Privacy Policy

Last updated: 6 October 2026

Data controller

The Wight List Ltd · ICO registration: ZC186762

What we collect

Job seekers

• Account information: name, email and a password hash, or your Google identity if you sign in with Google
• Date of birth: asked for only when you sign up with an email and password, to check you meet our minimum age (16+). It is checked and then discarded, not stored. If you sign up with Google, you confirm you are 16 or over instead.
• Profile data: phone number, location and postcode, work history, skills, job preferences, availability, right to work status and expected salary, where you choose to give them
• CV file (stored as a private file, not publicly accessible)
• Jobs you save, job alerts you set up and listings you report
• Your IP address, used to limit repeated sign-up, password reset and waitlist attempts. These records are deleted within two days. Our hosting provider also keeps short-lived server logs.
• Usage statistics, only if you agree to analytics: anonymous page-view counts with no cookies and nothing that identifies you
• Payment information is not collected from job seekers

Employers

• Account information (name, email, password hash). Employer accounts cannot use Google sign-in.
• Company details: name, address, phone number, website and social media link, logo, photo and the description you write
• The email addresses of colleagues you invite to your account
• Job listing content (title, description, requirements, salary)
• Payment records (invoices and Stripe payment references; card details are held by Stripe only)
• During the listing review process, a temporary snapshot of listing content is stored to allow our team to show you a before/after diff of any changes requested. This snapshot is deleted as soon as your listing is approved.

The waitlist

If you joined our waitlist before we launched we hold your name, your email address and, for employers, your business name. They were collected to send you one email when we launched. Ask us at any time and we will delete them.

Businesses we contact

We sometimes invite Isle of Wight businesses to try The Wight List. For this we hold the business name and website, a contact name, a business email address, the town, the kind of work and sometimes the business's logo. These come from publicly available sources such as the business's own website, or from the business itself. Each invitation links to a page made for that business, and we record whether that page has been opened. Every invitation has an unsubscribe link. If you unsubscribe we keep your address only so that we do not contact you again.

How applications are handled

How your application data is stored depends on the type of listing you apply to.

Standard listings

Standard listings deliver your application directly to the employer's inbox by email, including your profile details and your CV. We store only a minimal record (that you applied, for which job and when) to prevent duplicate submissions. Your cover letter and any other application content is sent to the employer by email and is not retained by us beyond that delivery. This stub record is deleted automatically after 30 days. Once the email has been sent, the copy in the employer's inbox is in their hands, not ours.

The Short List listings

Short List listings use our on-site applicant tracking system. We store your full application, including cover letter, screening question answers, messages exchanged with the employer and a link to your profile and CV, so both you and the employer can manage the hiring process through the platform. This data is retained for 6 months from submission, then permanently deleted. Hired applications are retained until you delete your account.

Where we get personal information from

• Directly from you
• Publicly available sources (for inviting businesses, see "Businesses we contact" above)
• Third parties: Google, when you sign in with a Google account (name, email and profile info); Stripe, which returns payment confirmation and status as payment references

Lawful bases and data protection rights

Under UK data protection law, we must have a lawful basis for collecting and using your personal information. Depending on which basis applies, you have the right of access, rectification, erasure, restriction of processing, objection to processing, data portability and, where we rely on consent, the right to withdraw that consent at any time. Read more about these rights on the ICO's website. If you make a request, we will respond without undue delay and within one month. To make a request, email privacy@thewightlist.co.uk. Job seekers can also use their Privacy Centre (/me/privacy).

Our lawful bases, by purpose

• To provide services and goods (operating the job board): Contract; and Legitimate interests, for scam/contact-detection moderation and employer verification checks.
• For the operation of customer accounts: Contract; and Legitimate interests, for security-purpose processing beyond bare necessity (login-attempt tracking, account lockouts, limits on repeated requests).
• For service updates or marketing purposes: Contract, for transactional emails (job alerts you set up, application updates); Consent, for marketing emails and for anonymous usage analytics, each withdrawable at any time; and Legitimate interests, for inviting local businesses to use the service, with an unsubscribe link in every invitation.
• To comply with legal requirements: Legal obligation.
• For recruitment purposes: Contract.
• For dealing with queries, complaints or claims: Contract; and Legitimate interests, for investigating reported or flagged listings to protect the integrity of the marketplace.

Who can see your profile

Job seeker profiles and CVs are not publicly searchable. Your details are only shared with an employer when you actively apply to one of their roles. The employer can view your profile and CV solely for the purpose of assessing your application. You can withdraw an application at any time via your applications page. For a Standard listing, what was emailed when you applied cannot be recalled.

Our own staff can see account and profile details where that is needed to run the service, review listings, deal with reports or answer your requests.

Employer company details (name, logo, photo, description, listing content and, if the employer chooses, a contact phone number) are shown publicly on job pages, category pages and the homepage. This is necessary for the job board to function.

Where your data is kept

Our database is hosted on Neon (AWS eu-west-2, London). CV files, logos and photos are stored via Vercel Blob in London (encrypted at rest). All data is encrypted in transit (TLS 1.2+). Emails and payments are handled by companies that also process data outside the UK; they are listed below with the safeguard that covers each one.

Who we share information with

Data processors

Organisations that handle personal information on our behalf, under contract:

• Vercel Inc. (cloud hosting, USA): hosts our web application; stores uploaded files (CVs, employer logos and photos) via Vercel Blob; provides anonymised, cookie-free usage analytics, which load only if you agree to them.
• Neon, Inc. (database hosting, USA; our database instance runs in AWS eu-west-2, London): hosts our production database, storing all account, job listing, application and message data.
• Stripe Payments Europe, Ltd (payments, Ireland): processes employer payment card details and manages billing; card details are held by Stripe only, we never receive or store raw card numbers.
• Resend, Inc. (transactional email, USA): sends account verification, application, job alert and receipt emails on our behalf. Standard applications are delivered to employers through Resend.
• Brevo (email, France): sends our invitations to local businesses.
• Google (Google Workspace, Ireland and USA): provides the mailboxes we use when you email us.

Others we share information with

• Relevant regulatory authorities (for example the ICO or HMRC), where required
• Organisations we're legally obliged to share personal information with
• Publicly, on our website: employer company details and listing content only (see "Who can see your profile" above)
• Google, as an identity provider, when you choose to sign in with a Google account

Sharing information outside the UK

Where necessary, our data processors, and Google, as our sign-in identity provider, share personal information outside the UK. Each transfer is covered by one of the safeguards below.

• Vercel Inc. (USA): Adequacy Regulations (UK data bridge)
• Neon, Inc. (USA): Addendum to the EU Standard Contractual Clauses (SCCs)
• Stripe Payments Europe, Ltd (Ireland, with onward transfer to the US): Adequacy Regulations (UK data bridge)
• Resend, Inc. (USA): Adequacy Regulations (UK data bridge)
• Brevo (France): Adequacy Regulations (European Economic Area)
• Google LLC (USA): Adequacy Regulations (UK Extension to the EU-US Data Privacy Framework)

Retention

• Standard application records: deleted automatically 30 days after submission.
• Short List application data (cover letters, screening answers, messages): retained for 6 months from submission, then permanently deleted. Hired applications are retained until you delete your account.
• CV files: deleted immediately when you remove them from your profile, or when your account is erased. CVs that have gone unused for 90 days (never applied) are removed automatically. Once you have applied, your CV is kept while it remains in active use and removed after 6 months of inactivity. We email you 7 days before any automatic removal.
• Account data, saved jobs and job alerts: retained until you remove them or delete your account.
• Unused job seeker accounts: if you have not signed in or used your account for two years, we email you, and delete the account 30 days later unless you sign in.
• Unconfirmed employer sign-ups: an employer account whose email address is never confirmed, and which has posted nothing, is deleted after 7 days.
• Records used to limit repeated requests (IP address): deleted within two days.
• Waitlist details: kept until you ask us to delete them.
• Business contacts: kept while we may still invite the business. After an unsubscribe, the address alone is kept so that we do not contact it again.
• Employer invoices: retained for 7 years for legal and accounting compliance.

Your rights

Under UK GDPR you have the right to access, rectification, erasure, portability, restriction and objection, and to withdraw consent at any time. Job seekers can exercise these rights in their Privacy Centre (/me/privacy). Employers, and anyone without an account, can email privacy@thewightlist.co.uk.

When you delete your account in the Privacy Centre it happens straight away. Your CV is deleted. Your profile, cover letters, screening answers and messages are removed. What remains, such as the fact that an application was once made, is no longer linked to your name or email address. Invoices are kept, as the law requires. Requests made by email are completed within 30 days.

An application already emailed to an employer for a Standard listing is in that employer's inbox, outside our systems. Ask the employer directly if you want that copy removed.

How to complain

If you have any concerns about how we use your personal information, you can make a data protection complaint to us by emailing privacy@thewightlist.co.uk.

If you remain unhappy with how we've handled your data after raising it with us, you also have the right to complain to the Information Commissioner's Office (ICO):

• Address: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
• Helpline: 0303 123 1113
• Website: ico.org.uk/make-a-complaint

Contact

privacy@thewightlist.co.uk