This Privacy Policy explains how Elavew collects, uses, shares and protects Personal Data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, each as amended by the Data (Use and Access) Act 2025, together with any other applicable data protection and privacy laws.

Elavew currently supports recruitment for roles in the United Kingdom and the GCC. This Privacy Policy explains how Personal Data is handled under applicable data protection and privacy laws, including UK data protection law and, where relevant, laws applicable to supported GCC recruitment and other processing activities.

This Privacy Policy applies to:

• Candidates and prospective Candidates;
• individuals who create or manage Candidate accounts;
• individuals who apply for jobs through the Platform;
• individuals who save jobs or draft applications;
• Employer customers;
• recruiters, hiring managers and other Employer authorised users;
• visitors to the Elavew website;
• individuals who contact Elavew;
• recipients of Elavew communications;
• individuals whose information is otherwise processed through the Services.

This Privacy Policy should be read together with:

• Elavew’s Terms of Service;
• Elavew’s Cookie Policy;
• any Candidate privacy notice displayed during an application;
• any Employer Data Processing Agreement;
• any consent wording or supplementary notice presented when a particular feature is used.

This Privacy Policy does not replace any privacy notice issued by an Employer. Employers may process Candidate Personal Data for their own recruitment, employment, legal, regulatory and business purposes and may be required to provide their own privacy information.

References in this Privacy Policy to “including” or “includes” mean “including without limitation”.

Elavew is operated by:

Legal entity: Elavew Limited Company number: 17401008 Registered office: 183-189 The Vale, London, United Kingdom, W3 7RW ICO registration number: ZC222960

In this Privacy Policy, “Elavew”, “we”, “us” and “our” refer to the legal entity identified above.

Elavew provides a technology-enabled hiring platform through which:

• Employers may create accounts and company profiles;
• Employers may create, publish and manage job listings;
• Candidates may search for and save job listings;
• Candidates may create profiles and submit job applications;
• Candidates may upload CVs, documents, audio or video submissions;
• Employers may review and manage applications;
• Employers may use permitted hiring, search, transcription and summarisation tools;
• Candidates may choose whether to make certain profile information visible to Employers;
• Users may receive account, application, recruitment and subscription communications;
• Employers may purchase subscriptions and other paid services.

Questions about this Privacy Policy or Elavew’s use of Personal Data may be directed to:

Email: info@elavew.com

To make a privacy request or exercise your data-protection rights, contact info@elavew.com and include “Privacy Request” in the subject line. Postal address: 183-189 The Vale, London, United Kingdom, W3 7RW

If Elavew appoints a Data Protection Officer, the Data Protection Officer’s contact details will be published in this section.

This Privacy Policy applies to Personal Data processed through:

• the Elavew website;
• Candidate registration and login;
• Employer registration and login;
• Candidate profiles;
• Employer and company profiles;
• job listings;
• saved jobs;
• draft and submitted applications;
• screening questions and Candidate responses;
• CV and document uploads;
• audio and video submissions;
• transcripts and AI-generated summaries;
• Evidence Finder and keyword-search functionality;
• application-management tools;
• messaging and notification functions;
• interview and application-status functions;
• Candidate search and profile-visibility functions;
• subscription, billing and payment functions;
• customer-support and complaint processes;
• marketing and service communications;
• cookies, analytics, logs and security systems;
• related integrations and third-party services.

This Privacy Policy applies whether an individual accesses the Services directly, through an Employer-provided link, through a job listing or through another authorised integration.

Elavew does not currently accept Elavew-hosted Candidate applications from persons located in the EU/EEA. Public website and job information remain accessible from those jurisdictions.

The Services may contain links to third-party websites, Employer websites or external services. Where a public Job Advertisement links to an Employer's external application website, the Candidate may leave Elavew and apply directly with that Employer. Personal Data submitted on that external website is processed under the Employer's or relevant third party's privacy arrangements, not as an Elavew-hosted application. Elavew does not receive an Elavew-hosted application merely because a Candidate follows the link.

Elavew is not responsible for the privacy practices of independent third parties. Individuals should review the relevant third party’s privacy information before providing Personal Data.

Elavew as controller

Elavew acts as an independent controller where it determines why and how Personal Data is processed for its own purposes.

This ordinarily includes processing for:

• creating and administering Elavew accounts;
• authenticating users;
• administering subscriptions and billing;
• communicating with users;
• providing website and Platform functionality;
• providing Candidate-controlled profile-visibility features;
• maintaining Platform security;
• detecting and preventing fraud or misuse;
• maintaining audit and transaction records;
• complying with legal obligations;
• managing complaints and disputes;
• analysing and improving the Services;
• managing Elavew’s own marketing preferences;
• establishing, exercising or defending legal claims.

Employers as controllers

Employers will ordinarily act as independent controllers where they determine why and how Candidate Personal Data is used for their own:

• recruitment processes;
• Candidate assessment;
• interview arrangements;
• hiring decisions;
• equality and diversity monitoring;
• regulatory obligations;
• background or eligibility checks;
• employment administration;
• record-keeping;
• dispute and claim management.

Elavew as processor

Where Elavew stores or otherwise processes Candidate application information solely on an Employer’s documented instructions, Elavew may act as a processor on behalf of that Employer.

In those circumstances:

• the Employer is responsible for identifying an appropriate lawful basis;
• the Employer is responsible for providing any required Employer-specific privacy notice;
• Elavew processes the relevant Personal Data in accordance with the applicable contract and Data Processing Agreement;
• Elavew may assist the Employer in responding to data protection requests where legally and contractually required.

Separate processing activities

Elavew may be a controller for one processing activity and a processor for another. Elavew will not be both controller and processor for the same processing activity.

Employer responsibilities

Employers are responsible for ensuring that their use of the Platform and Candidate Personal Data is fair, lawful, transparent and non-discriminatory.

Employers must not use the Services to:

• make unlawful recruitment decisions;
• discriminate against Candidates;
• request information that is unnecessary or disproportionate;
• use Candidate information for unrelated purposes without an appropriate lawful basis;
• retain Candidate information for longer than justified;
• use AI-generated outputs as the sole basis for a hiring decision;
• attempt to infer protected or sensitive characteristics unlawfully.

Candidate account and identity information

This may include:

• full name;
• email address;
• telephone number;
• account identifier;
• username;
• authentication information;
• password-reset and verification records;
• country;
• city or general location;
• profile photograph, where provided;
• preferred language;
• communication preferences;
• account status;
• date of registration;
• date of last activity;
• login and security records.

Elavew does not ordinarily have access to a user’s plain-text password.

Candidate profile and career information

This may include:

• professional summary;
• employment history;
• education history;
• qualifications;
• professional licences;
• skills;
• industry experience;
• languages;
• work authorisation information;
• salary expectations;
• preferred salary currency and payment period;
• preferred job title or role;
• preferred industry;
• preferred location;
• remote-working preferences;
• employment-type preferences;
• availability;
• CV or résumé;
• portfolio or professional links;
• other information voluntarily included in a Candidate profile.

Job-application information

This may include:

• the job applied for;
• application date and time;
• CV or résumé;
• cover letter;
• screening-question responses;
• written application responses;
• uploaded supporting documents;
• qualifications and certificates;
• audio submissions;
• video submissions;
• transcripts;
• AI-generated summaries;
• application status;
• interview information;
• communications relating to the application;
• Candidate withdrawal information;
• application-update history;
• application-related metadata.

Saved jobs and draft applications

Where a Candidate saves a job or begins an application without submitting it, Elavew may process:

• the relevant job-listing identifier;
• the Employer;
• the date the job was saved;
• draft answers;
• draft uploaded documents;
• draft application status;
• progress through the application;
• the date of the Candidate’s last update.

Candidate profile visibility information

Where a Candidate chooses to make a profile visible to Employers, Elavew may process:

• the Candidate’s visibility choice;
• the date and time of the choice;
• the consent or confirmation wording accepted;
• the profile fields made visible;
• any subsequent withdrawal or change;
• Employer access and download records.

Candidate profiles are not made visible to Employers unless the Candidate activates the relevant visibility setting or otherwise requests the feature.

Employer and authorised-user information

This may include:

• full name;
• work email address;
• work telephone number;
• job title;
• Employer name;
• company registration information;
• business address;
• industry;
• company size;
• company website;
• authorised-user role;
• access permissions;
• account status;
• authentication and security information;
• subscription and plan information;
• billing contact information;
• communications and support records.

Employer recruitment information

This may include:

• job titles;
• job descriptions;
• locations;
• salary details;
• employment types;
• role requirements;
• screening questions;
• application criteria;
• job-listing status;
• listing publication and expiry dates;
• interview details;
• Candidate notes;
• application statuses;
• recruitment communications;
• records of Candidate-material access or download;
• administrative and audit information.

Payment and subscription information

This may include:

• subscription plan;
• billing frequency;
• subscription status;
• trial or pilot status;
• payment status;
• transaction identifier;
• invoice information;
• billing name and address;
• tax information;
• discount or promotional information;
• payment-provider customer identifier;
• limited payment-method information, such as card type and last four digits;
• subscription renewal, cancellation, upgrade and downgrade records.

Full payment-card details and card-security codes are ordinarily processed directly by Elavew’s payment provider and are not stored by Elavew.

Communications and customer-support information

This may include:

• emails;
• support requests;
• complaints;
• feedback;
• survey responses;
• correspondence;
• call or meeting notes;
• records of actions taken;
• attachments submitted to customer support.

Technical, device and usage information

This may include:

• Internet Protocol address;
• browser type and version;
• device type;
• operating system;
• device identifiers;
• approximate location derived from an Internet Protocol address;
• login dates and times;
• pages viewed;
• links selected;
• session information;
• referring website;
• errors and performance information;
• cookie and consent preferences;
• security-event data;
• access logs;
• audit logs;
• file-access and download logs;
• suspected fraud or misuse indicators.

Marketing and preference information

This may include:

• marketing consent;
• subscription preferences;
• communication preferences;
• records of marketing messages;
• message interaction information;
• unsubscribe requests;
• objection records;
• suppression-list information.

Information contained in documents and media

Documents, CVs, written responses, audio and video submissions may contain additional Personal Data that the Candidate chooses to provide.

Candidates should avoid including Personal Data that is unnecessary for the relevant job application.

Information provided directly

Elavew obtains Personal Data directly when an individual:

• creates an account;
• completes a profile;
• publishes a job listing;
• saves a job;
• begins or submits an application;
• uploads a CV, document, audio file or video file;
• responds to screening questions;
• changes profile-visibility settings;
• purchases a subscription;
• communicates with another Platform user;
• contacts customer support;
• submits a complaint;
• subscribes to marketing;
• changes account or communication preferences.

Information provided by Employers

Employers may provide Personal Data concerning:

• their authorised users;
• recruiters;
• hiring managers;
• interviewers;
• billing contacts;
• company representatives;
• Candidates;
• application statuses;
• interview arrangements;
• recruitment notes and communications.

Employers must ensure that they are authorised to provide this information to Elavew.

Information generated through use of the Services

Elavew may generate or record information through use of the Services, including:

• account activity;
• saved-job records;
• application history;
• access records;
• download records;
• security logs;
• consent records;
• audit trails;
• transcripts;
• AI-generated summaries;
• keyword-search results;
• technical and analytics information.

Information from service providers

Elavew may receive Personal Data from service providers such as:

• payment processors;
• authentication providers;
• hosting and database providers;
• communications providers;
• analytics providers;
• fraud-prevention and security providers;
• transcription or AI-service providers.

Public and lawful sources

Where appropriate and lawful, Elavew may obtain limited business or professional information from:

• company websites;
• public company registers;
• professional directories;
• publicly available professional profiles;
• fraud-prevention or compliance sources.

Elavew does not use such data (a) to create Candidate profiles without the Candidate's knowledge/instruction; (b) to create secret Candidate profiles; or (c) to make automated hiring decisions.

Lawful bases

Where Elavew acts as controller, it will process Personal Data only where an appropriate lawful basis applies.

Depending on the activity, Elavew may rely on:

• Contract: where processing is necessary to enter into or perform a contract with the individual;
• Legal obligation: where processing is necessary to comply with applicable law;
• Legitimate interests: where processing is necessary for Elavew’s or a third party’s legitimate interests and those interests are not overridden by the individual’s rights and interests;
• Consent: where the individual has freely given a specific, informed and unambiguous indication of agreement;
• Vital interests: in limited circumstances where processing is necessary to protect life or physical safety;
• any other lawful basis recognised by applicable data protection law.

Processing purposes

Legitimate interests

Where Elavew relies on legitimate interests, those interests may include:

• operating and administering the Platform;
• providing secure and reliable Services;
• protecting users and the Platform;
• preventing fraud, misuse and unauthorised access;
• supporting Candidates and Employers;
• improving functionality and user experience;
• maintaining accurate business and audit records;
• managing commercial relationships;
• communicating relevant service information;
• enforcing Elavew’s Terms of Service;
• establishing, exercising or defending legal claims;
• protecting Elavew’s legal and commercial interests.

Elavew will consider the necessity and proportionality of the processing and the potential effect on individuals before relying on legitimate interests.

Consent

Where processing is based on consent, an individual may withdraw consent at any time.

Withdrawal of consent will not affect processing lawfully undertaken before consent was withdrawn.

Withdrawal may prevent Elavew from continuing to provide a particular optional feature where the feature depends on the relevant processing.

Candidate accounts

Elavew uses Candidate account information to:

• register and authenticate the Candidate;
• provide account access;
• maintain the Candidate profile;
• provide job-search and application functions;
• save jobs and draft applications;
• communicate about applications and account activity;
• provide security and password-reset functions;
• maintain account and audit records.

Job applications

When a Candidate submits an application, the application information is made available to the relevant Employer and its authorised users.

The relevant Employer may then:

• view the application;
• review the Candidate’s CV and responses;
• access uploaded documents;
• listen to or view permitted media submissions;
• review transcripts and AI-generated summaries;
• use Evidence Finder;
• update the application status;
• add internal recruitment notes;
• arrange an interview;
• contact the Candidate;
• download permitted Candidate materials;
• retain information in accordance with the Employer’s own retention policy.

Draft applications

Information entered into a draft application may be stored before submission so that the Candidate can return and continue the application.

Draft information is not ordinarily made available to the Employer until the Candidate submits the application, unless the Candidate is clearly informed otherwise.

Saved jobs

When a Candidate saves a job, Elavew stores the relevant job and account identifiers so that the job can be displayed in the Candidate’s Saved Jobs page.

Where a job closes or expires, Elavew may continue to display a limited record showing that the saved job is no longer active.

Candidate updates and withdrawals

Where a Candidate updates or withdraws an application, Elavew may:

• update the relevant application record;
• notify the Employer;
• retain an audit record;
• retain limited information where necessary for legal, security, fraud-prevention or dispute purposes.

Withdrawal of an application does not necessarily require immediate deletion of all information previously provided to an Employer.

Candidate profile visibility

Candidate profiles are private by default unless the Candidate chooses to make a profile visible to Employers.

Where the Candidate activates profile visibility:

• permitted Employers may search for and view the information made visible;
• permitted Employers may access Candidate documents or media where the feature and Candidate permissions allow;
• permitted Employers may download the Candidate’s CV where allowed by the Platform’s access controls;
• Elavew may record Employer access or download activity;
• Elavew may notify the Candidate of certain Employer activity.

Candidates may turn off profile visibility through their account settings. Turning off visibility prevents new Platform access through the relevant search function but may not delete information already accessed, exported or downloaded by an Employer.

Candidate responsibility

Candidates are responsible for ensuring that information submitted through the Platform is accurate and that they are entitled to provide it.

Candidates should not include unnecessary information concerning third parties or sensitive matters in their profile, CV, application, documents or media submissions.

Employer account administration

Elavew processes Employer and authorised-user information to:

• verify and administer Employer accounts;
• provide user access and permissions;
• maintain company profiles;
• publish and manage job listings;
• receive and manage applications;
• administer subscriptions and payments;
• send service and billing communications;
• provide customer support;
• protect Platform security;
• maintain audit records.

Employer-authorised users

Employers control which authorised users may access their account and Candidate information.

Employers are responsible for:

• ensuring that access is limited to individuals with a legitimate recruitment need;
• assigning appropriate user roles;
• promptly removing access when no longer required;
• maintaining account-security practices;
• preventing unauthorised sharing or downloading;
• ensuring that their users comply with applicable law and the Terms of Service.

Candidate information

Employers may use Candidate Personal Data only for lawful recruitment and related purposes.

An Employer must not use Candidate information:

• for unrelated marketing;
• to create unlawful blacklists;
• to discriminate unlawfully;
• to make decisions based solely on protected characteristics;
• to make solely automated decisions where prohibited;
• for surveillance or unrelated profiling;
• in a manner inconsistent with its privacy notice or lawful basis.

Employer notes and recruitment decisions

Employer notes, statuses and recruitment decisions may contain Personal Data concerning Candidates.

Employers are responsible for ensuring that such information is:

• relevant;
• accurate;
• objective;
• proportionate;
• non-discriminatory;
• retained only for an appropriate period;
• accessible only to authorised users.

Downloaded information

Where an Employer downloads Candidate information, the downloaded copy may leave Elavew’s direct technical control.

The Employer will ordinarily become independently responsible for:

• securing the downloaded copy;
• limiting access;
• responding to Candidate rights requests;
• applying its own retention period;
• deleting the information when no longer required;
• reporting relevant security incidents.

Nature of the tools

Elavew may provide AI-supported or automated tools that assist Employers and Candidates with navigating and reviewing information.

These tools may include:

• transcription of the spoken content of audio or video submissions;
• AI-generated summaries of CVs;
• AI-generated summaries of application responses;
• AI-generated summaries of transcripts and uploaded materials;
• keyword and phrase searching;
• Evidence Finder;
• extraction of potentially relevant passages;
• identification of terms appearing in application materials;
• job or role suggestions based on Candidate-selected preferences.

Purpose of AI-supported processing

AI-supported tools are provided to:

• make application materials easier to navigate;
• help Employers locate potentially relevant evidence;
• reduce administrative review time;
• assist users in finding information;
• improve accessibility of spoken submissions;
• support, but not replace, human review.

Human-led recruitment

Elavew does not use its AI-supported tools to rank, shortlist, reject or make hiring decisions on behalf of Employers.

Elavew’s AI-supported tools do not:

• automatically accept or reject Candidates;
• automatically shortlist Candidates;
• rank Candidates against each other;
• assign Candidate suitability scores;
• recommend that an Employer hire or reject a Candidate;
• make final recruitment decisions;
• remove a Candidate’s application; or
• prevent an Employer from reviewing the Candidate’s original application materials.

If Elavew introduces any materially different AI feature, it will update the applicable terms and privacy information, provide appropriate notice and obtain any consent required by law before the feature is activated.

Employers remain solely responsible for all recruitment decisions.

Evidence Finder

Evidence Finder searches submitted application materials and AI-generated summaries for words, phrases or related evidence entered by an Employer.

Evidence Finder may temporarily filter the visible Candidate list or highlight matching information for review convenience.

Evidence Finder does not:

• reject Candidates;
• permanently remove Candidates;
• rank Candidates;
• shortlist Candidates;
• recommend Candidates;
• determine whether a Candidate is suitable for a role.

Employers must use any “Show all”, “Clear” or equivalent function to restore the unfiltered Candidate list where required and must review the original Candidate materials before making a decision.

Accuracy and limitations

Transcripts, summaries, extracted information, keyword matches and other AI-generated outputs may:

• contain errors;
• omit relevant information;
• misunderstand context;
• misidentify words;
• fail to recognise technical or industry-specific language;
• provide incomplete results;
• be affected by recording quality, speech, formatting or document quality.

The original Candidate materials remain the primary materials for assessment.

Employers must not rely on an AI-generated output as the sole basis for a hiring decision.

No emotion, accent or appearance analysis

Elavew does not use Candidate audio, video, photographs or other application materials to conduct:

• emotion analysis;
• personality analysis based on facial expressions or voice;
• accent scoring;
• voice scoring;
• appearance scoring;
• facial attractiveness analysis;
• ethnicity inference;
• religion inference;
• disability inference;
• health inference;
• age inference;
• sex or gender inference;
• other analysis intended to infer protected or sensitive characteristics.

Transcription

Where a Candidate submits audio or video, Elavew may use an approved service provider to generate a transcript of the spoken content.

The transcript is intended to represent spoken words only. It is not intended to assess tone, accent, emotion, health, disability, ethnicity, appearance or other personal characteristics.

Third-party AI processing

Elavew may use specialist third-party AI and transcription providers, including OpenAI, to provide eligible AI Features.

Depending on the Feature used, Elavew may transmit information relevant to the application to the provider so that the requested functionality can be performed. This may include CV or application text, Candidate answers, transcripts, prompts or instructions, generated outputs, related technical metadata and, where transcription is requested, the submitted audio or video media file.

Elavew seeks to limit information disclosed to what is reasonably necessary for the relevant Feature. Such providers are subject to applicable contractual, privacy and security arrangements. Further information is available in Elavew’s Subprocessors & International Transfers notice.

Candidate job suggestions

Elavew may use Candidate-selected information, such as preferred role, skills, industry, location, salary and employment type, to suggest potentially relevant job listings.

Such suggestions:

• are provided for convenience;
• do not guarantee suitability;
• do not submit an application automatically;
• do not affect an Employer’s decision;
• may be changed by updating Candidate preferences.

Future material changes

If Elavew introduces solely automated decision-making that produces legal or similarly significant effects, Elavew will provide additional privacy information and implement any legally required safeguards before using that processing.

Application materials may contain or reveal sensitive information, including:

• racial or ethnic origin;
• political opinions;
• religious or philosophical beliefs;
• trade union membership;
• genetic information;
• biometric information used for identification;
• health information;
• information concerning sex life;
• information concerning sexual orientation;
• information relating to disability;
• other information relating to protected characteristics.

Elavew does not ordinarily require Candidates to provide special-category information unless:

• it is genuinely required for a lawful purpose;
• the Employer is legally permitted to request it;
• appropriate privacy information is provided;
• the relevant controller has identified an Article 6 lawful basis and an applicable Article 9 condition;
• appropriate safeguards are implemented.

Candidates may voluntarily include special-category or other sensitive Personal Data in a CV, application response, supporting document, audio submission or video submission. Candidates should avoid providing such information unless it is relevant and reasonably necessary for the application.

Where Elavew acts as controller, it will process special-category Personal Data only where the processing is lawful and necessary and where Elavew has identified an appropriate lawful basis under Article 6 and a condition under Article 9 of the UK GDPR, together with any applicable condition or safeguard required by the Data Protection Act 2018. Where the EU GDPR or other applicable data protection law applies, Elavew will process such information in accordance with the corresponding legal requirements.

Voluntary disclosure of sensitive information does not, by itself, constitute consent or otherwise permit its unrestricted processing.

Where Elavew acts as processor, the Employer is responsible for identifying and documenting the lawful basis and special-category condition applicable to its use of Candidate information.

Elavew does not intentionally infer special-category information from Candidate media or application materials for recruitment assessment.

Criminal-offence information

Candidates should not provide criminal-conviction or offence information unless specifically and lawfully requested.

Where such information is processed, the relevant controller must identify an appropriate lawful basis and legal authority and must implement any safeguards required by applicable law.

Employers

Candidate application information is shared with the Employer responsible for the relevant job listing and its authorised users.

Where a Candidate makes a profile visible, permitted profile information may be made available to Employers using the Candidate-search function.

Candidates

Elavew may share relevant Employer and job-listing information with Candidates, including:

• Employer name;
• company profile;
• job description;
• location;
• salary information;
• application status;
• interview details;
• Employer communications.

Service providers

Elavew may share Personal Data with service providers that support:

• website hosting;
• content delivery;
• cloud infrastructure;
• database services;
• authentication;
• file and object storage;
• email delivery;
• customer support;
• analytics;
• security and fraud prevention;
• payment processing;
• invoicing;
• subscription administration;
• transcription;
• AI-supported summaries and search;
• monitoring and error reporting;
• professional advice.

Service providers may process Personal Data only for authorised purposes and subject to appropriate contractual, confidentiality and security obligations.

OpenAI may be used as an AI and transcription provider for eligible AI Features. Further information about relevant providers and their roles is available in Elavew’s Subprocessors & International Transfers notice.

Professional advisers

Elavew may disclose information to:

• lawyers;
• accountants;
• auditors;
• insurers;
• tax advisers;
• consultants;
• other professional advisers,

where reasonably necessary for professional services, legal compliance, audit, risk management or dispute resolution.

Legal and regulatory disclosures

Elavew may disclose Personal Data where reasonably necessary to:

• comply with a court order;
• comply with applicable law;
• respond to a lawful regulatory or law-enforcement request;
• establish, exercise or defend legal claims;
• investigate fraud or security incidents;
• protect the rights, safety or property of Elavew, users or others;
• enforce the Terms of Service.

Corporate transactions

Personal Data may be disclosed in connection with:

• a proposed or completed investment;
• financing;
• corporate restructuring;
• merger;
• acquisition;
• sale of assets;
• insolvency;
• transfer of all or part of Elavew’s business.

Any recipient will be required to use the information only for the relevant transaction, due-diligence process or continuation of the Services, subject to applicable law.

No sale of Personal Data

Elavew does not sell Candidate or Employer Personal Data in exchange for money.

Elavew does not permit Employers to purchase unrestricted access to private Candidate application information unrelated to their own recruitment activity.

Infrastructure and Platform providers

Elavew may use third-party providers for:

• hosting;
• databases;
• authentication;
• file storage;
• content delivery;
• application deployment;
• security;
• system monitoring.

Current providers may include Supabase and Cloudflare, together with any replacements or additional providers appointed from time to time.

Payment processing

Elavew uses an independent payment provider to process subscription and other payments. The current payment provider may include Stripe.

Payment providers may collect:

• cardholder name;
• billing address;
• card or bank details;
• payment authentication information;
• transaction information;
• fraud-prevention information.

Payment providers process payment information under their own privacy notices and regulatory obligations.

Elavew ordinarily receives limited payment and subscription information rather than full payment credentials.

Communications providers

Elavew may use email, notification and communications providers to send:

• account-verification messages;
• password-reset messages;
• application notifications;
• interview notifications;
• subscription and billing messages;
• security alerts;
• service announcements;
• marketing messages where permitted.

AI and transcription providers

Elavew may use OpenAI and/or other specialist third-party providers for transcription, summarisation, Evidence Review, search support and related eligible AI Features. Elavew may also use specialist providers for infrastructure and hosting, databases and authentication, storage, communications, payments, security and, where used, analytics or support.

Where Elavew uses an external provider, Elavew will take reasonable steps to ensure that:

• processing is contractually restricted;
• Candidate information is used only for authorised purposes;
• appropriate security measures are applied;
• retention is limited;
• international-transfer requirements are addressed;
• the provider does not independently use Candidate information to make hiring decisions.

Further information

Elavew’s Subprocessors & International Transfers notice is the primary source of information about relevant service providers and processing arrangements. It identifies, as appropriate, providers, their roles, general processing purposes, categories of information or services involved, and international-transfer information and safeguards.

Additional information may be requested from Elavew, subject to legitimate confidentiality and security restrictions.

Cookies

Elavew uses cookies and similar technologies to:

• operate the website;
• maintain login sessions;
• remember user preferences;
• protect account security;
• prevent fraud;
• measure website and Platform performance;
• understand how the Services are used;
• support permitted marketing activities.

Essential cookies

Cookies that are strictly necessary for security, authentication, account access or requested functionality may be used without optional consent where permitted by law.

Non-essential cookies

Analytics, advertising or other non-essential cookies will be used only where an appropriate legal basis and any legally required consent have been obtained.

Users may manage cookie preferences through Elavew’s consent controls.

Further information is provided in Elavew’s separate Cookie Policy.

Service communications

Elavew may send communications necessary to administer the Services, including:

• account-verification messages;
• password and email-change confirmations;
• security alerts;
• application confirmations;
• Candidate withdrawal or update notifications;
• notifications when an Employer views or downloads Candidate Materials;
• job-listing publication and expiry notifications;
• interview and application-status messages;
• subscription, renewal, cancellation and billing messages;
• material legal or service updates.

Service communications are not ordinarily optional where they are necessary to provide or secure the Services.

Marketing communications

Elavew may send direct marketing by email, text message or other electronic communication only where permitted by the Privacy and Electronic Communications (EC Directive) Regulations 2003 (PECR), as amended, including by the Data (Use and Access) Act 2025, and applicable data protection law. Where PECR requires consent, Elavew will obtain valid consent unless an applicable statutory soft opt-in or other exemption permits the communication. Where Personal Data is processed for direct marketing, Elavew will also ensure that it has an appropriate lawful basis under the UK GDPR and Data Protection Act 2018, as amended. Recipients may opt out of marketing communications at any time.

Marketing objections

Individuals have the right to object to direct marketing at any time.

Elavew may retain limited suppression information after an unsubscribe request so that the individual’s preference can continue to be respected.

Elavew’s service providers, Employers, users or technical systems may be located in different countries.

Where a Candidate applies for a role in a supported GCC country, or a recruitment process otherwise involves transfers between the United Kingdom and a supported GCC country, Personal Data may be transferred internationally. Personal Data may also be processed in other jurisdictions by Elavew's service providers where permitted by applicable law and subject to appropriate safeguards.

Personal Data may therefore be:

• stored outside the United Kingdom;
• accessed from outside the United Kingdom;
• transferred to an Employer outside the United Kingdom;
• processed by an international service provider.

Where Elavew makes a restricted international transfer for which it is responsible, Elavew will use an appropriate transfer mechanism where required.

This may include:

• a country covered by an applicable adequacy decision or adequacy regulation;
• the UK International Data Transfer Agreement;
• the UK Addendum to approved standard contractual clauses;
• another legally recognised transfer mechanism;
• an applicable statutory exception in limited circumstances.

Where required, Elavew will assess whether supplementary contractual, technical or organisational measures are appropriate.

Where a Candidate applies directly to an Employer located outside the United Kingdom, the Employer’s location and recruitment process may result in Candidate information being transferred internationally.

The Employer may be independently responsible for that transfer and should explain its arrangements in its own privacy notice.

Further information about relevant providers and international-transfer arrangements is available in Elavew’s Subprocessors & International Transfers notice.

Individuals may contact Elavew for further information about the safeguards applicable to a particular Elavew-controlled international transfer.

Where a transfer of Personal Data is also subject to the privacy or data-protection law of a supported GCC jurisdiction, Elavew will comply with any additional international-transfer requirements imposed by that law and, where required, apply an appropriate locally recognised safeguard, assessment, authorisation or other lawful transfer mechanism.

Elavew uses appropriate technical and organisational measures intended to protect Personal Data against:

• unauthorised access;
• accidental loss;
• unlawful use;
• alteration;
• unauthorised disclosure;
• destruction;
• account compromise;
• other inappropriate processing.

Depending on the relevant system and risk, these measures may include:

• authentication controls;
• role-based access controls;
• access logging;
• private storage;
• signed or time-limited file-access links;
• encryption in transit;
• encryption or equivalent protection at rest;
• backup and recovery controls;
• security monitoring;
• vulnerability management;
• account verification;
• user-access reviews;
• incident-response procedures;
• staff and contractor confidentiality obligations;
• processor due diligence.

Access to Candidate application materials is restricted to relevant authorised users, service providers and personnel with a legitimate need.

Employers are independently responsible for protecting:

• their login credentials;
• authorised-user access;
• exported or downloaded Candidate information;
• information stored outside the Platform;
• devices used to access the Platform.

Users must:

• use a secure and unique password;
• keep login details confidential;
• log out of shared devices;
• notify Elavew promptly of suspected unauthorised access;
• avoid sharing Candidate information through insecure channels.

No online system can be guaranteed to be completely secure. Elavew will nevertheless take reasonable and proportionate steps to protect Personal Data and respond to identified security incidents.

Where a Personal Data breach occurs, Elavew will investigate and make any notifications required by applicable law.

General retention principle

Elavew retains Personal Data only for as long as reasonably necessary for the purposes for which it was collected or subsequently lawfully processed.

These purposes may include:

• recruitment processing;
• account administration;
• provision of Employer services;
• billing;
• Platform security;
• fraud prevention;
• legal and regulatory compliance;
• dispute management;
• audit;
• business record-keeping.

Elavew determines retention periods by considering:

• the nature of the Personal Data;
• the sensitivity of the Personal Data;
• the purpose of processing;
• applicable legal and regulatory requirements;
• relevant limitation periods;
• security and fraud-prevention requirements;
• the risk of harm arising from continued retention;
• user expectations;
• technical deletion capabilities;
• whether the purpose can be achieved through anonymisation.

Elavew’s role

Elavew acts as an independent controller in relation to processing undertaken for its own purposes, including:

• account administration;
• billing;
• communications;
• marketing preferences;
• Platform security;
• fraud prevention;
• legal compliance;
• service analytics.

Where Elavew processes Candidate application materials solely on behalf of an Employer and in accordance with that Employer’s documented instructions, the Employer will ordinarily act as controller and Elavew will ordinarily act as processor.

Employers may also act as independent controllers when they access, download, assess, retain or otherwise use Candidate information for their own recruitment and employment purposes.

The applicable responsibilities may depend on the particular processing activity and are further addressed in Elavew’s Terms of Service and any applicable Data Processing Agreement.

Candidate application information

Candidate application information may include:

• contact details;
• location;
• employment and education history;
• qualifications;
• CVs or résumés;
• screening-question responses;
• uploaded documents;
• audio or video submissions;
• transcripts;
• AI-generated summaries;
• application status;
• interview communications;
• Employer notes;
• recruitment decisions;
• application-related metadata.

Audio, video and other Candidate submissions may contain or reveal sensitive information, including special-category Personal Data or information relating to protected characteristics.

Elavew applies restricted-access, security, retention and deletion controls to such information.

Elavew does not use audio, video or other Candidate materials to infer or assess a Candidate’s:

• ethnicity;
• religion;
• disability;
• health;
• age;
• sex;
• accent;
• appearance;
• other protected or sensitive characteristics.

Indicative retention periods

The periods below are indicative and may be shortened or extended where reasonably necessary to:

• comply with applicable law;
• respond to a valid data protection request;
• administer a dispute or investigation;
• prevent fraud;
• protect Platform security;
• comply with a documented legal hold;
• comply with an Employer’s lawful instruction where Elavew acts as processor.

For this section, a recruitment process will ordinarily be treated as closed when:

• the Employer closes the vacancy;
• the Employer confirms that the recruitment process has ended; or
• the relevant job listing expires,

whichever occurs last.

Account and data-deletion requests

Candidates may request deletion of:

• their account;
• profile;
• CV;
• application materials;
• uploaded documents;
• media submissions;
• other Personal Data.

Employers may request deletion of:

• their account;
• company profile;
• job listings;
• authorised-user information;
• other Employer Personal Data.

Elavew will assess and action valid requests without undue delay, subject to:

• applicable legal exceptions;
• Employer instructions where Elavew acts as processor;
• legal and regulatory obligations;
• security requirements;
• fraud-prevention requirements;
• billing and tax obligations;
• dispute resolution;
• the establishment, exercise or defence of legal claims.

Employer-held copies

Where Candidate information has already been:

• accessed;
• exported;
• copied;
• printed;
• downloaded;
• transferred

by an Employer, Elavew may be unable to delete copies independently retained by that Employer.

The Candidate may need to contact the relevant Employer directly in relation to those copies.

Inactive accounts

Elavew may periodically review inactive accounts.

Where appropriate, Elavew may:

• contact the account holder;
• request confirmation that the account should remain open;
• provide advance notice of proposed closure;
• close the account;
• delete or anonymise information in accordance with this section.

Limited information may continue to be retained after account closure where justified under this Privacy Policy.

Legal holds

Elavew may temporarily suspend routine deletion where reasonably necessary in connection with:

• actual legal proceedings;
• reasonably anticipated legal proceedings;
• employment-related claims;
• discrimination or equality complaints;
• regulatory investigations;
• law-enforcement requests;
• fraud investigations;
• security incidents;
• payment disputes;
• breaches of the Terms of Service;
• other legal or regulatory matters.

Only information reasonably relevant to the applicable matter will be retained under a legal hold.

A legal hold will be reviewed and released when it is no longer required.

Backups

Personal Data may remain in encrypted or otherwise protected backups for a limited period after deletion from live systems.

Backup information will be:

• isolated from ordinary use;
• retained for disaster recovery, business continuity, security or legal purposes;
• subject to access restrictions;
• deleted or overwritten in accordance with the applicable backup cycle.

Where a backup is restored, Elavew will take reasonable steps to ensure that previously completed deletion requests are reapplied where appropriate.

Secure deletion and anonymisation

At the end of the applicable retention period, Elavew will delete, anonymise or otherwise securely dispose of Personal Data using measures appropriate to:

• the relevant system;
• the type of information;
• the sensitivity of the information;
• the available technical controls;
• the risk associated with continued retention.

This may include deletion or removal from:

• live databases;
• account records;
• object storage;
• CV storage;
• document storage;
• audio files;
• video files;
• thumbnails;
• transcripts;
• generated summaries;
• approved third-party tools.

Anonymised information

Where information is irreversibly anonymised so that an individual can no longer reasonably be identified, the anonymised information may be retained for:

• statistical purposes;
• analytical purposes;
• security purposes;
• service improvement;
• research;
• business planning.

Anonymised information that cannot reasonably be linked to an identifiable individual is not treated as Personal Data.

Retention reviews

Elavew periodically reviews:

• the categories of Personal Data it holds;
• the purposes for which information is retained;
• applicable legal requirements;
• Candidate and Employer expectations;
• technical deletion capabilities;
• third-party provider retention settings;
• backup cycles;
• the effectiveness of deletion and anonymisation processes.

Retention periods may be updated where Elavew's Services, systems, legal obligations, business activities or processing arrangements change.

Material changes will be reflected in this Privacy Policy.

Depending on applicable law and Elavew’s role in the relevant processing, individuals may have the following rights.

Right to be informed

You have the right to receive clear information about how your Personal Data is collected and used.

This Privacy Policy is intended to provide that information in relation to Elavew-controlled processing.

Right of access

You may request:

• confirmation that your Personal Data is being processed;
• access to your Personal Data;
• certain supplementary information about the processing.

This is commonly known as a subject access request.

Right to rectification

You may request correction of inaccurate Personal Data and completion of incomplete Personal Data.

You may be able to update certain account information directly through your account settings.

Right to erasure

You may request deletion of Personal Data in circumstances permitted by law.

The right to erasure is not absolute. Elavew may retain limited information where necessary for:

• legal compliance;
• fraud prevention;
• security;
• billing;
• tax;
• dispute management;
• legal claims;
• another lawful exception.

Right to restriction

You may request that Elavew restrict processing in certain circumstances, including while the accuracy or lawfulness of processing is being considered.

Right to data portability

Where processing is based on consent or contract and is carried out by automated means, you may have the right to receive Personal Data you provided in a structured, commonly used and machine-readable format.

You may also have the right to request transmission to another controller where technically feasible.

Right to object

You may object to processing based on legitimate interests where your particular circumstances justify the objection.

Elavew may continue processing where it demonstrates compelling legitimate grounds or where processing is necessary for legal claims.

Direct marketing

You have an absolute right to object to the use of your Personal Data for direct marketing.

You may unsubscribe by:

• selecting the unsubscribe link in a marketing communication;
• changing your account preferences;
• contacting Elavew.

Withdrawal of consent

Where Elavew relies on consent, you may withdraw that consent at any time.

Withdrawal does not affect the lawfulness of processing undertaken before withdrawal.

Automated decision-making

You may have rights relating to decisions based solely on automated processing that produce legal or similarly significant effects.

Elavew does not currently use its AI-supported recruitment tools to make solely automated hiring decisions on behalf of Employers.

Where an Employer independently uses automated decision-making, the Employer is responsible for explaining that processing and implementing any required safeguards.

Exercising your rights

Requests may be submitted to:

Email: info@elavew.com Postal address: 183-189 The Vale, London, United Kingdom, W3 7RW

Please provide sufficient information to identify:

• who you are;
• the account or application concerned;
• the right you wish to exercise;
• the Personal Data or processing activity involved.

Identity verification

Elavew may request reasonable evidence of identity before disclosing, deleting or changing Personal Data.

This is intended to prevent unauthorised access and protect user information.

Response period

Elavew will respond without undue delay and within the period required by applicable law.

Complex or numerous requests may require additional time where the law permits. Elavew will notify the requester where an extension applies.

Fees and refusal

Rights requests will ordinarily be handled without charge.

Elavew may charge a reasonable fee or refuse to act where a request is manifestly unfounded or excessive, where permitted by law.

Where Elavew refuses a request, it will explain the relevant reason and available complaint rights, subject to applicable law.

Representatives

An authorised representative may submit a request on an individual’s behalf. Elavew may require evidence that the representative has authority to act.

Where Personal Data is controlled by an Employer, the relevant data protection request should ordinarily be directed to that Employer.

This may apply to:

• Employer recruitment notes;
• hiring decisions;
• interview assessments;
• downloaded CVs;
• downloaded documents;
• downloaded media;
• copies exported from Elavew;
• information transferred to an Employer’s internal systems;
• Employer retention after the recruitment process.

Where Elavew receives a request concerning Employer-controlled information, Elavew may:

• refer the individual to the relevant Employer;
• notify the Employer of the request;
• assist the Employer where contractually and legally required;
• respond directly in relation to information for which Elavew is controller.

Elavew is not responsible for an Employer’s independent refusal, delay or failure to comply with its own data protection obligations.

This does not affect any duty Elavew has in relation to processing for which Elavew is controller or processor.

Elavew's account-based and interactive Candidate Services are intended only for individuals aged 18 or over. Persons under 18 may view publicly available pages and job information but may not create a Candidate account, submit an Elavew-hosted application, provide Candidate Materials or use restricted Candidate Services.

Elavew may use proportionate age-assurance measures to enforce this restriction. Where a person indicates that they are under 18, they will not be permitted to create an account, submit an application or continue to use restricted Platform services. Parental, guardian or institutional consent does not override this age requirement.

Personal Data processed for age assurance will be handled in accordance with applicable data protection law, including the UK GDPR and Data Protection Act 2018, and limited to what is reasonably necessary to determine eligibility. Elavew does not use age-assurance information to assess a Candidate's suitability for employment or make it available to Employers for recruitment decision-making.

If Elavew becomes aware that a person under 18 has provided Personal Data or used the Services contrary to this section, Elavew may restrict access and delete or otherwise handle that information as required by applicable law. If you believe Personal Data relating to a person under 18 has been provided to Elavew contrary to this section, please contact us using the details in this Privacy Policy.

Individuals who have concerns about Elavew’s use of Personal Data should contact Elavew first so that the matter can be investigated.

Email: info@elavew.com Postal address: 183-189 The Vale, London, United Kingdom, W3 7RW

Data Protection Complaints

If you have a concern or complaint about how Elavew handles your Personal Data or a request relating to your data protection rights, you may contact us using the details set out in this Privacy Policy.

We will acknowledge your complaint within 30 days, investigate it as appropriate and inform you of the outcome without undue delay.

You may also raise a complaint with the Information Commissioner's Office (ICO) or another competent data protection supervisory authority where applicable. Nothing in this section limits any rights or remedies available to you under applicable data protection law.

Individuals may also have the right to complain to the Information Commissioner’s Office or another competent supervisory authority.

For processing subject to United Kingdom data protection law, the relevant supervisory authority is:

Information Commissioner’s Office

Individuals may use the current complaint and contact methods published by the Information Commissioner’s Office.

Individuals located outside the United Kingdom may also have the right to complain to a supervisory authority or regulator in the country where they live or work, where applicable law provides that right.

Making a complaint does not affect any other legal or judicial remedy available to the individual.

Elavew may update this Privacy Policy where necessary to reflect changes to:

• the Services;
• Platform functionality;
• AI-supported tools;
• service providers;
• data-processing activities;
• retention arrangements;
• applicable law;
• regulatory guidance;
• business operations.

The date at the top of this Privacy Policy shows when it was last updated.

Where a change is material, Elavew may provide notice through:

• the website;
• the Platform;
• account notifications;
• email;
• another appropriate communication method.

Where legally required, Elavew will obtain consent before using Personal Data for a materially different purpose.

Historic versions of this Privacy Policy may be retained for legal, compliance and audit purposes.