Version 2026-10-09-r69.
The installation record in the Service supplies this version’s effective date.
HuntMandate Limited ("we", "us") provides HuntMandate. Our business/service address is 71–75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom. Contact privacy@huntmandate.com about personal information.
This notice explains information use; it does not ask for blanket consent. Your agency's administrator accepts the Terms and acknowledges this linked notice. Any consent or other specific permission required for an activity remains separate.
1. Who is responsible
Recruitment businesses decide how they use candidate, client and staff information for recruitment. For work we perform on their instructions, they are the controller and we are their processor. Contact the relevant business about those uses; we will help it respond.
We are controller for our own account administration, security, billing, support and improvement purposes, including shared learning and preparing and reviewing examples under section 4. We must have our own lawful basis and meet our own duties. Agency acceptance does not waive individual rights or supply consent on behalf of candidates, contacts or staff.
2. Information and sources
Information comes from you, your agency and its users, connected accounts, payment and service providers, and sources saved through permitted research. It includes:
- Accounts: names, work emails, agency membership, access roles, sign-in and account records. Job title is not an account field.
- Recruitment: names and contact details, CVs, career history, skills, salary and availability, preferences, notes, permissions, communications, documents and outcomes.
- Work and learning: assignments, targets, fee credit and performance figures, know-how, coach conversations and practice dialogues. Managers see permitted work-performance information. The agency's workforce privacy information should explain its own management uses.
- Audio: recordings and transcripts where enabled and lawfully permitted. Voice-input clips may go to OpenAI for transcription; the app does not retain those clips. Stored call recordings are separate.
- Operations and support: feature and AI use, sign-in history, administrative actions, errors, suggestions and problem reports. A report you choose to send may contain browser details; sign-in logs do not record a device/browser history. Public enquiry forms use temporary network information for abuse prevention.
- Enquiries: when you request a demo or trial, your name, work email, agency, team size, sectors and anything you add, used to reply and set up your trial.
- Billing: billing contacts, Plan, invoices and subscription/payment status. Stripe handles full card details.
Connected sources include selected mailbox content, applicant tracking systems, calls and meetings. Enabled online research may find public professional information, including names, roles, sources and published contact details, which a recruiter can save. Public job sources supply vacancy information. Public availability does not remove data protection rights.
Information needed to identify users, secure access and administer accounts is required for those functions; without it we may be unable to provide an account. Other content and integrations depend on what the agency supplies or enables. Avoid unnecessary sensitive or criminal offence information.
3. Our purposes and lawful bases as controller
| Purpose | Basis and interest |
|---|---|
| Accounts, customer administration and support | Contract where the individual is our contracting customer; otherwise legitimate interests in providing and administering a business service |
| Security, preventing misuse and investigating incidents | Legitimate interests in protecting people, data and the Service; legal obligations where applicable |
| Billing, accounting and necessary records | Contract where with the individual; legitimate interests in administering the business relationship; applicable legal obligations |
| Invitations, service messages and operational notices | Legitimate interests in operating accounts and providing necessary information; contract where applicable |
| Shared Figures, community learning, and preparing and reviewing examples to improve and evaluate the Service and its AI assistance | Legitimate interests in improving recruitment assistance, quality and shared knowledge, only where necessary and not overridden by people's interests and rights |
| Requests, disputes and legal claims | Applicable legal obligations; legitimate interests in resolving issues and establishing or defending claims |
| Marketing to business contacts | Legitimate interests where permitted, with consent where electronic marketing law requires it; marketing objections are honoured |
These are not interchangeable permissions for any use. Legitimate interests require a documented purpose, necessity and balancing assessment. Consent, where required, must cover the activity and can be withdrawn. An employer's contract is not the individual's own contract.
4. Shared learning and prepared examples
Shared learning is a standard part of the Service described in the Terms. We prepare combined figures and selected de-identified examples from records, decisions, outcomes, outreach, know-how and practice. Shared Figures use minimum group sizes. Prepared Examples are individual examples; reducing identifying details does not necessarily make them anonymous. Internal links may remain to support restrictions and erasure.
Authorised platform staff may read prepared wording and privacy/quality review items without separate permission to enter an agency's workspace. Access is limited by role. Other customers do not gain workspace access or access to original records through this process.
External commercial delivery and exports for third-party AI training or evaluation are disabled. Operational AI requests for an enabled feature are separate from those exports. Future external use requires a lawful basis, safeguards, clear information and legally required permissions before activation. The Terms do not give blanket authorisation.
Personal data in prepared material remains protected by law, including applicable objection, restriction and erasure rights. Cancellation does not automatically erase prepared material; retention decisions and requests must address it.
5. AI, profiling and messages
AI helps search, rank and match records, suggest actions, draft outreach and summarise information. This may involve profiling, such as assessing apparent candidate suitability. Outputs may be wrong and need meaningful human review. The Service assists decisions; it is not designed to make solely automated decisions with legal or similarly significant effects. Agencies remain responsible for their decisions and notices.
Recruitment outreach requires authorised approval, including scheduled outreach. Account, billing and service alerts may be automatic. Providers receive content needed for enabled AI or transcription requests. Their retention and use of inputs depend on processing agreements and account settings; accepting our Terms is not consent for a provider to train on personal information.
6. Recipients
Agency users see information according to their roles. Relevant information may go to authorised platform staff, suppliers needed for enabled functions, professional advisers and authorities where lawful. A business sale may involve a successor under appropriate confidentiality and data protection safeguards.
Annex 3 to the Terms lists DigitalOcean for London hosting and Amsterdam backups; OpenAI for AI and transcription; Anthropic and DeepSeek where selected; and Perplexity for enabled company, contact and public professional-profile research. Google Workspace / Gmail API provides platform account and service email delivery and authorised connected-mailbox sending and reply capture. Google receives the addresses, message content and other data needed for these enabled email functions. Microsoft Graph supports authorised Outlook and Microsoft 365 mailbox connections, sending and reply capture. Microsoft receives the addresses, message content and other data needed for these enabled functions. Stripe handles payments under its own privacy terms. Identify any separate recording-storage supplier before use.
Our use of information received from Google APIs is subject to the Google API Services User Data Policy, including its Limited Use requirements. We do not use that information or data derived from it to train or improve general-purpose AI models, build advertising profiles, or create examples shared with other agencies. Authorised assistance within an agency remains subject to its users' permissions.
Routine staff workspace access requires administrator approval and is time-limited and recorded. Account/security administration and prepared-example review are separate. Real external expert participation and commercial data delivery are not currently enabled.
7. International transfers
Information may be processed in the UK, Netherlands, United States and, if DeepSeek is selected, China. Google and its subprocessors may process email data globally, subject to any applicable account-specific data-region commitments and processing terms. Microsoft may also process mailbox data globally under the terms applicable to the connected Microsoft account. Locations and arrangements depend on enabled providers and their account terms; no UK-only location is promised for email.
Before a restricted transfer, we must establish a lawful mechanism, such as adequacy regulations or contractual safeguards with the required data protection test and additional measures. Naming a provider does not establish that protection. Contact privacy@huntmandate.com for applicable arrangements and safeguards, subject to lawful redactions.
8. Retention and deletion
Personal information must be kept only while needed for an identified lawful purpose. Relevant criteria are:
- Agency records: lawful instructions, active service needs, return/export and closure requests, unresolved rights requests and necessary legal holds. The current post-cancellation setting is 90 days: a review point, not automatic deletion or guaranteed workspace access.
- Accounts, audit, security and usage: necessary access administration, incident investigation, evidence of important actions and disputes, subject to continuing-necessity review. Disabling an account does not delete it.
- Billing: accounting/tax duties and payment or legal claims. The system does not automatically delete these records after a fixed number of years.
- Support, feedback and enquiries: the continuing need to resolve or evidence an issue, fulfil a request or improve the Service, subject to rights and necessary retention.
- Prepared Examples: continuing lawful improvement purposes, sensitivity, identification risk, rights requests and whether personal details are still needed. They are not automatically anonymous or exempt from deletion duties.
General automatic expiry is not implemented for these records. Deletion and closure require a deliberate authorised process. That fact does not permit unlimited retention or remove rights.
Encrypted backups, including independent immutable copies, do not expire or overwrite automatically. Erasure must cover live records and backup handling. Where immediate backup deletion is impossible, copies must be protected and put beyond ordinary use pending appropriate disposal; restoration must not return erased data to ordinary use.
Genuinely anonymous statistics and non-personal improvements may be kept without the same personal-data limits. We do not assume that removing names makes information anonymous.
9. Security
Measures include encrypted transport and backups, protected credentials and recordings, separation between agencies, role-based access, platform-console two-step sign-in and administrative logs. The operator performs restore checks; these are not assumed to be automatic. No system guarantees absolute security. Report concerns to privacy@huntmandate.com.
10. Your rights
Depending on the circumstances, you may request access, correction, erasure, restriction or portable data, and withdraw consent without affecting earlier lawful processing.
You can object to legitimate-interest processing for reasons relating to your situation. We must stop unless we establish compelling reasons that override your interests, rights and freedoms, or the processing is needed for legal claims. An objection to direct marketing must be honoured without that balancing exercise.
Contact privacy@huntmandate.com. We may need information to verify identity and locate records. We normally respond within one month; we will explain any lawful extension or adjustment. We help agencies with requests concerning processing on their instructions, and remain responsible for our own uses, including prepared material. Rights requests do not require a paid subscription or acceptance of new Terms.
You may complain to the Information Commissioner's Office (https://ico.org.uk/make-a-complaint/) or another competent authority. You do not have to contact us first, although we welcome the chance to resolve concerns.
11. Cookies and local storage
The Service uses storage for sign-in, security, preferences and reliable operation. Its current design does not use advertising cookies or third-party tracking. Future non-essential tracking requires the information and permissions required by law before introduction.
12. Children
The Service is intended for adult business users. Recruitment records may concern younger people and still require appropriate lawful handling and safeguards. The business-use age limit does not remove their rights.
13. Updates and contact
We will update this notice when practices materially change and provide appropriate notice. An updated notice is not itself consent to a new activity.
HuntMandate Limited, 71–75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom. Privacy: privacy@huntmandate.com. Support: support@huntmandate.com.