Privacy notice

1. Who we are

Career26 is operated by Career26 Limited. Career26 Limited is the data controller for personal information processed through career26.com and related services.

For privacy questions or data requests, contact us at zhan@career26.com.

2. Information we collect

Depending on how you use Career26, we may process:

• Account and contact details (name, email address, and similar Cognito account attributes).
• Profile information you choose to provide (education, work experience, interests, and optional diversity information such as ethnicity, gender, school type, first generation status, and date of birth).
• Application and form responses, including CVs and other files you upload.
• Interview data, including video recordings, transcripts, answers, scores, authenticity checks, and employer feedback.
• Academy, summit, ticket, and payment records (including Stripe payment references and receipts).
• Job preferences, saved roles, and in-app activity we record to operate the platform (for example, application clicks or course views).
• Technical and usage data from cookies, signed video-access cookies, and analytics tools where you allow them (see our Cookie Notice).

3. How we collect information

We collect personal information when you:

• Create or manage an account.
• Complete profiles, applications, surveys, or other forms.
• Take part in video interviews, academy courses, summits, or ticketed events.
• Make a payment or claim a ticket.
• Contact us or otherwise use the platform.
• Visit the site, through cookies and similar technologies (essential cookies always, including anonymous analytics; personalised analytics when signed in only with your consent).

4. How we use your personal information

We use your information to:

• Provide and personalise Career26 services (accounts, jobs, events, academy, interviews, tickets, and related features).
• Process applications and share relevant materials with partner employers or programme organisers where that is part of the service you use.
• Run and score video interviews, including AI-assisted analysis of responses and authenticity checks used in shortlisting.
• Send service emails (for example confirmations, interview results, offers, tickets, and responses to data requests).
• Send job newsletters and similar updates where we have a lawful basis (you can unsubscribe).
• Process payments and issue tickets or refunds via our payment provider.
• Analyse product usage, improve features, and keep the platform secure.
• Comply with legal obligations and respond to lawful requests.

5. Legal bases for processing

Under UK GDPR, we rely on one or more of the following:

• Contract - to provide the services you sign up for (account, applications, interviews, academy, tickets, and payments).
• Consent - for personalised analytics when signed in, optional diversity information, and certain marketing where consent is required. You can withdraw consent at any time.
• Legitimate interests - to improve and secure the platform, prevent misuse, understand product usage (where not cookie-based), and communicate about closely related services, balanced against your rights.
• Legal obligation - where we must keep or disclose information to meet UK law.

6. Special category data

Optional diversity profile fields (such as ethnicity or gender) may be special category data under UK GDPR. We only process these fields if you provide them, for equality monitoring and programme insight, on the basis of your explicit consent (or another Article 9 condition where applicable). You can leave these fields blank or select prefer-not-to-say options.

7. AI processing

We use AI models (currently provided by OpenAI) to help analyse interview responses, generate feedback summaries, support authenticity checks, and in limited cases match profile information to event speakers. When we send interview or profile content for analysis, we minimise identifiers: we typically include at most a first or preferred name for context, together with transcripts or answers and role details. We do not send your email address to these models for scoring.

AI outputs are decision-support tools for Career26 and, where relevant, employers. They are not solely deterministic automated decisions that produce legal or similarly significant effects without human involvement in our core shortlisting workflows. Feedback you receive is advisory; see our Disclaimer.

8. Who we share data with

We share personal information only as needed to run Career26, including with:

• Amazon Web Services (AWS) - hosting and storage in the EU (for example Cognito for authentication, DynamoDB and S3 for application, profile, interview, and file data, SES for email, and CloudFront for secured video delivery).
• Willo - our video interview provider. When you are invited to an interview, we share your name and email so Willo can run the session; Willo processes video, transcripts, and related interview content.
• OpenAI - AI processing as described above.
• Stripe - payment processing for tickets and paid products.
• MailerLite - email newsletter delivery (account email and name).
• Heap Analytics - anonymous website analytics under essential cookies; personalised analytics when signed in only if you consent.
• Employers and programme partners - where you apply or take part in an interview, course, summit, or similar opportunity, relevant application, interview, and profile materials may be shared with them for selection and feedback.
• Professional advisers, or authorities, where required by law or to protect our rights.

9. International transfers

Some providers (including OpenAI, Heap, Stripe, MailerLite, and Willo) may process data outside the United Kingdom. Where we transfer personal data internationally, we take steps required by UK data protection law, such as using providers' UK adequacy arrangements, standard contractual clauses / UK IDTA, or other appropriate safeguards.

10. Data retention

We keep personal information for as long as your account is active and as needed to provide the services you use (including applications, interview recordings and scores, academy records, tickets, and payments), and for longer where required for legal, accounting, or dispute purposes.

We do not currently apply a fixed automated deletion schedule to all account or interview data. If you ask us to erase your data, we will delete or anonymise information we hold in Career26 systems where we are not required to retain it. Some third parties (for example payment providers or email platforms) may retain records under their own legal obligations; we will take reasonable steps to request deletion where appropriate.

11. Your rights

Under UK GDPR you may have the right to:

• Access your personal data and receive a copy.
• Rectify inaccurate or incomplete data.
• Request erasure in certain circumstances.
• Restrict or object to certain processing.
• Data portability, where applicable.
• Withdraw consent where processing is based on consent.
• Complain to the UK Information Commissioner's Office (ICO) at ico.org.uk.

To exercise these rights, email zhan@career26.com. We may need to verify your identity before fulfilling a request.

12. Data security

We use appropriate technical and organisational measures to protect personal information, including access controls, encrypted transit where standard for our providers, and signed, time-limited access for private course and interview video. No method of transmission or storage is completely secure; please use a strong unique password and contact us promptly if you suspect unauthorised access to your account.

13. Contact us

Questions, concerns, or requests about this Privacy Notice or our data practices: zhan@career26.com.

14. Updates to this Privacy Notice

We may update this Privacy Notice from time to time to reflect changes in our practices or legal requirements. The date at the bottom of this page shows when it was last revised. Material changes will be indicated on this page or through other appropriate means.