Candidates (individuals who apply for roles via the platform). Please read the sections relevant to you.

1. Who We Are

Joof is a company incorporated in England and Wales. We are the Data Controller in respect of the personal data of our Customers and Users. In relation to Candidate Data, we act as a Data Processor on behalf of the Customer (employer or recruiter) who is the Data Controller.

For any data protection queries, please contact us at support@joofhq.com.

2. Definitions

Personal Data means any information relating to an identified or identifiable living individual.

Candidate Data means personal data relating to job applicants, including CVs, application forms, assessment responses, and any other information submitted as part of a recruitment process.

Usage Data means data collected automatically about how the Service is accessed and used (for example, page visits, session duration, IP address).

Data Controller means the person or organisation that determines the purposes and means of processing personal data.

Data Processor means a person or organisation that processes personal data on behalf of a Data Controller.

Customer means an organisation or individual subscribing to the Service.

Candidate means an individual who has applied for a role via the platform.

3. Data We Collect — Customers and Users

When you register for and use the Service as a Customer or User, we collect the following:

Account information: name, email address, job title, and organisation details provided at sign-up.
Billing information: name, address, and payment method details (processed securely via our third-party payment provider — we do not store card details directly).
Usage Data: IP address, browser type and version, pages visited, time and date of visits, session duration, and other diagnostic data.
Communications: any correspondence you send us, including support requests and feedback.
Cookies and tracking data: see the Cookies section below.

4. Data We Process — Candidates

As a Data Processor, we process Candidate Data on behalf of our Customers (the Data Controllers). The types of Candidate Data we process on their instruction may include:

Name, contact details (email address, phone number, address)
CV and covering letter content
Employment history, education, qualifications, and skills
Application form responses and assessment results
Recruiter notes, ratings, and correspondence
Any other information voluntarily submitted as part of a job application

If you are a Candidate and have questions about how your data is being used by the organisation you applied to, please contact that organisation directly as they are the Data Controller for your application data.

5. How We Use Your Data

We use Customer and User personal data for the following purposes:

To provide, maintain, and improve the Service
To manage your account and subscription
To process payments and send billing communications
To respond to support queries and communications
To send service-related notices and updates
To send marketing or promotional materials where you have consented or where we have a legitimate interest to do so — you may opt out at any time via the unsubscribe link in any email
To monitor usage, detect technical issues, and improve platform performance
To comply with our legal and regulatory obligations

We process Candidate Data solely on the documented instructions of the Customer and do not use it for our own purposes beyond providing and improving the Service.

6. Candidate Data Retention

We retain CV and application data submitted through the platform for a period of 24 months from the date of submission, unless the Customer instructs us to delete it sooner or their account is closed. This retention period allows Customers to refer back to previous applications and candidate records within their hiring workflows.

After 24 months, Candidate Data is automatically and permanently deleted from our systems unless it is subject to an active legal hold or the Customer has extended their retention settings.

Candidates: requesting deletion of your data. If you would like your CV or application data to be deleted before the end of the retention period, you can submit a deletion request by logging into your candidate portal and navigating to My Data. From there, you can view the data held about you and request its removal. We will action verified deletion requests within 30 days in accordance with UK GDPR.

7. Retention of Customer and User Data

We retain Customer and User Personal Data for as long as your account is active or as necessary to provide the Service. Following account closure or subscription termination, we will retain data for up to 30 days to allow for data export, after which it will be permanently deleted, unless we are required to retain it for longer to comply with legal obligations, resolve disputes, or enforce our agreements.

8. Tracking & Cookies

We use cookies and similar tracking technologies to operate and improve the Service. Cookies are small data files stored on your device by your browser.

Session Cookies: essential for the Service to function correctly
Preference Cookies: to remember your settings and preferences
Analytics Cookies: to understand how the Service is used and to improve performance
Security Cookies: to help protect your account

You can configure your browser to refuse cookies or alert you when cookies are being sent. Please note that disabling certain cookies may affect the functionality of the Service.

9. Sharing Your Data

We do not sell your personal data. We may share data in the following circumstances:

Service Providers: we engage trusted third-party companies to help deliver the Service (e.g. hosting, payment processing, analytics). These providers access personal data only as necessary to perform their services and are contractually obligated to protect it.
Service improvement: we may share anonymised, aggregated, or pseudonymised data with third-party providers to help improve, develop, and enhance the platform. This data cannot reasonably be used to identify individual candidates or users.
Legal requirements: we may disclose personal data where required by law, court order, or a request from a government or regulatory authority.
Business transfers: in the event of a merger, acquisition, or sale of assets, personal data may be transferred as part of that transaction. We will notify you in advance if this occurs.

10. Connected Email and Calendar Accounts

Customers can optionally connect a Google or Microsoft 365 account. We use a connected mailbox only to send the emails you send to candidates from the Service, and a connected calendar only to check your availability and add or remove interviews. We don't read the rest of your inbox or store your other calendar events. Candidate replies come to an address we own; we add them to the application and send a copy to your mailbox.

We never sell this data, use it for advertising, or use it to train AI models. You can disconnect at any time in the Service, which deletes the stored access. Joof's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

11. International Data Transfers

Your data is primarily stored and processed within the United Kingdom and European Economic Area. Where any transfer of personal data outside the UK is necessary, we ensure appropriate safeguards are in place in accordance with UK GDPR Chapter V, such as standard contractual clauses or adequacy decisions.

12. Security of Data

We implement appropriate technical and organisational measures to protect personal data against unauthorised access, accidental loss, destruction, or disclosure. These include encryption in transit and at rest, access controls, and regular security reviews.

While we take data security seriously, no method of transmission over the internet or electronic storage is completely secure. We cannot guarantee absolute security, but we will notify you and the relevant authorities in the event of a data breach where required to do so by law.

13. Your Rights

Under UK GDPR, you have the following rights in relation to your personal data:

Right of access: to request a copy of the personal data we hold about you
Right to rectification: to request correction of inaccurate or incomplete data
Right to erasure: to request deletion of your personal data in certain circumstances
Right to restrict processing: to request that we limit how we use your data
Right to data portability: to receive your data in a structured, machine-readable format
Right to object: to object to processing based on legitimate interests or for direct marketing
Right to withdraw consent: where processing is based on consent, you may withdraw it at any time without affecting prior processing

Candidates can exercise their right to erasure directly by logging into their candidate portal and visiting My Data. For all other rights requests, or if you are a Customer or User, please contact us at support@joofhq.com. We will respond within one calendar month.

You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk if you believe we have not handled your data appropriately.

14. Payments

We use third-party payment processors to handle subscription payments. We do not store or collect your payment card details directly. All payment data is handled by our payment provider and is governed by their own privacy policy and PCI DSS compliance obligations.

15. Links to Other Sites

Our Service may contain links to third-party websites not operated by us. We have no control over and assume no responsibility for the content or privacy practices of any third-party sites. We encourage you to review the privacy policy of any site you visit.

16. Minimum Age

Our Service is intended for use by individuals aged 18 and over. We do not knowingly collect personal data from anyone under the age of 18. If you become aware that a minor has provided us with personal data, please contact us so we can take appropriate action.

17. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. Where changes are material, we will notify you by email or via a notice within the Service at least 30 days before the changes take effect. The date at the top of this page will always reflect when the policy was last updated. We encourage you to review this policy periodically.

Contact Us

If you have any questions about this Privacy Policy or wish to exercise your data rights, please contact us at support@joofhq.com.