candiq

Privacy Policy

Effective date: 13 August 2026 · Last updated: 13 August 2026

Plain-English summary: We collect only what we need to run the Service. Candidate CV data you upload is used to score and rank — nothing else. You retain full control as the data controller. We act as your data processor under UK GDPR.

1. Who We Are

candiq ("we", "us", "our") is operated by Spectrum Glo Solutions, Barnsley, South Yorkshire, United Kingdom. We are the data processor for candidate personal data processed through the Service at candiq.co.uk. ICO registration number: CSN2702885. Contact: mark.driver@spectrumglo.co.uk.

2. Controller and Processor Roles

candiq operates as a data processor under UK GDPR. You, the recruiter or hiring organisation using the Service, are the data controller in respect of any candidate personal data you upload. You are responsible for ensuring you have a lawful basis to process candidate data before submitting it to the Service. A Data Processing Agreement (DPA) is available at candiq.co.uk/dpa and is agreed to at account creation.

2a. Automated Processing and Candidate Scoring

candiq uses tech-assisted scoring to generate a 0–100 match score for each candidate CV submitted against a job description. This scoring is intended to assist recruiters in shortlisting and is not designed to be used as the sole basis for any hiring decision.

Your rights as a candidate (Article 22, UK GDPR)

If a recruiter uses candiq to score your CV, you have the right to:

  • Be informed that automated scoring has been used as part of the process (the recruiter, as data controller, is responsible for informing you of this)
  • Request that a recruiter reviews your application manually rather than relying solely on an automated score
  • Contest a decision made solely on the basis of an automated score

To exercise these rights, contact the recruiter or hiring organisation directly. If you need assistance identifying whether candiq was used in a recruitment process, contact us at mark.driver@spectrumglo.co.uk.

Note for recruiters: By using candiq you agree to use automated scores as a decision-support tool only, not as the sole basis for excluding candidates. You are responsible as data controller for informing candidates that tech-assisted scoring is used in your process.

3. Data We Collect

Account data (registered recruiters)

  • Email address, hashed password, account creation date, subscription status, organisation name if provided.

Candidate data (uploaded by recruiters)

  • CV text submitted for scoring.
  • Job titles and role descriptions used for comparison.
  • Candidate scoring history and ranked results within your account.

Payment data

  • Handled by Stripe. We receive only a payment confirmation token and subscription status.

Technical data

  • IP address, browser type, device type via server logs.
  • Aggregate usage data for service improvement.
  • Error and performance data via Sentry (CV text redacted before transmission).

4. How We Use Your Data

  • Providing the Service — contract performance.
  • Account management — contract performance.
  • Billing and subscriptions — contract performance and legal obligation.
  • Service improvement using aggregated anonymised data — legitimate interests.
  • Security and fraud prevention — legitimate interests and legal obligation.
  • Legal compliance (HMRC records) — legal obligation.

We do not use candidate CV data to train AI models. We do not sell personal data to any third party.

5. Sub-Processors

  • Supabase Inc (USA) — database hosting and authentication. SCCs.
  • Stripe Inc (USA) — payment processing. SCCs.
  • Anthropic PBC (USA) — AI model provider for CV scoring. CV text transmitted for inference only, not retained for training. SCCs.
  • Sentry (Functional Software Inc, USA) — error monitoring. CV text redacted. SCCs.
  • Lovable AB (Sweden) — application hosting. EU adequacy / SCCs.

6. Data Retention

  • Account data: lifetime of account plus up to 90 days after deletion.
  • Candidate scoring data: retained while your account is active. You can delete individual candidates or roles at any time.
  • Payment records: 7 years (HMRC).
  • Server logs: up to 90 days.
  • Error logs: up to 30 days.

7. Your Rights Under UK GDPR

As a data controller you have obligations to your candidates. As our customer you have rights of access, rectification, erasure, restriction, portability, and objection. Contact mark.driver@spectrumglo.co.uk. We respond within 30 calendar days. Complaints to the ICO at ico.org.uk or 0303 123 1113.

8. Candidate Rights

If a candidate contacts you to exercise their UK GDPR rights (e.g. right to erasure), you as the data controller are responsible for responding. We will assist you in fulfilling candidate data subject requests relating to data we hold on your behalf. Contact mark.driver@spectrumglo.co.uk. You can also direct candidates to our Data Erasure Request form.

9. Cookies

  • Strictly necessary cookies: authentication and session management.
  • Analytics cookies: aggregate usage, anonymised, no cross-site tracking.
  • No advertising or tracking cookies.

See our Cookie Policy for full details and instructions on managing your preferences.

10. International Transfers

Data may be processed by sub-processors outside the UK or EEA. Safeguards: UK IDTAs, SCCs, UK adequacy decisions as applicable. See Section 5.

11. Security

  • HTTPS/TLS for all data in transit.
  • Passwords hashed.
  • Row-level security restricts database access.
  • Regular security reviews.
  • Breach notification to you and the ICO as required by law.

12. Changes to This Policy

We will notify registered users by email of material changes. Continued use constitutes acceptance.

13. Contact

mark.driver@spectrumglo.co.uk · candiq.co.uk · ICO: ico.org.uk/make-a-complaint · 0303 123 1113

← Back to home