Privacy Policy

Who we are

Cruvo is a talent research and candidate sourcing firm based in London, UK. We research and assess candidates for roles our clients are hiring for; the client decides whom to contact and makes all hiring decisions. For the candidate research database described below, Cruvo is the data controller under UK GDPR: we decide what personal data to collect and why. For data our clients upload or share with us about their own people or processes, we generally act as a processor on their behalf.

Contact for anything in this policy: hello@cruvo.app.

If you are a candidate we have researched

We research professionals for specific, named roles our clients are hiring for. That means we may hold information about you even though you have never interacted with Cruvo. This section explains what we hold, where it comes from, and what you can do about it.

What we collect

• Professional identity: name, current role and company, public professional profile URLs (for example LinkedIn), and headline.
• Career history: previous roles, employers, and dates, as published on public professional sources.
• Inferred professional characteristics, such as seniority and potential suitability for a role, derived from your public career history.
• Business contact details (for example a work email), obtained from licensed B2B data providers, where we or the client engaging us intends to contact you about a role.
• Notes made by our researchers in the course of an engagement.

We do not collect special category data (health, beliefs, ethnicity, and so on) and we do not build profiles for any purpose other than recruitment for specific roles.

Where it comes from

Publicly available professional sources (such as public profile pages, company websites, and press coverage), web search, and vetted third-party providers that license professional profile data.

Why, and our lawful basis

We process this data for one purpose: identifying and assessing candidates for specific roles our clients engage us to source for. Our lawful basis is legitimate interests (Article 6(1)(f) UK GDPR) — our and our clients’ interest in identifying strong candidates for hard-to-fill roles, and candidates’ own interest in being surfaced for relevant opportunities. We have carried out a legitimate interests assessment balancing these interests against your rights, and we limit collection to professional data you have chosen to make public or that is licensed for this purpose.

Who sees it

Shortlists including your profile are shared with the specific client hiring for the role. It is the client — not Cruvo — who decides whether to contact you and who makes all hiring decisions. We also use service providers to operate our platform, including AI providers that assist with evaluating role fit — see the sub-processor list below.

Your rights, including removal

You can ask us at any time to access the data we hold about you, correct it, delete it, or object to us processing it. Email hello@cruvo.app with the subject line “Privacy request”. We may need to verify your identity. We respond within one calendar month.

If you ask to be removed, we delete your records and keep only a minimal suppression entry (an identifier such as your profile URL) whose sole purpose is to prevent our research process from re-adding you in future. Deletion without that record would not be effective.

If you are a client or site visitor

For clients, we process business contact details, account credentials (via our authentication provider), and the content of engagements — role briefs, feedback, and notes — to deliver our services under our engagement terms. For site visitors, we collect only what our cookie policy describes: strictly necessary cookies, no advertising or cross-site tracking.

Sub-processors

We use the following service providers to deliver our services. Providers may use personal data only to provide their services to us — we do not permit any provider, including our AI providers, to use personal data to train their models. Where providers are outside the UK, transfers are safeguarded by the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, alongside each provider’s own commitments.

Retention

We keep candidate data only as long as it serves the recruitment purpose it was collected for, and we review stored records against that purpose. Suppression entries created by removal requests are kept indefinitely, because their purpose is to make removal stick. Client engagement records are retained for the engagement and as required for legal and accounting obligations.

Security

Candidate and client data is held in access-controlled systems, encrypted in transit, with access limited to Cruvo staff who need it for an engagement. Client report access is scoped to the client organisation.

Your rights and complaints

Under UK GDPR you have the right to access, rectify, and erase your personal data, to object to or restrict processing, and to data portability where it applies. To exercise any of these, email hello@cruvo.app. You also have the right to complain to the Information Commissioner’s Office (ico.org.uk), though we would welcome the chance to resolve any concern directly first.

Changes to this policy

We will update this page when our processing changes and revise the date at the top. Material changes to how we handle candidate data will be reflected here before they take effect.