Last updated: 10/06/2021
This notice outlines the data we collect on the TotallyLegal website and the TotallyLegal app, how we use it, who it is shared with and why, and how long it is kept.
Who we are :
Reach Work Ltd, Company No. 01904765 ("TotallyLegal")
One Canada Square, Canary Wharf, London, E14 5AP
You can contact us at cs@TotallyLegal.com
What information do we collect?
Profile registration & CV data
If you create an account on TotallyLegal then the minimum data you provide is your email address, first and last name and a password. Additional data which you can choose to add by completing your jobseeker profile includes your location, years of work experience, sector specialism, qualifications, current job title, salary, desired job title, willingness to relocate, availability, eligibility to work in the UK, driving licence, as well as your CV and cover letter.
IP address data
We also collect IP address data; this is a unique number assigned to each individual computer on a network.
Site activity data
We collect job application data (the roles you’ve browsed and applied for), your marketing preferences, and job alert emails created.
We collect statistical, aggregated data about all our site visitors to help monitor site performance.
We track the user journey of logged-in site visitors in order to better understand the lifecycle of our audience, and how the features and functions of the site are used in order to improve our services. Data will be retained until you remove your account with us, or request its deletion, at which point that data will be anonymised.
We also collect information by using cookies.
For more information on cookies and how we use them, see https://www.totallylegal.com/staticpages/10281/cookie-notice/
Why is data being collected?
Primarily we collect data to deliver a better, more relevant jobseeker experience.
We collect profile and CV data to save you time when applying for jobs, to tailor the types of jobs we might send in email marketing campaigns (if you have opted to receive them) and so that recruiters and employers who have been granted access to our CV database are able to headhunt you for relevant jobs (if you have opted to set your profile and CV to “visible” in your profile).
The statistical, aggregated data we collect is used to inform business decisions on how to improve the jobseeker experience, as well as to share top level data to clients (e.g. total site visitors each month).
What is the legal basis for processing your personal information?
We rely on your consent for all promotional messages via email, whether that is a newsletter or job alert by email. You can unsubscribe from these emails at any time, either by clicking on the “unsubscribe” link in the footer of the email, or by updating your marketing preferences within your TotallyLegal profile. If you need any assistance please contact cs@TotallyLegal.com
TotallyLegal may process data when it is in our legitimate interests to do so in operating our business. These include:
- Personalising website content and emails (e.g. making job recommendations based on your browse history data, reminder emails to apply for jobs before they expire) to improve your job search experience.
- Sharing your CV with an employer or recruiter to progress or complete your job application.
TotallyLegal may process your data to comply with legal and regulatory obligations (e.g. investigating fraudulent activity, working with law enforcement agencies).
How will it be used?
We use data for the following purposes:
- To fulfil our contractual obligations to our clients who are advertising their job vacancies through our services (i.e. share job application details and the application CV)
- To personalise your job search experience on the TotallyLegal website through on-site job recommendations, site banners and through our emails.
- To send you marketing communications in line with your marketing preference data, including newsletters and job alerts by email.
- To understand and improve the user journey on our website.
Who will it be shared with?
If you have opted to upload your CV and set it to “visible” then recruiters and employers who have an agreement with us may view your CV and contact you about jobs which they consider match your experience. We ask recruiters to only retain your CV for as long as necessary and not to use it for purposes other than recruitment.
We work with various service providers to ensure that you receive the best possible job seeker experience, and as such we may share some of your data with them for the purpose of providing our services. Any service provider who processes your data in order to deliver a relevant service to us is governed by strict contractual restrictions to ensure that they comply with data privacy and protection requirements, and this extends to them agreeing not to share your data with anyone else, and not retaining it longer than is necessary. The service providers are as follows:
TotallyLegal uses Google Analytics and Lead Feeder tagging to collect data on website activity. If you would like to opt-out of Google Analytics monitoring your behaviour on our sites please use this link (https://tools.google.com/dlpage/gaoptout/)
Google Analytics data will be retained until you remove your account with us, or request its deletion, at which point that data will be anonymised.
TotallyLegal uses Fresh Relevance, a real-time marketing system, to allow us to deliver relevant jobs to candidates on both the website and through email.
The data captured by Fresh Relevance is behavioural, not personal data. Sensitive data such as passwords are not stored by Fresh Relevance. The personal data is limited to email address and perhaps first and last name where this is provided.
Multiposter Job Posting Platforms
Multiposters are job posting platform providers whose software allows recruiters and employers to post their job adverts in one place and distribute the advert to multiple job boards in one step. All application data is returned to the multiposter platform, including the CV of the applicant.
Some of our clients choose to post their vacancies using multiposter software. Currently TotallyLegal integrates with the below multiposter platforms.
- Broadbean (https://www.broadbean.com/uk/privacy-policy/)
- Logic Melon (https://logicmelon.com/privacy)
- Idibu (https://www.idibu.com/privacy/)
Multiposters are contractually restricted from selling or disclosing personal information of candidates.
How long is it kept for?
We store data for as long as we deem it is required in order to deliver a service to you, that is both useful and still required. As such we will keep candidate profile and CV data indefinitely. Candidates can return to our sites as their careers progress, using their stored profile and CV to apply for their next job. The professional nature of our audiences means that these job moves are typically a number of years apart.
We have a legitimate business interest in retaining profiles and their associated CVs, to enable candidates to keep track of their job applications and monitor the job market through job alert emails. Candidates have complete control to upload, amend or delete their profile and CV at any time.
What we won’t do with your data
We won’t sell your data or share it with anyone who does not have a legitimate reason for requiring access to it (e.g. a service provider who adds value to your job seeker experience on TotallyLegal)
We won’t supply your data to third parties unless we have your consent to do so or the law requires it.
What you should consider before sharing any personal data with us
Please do not share any personal data that could be considered sensitive, whether in your personal statement, your CV, or job application cover letter. This includes data such as health, date of birth, passport number, bank details and photographs. Whilst we endeavour to ensure the security of all data we hold, it is your responsibility to provide only data which is appropriate to your job search. If you upload data which is considered sensitive, you accept that you do so at your own risk, and that by uploading it you consent to us processing it until you have deleted it.
Your right to access data we hold about you (Subject Access Request (SAR) / Right to be forgotten)
In accordance with EU General Data Protection Regulations (GDPR) you have the right of access to your personal data free of charge, and within one month of receipt of the request.
You have visibility of a lot of that data yourself if you have created a profile on TotallyLegal, as your personal profile data, job applications, job alerts, and views by recruiters are all visible within your own “privacy dashboard”. Here you can access your marketing and privacy settings and with a one-click revoke all data and delete your account.
To delete your account, please follow these steps:
Sign in as a jobseeker. Click on your name on the top right of the page and select ‘Your account’ from the drop down. Click ‘Delete your account’. Enter your password on the pop up to confirm.
When you delete your profile and your CV from TotallyLegal, we do not keep a copy of your data. We are not responsible for how recruiters and employers who have already received or downloaded your CV store your personal details and your CV.
If you would still like to request a Subject Access Request (SAR) then please send an email to firstname.lastname@example.org.
What are your rights under data protection laws?
Here is a list of the rights that all individuals have under data protection laws. They don’t apply in all circumstances. If you wish to use any of them, we’ll explain at that time if they are engaged or not. The right of data portability is only relevant from May 2018.
The right to be informed about the processing of your personal information
The right to have your personal information corrected if it is inaccurate and to have incomplete personal information completed
The right to object to processing of your personal information
The right to restrict processing of your personal information
The right to have your personal information erased (the “right to be forgotten”)
The right to request access to your personal information and to obtain information about how we process it
The right to move, copy or transfer your personal information (“data portability”)
Rights in relation to automated decision making which has a legal effect or otherwise significantly affects you
You have the right to complain to the Information Commissioner’s Office which enforces data protection laws: https://ico.org.uk/. You can contact us using the details below.
Your right to object
You have the right to object to certain purposes for processing, in particular to data processed for direct marketing purposes and to data processed for certain reasons based on our legitimate interests. You can contact us by going to the Contact Us section of our website to exercise these rights.
Do you have to provide your personal information to us?
We’re unable to provide you with our services if you do not provide certain information to us. In cases where providing some personal information is optional, we’ll make this clear.