Legal

Privacy Policy

In brief

We collect what we need to help you find work (or hire someone) on the Isle of Wight — things like your name, contact details, and your CV if you upload one.
We don't sell your data, and your profile isn't public. Employers only see it if you apply to their job.
You must be 16 or older to use The Wight List.
You can see, download, or delete your information at any time from your Privacy Centre.
Not happy with how we've used your data? Email privacy@thewightlist.co.uk — or contact the ICO.

That's the short version. The full details are below.

Last updated: 9 July 2026

Data controller

The Wight List Ltd · ICO registration: ZC186762

What we collect

Job seekers

Account information (name, email, password hash)
Date of birth — collected only at sign-up, to verify you meet our minimum age requirement (16+). It is checked and then discarded, not stored.
Profile data (location, work history, skills, job preferences)
CV file (stored as a private file — not publicly accessible)
Usage data (page views, search queries — anonymised)
Payment information is not collected from job seekers

Employers

Account information (name, email, password hash or Google identity)
Company details (name, description, logo)
Job listing content (title, description, requirements, salary)
Payment records (invoices and Stripe payment references — card details are held by Stripe only)
During the listing review process, a temporary snapshot of listing content is stored to allow our team to show you a before/after diff of any changes requested. This snapshot is deleted as soon as your listing is approved.

How applications are handled

How your application data is stored depends on the type of listing you apply to.

Standard listings

Standard listings deliver your application directly to the employer's inbox by email. We store only a minimal record (your name and the date you applied) to prevent duplicate submissions. Your cover letter and any other application content is sent to the employer by email and is not retained by us beyond that delivery. This stub record is deleted automatically after 30 days.

The Short List listings

Short List listings use our on-site applicant tracking system. We store your full application — including cover letter, screening question answers, messages exchanged with the employer, and a link to your profile and CV — so both you and the employer can manage the hiring process through the platform. This data is retained for 6 months from submission, then permanently deleted. Hired applications are retained until you delete your account.

Where we get personal information from

Directly from you
Publicly available sources (for employer outreach — see below)
Third parties: Google, when you sign in with a Google account (name, email, and profile info); Stripe, which returns payment confirmation and status as payment references

Lawful bases and data protection rights

Under UK data protection law, we must have a lawful basis for collecting and using your personal information. Depending on which basis applies, you have the right of access, rectification, erasure, restriction of processing, objection to processing, data portability, and — where we rely on consent — the right to withdraw that consent at any time. Read more about these rights on the ICO's website. If you make a request, we will respond without undue delay and within one month. To make a request, use the contact details at the top of this page, or your Privacy Centre (/me/privacy).

Our lawful bases, by purpose

To provide services and goods (operating the job board): Contract; and Legitimate interests, for scam/contact-detection moderation and employer verification checks.
For the operation of customer accounts: Contract; and Legitimate interests, for security-purpose processing beyond bare necessity (login-attempt tracking, account lockouts).
For service updates or marketing purposes: Contract, for transactional emails (job alerts, application updates); Consent, for marketing emails, withdrawable at any time; and Legitimate interests, for anonymised analytics used to improve the platform.
To comply with legal requirements: Legal obligation.
For recruitment purposes: Contract; and Legitimate interests, for candidate-employer matching and application-quality/fraud screening.
For dealing with queries, complaints or claims: Contract; and Legitimate interests, for investigating reported or flagged listings to protect the integrity of the marketplace.

Who can see your profile

Job seeker profiles and CVs are not publicly searchable. Your details are only shared with an employer when you actively apply to one of their roles. The employer can view your profile and CV solely for the purpose of assessing your application. You can withdraw an application at any time via your applications page.

Employer company details (name, logo, and listing content) are shown publicly on job pages, category pages, and the homepage — this is necessary for the job board to function.

Data residency

All personal data is stored on servers in the EU/UK. CV files are stored via Vercel Blob (encrypted at rest). Our database is hosted on Neon (AWS eu-west-2, London). All data is encrypted in transit (TLS 1.2+).

Data processors

Organisations that handle personal information on our behalf, under contract:

Vercel Inc. (cloud hosting, USA) — hosts our web application; stores uploaded files (CVs, employer logos) via Vercel Blob; provides anonymised, cookie-free usage analytics.
Neon, Inc. (database hosting, USA; our database instance runs in AWS eu-west-2, London) — hosts our production database, storing all account, job listing, application, and message data.
Stripe Payments Europe, Ltd (payments, Ireland) — processes employer payment card details and manages billing; card details are held by Stripe only, we never receive or store raw card numbers.
Resend, Inc. (transactional email, USA) — sends account verification, application confirmation, job alert, and receipt emails on our behalf.

Relevant regulatory authorities (for example the ICO or HMRC), where required
Organisations we're legally obliged to share personal information with
Publicly, on our website — employer company details and listing content only (see "Who can see your profile" above)
Google, as an identity provider, when you choose to sign in with a Google account

Where necessary, our data processors — and Google, as our sign-in identity provider — share personal information outside the UK. Each transfer is covered by one of the safeguards below.

Vercel Inc. (USA) — Adequacy Regulations (UK data bridge)
Neon, Inc. (USA) — Addendum to the EU Standard Contractual Clauses (SCCs)
Stripe Payments Europe, Ltd (Ireland, with onward transfer to the US) — Adequacy Regulations (UK data bridge)
Resend, Inc. (USA) — Adequacy Regulations (UK data bridge)
Google LLC (USA) — Adequacy Regulations (UK Extension to the EU-US Data Privacy Framework)

Retention

Standard application records: deleted automatically 30 days after submission.
Short List application data (cover letters, screening answers, messages): retained for 6 months from submission, then permanently deleted. Hired applications are retained until you delete your account.
CV files: deleted immediately when you remove them from your profile, or when your account is erased. CVs that have gone unused for 90 days (never applied) are removed automatically. Once you have applied, your CV is kept while it remains in active use and removed after 6 months of inactivity. We email you 7 days before any automatic removal.
Account data: retained until you request erasure.
Employer invoices: retained for 7 years for legal and accounting compliance.

Your rights

Under UK GDPR you have the right to access, rectification, erasure, portability, restriction, and objection, and to withdraw consent at any time. Exercise these rights via your Privacy Centre (/me/privacy) or by emailing privacy@thewightlist.co.uk.

Erasure requests are processed within 30 days and include permanent deletion of your CV and all associated application data from our systems.

How to complain

If you have any concerns about how we use your personal information, you can make a data protection complaint to us by emailing privacy@thewightlist.co.uk.

If you remain unhappy with how we've handled your data after raising it with us, you also have the right to complain to the Information Commissioner's Office (ICO):

Address: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
Helpline: 0303 123 1113
Website: ico.org.uk/make-a-complaint

Contact

privacy@thewightlist.co.uk