GDPR & UK Data Protection

How we comply with UK GDPR and the Data Protection Act 2018

Our commitment

JobPilot UK is built with privacy at its core. We are built to comply with UK GDPR (as retained in domestic law post-Brexit) and the Data Protection Act 2018. Our platform is designed for UK users, and all data processing decisions are made with ICO guidance in mind.

Lawful basis for processing

Processing activity	Lawful basis
Account creation and authentication	Contract performance
Job matching and AI features	Contract performance
Marketing emails	Consent
Platform analytics	Legitimate interests
Fraud prevention	Legitimate interests / Legal obligation
Employer outreach (PECR)	Consent or Legitimate interests (LIA conducted)

Data retention

Active account data: retained while your account is active
Deleted account data: removed within 30 days of deletion request
Application records: retained for 6 months after position is filled
Payment records: retained for 7 years (legal requirement)
Anonymised analytics: retained indefinitely (not personal data)

Your rights under UK GDPR

You can exercise any of the following rights by emailing hello@jobpilotuk.org:

Right of access (Article 15): Request a copy of all data we hold about you
Right to rectification (Article 16): Correct inaccurate personal data
Right to erasure (Article 17): Request deletion of your personal data
Right to restriction (Article 18): Limit how we use your data
Right to portability (Article 20): Receive your data in a machine-readable format
Right to object (Article 21): Object to processing based on legitimate interests

We will respond to all requests within 30 days. No fee is charged for exercising your rights.

The Information Commissioner's Office (ICO)

If you are not satisfied with our response to a data request, you have the right to lodge a complaint with the ICO at ico.org.uk.

Contact our DPO

Data Protection enquiries: hello@jobpilotuk.org
Subject line: “Data Protection Request”