Privacy Policy



This Privacy Policy applies between you, the User, and CareerSet Ltd, the owner and provider of this Website. CareerSet takes the privacy and protection of your Data very seriously. This Policy sets out how we collect, use, and safeguard your Data in connection with your use of the Website and our services.

Please read this Privacy Policy carefully. For easy answers to common questions, you can also visit our Privacy Help Centre.

Definitions and interpretation

  1. In this privacy policy, the following definitions are used:

Data

Collectively, personal information that you provide to CareerSet or that CareerSet collects in connection with your use of the Website and our services. This definition incorporates, where applicable, the definitions provided in the Data Protection Laws.

Cookies

A small text file placed on your computer by this Website when you visit certain parts of the Website and/or when you use certain features of the Website. Details of the cookies used by this Website are set out in the clause below (Cookies); see our Cookies Statement.

Data Protection Laws

All applicable laws relating to privacy and the processing of personal Data, including the UK GDPR, the Data Protection Act 2018, the EU GDPR where applicable, and the Privacy and Electronic Communications Regulations 2003.

UK GDPR

The General Data Protection Regulation (EU) 2016/679 as it forms part of UK domestic law, as amended from time to time.

CareerSet, or us

CareerSet, www.careerset.io, www.careerset.com
Registered: CareerSet Ltd, 167-169 Great Portland Street, Fifth Floor, London, W1W 5PF, United Kingdom.

UK and EU Cookie Law

The Privacy and Electronic Communications (EC Directive) Regulations 2003 as amended by the Privacy and Electronic Communications (EC Directive) (Amendment) Regulations 2011.

User or you

Any individual who accesses or uses the Website or CareerSet services.

Website

The Website that you are currently using, CareerSet.io, CareerSet.com, and any sub-domains of this site unless expressly excluded by their own terms and conditions.

  1. In this Privacy Policy, unless the context requires otherwise:
    1. The singular includes the plural and the plural includes the singular;
    2. References to clauses, sub-clauses, schedules or appendices are to those within this Privacy Policy;
    3. A reference to a "person" includes a natural person, company, partnership, trust, government body or other legal entity;
    4. "Including" is understood to mean "including without limitation";
    5. References to any law or regulation include any amendment, modification, re-enactment or replacement of it;
    6. Headings and sub-headings are for convenience only and do not affect the interpretation of this Privacy Policy.

Scope of this Privacy Policy

  1. This Privacy Policy applies only to the actions of CareerSet and Users in relation to this Website and our services. It does not extend to any third-party websites that may be accessed from this Website, including (but not limited to) links to social media platforms or external resources.
  2. For the purposes of applicable Data Protection Laws, CareerSet acts as a data controller where we determine the purposes and means of processing your Data. In some circumstances, we may act as a data processor on behalf of your educational institution or authorised partner and process your Data only on its documented instructions. Where a different privacy notice applies to your use of CareerSet, this will be made available to you through the relevant portal or when you register for the service.

Data collected

  1. The type of Data we collect depends on the CareerSet product you use. As our products are provided through your educational institution or another authorised partner, we only collect the information necessary to deliver the service you access. The categories of Data we may collect are:

a. Account Information

Scope: applies to all users who register with CareerSet.

Name and email address — used to create your account and communicate with you.


Account verification details — such as graduation year, course, faculty, or student number (where required by your educational institution at registration).

b. Application and Profile Content

Scope: applies depending on the product you use and the configuration enabled by your educational institution or authorised partner.

CV content and, where provided, job description content — submitted through documents and job descriptions you upload via ScoreMyCV, ScoreMyCV AI+ or TargetMyCV.


Where enabled by your educational institution or authorised partner, uploaded CV documents may be securely stored within your account to support visual feedback and document highlighting. This storage is optional for ScoreMyCV and is institution-controlled. Where the original CV document is not stored, its content may still be processed as necessary to provide ScoreMyCV AI+. Stored documents are handled in accordance with the retention and deletion provisions set out in this Privacy Policy.


Career Map content — submitted through a role, industry, job description or CV you provide via Career Map.


Cover letter and job description content — submitted through documents and job descriptions you upload via Cover Letter Feedback.


LinkedIn profile content — submitted through profiles, images or other information you provide via CareerSet’s LinkedIn Optimisation tool.


Audio, video and/or text responses, alongside CV and job description content — submitted through CareerSet’s Interview Practice tool.

c. Technical and Other Information

Scope: applies to all users when logging in or submitting information.

IP address — collected when you log in, for security and fraud-prevention purposes.


Other details — provided when completing a form, opening a support ticket, entering information, uploading files, or submitting feedback.

In all cases, Data is collected solely to provide the CareerSet product you are using and is always processed in accordance with this Privacy Policy.

How we collect Data

  1. We collect Data in two main ways:
    1. Data you provide to us – information you actively submit when using our services;
    2. Data collected automatically – information gathered through your interaction with our Website and products.

Data you provide to us

  1. CareerSet collects Data that you choose to share with us, for example:
    1. when registering for an account or logging in to access CareerSet products provided by your educational institution or authorised partner;
    2. when using ScoreMyCV, ScoreMyCV AI+ or TargetMyCV and submitting CVs and, where applicable, job descriptions;
    3. when using Cover Letter Feedback and submitting cover letters and related job descriptions;
    4. when using LinkedIn Optimisation and submitting LinkedIn profile content, such as profile details, images or other information;
    5. when using Interview Practice and submitting audio, video and/or text responses;
    6. when using Career Map and submitting a role, industry, job description or CV;
    7. when contacting us, for example via the Website, email, telephone or post, completing optional surveys, or providing feedback and suggestions.

Data that is collected automatically

  1. When you access the Website, certain Data is collected automatically, namely:
    1. information about your visit — including your IP address, the date, time and frequency of access, and how you use and interact with Website content (used to help us improve functionality, security and navigation);
    2. Data collected via cookies — in accordance with the cookie settings on your browser. For more information about cookies and how we use them, please see our Cookies Statement.

Our use of Data

  1. We collect and process Data only for the purposes of providing career support through our products and services. We do not monetise your Data or use it for any unrelated purposes. Specifically, Data may be used for the following purposes:
    1. to process and analyse application documents, including extracting CV content and structure, assessing machine readability, and providing personalised feedback on your CV, cover letter and LinkedIn profile;
    2. to provide feedback on your interview responses through Interview Practice, helping you prepare for real interviews;
    3. to share usage data and feedback with your educational institution, either directly or via its career centre management system, where applicable, to support personalised career guidance and reporting;
    4. to maintain, improve and further develop our products and services, including internal administration;
    5. to ensure the security of our platform and prevent misuse or unauthorised access;
    6. to comply with legal or regulatory obligations, where required.

Automated features and processing

  1. In relation to automated features and processing within CareerSet products:
    1. CareerSet’s automated scores, checks and feedback are provided for career development and educational purposes only. They do not determine recruitment, admissions or employment outcomes and may not reflect how every employer or recruitment system will interpret submitted content.
    2. CareerSet does not engage in automated decision-making or profiling that produces legal or similarly significant effects on individuals within the meaning of applicable Data Protection Laws.

Lawful bases for processing

  1. We process your Data only where we have a lawful basis to do so. Although use of CareerSet is voluntary, once you choose to use a product, the processing required to deliver its core functionality is generally necessary to provide that service. Depending on the purpose, we may rely on:
    1. performance of a contract — where processing is necessary to provide the CareerSet products and functionality you choose to use, including analysing submitted application, profile and interview content and generating the requested feedback;
    2. legitimate interests — our legitimate interests in maintaining platform security and integrity, providing technical support, carrying out internal administration, and continuously improving our services, provided that these interests are not overridden by your rights and interests;
    3. consent — where you choose to use a genuinely optional feature, or where consent is otherwise required by applicable law; and
    4. legal obligation — where processing is necessary for us to comply with applicable law.

    Where we rely on consent, you may withdraw it at any time. Withdrawing consent will not affect the lawfulness of processing carried out before withdrawal, but it may prevent you from continuing to use the relevant optional feature.

Special category Data

  1. CareerSet does not request or require special category personal Data, such as information about health, ethnicity, religious beliefs or political opinions. If you choose to include such information in content you submit, it may be processed incidentally where necessary to provide the requested functionality and will be subject to the safeguards described in this Privacy Policy.

Who we share Data with

  1. We may share your Data with the following parties, where necessary for the provision of our services:

a. Employees, Agents and Professional Advisors

To enable the effective provision, support and improvement of our services and solutions.

b. Your Educational Institution or Authorised Partner

To provide insights into usage and feedback, supporting personalised career guidance and reporting requirements.


Current partners: educational institutions and other authorised organisations that have entered into a service agreement with CareerSet. The relevant partner may be clear from the dedicated login domain used to access the platform (e.g. careerset.com/institution), or from the invitation or access link provided to you.

c. Career Centre Management System Providers

If integrated by your institution, to ensure efficient and secure storage of student information for service delivery.


Current providers: Group GTI, Symplicity.

d. Hosting and Cloud Providers

To securely host, store and back up Data, and to make our platform accessible via our registered domains.


Current providers: DigitalOcean, AWS.

e. Technical and Security Providers

To provide website security and performance, including processing IP addresses to protect against malicious traffic and ensure service resilience.


Current provider: Cloudflare.

f. AI Technology Providers

To power AI-based and parsing features within CareerSet.


Optional AI features: Optional AI features may be available within ScoreMyCV, TargetMyCV and Cover Letter Feedback, including AI writing suggestions and clearly identified checks such as AI readability and profile photo checks. Availability is controlled by your educational institution or authorised partner, and use is optional. Only the content required for the feature you choose to use is securely transmitted to the relevant AI technology provider for processing.


Core product functionality: AI and parsing technologies also support core functionality within products including LinkedIn Optimisation, Interview Practice, Career Map and ScoreMyCV AI+. When you use these products, relevant content you submit may be securely transmitted to selected AI technology providers for processing. This may include parsing documents or submitted content, extracting text and structure, and generating the requested feedback or analysis. Use of these products is subject to this data sharing, which is necessary to deliver the core functionality.


Current providers: OpenAI and Mistral AI.


Providers process submitted content on our behalf solely to deliver the requested functionality. They do not use it to train or improve their general-purpose models. Depending on the provider and applicable service settings, content may be retained for a limited period for purposes such as security, abuse monitoring and troubleshooting, but is not retained permanently or reused for unrelated purposes.

International data transfers

  1. Where personal Data is transferred outside the United Kingdom, we ensure that the transfer is made in accordance with applicable Data Protection Laws. Depending on the destination, we may rely on applicable adequacy regulations or appropriate safeguards, such as the UK International Data Transfer Agreement (UK IDTA) or the UK Addendum to the EU Standard Contractual Clauses, where required. In each case, Data is shared only to the extent necessary and always in accordance with this Privacy Policy.

Keeping Data secure

  1. We use a combination of technical and organisational measures to safeguard your Data, including:
    1. controlling account access with unique usernames and secure authentication;
    2. storing Data on servers certified to ISO/IEC 27001:2013;
    3. encrypting traffic between your browser and our Website using Transport Layer Security (TLS) over HTTPS;
    4. encrypting Data at rest and maintaining two automated daily backup mechanisms;
    5. protecting systems with advanced web application firewalls, vulnerability monitoring, and regular penetration testing;
    6. scanning the Website regularly for malware, security risks, and vulnerabilities;
    7. restricting access to Data to authorised individuals only, who are required to maintain confidentiality.
  2. We also have procedures in place to detect, respond to and mitigate any suspected Data breach. If you suspect misuse, loss, or unauthorised access to your Data, please contact us immediately at [email protected].
  3. For practical guidance on protecting your own information and devices against fraud, identity theft, viruses, and other online threats, you may visit www.getsafeonline.org. Get Safe Online is a UK not-for-profit organisation supported by public and private sector partners.

Data retention

  1. We retain your Data only for as long as necessary to fulfil the purposes set out in this Privacy Policy, unless a longer retention period is required by law. Temporary content is retained only for as long as required to provide the relevant functionality, while security and operational records are retained in accordance with our internal retention schedules. Specifically:
    1. Feedback reports, which may contain personal information derived from submitted documents, and uploaded CV documents stored where document storage is enabled, are automatically deleted 36 months after the most recent document submission associated with your account;
    2. User account information, such as your name and verification details, is automatically deleted 36 months after your last login;
    3. Your Data may also be deleted earlier if we cease our collaboration with the educational institution or authorised partner that granted you access to CareerSet;
    4. You may request the deletion of stored documents, feedback reports or your account at any time.
  2. Even if your Data is deleted from our active systems, it may continue to exist temporarily in secure backup or archival media where required for legal, tax or regulatory compliance. Such Data is not used for any other purpose and will be permanently erased in accordance with our retention and backup policies.

Your rights

  1. Under the UK GDPR, the EU GDPR where applicable, and the Data Protection Act 2018, you have the following rights in relation to your Data:
    1. Right of access – to request a copy of the Data we hold about you, or to ask that we update or delete such Data. Requests will be free of charge unless they are "manifestly unfounded or excessive". Where legally permitted, we may refuse a request, and if so, we will explain the reasons.
    2. Right to rectification – to have your Data corrected if it is inaccurate or incomplete.
    3. Right to erasure – to request that we delete or remove your Data from our systems.
    4. Right to restrict processing – to limit the way in which we use your Data or to block us from processing it.
    5. Right to data portability – to request that we transfer your Data to another service provider in a structured, commonly used, and machine-readable format.
    6. Right to object – to object to our processing of your Data, including where we rely on legitimate interests as the legal basis for processing.
    7. Right to opt out of communications – to stop receiving emails, notices, or other communications about products and services. You can do this by unsubscribing from communications or by contacting us at [email protected].
    8. Right to close your account – to request that we delete your account and stop using your Data to provide services. Please note this may mean you can no longer access CareerSet solutions.
  2. To make enquiries, exercise any of your rights above, or withdraw your consent (where consent is the legal basis for processing your Data), please contact us at [email protected]. We aim to respond to all requests within one month, in line with legal requirements.
  3. If you are not satisfied with how we handle your Data or a complaint you make to us, you may refer your complaint to the relevant data protection authority. In the UK, this is the Information Commissioner’s Office (ICO), details available at https://ico.org.uk/. If you are based in the EU, you may also contact your local EU supervisory authority.
  4. It is important that the Data we hold about you is accurate and up to date. Please let us know if your Data changes during the period we hold it.

Data aggregation and analytics

  1. We may use information about your use of CareerSet in an anonymised or aggregated form for analytics, service improvement, industry analysis and benchmarking. This information does not identify you, and we will not attempt to re-identify anonymised Data.

Links to other websites

  1. Our Website may, from time to time, include links to external websites. We have no control over such websites and are not responsible for their content. This Privacy Policy does not apply to your use of those websites, and we encourage you to review the privacy policy of any website you visit.

Other disclosures

  1. We may disclose your Data where required by law, regulation or court order, or where reasonably necessary to protect the rights, security or safety of CareerSet, our users or others.
  2. We do not sell your Data or permit it to be used for third-party behavioural advertising.

Changes to this Privacy Policy

  1. CareerSet may update this Privacy Policy from time to time, as we deem necessary or as required by law. Any changes will be posted immediately on the Website, and users will be notified upon their next login. In the case of significant changes, you may be asked to review and acknowledge the updated Privacy Policy.

Contact information

Questions about this Privacy Policy should be sent to [email protected].

CareerSet Ltd is registered with the Information Commissioner's Office (ICO), registration number ZA557721.

For the purposes of Article 27 of the EU GDPR, CareerSet's designated EU representative is Chris Schaap, who can be contacted at [email protected].

Last updated:  20 August 2026