1. Who we are and how to contact us

This notice is issued by Cressoft Consultancy Limited ("Cressoft", "we", "us", "our"), a company registered in England and Wales (company number 07628636). Our registered office is 167-169 Great Portland Street, London, W1W 5PF, United Kingdom.

For any privacy question or to exercise your rights, contact Kemal Ediz, Co-founder, at admin@cressoft.io. We have not appointed a Data Protection Officer because the law does not require us to, so Kemal is your contact for anything about your personal data.

This notice covers our websites, our job application, candidate assessment and interview booking services, our work with consultants who work on client engagements through us, and our dealings with clients and other business contacts.

2. Our role, and when we act for a client

Cressoft is the controller for its own recruitment activities and for managing the consultants who work through us.

When we handle personal data on a client's instructions under our contract with them, we act as that client's processor and the client is the controller. Clients make their own hiring decisions and their own privacy notices apply to how they use your data.

3. The personal data we collect

What we hold depends on how you deal with us. It may include:

• Identity and contact details, such as your name, email address, phone number, country and professional profile link.
• Application and career details, such as your CV, work history, education, skills and the roles you are interested in.
• Assessment data, such as test results, the work and answers you give in an assessment and, with your consent, video, audio and screen recordings and their transcripts. Before any recording starts we tell you exactly what it will capture.
• Evaluation data, such as scores, written assessments, notes and decisions made by our team, by clients and with the help of AI tools (see section 6).
• Consultant and contract data, such as contracts, rates, timesheets, invoices, payment details, identity documents and right to work evidence.
• Business contact data, such as job title, work contact details, our correspondence with you, feedback you record in our tools and, if you ask us for access to shared information, the details of your request.
• Technical and security data: your IP address and related technical information, used to keep our services secure and to prevent fraud.
• Communications, such as emails, messages and contact form enquiries.

We do not ask for special category data, such as information about health, ethnicity or religion. Please do not include it in your CV. Recordings show your face and voice so that they can be assessed, but we do not use them to identify you by facial or voice recognition.

4. Where we get your personal data

• From you, when you apply, take an assessment, book an interview, contact us or work with us.
• From sourcing partners who introduce candidates to us.
• From public professional profiles, such as LinkedIn, when we look for people who match a role.
• From our clients, and from service providers who run assessments for us.

If we receive your details from someone other than you, we will tell you within one month, and at the latest when we first contact you.

5. Why we use your data, and our lawful basis

Where we rely on legitimate interests you can ask us how we balanced them against yours, and you can object (see section 10).

Recordings and your consent. You do not have to agree to be recorded. You can decline and ask us for another way to be assessed, or withdraw your consent at any time, by emailing admin@cressoft.io. We will then stop using your recordings and delete them, although we may keep them until a decision already under way is made. Withdrawing does not affect what we did before.

6. How we use AI, and automated decisions

We use AI tools to help us assess candidates. They help review CVs against a role, help assess recordings and other assessment work, and flag anything that needs a person to look at.

If the AI assessment of your CV is a pass, your application can move forward to the next step automatically. Nothing rejects anyone automatically. Decisions to reject a candidate, to put a candidate forward and to make an offer are made by people, who can see the AI assessment and disagree with it.

You have the right to ask for a person to review any assessment made about you, to give us your point of view and to contest it. Email admin@cressoft.io.

Our AI service providers do not use the data we send them to train their models.

7. Who we share your data with

We share personal data only where needed for the purposes above, with:

• clients considering you for a role, once our team has decided to put you forward, and people we ask to help review assessments;
• service providers who process data for us under contract: cloud hosting and storage, AI service providers, assessment and video interview platforms, our recruitment and CRM systems, communication and scheduling tools, and security and fraud prevention services; and
• professional advisers, auditors, HMRC, regulators, the police or courts where required or needed to protect our legal rights, and a buyer or successor if our business is sold.

We do not sell personal data. You can ask us for more details of the recipients of your data at admin@cressoft.io.

8. International transfers

Some of our service providers and team members process personal data outside the UK, including in the United States. When this happens, the transfer is protected by UK adequacy regulations or by approved safeguards such as the UK International Data Transfer Agreement or the UK Addendum to the EU standard contractual clauses. You can ask us for details of the recipients and the safeguards at admin@cressoft.io.

9. How long we keep your data

When a period ends we delete the data or anonymise it so it no longer identifies you. Backups are deleted on a short rolling cycle.

10. Your rights

Under the UK GDPR you have the right to:

• access the personal data we hold about you and get a copy of it;
• have inaccurate or incomplete data corrected;
• have your data erased in certain circumstances;
• restrict how we use your data in certain circumstances;
• object to our use of your data where we rely on legitimate interests;
• data portability: receive data you gave us, under contract or consent, in a machine readable format, or have it sent to someone else;
• withdraw consent at any time where we rely on consent; and
• not be subject to a decision based solely on automated processing that has a legal or similarly significant effect on you, and to ask for human review (see section 6).

To use any of these rights, email admin@cressoft.io. We will reply within one month, and may ask you to confirm your identity first. There is normally no charge.

If you are unhappy with how we have handled your data, please tell us first so we can try to put it right. You also have the right to complain to the Information Commissioner's Office: ico.org.uk/make-a-complaint, telephone 0303 123 1113.

11. Do you have to give us your data?

No. However, we cannot consider you for a role without your contact details and CV, or assess you for a role that requires an assessment if you do not take it. Consultants must give us the information we need for their contract and to meet our legal duties, or we cannot engage them.

12. Cookies

This website does not set any cookies and does not use analytics or advertising tools. The site loads fonts and style files from third-party content delivery services, which receive your IP address to deliver them. Our hosting provider receives technical data, such as your IP address, to run and secure the site. Our other online services use only cookies and browser storage that are strictly necessary, for example to keep you signed in.

13. How we protect your data

Cressoft operates an information security management system certified to ISO/IEC 27001, and we use appropriate technical and organisational measures to protect your data. If a personal data breach is likely to put you at high risk, we will tell you without undue delay.

14. Children

Our services are for working professionals and are not aimed at anyone under 18. We do not knowingly collect data about children.

15. Changes to this notice

We update this notice when the way we use personal data changes. The date at the top shows when it last changed. If we make a significant change that affects you, we will tell you directly where we can.

16. Contact

Cressoft Consultancy Limited
167-169 Great Portland Street
London W1W 5PF, United Kingdom
Email: admin@cressoft.io