Legal
Privacy Policy
Furtherly - Online Job-Matching Service Last updated: 22 March 2026
Important - please read before using this Service
By creating an account or otherwise using the Service, you confirm that you have read and agree to this Privacy Policy. Account creation is not possible without actively ticking the checkbox confirming your agreement. If you do not agree, you must not use the Service. See Section 18 for details of how your agreement is formed. This Policy should be read alongside our Terms of Service and Cookie Policy, available at furtherly.co.uk.
This privacy policy explains how Calamari Small Ltd. ("we", "us", "our") collects and uses personal data when you use the Furtherly online job-matching service (the "Service"), accessible at furtherly.co.uk. We are the data controller for the personal data processed through the Service.
Company name: Calamari Small Ltd. Company number: 16956528 Registered address: 124-128 City Road, London, England, EC1V 2NX Country of operation: United Kingdom Data protection email: privacy@furtherly.co.uk
If you have any questions about this policy or how we handle your personal data, you can contact us using the details above.
We have assessed our obligations under Article 37 of the UK GDPR and have determined that we are not currently required to appoint a Data Protection Officer. Data protection enquiries should be directed to privacy@furtherly.co.uk. We will review this assessment annually and update this Policy if a DPO is appointed.
This privacy policy applies to personal data we collect when you: create an account; upload a CV or use our CV builder; set job preferences or interact with job recommendations; use optional features, including AI-powered career guidance, text-based assistance, and voice interview preparation; visit our website, including through the use of cookies and similar technologies; and make payments or manage subscriptions.
It explains what personal data we collect, why we use it and our lawful basis for doing so, how automated job matching works, how we use cookies and tracking technologies, and your rights under UK data protection law.
This Policy should be read alongside our Terms of Service and Cookie Policy (furtherly.co.uk). In the event of any conflict on a data protection matter, this Policy prevails.
The Service is intended for users based in the United Kingdom. We do not actively target users outside the UK at this time. If you access the Service from outside the UK, you do so at your own initiative and are responsible for compliance with applicable local law.
We collect and process the following categories of personal data:
a) Account data
When you register for an account, we collect: your name; your email address; and your date of birth (used solely to verify that you are at least 16 years old and eligible to use the Service).
This data is used to create and manage your user account, verify your eligibility, and enable secure access to the Service.
b) CV data
You may provide CV data by uploading a CV document or by manually entering information using our CV builder feature. CV data may include employment history, education and qualifications, skills and experience, and other professional information you choose to include.
Important: how we handle uploaded CV files
Uploaded CV files are processed to extract relevant text for job-matching purposes and are permanently deleted immediately after processing. We do not retain the original CV files. Only encrypted extracted text is stored for ongoing use within the Service. We do not use your CV data for any purpose other than providing job-matching functionality.
c) Preference and interaction data
We collect information about how you use the Service, including job preferences (such as desired job type, location, or experience level), job goals you choose to provide, and interactions with job recommendations (for example, roles you dismiss and reasons you provide, such as salary expectations). This data helps us personalise job recommendations and improve their relevance.
d) AI assistant and interview preparation data
We provide optional AI-powered features designed to support users with career guidance and interview preparation, including voice-based interview practice. If you choose to use these features, we may process: conversational inputs you provide (text or voice); responses generated by the AI system; interview preparation content, including simulated interview questions, answers, and performance feedback; and voice recordings and transcripts generated during voice interview sessions.
Voice interview data
If you use the voice interview feature, you will be asked to grant microphone access through your browser. Voice audio is streamed in real time to our third-party voice AI provider (ElevenLabs, Inc.) for speech processing and is not stored by us as raw audio. A text transcript of the conversation is generated, encrypted using AES-256, and stored in our database so that we can provide you with interview feedback and performance insights.
Our voice AI provider may retain conversation audio and metadata in accordance with its own privacy policy and data processing terms. We have selected provider settings designed to minimise data retention where available.
AI interaction data, including voice transcripts, is stored securely in a dedicated encrypted database. Users can delete AI conversations and interview sessions at any time through their account controls. These features are optional and are not required to use the core job-matching Service.
e) Payment information
If you purchase a paid subscription, payments are processed by Stripe, a third-party payment provider. We do not collect or store your full payment card details. We may receive limited information from Stripe, such as confirmation of payment, transaction identifiers, and subscription status, for accounting and service administration purposes. Stripe's processing of your payment data is governed by its own privacy policy.
f) Billing and invoicing data
Billing and transaction records are processed to manage subscriptions and comply with legal and accounting obligations. These records are retained for up to 7 years after the relevant transaction to comply with HMRC requirements.
g) Cookies and similar technologies
When you visit our website, we use cookies and similar technologies to support the functioning of the Service and, where you consent, to understand how users interact with it.
Essential cookies
Essential cookies are strictly necessary for the operation of the Service. They include session cookies that keep you logged in and security cookies that help protect your account. Essential cookies do not require your consent under UK law (the Privacy and Electronic Communications Regulations 2003, "PECR").
Analytics cookies
With your consent, we use Google Analytics 4 to collect pseudonymised usage data about how users interact with the Service. This helps us understand usage patterns, identify issues, and improve the user experience. Analytics cookies are only set after you provide consent through our cookie consent banner. Information collected may include: pages visited and time spent on each page; referring website or source; browser type and device information; and general geographic region (not precise location). We do not use analytics data to identify individual users.
Managing your cookie preferences
When you first visit the Service, a cookie consent banner will ask you to choose between essential cookies only or accepting all cookies (including analytics). You can change your preferences at any time by clearing your browser cookies, which will cause the consent banner to appear again on your next visit. For more detail, please see our separate Cookie Policy at furtherly.co.uk/cookies.
h) Security and access data
We automatically collect certain technical data for security and fraud prevention purposes, including: your IP address; login timestamps and failed login attempts; and session identifiers. This data is used to protect your account and the Service from unauthorised access and abuse.
i) Special category data
We do not intentionally collect special category personal data (as defined in Article 9 UK GDPR), including health information, racial or ethnic origin, religious beliefs, or trade union membership. Users should avoid including such information in CVs or other inputs. If we become aware that special category data has been inadvertently provided, we will not process it for any specific purpose and will take prompt steps to delete it securely within 30 days of becoming aware of it. We will notify the affected individual where practicable.
We only use your personal data where we have a lawful basis to do so under the UK GDPR. The following summarises our processing activities:
Create and manage accounts - Personal data used: Name, email, date of birth - Lawful basis: Contract (Art. 6(1)(b)) - Necessary to provide the Service.
Age verification (16+) - Personal data used: Date of birth - Lawful basis: Contract / Legal obligation (Art. 6(1)(b)(c)).
Provide job-matching services - Personal data used: CV data (extracted text) - Lawful basis: Contract (Art. 6(1)(b)) - Core functionality.
Source job listings - Personal data used: Job preferences, location - Lawful basis: Legitimate interests (Art. 6(1)(f)).
Personalise recommendations - Personal data used: Preferences, interaction data - Lawful basis: Legitimate interests (Art. 6(1)(f)) - Users can update at any time.
AI career guidance (text) - Personal data used: AI assistant interaction data - Lawful basis: Legitimate interests (Art. 6(1)(f)) - Optional feature.
Voice interview preparation - Personal data used: Voice audio (streamed), transcripts - Lawful basis: Consent (Art. 6(1)(a)) - Optional; consent required.
Quality monitoring and system performance - Personal data used: AI data, voice transcripts - Lawful basis: Legitimate interests (Art. 6(1)(f)) - Limited, logged access; right to object.
Essential cookies - Personal data used: Session and security data - Lawful basis: Contract (PECR strictly necessary exemption).
Analytics cookies (GA4) - Personal data used: Pseudonymised usage data - Lawful basis: Consent (PECR / Art. 6(1)(a)) - Consent via banner.
Marketing emails - Personal data used: Email address, name - Lawful basis: Consent (Art. 6(1)(a)) - Opt-in; withdraw anytime.
Process payments - Personal data used: Transaction identifiers, status - Lawful basis: Contract (Art. 6(1)(b)) - Via Stripe.
Comply with legal obligations - Personal data used: Billing records, account data - Lawful basis: Legal obligation (Art. 6(1)(c)) - Tax, HMRC, 7-year retention.
Platform security and fraud prevention - Personal data used: IP address, login data, session IDs - Lawful basis: Legitimate interests (Art. 6(1)(f)).
Core service provision
We process your account data and CV data to deliver the core functionality of the Service, including account access and personalised job recommendations. This processing is necessary to perform our contract with you (Article 6(1)(b) UK GDPR).
Personalisation and preferences
Preference and interaction data is processed to improve the relevance of job recommendations. This is based on our legitimate interests in providing a responsive, user-centred job-matching service (Article 6(1)(f) UK GDPR) and aligns with users' reasonable expectations. You can update or remove your preferences at any time.
Optional AI features
Use of AI-powered guidance and interview preparation features is voluntary. Processing associated with these features supports users in preparing for job opportunities and improving interview performance. Users can choose whether or not to engage and can delete their AI interaction data at any time. We have conducted and documented a Legitimate Interests Assessment confirming that this processing does not override users' rights and freedoms.
Quality monitoring and system performance
We may occasionally review AI interaction data, including voice interview transcripts, for the purpose of monitoring system performance, ensuring the quality and accuracy of AI-generated outputs, and identifying and resolving technical issues. This review is carried out by a small number of authorised team members, is conducted on a limited and proportionate basis, and is not routine. Access is restricted, logged, and subject to internal controls.
We rely on our legitimate interests as the lawful basis for this processing (Article 6(1)(f) UK GDPR). We have carried out a balancing assessment and are satisfied that this limited, occasional review is proportionate and does not override users' rights, given that: access is restricted to authorised personnel; review is conducted only when necessary; data is encrypted at rest; and users are informed of this practice through this Policy.
If you wish to object to this processing, you may do so by contacting us at privacy@furtherly.co.uk. We will cease reviewing your data for quality monitoring purposes unless we can demonstrate compelling legitimate grounds that override your interests, rights, and freedoms.
Marketing communications
With your consent, we may send you marketing emails about product updates, new features, and service improvements. You can opt in to marketing emails during registration or through your account settings. You can withdraw your consent and unsubscribe at any time by using the unsubscribe link included in every marketing email, or through your account settings. Withdrawal of consent does not affect the lawfulness of processing carried out before withdrawal.
Analytics and cookies
We process pseudonymised usage data through analytics cookies for the purpose of understanding how users interact with the Service and improving its performance. This processing occurs only with your prior consent, which you can provide or withdraw at any time through our cookie consent controls.
Automated job matching
We use automated systems to analyse the information you provide, such as your CV and job preferences, in order to generate job recommendations that may be relevant to you. This automated processing is used to support and personalise job matching only. The recommendations are advisory in nature and do not produce decisions that have legal or similarly significant effects on you. In particular, the automated processing does not determine whether you are hired for a role, does not restrict your access to job opportunities, and does not replace your own decision-making.
You remain in full control of how you use the Service. You can choose whether or not to engage with recommended roles, update or remove your preferences at any time, and influence future recommendations through your interactions with the Service.
Profiling
As part of providing personalised job recommendations, we may create a limited profile based on information such as your skills, experience, stated preferences, and past interactions with job recommendations. This profiling is used solely to improve the relevance of job suggestions and is not used to make exclusionary or irreversible decisions about you. We take steps to avoid narrow or permanent categorisation and to ensure that recommendations remain adjustable and responsive to changes you make.
Optional AI assistant and interview preparation
If you choose to use the AI assistant, automated systems generate responses based on the information you provide during interactions. This may include career guidance, CV suggestions, job-search advice, and general employability support. Any guidance provided is informational only and is not intended to be authoritative, professional, or determinative. The AI assistant does not make decisions on your behalf and you remain fully responsible for how you use any guidance or content generated.
We also offer AI-powered interview preparation features, which may involve automated analysis of your responses to simulated interview questions in order to generate feedback and performance insights. Automated processing associated with these features does not produce decisions that have legal or similarly significant effects on you - in particular, it does not determine your eligibility for roles, influence hiring decisions, or restrict your access to employment opportunities.
We do not sell, rent, or trade your personal data. We do not share your personal data with third parties for their own marketing purposes. We only share personal data in the circumstances described below.
Service providers (processors)
We use trusted third-party service providers who process personal data on our behalf and only in accordance with our documented instructions. All service providers are bound by written Data Processing Agreements (DPAs) that comply with Article 28 UK GDPR, specifying the subject matter, duration, nature and purpose of processing, the type of personal data, and the categories of data subjects. Current service providers include: cloud hosting and infrastructure (Amazon Web Services, data hosted in EU/UK regions); email and communication (Amazon SES); analytics (Google Analytics 4, where you have consented to analytics cookies); AI text guidance (Google Gemini - data sent is limited to AI assistant interaction content; we do not transmit directly identifiable data such as your name or email address); job listings (Reed, UK-based); voice interview AI (ElevenLabs, Inc. - see below); and professional advisers (legal, accounting), where necessary.
Payment provider (Stripe)
Stripe processes payment transactions on our behalf as a data processor. Stripe may also process your payment data as an independent controller for its own fraud prevention, regulatory compliance, and financial reporting purposes. We do not receive or store your full payment card details. For more information, see Stripe's privacy policy.
Voice AI provider (ElevenLabs, Inc.)
When you use the voice interview feature, audio from your conversation is streamed in real time to ElevenLabs for speech processing. ElevenLabs is based in the United States - see Section 7 for transfer safeguards. ElevenLabs may retain conversation audio and associated metadata for safety review, abuse prevention, and service improvement purposes in accordance with its own privacy policy. ElevenLabs acts as a data processor on our behalf for primary processing, but may also process data as an independent controller for its own safety and compliance purposes.
Legal and regulatory disclosures
We may disclose personal data if required to do so by law, regulation, or a valid legal request, or where necessary to protect our rights, the rights of users, or the integrity of the Service.
We are based in the United Kingdom and the Service is primarily intended for UK users. Some of our service providers are based in, or process data in, the United States. These include: Amazon Web Services (cloud hosting, data hosted in EU/UK regions, but AWS is a US-headquartered company); Google (AI processing via Gemini and analytics via Google Analytics 4); Stripe (payment processing); ElevenLabs, Inc. (voice AI processing for interview preparation); and Reed (job listing data, UK-based, included for completeness).
Where personal data is transferred outside the United Kingdom, we ensure that appropriate safeguards are in place in accordance with UK data protection law. These safeguards may include: the UK International Data Transfer Agreement (IDTA); the UK Addendum to the EU Standard Contractual Clauses; or reliance on a UK adequacy decision, where applicable.
In particular: transfers to Amazon Web Services are covered by AWS's UK IDTA-compliant DPA; transfers to Google (Gemini and GA4) are covered by Google's DPA incorporating the UK Addendum to the Standard Contractual Clauses; transfers to ElevenLabs are covered by appropriate contractual protections including the UK Addendum to the Standard Contractual Clauses. Details of the safeguards applicable to any specific transfer are available on request by contacting privacy@furtherly.co.uk.
We keep personal data only for as long as necessary to fulfil the purpose for which it was collected and to comply with applicable legal obligations. Our retention practices are designed to minimise the data we store.
Account data (name, email, DOB): Active account lifetime plus up to 90 days post-deletion for fraud prevention; up to 7 years where required for legal claims. Basis: Contract / Legitimate interests.
Extracted CV text: Active account lifetime; deleted on account deletion. Basis: Contract.
CV builder data: Active account lifetime; deleted on account deletion. Basis: Contract.
Preferences and interaction data: Active account lifetime; adjustable by user; deleted on account deletion. Basis: Legitimate interests.
AI assistant interaction data: Until user deletes session or closes account. Basis: Legitimate interests.
Voice interview transcripts (AES-256): Until user deletes session or closes account; no raw audio stored. Basis: Consent.
Cookie data (essential): Session / browser close. Basis: Contract (PECR).
Analytics data (GA4): Minimum GA4 retention period (configured by us). Basis: Consent.
Billing and transaction records: 7 years after transaction (HMRC requirements). Basis: Legal obligation.
Service logs / security records: Up to 90 days in identifiable form; anonymised thereafter. Basis: Legitimate interests.
Backups (AWS): Up to 30 days per provider recovery cycle; not used for routine processing. Basis: Legitimate interests.
When personal data is no longer required, we securely delete or anonymise it. You can delete your account at any time through your account settings. Upon account deletion, we will delete or anonymise your personal data in accordance with the practices described above, subject to any legal obligation to retain certain records (such as billing records retained for 7 years).
We may use anonymised or aggregated data (including from AI interactions) to improve system performance and user experience. Where this occurs, the data will no longer identify you.
We take the security of your personal data seriously and use appropriate technical and organisational measures to protect it against unauthorised access, loss, misuse, or alteration. Our measures include:
Encryption: Personal data encrypted in transit (TLS/HTTPS) and at rest. CV extracted text, AI interaction data, and voice transcripts use AES-256 encryption at rest.
Access controls: Least-privilege access. CV extracted data is not accessible to administrative or development staff in routine operations. Access to AI and voice transcript data by authorised team members is logged and limited to quality monitoring purposes.
Monitoring and logging: Monitoring and logging systems to detect, investigate, and respond to security incidents.
Secure development: Secure development practices designed to reduce vulnerabilities within the Service.
Supplier security: All processors bound by written DPAs requiring appropriate technical and organisational security measures.
While no system can be guaranteed to be completely secure, we regularly review our security practices and take prompt steps to address any identified vulnerabilities.
In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the Information Commissioner's Office (ICO) without undue delay and, where feasible, within 72 hours of becoming aware of the breach, in accordance with Article 33 of the UK GDPR.
Where a breach is likely to result in a high risk to your rights and freedoms, we will also notify affected individuals without undue delay, in accordance with Article 34 of the UK GDPR, providing information about the nature of the breach and the steps we recommend you take to protect yourself.
Under UK data protection law, you have the following rights in relation to your personal data. These rights are not absolute and may be subject to exemptions or limitations under applicable law.
Right of access (Art. 15): Request confirmation of whether we process your personal data and receive a copy of it, together with information about the processing.
Right to rectification (Art. 16): Request that we correct inaccurate or incomplete personal data we hold about you.
Right to erasure (Art. 17): Request deletion of your personal data in certain circumstances - for example, where it is no longer necessary for the purpose it was collected, or where you withdraw consent.
Right to restriction (Art. 18): Request that we restrict processing of your personal data in certain situations, such as while accuracy is contested.
Right to object (Art. 21): Object to processing based on legitimate interests. We will cease processing unless we can demonstrate compelling legitimate grounds that override your interests, rights, and freedoms.
Right to data portability (Art. 20): Receive your personal data in a structured, commonly used, machine-readable format and transmit it to another controller, where technically feasible and where processing is based on consent or contract.
Right to withdraw consent (Art. 7(3)): Withdraw consent at any time where we rely on consent as our lawful basis. Withdrawal does not affect the lawfulness of processing before withdrawal.
Right not to be subject to solely automated decisions (Art. 22): Not to be subject to a decision based solely on automated processing that produces legal or similarly significant effects. Our job recommendations are advisory only and do not engage this right.
To exercise any of these rights, please contact us at privacy@furtherly.co.uk. We will verify your identity before responding - this will typically involve confirming details associated with your account. We will respond to valid requests within one calendar month of receipt. Where a request is complex or we receive multiple requests, we may extend this period by a further two months, in which case we will notify you within the first month and explain the reason for the extension. We will not charge a fee for responding to a rights request unless it is manifestly unfounded or excessive, in which case we may charge a reasonable fee or decline to respond, and will notify you accordingly.
If you have concerns about how we handle your personal data, we encourage you to contact us first at privacy@furtherly.co.uk so that we can try to resolve the matter promptly. We aim to respond to all complaints within 14 calendar days.
If you are not satisfied with our response, you have the right to lodge a complaint with the UK supervisory authority:
Information Commissioner's Office (ICO) Website: ico.org.uk Telephone: 0303 123 1113 Wycliffe House, Water Lane, Wilmslow, SK9 5AF
The right to complain to the ICO does not affect your right to seek judicial remedies under Article 79 UK GDPR or your right to pursue a claim for compensation under Article 82 UK GDPR where you have suffered material or non-material damage as a result of a breach of UK data protection law.
This Service is not intended for children and we do not knowingly collect personal data from individuals under the age of 16. By using the Service, you confirm that you are aged 16 or over. We collect your date of birth at registration to verify this. If you believe that a child has provided us with personal data, please contact us at privacy@furtherly.co.uk immediately and we will take prompt steps to delete that data.
Full details of our use of cookies are set out in Section 3g above and in our Cookie Policy at furtherly.co.uk/cookies. In summary: essential cookies are strictly necessary for the Service to operate and are set automatically without requiring your consent under PECR; analytics cookies (Google Analytics 4) are set only with your prior consent, obtained through our cookie consent banner, and you can withdraw consent at any time by clearing your browser cookies.
We will update this section and implement any required consent mechanisms if we introduce additional cookies or tracking technologies in the future.
We may update this Privacy Policy from time to time to reflect changes to the Service, applicable law, or our data processing practices. The version number and "Last updated" date at the top of this Policy will be updated at all times.
Where changes are material (for example, where we intend to process personal data in a new way or for a new purpose), we will notify you by email to the address associated with your account and by displaying a prominent notice within the Service. Continued use of the Service following notification of a material change will be treated as acceptance of the updated Policy. Where applicable law requires express consent, we will obtain it before the change takes effect.
Previous versions of this Policy are available on request by contacting privacy@furtherly.co.uk.
If you have any questions about this privacy policy or how we handle your personal data, please contact us:
Calamari Small Ltd. (trading as Furtherly) Email: privacy@furtherly.co.uk Website: furtherly.co.uk Address: 124-128 City Road, London, England, EC1V 2NX
In this Privacy Policy, the following terms have the meanings set out below:
"Personal Data" means any information relating to an identified or identifiable natural person (Article 4(1) UK GDPR).
"Processing" means any operation performed on personal data, including collection, storage, use, disclosure, or deletion (Article 4(2) UK GDPR).
"Data Controller" means the entity that determines the purposes and means of processing personal data. Calamari Small Ltd is the data controller for this Service.
"Data Processor" means a third party that processes personal data on behalf of the data controller, only in accordance with the controller's documented instructions.
"UK GDPR" means the UK General Data Protection Regulation as it forms part of UK law by virtue of the European Union (Withdrawal) Act 2018, together with the Data Protection Act 2018.
"Service" means the Furtherly job-matching platform and all associated features operated by Calamari Small Ltd, accessible at furtherly.co.uk.
"User" / "you" means an individual who accesses or registers for the Service.
"Consent" means a freely given, specific, informed, and unambiguous indication of agreement to the processing of personal data (Article 4(11) UK GDPR).
"Legitimate Interests" means a lawful basis for processing under Article 6(1)(f) UK GDPR, where processing is necessary for the controller's legitimate interests, provided those interests are not overridden by the data subject's rights and freedoms.
Account registration
When you create an account, you are required to actively tick a checkbox confirming that you have read and agree to this Privacy Policy. Account creation is not possible without completing this step. By completing registration, you enter into a binding agreement with us and agree to the processing of your personal data as described in this Policy.
Consent for voice interview and marketing features
Use of the voice interview feature and receipt of marketing emails each require a separate, specific consent. Before you first use these features, you will be presented with a clear description of how your data will be processed and asked to provide explicit consent. You may withdraw consent at any time without detriment to your access to the core job-matching Service (see Section 11 for how to exercise your rights).
Notification of changes
If we make material changes to this Policy, we will notify you by email to the address associated with your account and by displaying a prominent notice within the Service. Continued use of the Service following such notification will be treated as acceptance of the updated Policy. Where applicable law requires fresh consent for a new processing activity, we will obtain that consent before the change takes effect.
Version control
This Policy is identified by the "Last updated" date at the top of the document. Previous versions are available on request by contacting privacy@furtherly.co.uk.
This Privacy Policy and any disputes arising from or in connection with it (including non-contractual disputes or claims) are governed by and construed in accordance with the laws of England and Wales.
The courts of England and Wales shall have exclusive jurisdiction to settle any dispute or claim arising out of or in connection with this Privacy Policy, subject to any mandatory rights you may have under applicable consumer protection or data protection law.
Nothing in this clause affects your right to lodge a complaint with the ICO or to seek judicial remedies before a court of competent jurisdiction under Article 79 UK GDPR, or your right to seek compensation under Article 82 UK GDPR where you have suffered material or non-material damage as a result of a breach of UK data protection law.
We are accountable for compliance with data protection law under Article 5(2) of the UK GDPR (the accountability principle). Our accountability measures include: maintaining a Record of Processing Activities (ROPA) as required by Article 30 UK GDPR; conducting Data Protection Impact Assessments (DPIAs) for high-risk processing activities, as required by Article 35 UK GDPR; documenting Legitimate Interests Assessments (LIAs) for processing activities based on legitimate interests, covering: (i) personalisation of job recommendations; (ii) quality monitoring of AI and voice transcript data; and (iii) security monitoring and service logging; maintaining written Data Processing Agreements (DPAs) compliant with Article 28 UK GDPR with all processors; reviewing this Privacy Policy at least annually and upon any material change to the Service; and maintaining and testing an internal data breach response procedure.
Records of our compliance documentation are available to the ICO on request. Summaries of our LIAs are available to data subjects on request by contacting privacy@furtherly.co.uk.
The Service may contain links to or integrations with third-party websites, services, or platforms, including employer websites linked from job recommendations, Stripe for payment processing, and external resources referenced within the Service. We are not responsible for the privacy practices or content of third-party websites or services. Once you leave the Service or click a link to a third-party site, this Privacy Policy no longer applies. We encourage you to read the privacy policies of any third-party services you use.
We do not control the data practices of third-party employers or recruiters whose job listings may appear on or be linked from the Service. If you apply for a role or otherwise contact an employer directly, your personal data will be processed by that employer in accordance with their own privacy policy.
Appendix. In-service notices
The following notices are displayed to users at relevant points within the Service. They are reproduced here for transparency and completeness.
A. CV upload notice
When you upload a CV, we process it to extract relevant text for job-matching purposes. The original CV file is deleted immediately after processing and is not retained. Only encrypted extracted text is stored so we can continue to provide job recommendations. You can update or delete your CV at any time, or delete your account to remove all associated data. For more information, see our Privacy Policy.
B. AI assistant and voice interview notice
This AI assistant is an optional feature designed to provide general, career-related guidance. Voice interview preparation is also available as an optional feature. It does not make decisions for you and does not determine access to job opportunities. Any guidance provided is informational only. Voice interviews: If you use the voice interview feature, your microphone audio is streamed to a third-party provider (ElevenLabs) for real-time speech processing. We store an encrypted text transcript of the conversation but do not retain the raw audio. A small number of authorised team members may occasionally review transcripts for quality and performance monitoring purposes. Please avoid sharing sensitive personal information when using these features. You can delete your conversation and interview data through your account settings at any time. Learn more in our Privacy Policy.
C. Account deletion notice
Before you delete your account: Deleting your account will remove your personal data, including your CV data, AI conversation and interview data, preferences, and interaction history. Uploaded CV files are not retained. Encrypted extracted CV data and other account information will be deleted as part of the account deletion process. Billing records are retained for up to 7 years to comply with HMRC requirements. This action cannot be undone.