Privacy Policy

Who we are and how to contact us

CoApplyBoard is a service operated by EMFIX LIMITED, a company registered in England and Wales under company number 16187894. In this policy “we”, “us” and “our” mean EMFIX LIMITED. For the personal information described here we are the data controller; that is, we decide what is collected and why.

You can reach us about anything in this policy, including any request to exercise your rights, at hello@coapplyboard.com. We aim to acknowledge every privacy enquiry within five working days.

We have not appointed a Data Protection Officer, because we are not required to. Privacy questions are handled by the company’s directors rather than routed to a general support queue.

If you are unhappy with how we have handled your information you can complain to the Information Commissioner’s Office, the UK’s data protection regulator, at ico.org.uk or on 0303 123 1113. We would ask you to raise it with us first so we have the chance to put it right, but you do not have to.

The information we collect

When you create an account we collect your name, email address and phone number, and we ask you to confirm the email address by entering a code we send to it. If you arrived from the form on our home page, the details you typed there are carried to the sign-up form by your own browser and are not sent to us until you submit the sign-up form itself.

When you complete your client profile we collect the information a job application asks for: your title, full name and any preferred name, date of birth, gender, marital status, home address and postcode, contact numbers, an email address you would like employers to use, your right to work in the UK together with any visa type, expiry date and sponsorship requirement, the job titles and locations you are targeting, your salary expectation, the type of work and notice period you want, and your referees’ names, positions, organisations, contact details, relationship to you and whether we may approach them before an interview. We also ask whether you hold a UK driving licence, have access to your own transport and are willing to travel, and whether you need any reasonable adjustments.

While we work for you we hold the documents the work produces: the CV you upload, every CV and cover letter a specialist writes for you, the job adverts we capture so an application can be explained later, the notes you and your specialist leave on drafts, and the status of every application made in your name. If you cancel because you have been hired, we hold the offer document you provide as evidence.

We also generate technical and account information as you use the service: your account status and onboarding stage, sign-in events, the security log described in clause 9, and short-lived records used to limit repeated sign-in attempts and to expire the one-time codes we email you.

Some of this is required and some is not. Your name, email address and phone number are required to hold an account at all. Both referees are required. The equal-opportunities questions in clause 3 may be left blank, and leaving them blank does not stop us working for you; it means only that an application to an employer who asks for them compulsorily cannot be completed without coming back to you.

We do not collect your job-board passwords. Our forms never ask for one, and we will never ask you for a password to a third-party site by email or by telephone. If anyone claiming to be from CoApplyBoard does, it is not us.

Special category and criminal offence information

Five of the questions on your profile concern information that UK data protection law treats as needing extra protection: your ethnicity, your religion or belief, whether you have a disability or health condition and what it is, whether you have any unspent criminal convictions and their details, and your National Insurance number.

We collect these because employers ask for them. NHS trusts, the Civil Service and many large employers make equal-opportunities and eligibility declarations a compulsory part of their application forms, and an application cannot be completed on your behalf without the answers. We do not use them to decide which roles to put you forward for, we do not disclose them to anyone other than the employer whose form asks for them, and we never use them for any purpose of our own.

Our lawful basis for the special category answers is your explicit consent under Article 9(2)(a) of the UK GDPR, given when you complete that part of your profile. Our basis for the criminal convictions answer is the same consent, relied on under the condition in paragraph 29 of Schedule 1 to the Data Protection Act 2018. You can withdraw that consent at any time by telling your specialist or emailing us, and we will erase those answers. Withdrawing consent does not affect anything we lawfully did beforehand, and does not affect the rest of your account.

These answers are stored apart from the rest of your profile, in a place our system is built so that no browser can reach: not yours, and not your specialist’s. A specialist who needs one has to ask our servers for it explicitly, and that request is written into the security log described in clause 9 in the same moment the information is disclosed. In practical terms: nobody sees this information incidentally, and nobody can look at it without leaving a permanent record that they did.

The reasonable-adjustments questions are deliberately not treated this way. Acting on an adjustment is the entire reason for recording it, and putting it behind a control designed to discourage access would make it useless to the person meant to act on it.

Why we use your information, and our lawful basis

We use your account details to create and secure your account, to confirm that an email address belongs to you, to sign you in, and to contact you about the service. The lawful basis is performance of our contract with you and, for the security measures, our legitimate interest in protecting accounts from unauthorised access.

We use your profile, your documents and your application history to do the thing you are paying for: to research roles, to write and tailor CVs and cover letters, to submit applications in your name, and to keep the record of them on your board. The lawful basis is performance of our contract with you. For the special category and criminal offence answers it is your explicit consent, as set out in clause 3.

We use payment and subscription records to take payment, to calculate refunds, and to meet our accounting and tax obligations. The lawful basis is performance of our contract with you and, for retaining the records afterwards, compliance with a legal obligation.

We use the security log, the rate-limiting counters and our system records to keep the service safe, to investigate misuse, and to be able to show what happened to an account if it is ever questioned. The lawful basis is our legitimate interest in the integrity of the service and in protecting the people whose information it holds. We consider that interest is not outweighed by any prejudice to you, because the log records who did what and when, never what was written.

Where we rely on consent you may withdraw it at any time, and where we rely on legitimate interests you have the right to object; see clause 11. Withdrawing consent does not make our earlier use of the information unlawful.

Applications we make on your behalf

The service works by a specialist submitting applications in your name. Information from your profile and your CV is therefore sent to the employers, recruiters and job boards you have asked us to apply to, in the form their application asks for. This is the core of the service and it cannot be switched off while your subscription is running, but you decide the roles, the sectors, the locations and the salary band, and you can change any of them at any time.

Once an employer receives your application, that employer is a data controller in its own right and its own privacy notice governs what it does with your information. We cannot delete an application from an employer’s system, and erasing your CoApplyBoard account does not withdraw applications already submitted. If you want one withdrawn, tell your specialist and we will ask the employer, or you can contact them yourself.

We approach a referee only if you have told us we may, and only in the way you specified when you gave their details. Before you give us someone’s contact details, please make sure they know you are naming them.

Who can see your information

Inside our organisation, your information is visible to the specialist assigned to you and to the supervisor who manages assignments. Nobody else. Other clients cannot see anything about you, and neither can specialists who are not working with you. Until a supervisor assigns you to someone, no specialist has access to your details at all.

A specialist’s access is tied to their assignment rather than to their job title. When an assignment ends (because you were moved to someone better suited to your field, because your specialist left, or because you closed your account), that person’s access to your file ends with it. We record the period during which each specialist was responsible for you, which is what lets us say later who handled a particular application.

We do not sell personal information, we do not share it with advertisers or data brokers, and we do not use it to build a profile of you for anyone else’s benefit.

Outside our organisation, your information goes to the employers you are applying to (clause 5), to the service providers listed in clause 7 who operate parts of our infrastructure on our instructions, and to professional advisers, insurers or public authorities where we are required by law to disclose it or need to establish or defend a legal claim. If our business were ever sold or reorganised, information would pass to the buyer, who would remain bound by this policy until they told you otherwise.

The companies that process data for us

We use a small number of established providers to run the service. Each acts only on our instructions under a written contract that requires them to keep your information secure and forbids them from using it for their own purposes.

Vercel Inc. hosts the website and runs the servers behind it. Google LLC, through Firebase and Google Cloud Platform, provides our database and the system that signs you in. Supabase, Inc. provides the storage where your documents are held. Zoho Corporation, through its ZeptoMail service, delivers our emails, including the codes we send to confirm your address. Stripe handles payment: it collects your card details directly on its own page, and if you choose to pay through Klarna, Klarna Bank AB does the same for that payment. We never see or store card details, and no part of our system is capable of receiving a card number. Stripe holds the name and billing address it needs to take payment and issue an invoice; when you erase your account we instruct Stripe to delete that customer record, and Stripe keeps only the invoice and payment records it is required to retain.

This list is current at the date shown at the top of this page. If we add a provider that handles personal information we will update this clause, and if the change is material we will tell you, as described in clause 17.

Where your information is held

Your documents are stored in London. Our database and sign-in system run in Google’s European Union data centres, and our email is sent from ZeptoMail’s European Union data centre. The servers that run the website itself, and our payment provider, operate globally, so some processing takes place in the United States.

UK law treats the European Union as offering an adequate level of protection, so no further safeguard is needed for information held there. Where information reaches the United States we rely on the UK’s international transfer safeguards: the UK Extension to the EU–US Data Privacy Framework where a provider is certified under it, or otherwise the UK International Data Transfer Addendum to the European Commission’s standard contractual clauses, which our providers have entered into. In plain terms, our contracts require the same standard of protection abroad that your information would receive here.

You can ask us which safeguard applies to a particular provider by emailing hello@coapplyboard.com.

Records of access

Our system keeps a security log of the actions taken on your account: when it was created, when a specialist was assigned or unassigned, when a CV was written or approved, when an application was submitted, when a payment was taken, when someone viewed your special category information, and when your data was erased.

Each entry is linked cryptographically to the one before it, so an entry cannot be altered or removed without breaking the chain. That is deliberate: the log’s value to you is precisely that it cannot be edited by anyone, ourselves included.

The log records identifiers, timestamps, counts and fixed labels: who did what, to which record, when. It never contains the content of a document, the text of an answer, or anything you have written. That restriction is what makes it safe for the log to outlive the information it refers to.

The log is retained after an account is erased and is not removed by a deletion request. It has to be: it is the evidence that the erasure happened, and destroying it would remove the only proof of what was done with your information while we held it. Because it holds no content and refers to an account whose identifying details have been destroyed, it does not by itself identify you.

How long we keep your information, and what deletion does

While your account is open we keep your information for as long as you have an account with us. You can ask us to erase it at any time from the account page in your dashboard, or by emailing hello@coapplyboard.com.

Erasure is genuine destruction, not a hidden flag on a record we quietly keep. When you request it we permanently destroy: your name, email address and phone number; every answer on your profile, including the special category answers in clause 3; the CV you uploaded and every CV a specialist wrote for you; cover letters, personal statements and captured job adverts; the notes on your applications; any offer document you supplied; any queued emails not yet sent; and your sign-in sessions, so you are signed out everywhere.

Four things survive, and none of them identifies you once the above is gone. First, the list of jobs applied for with their dates, status and the advert’s web address: the record that an application was made, without its content. Second, which specialist worked with you and during which period, so that history remains attributable. Third, the record that a payment was taken, with its amount, date and reference, which we keep for six years to meet our accounting and tax obligations and because it is the basis of any refund you may later be owed; our payment provider keeps its own invoice and payment records for the same reason. Fourth, the security log described in clause 9, together with the record that the erasure itself was carried out.

Erasure is irreversible in one way that surprises people, so we say it here as plainly as the dashboard does: your email address is released from our records entirely, and our system will not create a second account for an address it has seen before. If you think you may want to come back, cancel your subscription instead of erasing your account.

If you never ask us to erase your account, we keep it while it is in use and for up to two years after your subscription ends, so that you can return without starting again. After that we erase it as described above.

One-time codes expire ten minutes after we issue them and are then removed automatically. Rate-limiting counters expire on their own within hours.

Your rights

You have the right to ask us for a copy of the personal information we hold about you and to be told how we use it. You have the right to have inaccurate information corrected and incomplete information completed. You have the right to ask us to erase your information, which for this service is the process described in clause 10. You have the right to ask us to restrict how we use your information while a dispute about it is resolved. You have the right to receive the information you gave us in a portable electronic format, or to have it sent to another provider where that is technically feasible. You have the right to object to processing we carry out on the basis of legitimate interests, and to withdraw consent wherever consent is the basis we rely on.

To exercise any of these, email hello@coapplyboard.com, or use your dashboard where it already does the job, since the account page erases your account and the profile page corrects your answers. We may ask you to confirm your identity, which for an email request usually means replying to a code we send to your registered address.

We will respond within one month. If a request is unusually complex we may extend that by up to two further months, and we will tell you within the first month if we need to. Exercising a right is free. We may charge a reasonable fee, or decline, only where a request is manifestly unfounded or excessive (for example a repeat of one we have just answered), and if we do, we will explain why and tell you how to challenge it.

Two limits are worth stating in advance rather than at the moment you ask. We cannot recall an application already submitted to an employer, although we will ask them on your behalf. And we cannot erase the four categories listed in clause 10, for the reasons given there.

Marketing

We do not send marketing emails. Every message our system is capable of sending relates to something happening on your account: a code to confirm your address, a CV ready for your approval, a change to an application’s status, a confirmation that a subscription was cancelled, or a reply to a callback you asked for.

If we ever introduce a newsletter or promotional email it will be something you opt into, never something you are opted into by default, and every message will carry a one-click unsubscribe.

If you filled in the form on our home page but never completed sign-up, we hold nothing: those details are kept by your own browser and passed straight to the sign-up form, not to us.

Automated decisions and artificial intelligence

We do not make decisions about you by automated means that produce legal effects or similarly significantly affect you. No algorithm decides whether we take you on, which roles you are put forward for, or what is written about you. A named human specialist makes those judgements and is accountable for them.

Where AI tools assist a specialist with groundwork (summarising a job advert, or suggesting phrasing for a draft), the specialist reads, edits and remains responsible for everything that goes out in your name. We do not permit your personal information to be used to train third-party AI models.

Employers you apply to may use automated screening of their own, including applicant tracking systems. That is their process rather than ours, and their privacy notice governs it.

How we protect your information

Everything you send to and from the service travels over an encrypted connection, and your information is encrypted while stored by our providers. Signing in is protected by a one-time code sent to your email address, so knowing a password alone is never enough to reach your account.

Our system is built so that access is enforced by the database itself rather than by the screens in front of it. A specialist who is not assigned to you cannot retrieve your record even by asking our servers directly, and your special category information cannot be retrieved by any browser at all. Sessions end automatically after ten minutes of inactivity and are re-checked on every request, and signing out ends every session on every device.

We restrict access to what each person needs in order to do their job, we log the accesses described in clause 9, and we hold neither your card details nor your passwords to other services.

No system is perfectly secure. If a breach occurs that is likely to result in a high risk to your rights and freedoms we will tell you without undue delay, explain what happened and what we are doing about it, and report it to the Information Commissioner’s Office within 72 hours where the law requires.

Children

This service is for adults seeking work. It is not intended for anyone under 18, and you may not open an account unless you are 18 or over.

If we learn that we hold information about a child we will erase it. If you believe a child has given us information, tell us at hello@coapplyboard.com.

Complaints

If you are concerned about how we have handled your information, email hello@coapplyboard.com with the details. We will acknowledge it within five working days and give you a substantive answer within one month.

If you are not satisfied with our response you can complain to the Information Commissioner’s Office at ico.org.uk, by post to Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF, or by telephone on 0303 123 1113. You can go to the ICO without coming to us first, and doing either does not affect any other legal remedy available to you.

Changes to this policy

We keep this policy up to date as the service changes. The date at the top and bottom of this page tells you when it was last revised, and the current version is always the one published here.

If we make a material change (a new purpose for your information, a new category of recipient, or a change to how long we keep something), we will email the address on your account at least 14 days before it takes effect, so you have time to object, withdraw consent or close your account.

Continuing to use the service after a change is not by itself treated as your agreement to it. Where a change requires your consent, we will ask for it separately.