Reading a job board's small print
Twelve questions you can ask of any job board in about fifteen minutes, including this one. Every failure described below was found on a real, trading UK job board. None of them is named here and none ever will be. Naming them would make this a smear instead of a tool, and they are common enough that you will find them yourself.
The trade body sells its guidance behind a membership. We would rather give ours away. Copy it, print it, use it on us.
1. Is there a privacy notice AT ALL, and does the page taking your CV link to it?
What to look for. Try the obvious addresses: /privacy, /privacy-policy, /cookies. Then look at the actual form where you hand over your CV or your telephone number and see whether anything next to the button tells you what happens to it.
Why it matters. We expected this to be a formality and it was not. A live UK job board, taking CV submissions and running registration and a contact form with file upload, returned NOT FOUND on every privacy address we tried. No notice, no cookie information, nothing. Articles 13 and 14 of the UK GDPR require the information to be given AT THE POINT the data is collected, so that is not a thin policy, it is the absence of one, and it is the single easiest thing for a regulator to establish.
What we do. Ours is at the address you would guess, and every page that asks you for anything links to it right next to the button rather than in the footer. Check us on it.
2. Does the privacy notice say WHY it is allowed to hold your data?
What to look for. The words "lawful basis", or one of the six named in Article 6 of the UK GDPR: consent, contract, legal obligation, vital interests, public task, legitimate interests.
Why it matters. Plenty of live job boards never name one anywhere in the document. A notice that only describes what they collect and never says under which basis has missed the first requirement of Articles 13 and 14, which is the part the ICO opens with.
What we do. Ours names the basis purpose by purpose, and the legitimate interests assessment behind it is published rather than kept in a drawer. Check us on it.
3. Does the product contradict the notice?
What to look for. A notice promising "we will not share your information with any third party" on a site whose employer page advertises "search qualified candidates".
Why it matters. Both cannot be true. If recruiters can search CVs, the CVs are being disclosed to third parties, and that disclosure has to be described and lawful. This is the commonest and most serious defect we have found, and it is on sites that have traded for years.
What we do. We do not hold a searchable database of people at all, which is why we have nothing to reconcile. Your CV goes to the employer you applied to and to nobody else. Check us on it.
4. What licence are you granting over your own CV?
What to look for. "Royalty free, perpetual, non exclusive, unrestricted, worldwide licence to use, copy, sub-license, adapt, transmit" or anything resembling it.
Why it matters. That wording is standard in American user generated content templates, where it is aimed at forum posts. Applied to a CV it claims a permanent right to pass your employment history, address and telephone number to anybody, forever, which cannot sit alongside a right to erasure.
What we do. We take no licence over your CV. We hold it to pass to the employer you chose, we delete it on the published schedule, and you can have it removed at any time. Check us on it.
5. How long do they keep it, in months?
What to look for. A number. Not "as long as necessary", which is a way of writing a retention policy without having one.
Why it matters. If there is no period, nobody has decided one, and in practice nothing is ever deleted. A CV database from 2021 that has never been cleared is a breach waiting for a date.
What we do. Every period is published as a number, and there is a sweep that actually runs and is tested. You can also ask us to erase it before then, from a form rather than by writing a letter. Check us on it.
6. Is their marketing opt in or opt out?
What to look for. "Unless you ask us not to, we may contact you in future about special offers."
Why it matters. That is opt out. For an individual subscriber, electronic marketing needs consent or a narrow soft opt in under PECR, and PECR is where the Commissioner issues most of the fines that have a number attached to them.
What we do. Nothing marketing goes out without a tick, every message carries a one click stop, and a stop is honoured inside the sending code rather than on a list somebody has to remember to check. Check us on it.
7. Do the cookies ask before they set?
What to look for. "Some of our business partners may use cookies on our site, for example advertisers. However we have no access to or control over these cookies."
Why it matters. Saying you have no control does not move the duty. If advertising cookies are set through your site, PECR regulation 6 says you needed consent BEFORE they were set, and a sentence in a policy nobody reads is not consent.
What we do. No advertising cookies, no third party trackers, and no consent banner, because there is nothing to consent to. Check us on it.
8. Was the document written for this country?
What to look for. "Inc.", "attorneys' fees", "merchantability and fitness for a particular purpose", "some jurisdictions do not allow", or an export control clause about technical data.
Why it matters. Those are American forms with no meaning in England and Wales. Where an English company's terms describe an "Inc." parent that does not exist, the document has been bought rather than written, and nobody has read it since.
What we do. Ours cite the Conduct of Employment Agencies and Employment Businesses Regulations 2003 and the Consumer Rights Act 2015 by regulation and section, because those are the laws that actually apply to us. Check us on it.
9. Do the dates and the addresses agree with themselves?
What to look for. A copyright year earlier than the year the company was formed. A different registered office on the contact page from the one on the about page. A pricing page still promising plans "launching next year" several years later.
Why it matters. The registered office has to be stated correctly on a company website under the trading disclosure rules. Two different ones for the same company number means at least one is wrong, and the rest of the small print was proof read to the same standard.
What we do. One company, one number, one registered office, shown in the footer of every page and on every invoice. Check us on it.
10. Can they really exclude every liability they claim to?
What to look for. Blanket capitals excluding all liability, and "your sole and exclusive remedy is to stop using the site".
Why it matters. Against a consumer, and a job seeker is a consumer, terms like that run into the Consumer Rights Act 2015, and liability for death or personal injury caused by negligence can never be excluded at all. A clause that overreaches is not stronger, it is likelier to be struck out entirely.
What we do. Our limits are stated in ordinary type, they keep to what the law allows, and the complaints route with the escalation to the director is published. Check us on it.
11. Was there already a file on you before you ever arrived?
What to look for. "Claim your profile." "Built from public sources before you arrived." "He finds his record, he does not need to manually add it." Any service that greets you with a history of your own career you never gave it.
Why it matters. Article 14 of the UK GDPR covers personal data NOT obtained from you, and it does not let a company wait until you turn up. You are supposed to be told, within a month of them taking it or at first contact, who has it, why, on what basis and how to object. "Claim it when you get here" is not that. And watch for the sharper version of the trap: a service can offer genuinely excellent controls over the data you GAVE it, withdrawal, scope, expiry dates, all of it, while the far larger pile it TOOK sits outside that tooling entirely, sometimes belonging to people whose side of the product has not even launched yet. They cannot see it, correct it, object to it or have it erased, because there is no door.
What we do. There is no file on you here until you send us one. Nothing is scraped, nothing is bought, and nothing is built from public sources. What you give us has a written scope, a version and an expiry date, and you can erase it yourself from a form without writing to anybody. Check us on it.
12. If it is free to everybody, who is the customer?
What to look for. A board free for employers and free for candidates, with a sponsor block, a display advertising page, or one payroll company featured throughout.
Why it matters. Somebody is paying, and if it is not the employer and not the candidate then the product being sold is access to the candidate. Where the sponsor is an umbrella payroll company, the board is a funnel into a deduction from the worker's pay.
What we do. Employers pay a published price, the same for everybody, and that is our only income from the board. We place workers on PAYE and never through an umbrella. Check us on it.
If you are running a job board yourself
Take all of it. We are not going to pretend that keeping our promises is a trade secret. The documents behind our own answers are published too: the record of processing, the retention periods as numbers, and the legitimate interests assessment.
What we hold and why · How long we keep things · Privacy notice