Privacy noticePrivacy notice

This notice explains what personal data Candit collects when we find, vet and place people, and when we work with the companies who hire through us. It covers candidates and clients. If anything isn’t clear, email privacy email and a person will answer.

Who we are

Candit is a recruitment agency for startups, run by Candit legal entity name, registered in England and Wales under company number company number, at registered address.

We’re the controller of the personal data described here. Our ICO registration number is number.

If you’re a candidate: what we collect

We collect what we need to find you a role and to check it fits. Depending on how far you go with us, that can include:

• Contact details: name, email, phone number and location.
• Your CV, LinkedIn profile and anything else you send us.
• Work history, the roles you’re interested in, salary expectations and notice period.
• ID and right-to-work documents.
• References, confirmed through your referees’ work email.
• Recordings and transcripts of interviews we run with you, and any flags our anti-cheat raises during them.
• For go-to-market (sales, growth and marketing) roles: what your former managers tell us about your results (quota attainment, pipeline, revenue), and documents if you choose to share them. We never ask for documents you don’t want to share.

Where candidate data comes from

Mostly from you. We also collect it from referees and former managers you put us in touch with, from public professional profiles such as LinkedIn, and from people who recommend you to us.

If we contact you after finding your profile, we’ll tell you where we found it, and you can ask us to delete your details straight away.

If you’re a client: what we collect

When your company hires through us, we collect:

• Names, work email addresses, phone numbers and job titles of the people we deal with.
• Briefs, call notes, interview feedback and hiring decisions.
• Billing details and fee terms.
• What you tell us when you book a call or fill in a form on this site.

Why we use it, and our lawful bases

We rely on these lawful bases under UK GDPR:

• Legitimate interests: to find candidates, put suitable people forward, run vetting checks and manage our relationships with clients. We weigh this against your rights, and you can object at any time.
• Consent: to record interviews and run our anti-cheat on them, and to receive documents you choose to share. You can withdraw consent at any time.
• Legal obligation: to check right to work, keep the records the law requires, and meet tax and accounting rules.
• Contract: to deliver the services a client has agreed with us, and to take steps you ask for before an offer.

How vetting works

You’ll know what’s involved before it starts. We tell every candidate upfront what each check is, and you agree before any interview is recorded.

Our anti-cheat reads the interview for signs of outside help. If it raises a flag, that’s a prompt for a follow-up question, never a verdict.

People make every decision. We don’t make decisions about you based solely on automated processing that have legal or similarly significant effects.

If you’d rather not be recorded, tell us. what happens instead

Who we share it with

We put candidates forward to clients with your OK, and never without it. We share what’s relevant to the role: your CV, our interview pack and the results of your checks.

We use service providers (processors) to run Candit. They act on our instructions and can’t use your data for their own purposes: confirm list. This typically covers hosting and database, email, call booking, video-call recording and transcription, and AI analysis of interviews.

We may share data where the law requires it, or with professional advisers who owe us a duty of confidentiality.

We never sell personal data.

International transfers

We work across the UK and US, and some of our providers store data outside the UK. When data leaves the UK, we protect it with safeguards, e.g. the UK International Data Transfer Addendum or the UK-US data bridge.

If you’re put forward for a US role, your details go to that US client, with your OK.

How long we keep it

We keep candidate data for retention period after our last contact with you, unless you ask us to delete it sooner. Every candidate record carries a delete-by date, and on that date we delete or anonymise it.

Interview recordings are kept for recording retention period. Records we have to keep by law are kept for as long as the law requires (periods).

Client data is kept for client retention period after our last engagement, or longer where tax and accounting rules require it.

Your rights

You have rights over your data. To use any of them, email privacy email. We’ll answer within one month. You can ask us to:

• Give you a copy of the data we hold about you.
• Correct anything that’s wrong or out of date.
• Delete your data.
• Stop or limit how we use it, including objecting to processing based on legitimate interests.
• Send your data to you or another organisation in a portable format.
• Withdraw your consent, for example to interview recording, at any time.
• And you can complain to the Information Commissioner’s Office (ico.org.uk) if you’re unhappy with how we’ve handled your data. We’d appreciate the chance to put it right first.

Security

Candidate data lives in our private systems, behind team logins with access limited by role. CVs are stored privately and never made public. Nothing about candidates appears on our public website.

Data is encrypted in transit and at rest. If something goes wrong, we’ll tell the ICO and anyone affected whenever the law requires it.

Cookies

This site doesn’t use advertising or tracking cookies.

We use Cloudflare Turnstile on our forms to keep out spam and bots. To do that, it may process technical details about your browser and device.

If you book a call, our booking provider sets the cookies it needs to work. analytics, if any

Changes to this notice

We’ll update this notice when something changes, and put the date at the top.

Contact us

Questions or requests: privacy email, or write to us at registered address.