Privacy Policy

RecruitCommis is run by **RecruitCommis Ltd**, a company registered in England and Wales (company number: 17458604), registered office: 82A James Carter Road, Mildenhall, Bury St. Edmunds, IP28 7DE.

• • **ICO registration number:** ZC248642
• • **Data protection contact:** William Waight, [privacy@recruitcommis.com](mailto:privacy@recruitcommis.com)
• • **Our representative in the EU:** [EU_REPRESENTATIVE not set]

This policy covers three groups of people:

• • **Candidates** — anyone who uses the candidate side of RecruitCommis, applies to a job through us, or whose details a venue has added (for example, as a member of staff or a referral).
• • **Venue teams** — owners, managers and staff who use our employer tools.
• • **Website visitors** — anyone browsing recruitcommis.com.

When you use RecruitCommis, two organisations are often involved: us, and the venue you're applying to or working for. The law calls the organisation that decides why and how information is used the **controller**. Which of us that is depends on what's happening.

| What's happening | Who's responsible |

|---|---|

| Your candidate account, profile, preferences, job search and match scores you see on job cards | **Us** |

| Your application once you've sent it to a venue, the venue's notes, trial assessments, shortlists, rejections and offers | **The venue.** We run the software for them and only use the information on their instructions |

| Staff records, right-to-work documents and referral tracking in a venue's "Your Team" area | **The venue.** Again, we run the software for them |

| Candidate details a venue receives through our shared features (the "Available Now" feed, Talent Bank search across venues, Table 2 Table introductions) | **Us** when we share it, then **the venue** once they have it |

| WhatsApp, SMS and email messages a venue sends you through RecruitCommis | **Both of us, jointly** — see below |

| Venue team accounts, billing, verification and support | **Us** |

| Security, fraud prevention and anonymous statistics about how the platform is used | **Us** |

**Messages sent through RecruitCommis (shared responsibility).** When a venue messages you through our WhatsApp, SMS or email channels, we're jointly responsible. We're responsible for your consent and opt-out choices, the sending number, message templates, quiet hours and sending limits. The venue is responsible for deciding who to message and what the message says. You can raise a concern with either of us. If you contact us, we'll deal with it and involve the venue if we need to.

**Conversations outside RecruitCommis.** If a venue manager phones you or messages you from their own WhatsApp, that conversation happens outside our platform. We record that contact was started, never what was said. The venue is responsible for that conversation.

Where a venue is the controller, their own privacy notice also applies, and you can ask them directly about how they use your information. You can always ask us too, and we'll pass your request on.

### 3.1 Candidates

| Type | Examples | Where it comes from |

|---|---|---|

| Identity and contact | Name, email, mobile number, postcode or area | You |

| Profile | Roles, skills, languages, till/POS systems, certificates (e.g. Level 2 Food Hygiene, Personal Licence), experience, availability, travel radius, pay expectations, work-style preferences ("vibe"), written bio, optional photo, optional 15-second video | You |

| Applications | CV, answers to screening questions, the jobs you apply for, application status | You, and CommisBot where it reads your CV |

| Match information | Your match scores and the breakdown behind them (see section 5) | Calculated by CommisBot |

| Trial shifts and work | Trial bookings, check-ins ("On my way", "Arrived"), attendance, trial assessments and ratings from venues, offers, start dates | You and the venue |

| Messages and consent | Messages sent through RecruitCommis, whether you've opted in or out of WhatsApp, SMS and email, and the evidence of that choice (what you agreed to, when, from which device) | You and our systems |

| Right-to-work documents | Passport, visa, share code, residence permit, work permit or equivalent; food hygiene certificates | You, when a venue asks |

| Emergency contact | Name and phone number of someone to call in an emergency on shift | You |

| Visibility settings | Whether you're "Available Now", "Open to Offers" or "Not Looking", venues you've hidden yourself from, sharing choices | You |

| Sign-in security | If you set up a passkey: a public key, the type of device and a label you choose. Never your fingerprint or face | Your device and our systems |

| Technical | Device and browser type, IP address, sign-in times, pages used | Our systems |

### 3.2 Venue teams

Name, work email, mobile number, job role, the venues you manage, your permissions, business registration details used for verification (e.g. Companies House number), billing contact and invoices (card details are held by Stripe, not us), messages and notes you write, and how you use the platform.

### 3.3 Website visitors

Pages visited, device and browser type, and IP address. See our [Cookie Policy](/cookies) for what we store on your device.

### 3.4 Information about other people

Sometimes you'll give us information about someone else: an emergency contact, a person you've referred for a job, or a referee. Please only do this if they're happy for you to, and let them know this policy exists.

### 3.5 Sensitive information

We don't ask about your health, religion, ethnicity, sexual orientation, trade union membership or criminal record, and CommisBot never uses any of these.

• • **Right-to-work documents** can show your nationality, date of birth, photo and immigration status. We use them only so the venue can carry out the right-to-work check the law requires of them. They're stored in a separate vault with the controls in section 10.3, and CommisBot never reads them.
• • **Diversity information** is optional. If you choose to give it, it's stored separately from your profile, never shown to venues, never used in scoring, and only used in anonymous totals to check that CommisBot treats groups fairly (section 5.6). We rely on your explicit consent for this, and you can withdraw it at any time in Settings.

Data protection law requires us to have a legal reason (a "lawful basis") for each use. For people in the UK and EU, these are ours:

| What we do | Legal reason |

|---|---|

| Run your account, show you jobs, send your applications to venues, book trials | **Contract** — it's the service you signed up for |

| Calculate match scores and show you and venues the breakdown | **Contract** for candidates who use matching; **the venue's reasons** for applications to their jobs (we act for them) |

| Send you messages about your applications and trials (reminders, check-ins, offers) | **Contract** |

| Send you new job alerts, "Available Now" broadcasts, urgent shift alerts, and re-engagement messages | **Consent** — only if you've opted in, and you can opt out any time by replying STOP |

| Let verified venues see your card in the "Available Now" feed or find you in Talent Bank search | **Consent** — only when you switch these on |

| Share your profile through Table 2 Table introductions | **Consent** — off unless you switch it on, and you approve each introduction |

| Help venues meet their right-to-work obligations | **The venue's legal obligation** (we act for them) |

| Verify that venues are real businesses before they can see candidate data | **Legitimate interests** — protecting candidates from fake employers |

| Keep the platform secure, prevent fraud and misuse, confirm identity before the document vault opens, and log who viewed which document and why | **Legitimate interests**, and **legal obligation** for security |

| Handle your data protection requests and complaints | **Legal obligation** |

| Improve the platform and produce anonymous statistics (e.g. average time to fill a role) | **Legitimate interests** — we use de-identified information wherever we can |

| Billing, invoices and tax records for venues | **Contract** and **legal obligation** |

| Tell venue teams about product changes and offers | **Legitimate interests** for existing customers; you can unsubscribe any time |

| Diversity monitoring | **Explicit consent** |

Where we rely on legitimate interests, we've weighed our interests against yours. You can ask us for that assessment, and you can object (section 11).

This section explains the automated processing we carry out, including profiling. It's the information required by Article 13(2)(f) and Article 14(2)(g) of the UK GDPR and EU GDPR and, in the UK, by Articles 22A to 22D of the UK GDPR as amended by the Data (Use and Access) Act 2025.

### 5.1 What CommisBot does

CommisBot is the matching engine inside RecruitCommis. For each job, it gives each candidate a **match score from 0 to 100**, which estimates how well their profile fits what the venue has asked for. Scoring someone against a job like this is "profiling".

CommisBot also reads CVs to pull out details (roles, dates, skills) and writes a short summary for the venue. And if you use "Enhance bio", it suggests wording for your written bio. You decide whether to use the suggestion.

### 5.2 What the score is made of

The score adds up six parts. These are the default weights; a venue can adjust them for a particular job, and we keep a record of the weights used for every score.

| Part | Default points | What it looks at |

|---|---|---|

| Role and experience | 30 | How your roles, seniority and years in the trade match the job |

| Practical skills | 20 | Skills, certificates and till/POS systems the job needs that you have |

| Availability | 15 | Whether your shift pattern and start date fit |

| Location and travel | 15 | Whether the venue is within your travel radius |

| Work-style ("vibe") | 15 | How close your preferences are to the venue's on pace, culture, flexibility, autonomy and energy |

| Track record | 5 | Completed trials, trial assessments, previous work with the venue group, and missed trials on RecruitCommis |

If a piece of information is missing (for example, you haven't set your work-style preferences), that part is left out and the score is worked out from the rest. You're never scored zero for something you haven't filled in.

### 5.3 What it never uses

CommisBot never uses your name, photo, video, age or date of birth, nationality, gender, marital status, the free-text wording of your bio, your right-to-work documents, or any diversity information. We test for this.

In the Gulf states, venues may filter for local nationals where national employment rules require it (for example, Emiratisation or Saudization). That's a filter the venue sets and can see, kept completely separate from the score. It never adds or removes points.

### 5.4 What the score means for you

We want to be straight about this. The score doesn't decide whether you get a job, but it does affect how visible you are:

• • It sets the **order** in which the venue sees applications.
• • Scores of **80 or more** can trigger a "hot lead" alert to the venue manager, so you're more likely to be contacted quickly.
• • When a venue sends a re-engagement message to past applicants, it can choose to message only those above a score it picks.
• • In the "Available Now" feed, venues see your score for their jobs.

So a lower score may mean a venue reaches you later, or not at all if they fill the role from people higher up the list.

### 5.5 A person makes every decision

**CommisBot never rejects anyone.** There is no automatic rejection anywhere in RecruitCommis. Every shortlist, rejection and offer is made by a named person at the venue, and our system records who made it. A decision without a person attached isn't possible in our software.

This means no decision about you is made solely by automated means. But because the score affects what happens next, we give you the same protections as if it were:

• • **See why.** Every job card shows your score broken down into the six parts above, the two areas where you lost the most points, and what you could add to improve it.
• • **Ask about a decision.** If a venue turns down your application, you can use "Ask about this decision" to message the venue directly.
• • **Ask for a human review of your score.** Contact us at [privacy@recruitcommis.com](mailto:privacy@recruitcommis.com) or through the [data requests page](/compliance/complaints). A member of our team will check how it was calculated and correct any mistake.
• • **Challenge the information behind it.** If something in your profile or CV summary is wrong, correct it in your profile or ask us to.
• • **Switch off scoring.** In Settings you can turn off matching. Venues will then see your applications without a score, in the order they arrived, and you won't appear in hot lead alerts or score-based messages. You can switch it back on at any time.

### 5.6 Checking CommisBot is fair

Every month we check whether CommisBot's scores and venues' shortlisting rates differ between groups, using only anonymous totals and only diversity information people have chosen to give us. We never guess anyone's background from their name, photo or nationality. This is a monitoring check, not a legal guarantee. Venues remain responsible for making fair, lawful hiring decisions.

### 5.7 Our help assistant

The chat assistant on our website and help pages is automated. It answers questions about how RecruitCommis works. Please don't share personal details in it; if you need help with your account, contact [support@recruitcommis.com](mailto:support@recruitcommis.com).

• • We only send messages about your applications and trials once you've applied or been invited, and only on channels you've given us.
• • We only send job alerts, broadcasts, urgent shift alerts and re-engagement messages if you've opted in for that channel.
• • Reply **STOP** on any channel to opt out (we also recognise UNSUBSCRIBE, ARRET, ALTO and إيقاف). It takes effect immediately. You'll stay visible to venues you've applied to, who can still reach you in the app.
• • We respect quiet hours based on where you are, and limit how often any venue can message you.
• • Every message says who it's from.

• • **Venues you apply to, or choose to be visible to.** They see what they need to consider you: your profile, application, score breakdown and, when they request it for a hire or trial, your documents.
• • **Verified venues only.** Venues can't see the "Available Now" feed, search candidates who haven't applied to them, or use Table 2 Table until we've verified they're a real business.
• • **Your current employer, never, if you've hidden yourself.** If you add your current venue to your hidden list, we exclude you from their feed and searches. This relies on you picking the right venue, so please check it.
• • **Service providers** who run parts of our platform for us, such as hosting, messaging and payments. They can only use your information to provide their service to us. The full list is on our [sub-processors page](/subprocessors).
• • **Professional advisers** such as lawyers and accountants, under confidentiality.
• • **Authorities**, where the law requires it or to protect someone's safety.
• • **A buyer**, if our business is sold or merged, under the same protections as this policy. We'd tell you first.

We don't sell personal information, we don't share it for advertising, and we don't let advertisers use it.

We're based in the UK, and our main database is hosted in [SUPABASE_REGION_LABEL not set]. Some of our service providers are based in, or access information from, other countries, including the United States. When information leaves the UK or EEA, we protect it using one of the safeguards the law recognises: an adequacy decision or data bridge (for example, the UK Extension to the EU–US Data Privacy Framework), the UK International Data Transfer Agreement or Addendum, or the EU Standard Contractual Clauses. Each provider's safeguard is listed on our [sub-processors page](/subprocessors). You can ask us for a copy.

For candidates and venues in the Gulf, Australia, New Zealand and Canada, see section 12.

| Information | How long |

|---|---|

| Candidate account and profile | While you use it. If you haven't signed in or been active for 11 months, we'll email you. At 12 months we delete or anonymise it. |

| Applications to a venue's jobs | As the venue decides. By default, 12 months after the job closes. |

| Hired staff records and right-to-work documents | As the venue decides, based on the law where they are. In the UK, the default is the length of employment plus 2 years, because employers must keep these records for that long. |

| Messages sent through RecruitCommis | 12 months |

| Consent and opt-out records | 3 years after your last change, so we can prove what you agreed to |

| Records of who viewed documents | 12 months in full, then kept without the viewer's name so we can investigate any security incident. This is the same 12 months you can see yourself (section 10.4) |

| Passkey records | While the passkey is set up. Removed when you delete it, when it's revoked, or when you close your account |

| Hiring statistics (e.g. time to fill) | Kept only in anonymous form after the personal details are removed |

| Venue team accounts | While the account is active, and 12 months after cancellation so the venue can come back, unless the venue asks us to delete sooner |

| Billing and tax records | 6 years, as UK tax law requires |

| Data requests and complaints | 3 years after they're closed |

| Backups | Overwritten on a rolling [BACKUP_RETENTION_DAYS not set]-day cycle |

When we delete your information, we remove your personal details and keep anonymous totals (like "one bartender hired in March") so venues' reporting still adds up.

### 10.1 Across the platform

• • Information is encrypted in transit and at rest.
• • Each venue can only see its own candidates and records. This is enforced in our database, not just on screen.
• • Our team's access is limited to what their job needs, and it's logged.
• • If something goes wrong that puts your information at risk, we'll tell the regulator and you where the law requires, and quickly.

### 10.2 Your CV

CVs are held in private storage. Nobody can open one without a time-limited link that we issue on our servers to someone with permission, and every view is logged with who, which document and when. Those links last 5 minutes.

### 10.3 Your right-to-work documents

Passports, visas, share codes, Iqamas, residence permits and work permits are the most sensitive things we hold, so they sit in a separate vault with tighter controls than the rest of the platform.

• • **Named access, not a job title.** Working at a venue isn't enough, and neither is being a manager there. Someone has to be given document access individually by the venue's owner. That access ends automatically when they leave, when their role changes, or when a temporary grant runs out.
• • **Confirming it's really them.** Before the vault opens, the person confirms their identity a second time using a passkey (their device unlock) or an authentication code, even though they're already signed in. The vault then stays open for 15 minutes, extended while they're still working to no more than an hour, or 10 minutes without extension for venues in the Gulf. Taking a copy of a document off the platform, or exporting a set of documents for an inspection, needs that confirmation again each time.
• • **Why they're looking.** Once per session they're asked what they're opening documents for, and the answer is recorded next to every document they open.
• • **Links that expire almost immediately.** A link to a right-to-work document lasts 120 seconds, works once, and only in the session that asked for it. Any attempt to reuse one is refused and recorded.
• • **Looking is separate from keeping.** Documents are shown inside the app rather than sent to a downloads folder. Downloading is a separate permission the venue's owner has to grant deliberately, because a downloaded document leaves the protections on this page.
• • **A watermark on every view.** Every document shown on screen, and every individual document downloaded, carries the viewer's name, the venue and the time across it. That doesn't stop someone photographing a screen, but it makes the copy traceable to one person and one moment. The bundle a venue produces for an official inspection is the exception, because an inspector may not accept a marked copy; it carries a cover sheet naming who produced it, when and why instead.
• • **We watch for unusual patterns.** A lot of documents opened in a short time, access from a device we haven't seen before for that person, or a refused link all raise an alert.

### 10.4 Seeing who looked at yours

Sign in and go to **Documents → Who's looked at these**. You'll see every time a venue opened one of your documents in the last 12 months: the date, the time and what they said they were opening it for.

We show you the venue rather than the name of the individual manager. The venue is the organisation responsible, and naming one of its staff to you creates a problem for that person that we don't think it's our place to create. If you need to know more than that, ask us and we'll take it up with them.

If something looks wrong, there's a link on the same page to tell us. You don't need to explain why, and you don't need an account in good standing for us to look into it.

### 10.5 Passkeys, and what we don't collect

A passkey lets your phone or laptop confirm it's you using whatever unlock you already use. Your fingerprint or face **never leaves your device and never reaches us**. The device checks you, then sends us a mathematical key and a signature, and nothing else.

**We do not collect, store, transmit or sell biometric information of any kind.** That's true everywhere, including Illinois, Texas and Washington, whose laws deal specifically with this.

Passkeys are optional for candidates. If your phone doesn't support them, you sign in exactly as you always have and you keep full access to your account, your applications and your own documents.

### 10.6 Things we deliberately don't do

• • **No shared venue password.** There is no password a venue sets and shares among its managers. Everyone is identified as themselves, which is the only thing that makes a record of who looked at your passport worth keeping.
• • **No approval needed from you for each view.** An employer has a legal duty to check your right to work and can't wait on a reply, so we don't ask you to approve each time. You get to see what happened afterwards (section 10.4) and to challenge it (section 11).
• • **We don't check your documents.** Holding a document is not a right-to-work check. The employer carries that out themselves.

You have the right to:

• • **See** the information we hold about you and get a copy. For the record of who opened your documents, you don't need to ask us at all: it's in your account (section 10.4)
• • **Correct** anything that's wrong
• • **Delete** your information
• • **Restrict** how we use it while a concern is looked into
• • **Take it with you** in a machine-readable format
• • **Object** to how we use it, including to profiling and to marketing
• • **Withdraw consent** at any time, for anything we rely on consent for
• • **Human review** of automated processing, and to challenge it (section 5.5)
• • **Complain** to us and to a regulator

**How to use them.** Go to [recruitcommis.com/compliance/complaints](/compliance/complaints). You don't need an account. You'll get a reference number straight away and an email acknowledgement. We'll respond within one month, and tell you if we need longer (up to two further months for complex requests).

**Checking it's you.** Before we release or delete anything, we'll send a link to the email or a code to the phone number we already hold. We won't ask for a passport scan to delete your data.

**What we won't release.** If you ask for a copy of your information, we'll include your profile, applications, scores, trials, messages, consent records and the full log of who viewed your documents, including the reason each viewer gave. A venue's private notes about you belong to the venue; you can ask them directly.

### United Kingdom

Our regulator is the **Information Commissioner's Office (ICO)**, [ico.org.uk](https://ico.org.uk). We'll acknowledge any data protection complaint within 30 days (in practice, within a minute). Please try us first, but you can go to the ICO at any time.

### European Union and EEA

Our EU representative is [EU_REPRESENTATIVE not set]. You can complain to the data protection authority in the country where you live or work; the European Data Protection Board lists them at [edpb.europa.eu](https://www.edpb.europa.eu/about-edpb/about-edpb/members_en). We tell you that CommisBot ranks applications at the point you apply, and section 5 explains how it works.

### United States

We don't sell or share personal information for targeted advertising. Depending on the state you live in, you may have rights to know, delete, correct and opt out; use the request page above, and we won't treat you differently for using them. We honour Global Privacy Control signals. **Biometric information:** we don't collect any. Where a passkey is used, your device holds the fingerprint or face data and releases only a key and a signature, so nothing covered by the Illinois Biometric Information Privacy Act, the Texas Capture or Use of Biometric Identifier Act or Washington's My Health My Data Act is collected, stored, transmitted or sold. **New York City:** before a venue uses CommisBot for a NYC role, you'll be told at least 10 business days in advance, and a summary of the most recent independent bias audit is published at [BIAS_AUDIT_URL not set]. If you're not satisfied, contact your state Attorney General; in California, the California Privacy Protection Agency.

### Canada

Our privacy officer is William Waight. You can complain to the Office of the Privacy Commissioner of Canada. **Québec:** you have the right to be told about decisions made using automated processing, the main factors behind them (section 5.2) and to have them reviewed by a person. This policy is available in French at [recruitcommis.com/fr/privacy](/fr/privacy). You can also complain to the Commission d'accès à l'information.

### Australia and New Zealand

We handle your information in line with the Australian Privacy Principles and the New Zealand Information Privacy Principles. Your information may be stored overseas as described in section 8. If you're not satisfied with our response, contact the Office of the Australian Information Commissioner (OAIC) or the New Zealand Office of the Privacy Commissioner.

### Gulf states (UAE, Saudi Arabia, Qatar)

Candidate records can include passports, visas, Iqama and national ID. We protect these with the controls in section 10, and alert the venue owner whenever someone other than the owner opens one, including the reason that person gave for opening it. In the Gulf the document vault also closes after 10 minutes rather than 15, doesn't stay open while someone is working, and asks the viewer to confirm their identity again before each download rather than only before each export. Any transfer outside your country follows the transfer rules in your local data protection law. You have rights over automated processing, and your score breakdown is available in Arabic. Regulators: UAE Data Office; Saudi Data & AI Authority (SDAIA); Qatar National Data Privacy Office.

You must be 16 or over to create a candidate account. Some roles, such as those serving alcohol, have higher minimum ages set by local law, and venues are responsible for checking these.

If we make an important change, we'll email you and show a notice when you sign in, before the change takes effect. Previous versions are available at [recruitcommis.com/legal/privacy/versions](/legal/privacy/versions).

• • Email: [privacy@recruitcommis.com](mailto:privacy@recruitcommis.com)
• • Data requests and complaints: [[SITE_URL not set]/compliance/complaints]([SITE_URL not set]/compliance/complaints)
• • Post: RecruitCommis Ltd, 82A James Carter Road, Mildenhall, Bury St. Edmunds, IP28 7DE