Candidate Privacy Notice
Last updated 6 October 2026
About this notice
This notice explains how Metamindz collects, uses, shares and protects personal data about candidates, and the rights you have. It applies whether we are recruiting for ourselves or for one of our clients.
Who it covers:
- people who apply for a role we advertise, or send us their CV;
- people we approach about a role;
- people referred to us by someone else;
- people whose profile we keep on file for future roles;
- referees, for the limited data we hold about them.
Who we are: Metamindz Limited is the controller of your personal data. We are registered in England and Wales, company number 11831397, at Hale House, 76 Portland Place, London W1B 1NT. Our ICO registration number is ZB187231.
Contact: for any question or request about your data, email hello@metamindz.co.uk with “Data request” in the subject line.
Our clients: once we share your profile with a client, that client also becomes a controller of your data. It uses your data under its own privacy notice, which we can point you to on request.
Our website, cookies and other services are covered by our main Privacy Policy.
The personal data we collect
We collect the data we need to assess you for roles and to run a fair, secure recruitment process.
| Category | Examples |
|---|---|
| Identity and contact | Name, email, phone number, city and country, LinkedIn, GitHub and portfolio links |
| Career and skills | CV, work history, employers, projects, technical skills, education, qualifications, certifications, languages, seniority |
| Role preferences | Types of role and work, working arrangement (employee, contractor, sole trader or limited company), availability, notice period, rate or salary expectations, preferred locations |
| Assessments | Screening notes, interview notes and evaluations, technical test and take-home results, scores, rankings, outcomes, feedback from our clients |
| Recordings | Audio or video recordings of interviews, and transcripts and summaries of them |
| AI outputs | Results produced by AI tools when they process your CV or interview (see Our use of AI) |
| Communications | Emails, messages and call notes between you and us, and internal messages about your application |
| References | Details of referees you give us, and what they tell us |
| Agreements and preferences | Your agreement to be put forward for each role, and any objections, opt-outs or withdrawals |
| Integrity records | Results of our checks on your application, including any manipulation or misrepresentation we find, and do-not-engage records |
If you apply through a form on our website, our main Privacy Policy also applies to the technical data that collects.
Where we get your data
Most of it comes from you. We also collect some from other sources:
- You: your application, CV, messages, interviews and tests.
- Public professional profiles: LinkedIn, GitHub, personal websites and portfolios.
- Job boards and recruitment platforms where we advertise roles, when you apply or make your profile visible to recruiters.
- People who refer you to us.
- Our clients: feedback on your interviews and their decisions.
- Referees: only with your permission.
If we approach you: if we find your details ourselves, we will point you to this notice in our first message to you, and in any case within one month of collecting your data. You can tell us at any time to stop contacting you and to delete your data.
How we use your data and our lawful bases
UK data protection law requires a lawful basis for each use of your data. Ours are set out below.
| What we do | Lawful basis (UK GDPR Article 6) |
|---|---|
| Screen your CV, interview and assess you against roles | Legitimate interests: running our recruitment service and finding suitable candidates. Where you apply to work with Metamindz directly: steps you asked us to take before a contract, 6(1)(b) |
| Contact you about your application and roles you applied for | Legitimate interests, or 6(1)(b) for roles with Metamindz |
| Put you forward to the client hiring for the role you applied for | Legitimate interests, and only after you have agreed to be put forward (see Sharing your profile with the hiring client) |
| Keep your profile on file and match you to future roles. We only put you forward to another client with your approval for that specific role | Legitimate interests: helping you find suitable roles, which is the service you came to us for. You can opt out at any time |
| Prepare a Metamindz-formatted CV, often anonymised | Legitimate interests: presenting candidates consistently and limiting what we disclose about you and your past employers |
| Record and transcribe interviews | Legitimate interests: accurate and consistent assessment and records. You can object (see Interview recordings) |
| Use AI tools to help us process applications | Legitimate interests: efficient and consistent screening, always with human review (see Our use of AI) |
| Detect and prevent fraud, misrepresentation and manipulation of our screening, and keep do-not-engage records | Legitimate interests: protecting the integrity of our process, our clients and other candidates |
| Contracts, onboarding, invoicing and administration when you are placed | Contract, 6(1)(b), and legal obligation, 6(1)(c) |
| Meet our legal and regulatory duties, including recruitment, tax and record-keeping rules | Legal obligation, 6(1)(c) |
| Establish, exercise or defend legal claims, including discrimination claims and disputes about introductions or fees | Legitimate interests |
Legitimate interests: where we rely on legitimate interests, we have weighed our interests against your rights and expectations. You can ask us for details of that assessment, and you can object (see Your rights).
Sharing your profile with the hiring client
We only send your profile to a client after you have agreed to be put forward for that specific role.
The role you applied for. When you apply for a role we are recruiting for on a client's behalf, the aim is for that client to consider you. Before we share your profile, we will:
- tell you the role and the client. If the client is confidential at that stage, we will describe it (for example its sector, size and location) and name it before any interview;
- ask you to confirm that you agree to be put forward;
- record your agreement and the date.
Ticking the agreement box on our application form, or confirming in writing, counts as your agreement for that role and client only.
What we share. Your CV (which may be in Metamindz format), your LinkedIn profile and your name, plus a summary of our conversation written by a member of our team. The summary may cover your experience, skills, location, availability and rate or salary expectations. If the client wants to meet you, we also share your email address. We never share interview recordings, transcripts or AI outputs with clients.
After we share. The client becomes a controller of your data under its own privacy notice. The client may be outside the UK (see International transfers).
Changing your mind. You can withdraw your agreement before we submit your profile, and we will not send it. If you withdraw after we have sent it, we will tell the client you are no longer a candidate and ask them to delete your data. We cannot delete data the client already holds, but you can contact them directly.
Future roles. Unless you opt out, we keep your profile for up to 24 months from our last contact, so we can tell you about other suitable roles. We never share your details with any other client without your approval for that specific role, given in the same way as above. You can opt out at any time by emailing us, and we will delete your profile.
Duplicate applications. Please tell us if you have already applied to the same client directly or through another agency. This avoids disputes that could affect your application.
Our use of AI
We use AI tools to help us process applications, and a person reviews every outcome. AI never makes a decision about you on its own.
What AI does for us:
- reads and extracts information from CVs;
- compares your skills and experience with a role's requirements, and suggests a fit assessment;
- transcribes and summarises interviews, and drafts notes;
- reformats and anonymises CVs into the Metamindz format, including researching public information about former employers so we can describe them without naming them;
- checks applications for manipulation or misrepresentation, for example hidden text or instructions aimed at AI systems, and inconsistencies.
Providers: Anthropic (Claude), Google (Gemini in Google Meet) and Notion (Notion AI). They act as our processors under contract, and only process your data to provide the service to us. Their terms do not allow them to use your data to train their models.
Human review: a member of our team reviews AI outputs before any decision is made about your application, including whether to put you forward. We do not make decisions based solely on automated processing that have legal or similarly significant effects on you.
Your rights here: you can ask us how AI was used in your application, ask a person to explain a decision, contest it, and give your views. You can also object to AI processing of your application, and we will assess it manually instead.
Integrity of applications. Your application and interviews must be honest and your own work. Do not:
- include hidden text, or instructions aimed at AI or screening systems, in your CV or any other document;
- misrepresent your identity, experience, qualifications or employment history;
- let anyone else take part in an interview or test on your behalf, or use undisclosed real-time assistance (including AI) during an interview where we have told you it is not allowed.
We may ask you to verify your identity, for example by appearing on camera. If we find a breach, a member of our team will review it. We may then stop your application, keep a do-not-engage record, and tell any client we have already introduced you to for that application.
Interview recordings, assessments, references and checks
Recordings. We may record interviews, and use Gemini in Google Meet to create transcripts and summaries. We will tell you at the start of the interview. If you object, we will take written notes instead, and this will not count against you. Recordings and transcripts are stored securely in our Google Workspace. We never share them with clients.
Technical assessments. We keep your submissions, results and our evaluations as part of your application.
References. We only contact referees with your permission. We use what they tell us only to assess your application.
Background and criminal record checks. We run some background checks, based only on public information available about you, such as your professional profiles and public records of your work. We do not carry out criminal record checks as standard. If a client requires a check for a role, we will tell you first, explain what is involved, and only proceed where the law allows.
Right to work. If you will work for Metamindz directly, we check your right to work where the law requires it.
Do-not-engage records
We keep a short record of candidates we will not work with again, to protect our process, our clients and other candidates.
When we create one. A member of our team decides, after reviewing the evidence, where we find:
- fraud, impersonation, or someone else taking part in an interview on a candidate's behalf;
- material misrepresentation of identity, experience or qualifications;
- attempts to manipulate our screening, including hidden instructions aimed at AI systems;
- abusive or threatening behaviour towards our team or our clients.
What it contains. Your name, email, profile links, the date, a short factual reason, and a reference to the evidence. Nothing more.
Lawful basis. Legitimate interests: protecting the integrity of our recruitment process.
Who sees it. Only our team. We may tell a client we have already introduced you to for the same application. We do not share do-not-engage records with other recruiters or third parties, unless the law requires it.
How long we keep it. 3 years from the date of the decision.
Your rights. You can ask us whether we hold a record about you, ask us to correct it, and object to it. We will review any objection and tell you the outcome.
Who receives your data
We share your data only with the people and organisations below, and only as much as each needs.
| Recipient | Their role | What for | Where |
|---|---|---|---|
| The client hiring for the role | Independent controller | Considering you for the role, after you agree | UK or abroad, depending on the client |
| Our team, employees and contractors | Act for us, under confidentiality | Screening, interviewing, assessing, administration | UK, EU and Montenegro |
| Google (Google Workspace) | Processor | Email, documents, interview recordings, and meeting transcripts and notes (Gemini) | UK, EU and US |
| Notion Labs Inc. | Processor | Our candidate database, including Notion AI | US |
| Slack Technologies | Processor | Internal messages, and shared channels with clients | US |
| Anthropic | Processor | AI processing (see Our use of AI) | US |
| Professional advisers and insurers | Independent controllers | Legal, accounting and insurance advice | UK |
| Courts, regulators and authorities | Independent controllers | Where the law requires, or to defend legal claims | UK |
| A buyer, investor or successor | Independent controller | If our business is sold, merged or restructured, under confidentiality | Depends on the party |
We do not sell your data, and we do not share it with other recruiters.
International transfers
Some recipients are outside the UK, so your data may be transferred abroad. We only do this with a legal safeguard in place.
- EEA and other countries with UK adequacy regulations: the UK recognises these as providing adequate protection, so no further safeguard is needed.
- US service providers: we rely on the UK-US Data Bridge where the provider is certified. Otherwise, we use the ICO's International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses.
- Our team: team members who access your data are based in the UK, the EU and Montenegro. Montenegro has no UK adequacy regulations, so we use the ICO's International Data Transfer Agreement for that access.
- Clients outside the UK: if the hiring client is in a country without UK adequacy regulations, we will tell you the country when we ask to put you forward. We will explain that it may not offer the same protection as the UK, and ask for your explicit agreement to the transfer.
You can ask us for a copy of the safeguards that apply to your data.
How long we keep your data
We keep your data only as long as we need it for the purposes above. Then we delete it or make it fully anonymous.
| Record | How long we keep it |
|---|---|
| Detailed application records: interview recordings, transcripts, AI outputs, assessments, interview notes and related messages | 6 months after the recruitment process for that role ends |
| Your profile for future roles: CV, contact details, LinkedIn profile, skills, preferences and our written summary | 24 months from our last contact, unless you opt out sooner |
| Successful placement: contract, onboarding and invoicing records | The placement period plus 6 years, for legal, tax and contract purposes |
| Do-not-engage record | 3 years from the decision |
| Records of your agreement to be put forward, objections and opt-outs | As long as the related records, so we can show what you agreed to |
| Suppression record after you opt out or ask us to delete your data: name, email and date | As long as needed to respect your request and not contact you again |
| Data needed for an actual or likely legal claim | Until the matter is resolved |
These periods apply wherever your data is held, including email, our database, shared drives and messages. We may keep it longer where the law requires.
Security
We protect your data with technical and organisational measures appropriate to the risk.
- Access is limited to team members who need it for your application.
- Our accounts use multi-factor authentication.
- Our service providers encrypt data in transit and at rest, and act under data processing agreements.
- Our team members are bound by confidentiality.
- When we send you a copy of your data, we use a secure, access-restricted method.
If a personal data breach is likely to result in a high risk to you, we will tell you without undue delay.
Your rights
You have the following rights over your data. Some apply only in certain circumstances.
- Access: a copy of your personal data and information about how we use it.
- Rectification: correction of inaccurate or incomplete data.
- Erasure: deletion of your data, where we have no overriding reason to keep it.
- Restriction: limiting our use of your data while a concern is resolved.
- Objection: to any use based on legitimate interests, including recordings, AI processing and do-not-engage records. We will stop unless we have compelling grounds or need the data for a legal claim.
- Portability: a copy, in a machine-readable format, of data you gave us that we process by consent or contract.
- Opting out: of being kept on file for future roles, at any time. You can also withdraw any agreement or consent you have given.
- Human review: to ask a person to review a decision, explain it, and hear your views.
How to use your rights. Email hello@metamindz.co.uk with “Data request” in the subject line.
- It is free in most cases.
- We will reply within one month. For complex or multiple requests, we may extend this by up to two further months, and we will tell you why.
- We may ask for proof of identity, but only if we need it.
- If your request is unclear, we may ask you to clarify it. The time limit pauses until you reply.
- We carry out reasonable and proportionate searches.
- We may withhold some information where the law allows, for example data about other people or legally privileged material. If we do, we will tell you why.
You can also complain to the Information Commissioner's Office at ico.org.uk.
Other important information
Sensitive data. We do not ask for information about your health, ethnicity, religion, sexual orientation, political views or other special category data. Please leave it out of your CV. If you tell us about a disability or condition so we can adjust our process, we use it only for that, with your agreement, and share it with a client only if you ask us to.
If you do not give us your data. Providing your data is voluntary. Without it, we may not be able to consider you for roles.
Under 18s. We do not recruit people under 18 and do not knowingly collect their data.
Changes to this notice. We may update this notice. The date at the top shows the latest version. If we make significant changes, we will tell candidates whose data we currently hold.
Contact. Metamindz Limited, Hale House, 76 Portland Place, London W1B 1NT. Email hello@metamindz.co.uk.