1. Data Controller

Duxier Tax Recruitment ("we", "us") is the data controller for personal data processed through this platform. For data protection queries, contact our Data Protection Officer (see Section 10).

2. What We Collect

• Account data: username and hashed password (we never store plain-text passwords)
• CV data: uploaded CV files (PDF/DOCX) which may contain your name, email, phone number, address, work history, education, and skills
• AI-generated data: summaries, skill extractions, scores, cover letters, and improvement advice
• Usage data: login times, actions performed, IP addresses (for security and rate limiting)
• Consent records: when you consented and to which policy version

3. How We Use Your Data

• To provide AI-powered CV analysis, scoring, and cover letter generation
• To enable recruiters to search and match candidates (contractors only)
• To maintain platform security (login monitoring, rate limiting)
• To process subscription payments via Stripe

4. AI Processing Disclosure

Important: When you upload a CV, the text content is sent to Anthropic's Claude AI API for processing. This includes:

• Generating a professional summary
• Extracting skills as structured data
• Scoring your CV on completeness, clarity, impact, and formatting
• Generating cover letters (when requested)
• Matching candidates to job descriptions (recruiter feature)

Anthropic does not use API data to train their models. See Anthropic's Privacy Policy.

You can opt out of AI processing at any time from your Profile page. Your CV will still be stored and visible but will not be sent to any AI service.

5. Legal Basis (GDPR Article 6)

• Consent (Art. 6(1)(a)): You explicitly consent when registering and can withdraw at any time by deleting your account
• Contract (Art. 6(1)(b)): Processing necessary to provide the CV analysis service
• Legitimate interest (Art. 6(1)(f)): Platform security, fraud prevention, and service improvement

6. Your Rights (GDPR)

You have the following rights, exercisable from your Profile page or by contacting us:

• Access (Art. 15): View all data we hold about you via your dashboard
• Portability (Art. 20): Download all your data as a ZIP file from your Profile
• Rectification (Art. 16): Update your CV by uploading a new version
• Erasure (Art. 17): Delete your account and all data permanently
• Restriction (Art. 18): Opt out of AI processing while keeping your account
• Object (Art. 21): Object to AI profiling via the opt-out toggle
• Withdraw consent: Delete your account at any time

7. Data Storage & Security

• CV files are stored in Cloudflare R2 (encrypted at rest, EU/US regions)
• Database hosted on Railway (PostgreSQL, encrypted connections)
• Passwords hashed with PBKDF2-SHA256 (industry standard)
• All connections encrypted via HTTPS/TLS
• Session cookies: HttpOnly, SameSite=Lax, Secure in production
• Rate limiting on authentication endpoints
• File uploads validated with magic bytes verification

8. Data Retention

• Account data: retained while account is active
• CV files: retained while account is active
• Activity logs: retained for 12 months for security purposes
• On account deletion: all personal data permanently removed within 24 hours

9. Third-Party Processors (Art. 28)

Processor	Purpose	Data Shared
Anthropic (Claude AI)	CV analysis & scoring	CV text content (not stored by Anthropic)
Railway	Application hosting	All platform data (encrypted)
Cloudflare R2	File storage	CV files (encrypted at rest)
Stripe	Payment processing	Payment details (not stored by us)

10. Data Protection Officer

For any data protection queries, rights requests, or complaints:

• DPO Contact: dpo@thepmportal.co.uk
• You also have the right to lodge a complaint with the ICO (Information Commissioner's Office) at ico.org.uk

11. Data Breach

In the event of a personal data breach, we will:

• Notify the ICO within 72 hours (where required under Art. 33)
• Notify affected users without undue delay (where high risk under Art. 34)
• Document the breach, its effects, and remedial action taken

12. Changes to This Policy

We will notify users of material changes via the platform. Continued use after notification constitutes acceptance of the updated policy.

Version 1.0 — Last updated: March 2026