How TalentStore Digital (trading as MashalCareers) collects, uses, stores, and protects your personal data under UK GDPR.
This Privacy Policy explains how TalentStore Digital ("we", "us", "our"), trading as "MashalCareers", collects, uses, stores, and protects your personal data.
We are committed to complying with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
This policy applies when you use the MashalCareers platform by submitting your CV and interacting with our services, or when you contact us. It also explains how we use cookies and similar technologies on our website.
TalentStore Digital Ltd (trading as MashalCareers)
Company Number: SC873333
Email: hello@mashalcareers.com
For the purposes of UK GDPR, TalentStore Digital trading as MashalCareers is the Data Controller responsible for your personal data. If you have any questions about this policy or how we use your data, please contact us using the details above.
We may collect and process the following information:
Your name, email address, telephone number
Account details created when registering to use MashalCareers
Information you upload, including CV, LinkedIn profile, skills, and job preferences
Communications between you and MashalCareers
Usage data (e.g., site interactions, cookie preferences)
Technical data such as IP address, device type, browser type, and security/audit logs
Important: CVs and profiles can sometimes contain sensitive information (for example, health details, religious beliefs, trade union membership, or political opinions). Please avoid including special category personal data unless it is necessary for the service you are requesting.
We process personal data you provide for the following purposes:
To store and refer to your CV for career coaching
To provide career-coaching services
To maintain user accounts and deliver user features
To contact you for annual check-ins
To improve MashalCareers service offering and user experience
For AI-driven features, we use the OpenAI API services. OpenAI acts as a data processor on our instructions.
Your uploaded CVs and associated data may be processed by these AI tools to generate assessments and recommendations.
We ensure that any data sent to OpenAI is not used to train their models or for any other purpose beyond providing the requested service.
By default, OpenAI does not use API customer data to train its models. API prompts/responses may be retained by OpenAI for abuse monitoring for up to 30 days unless configured otherwise.
Our Data Processing Agreement with OpenAI includes confidentiality and data protection obligations, and can be found here: OpenAI Data Processing Addendum.
We rely on the following legal bases under UK GDPR:
Contractual necessity — when providing career consulting and related services (including processing your CV to provide the service)
Legitimate interests — managing platform performance, security, fraud prevention, and responding to enquiries
Consent — for non-essential cookies and optional communications where required by law
You may withdraw consent at any time by contacting hello@mashalcareers.com (this will not affect processing that is necessary to provide the service under contract).
Data are stored solely for the purpose of career coaching through MashalCareers.
Retention rules:
Account Data: Retained for the duration of your account's active status and for up to 30 days after account deletion.
We will check in with users annually to confirm whether they wish to maintain their account and stored CV.
If a user does not respond within 30 days of this annual check-in, their CV and associated personal data will be permanently deleted from our systems.
We may retain limited account, communications, and security/audit log data for longer where necessary for security, legal, or operational reasons.
Deletion from live systems may take place immediately, while encrypted backups may persist for a limited period until they are overwritten or expire.
Marketing Data: Retained until the user opts out or withdraws their consent.
Legal Compliance Data: Retained as required by law.
We implement appropriate technical and organisational safeguards to protect personal data from unauthorised access, use, or disclosure. This includes secure servers, firewalls, encryption, and regular security audits.
Encrypted storage
Strict access controls
Secure authentication
Regular monitoring for vulnerabilities
Encryption is used in transit and at rest where appropriate
Only authorised team members within TalentStore Digital Ltd will have access to user data.
We use OpenAI as a processor. This may involve processing outside the UK. Where required, we use appropriate safeguards such as the UK Addendum to the EU Standard Contractual Clauses or the UK International Data Transfer Agreement (IDTA), and we carry out transfer risk assessments where required.
We will not sell your data. We only share it with vetted service providers who process it on our instructions. Examples include cloud hosting providers, email delivery providers, security/monitoring providers, and our AI processing provider (OpenAI).
We will not make decisions about you that have legal or similarly significant effects solely by automated means.
Under GDPR, all users (both individual users and company representatives) have the following rights:
Right to Access: Request a copy of the personal data we hold about you.
Right to Rectification: Request correction of inaccurate or incomplete data.
Right to Erasure: Request the deletion of your personal data where it is no longer necessary. When you delete your profile, your data will be removed from our active systems within 30 days, and any residual data retained for legal or security reasons will be permanently deleted within two years.
Right to Restriction: Request the suspension of data processing under certain conditions.
Right to Data Portability: Request transfer of your data to another service provider in a structured format.
Right to Object: Object to processing based on legitimate interests, direct marketing, or for research/statistical purposes.
Right to Withdraw Consent: Withdraw your consent at any time if processing is based on consent.
To exercise these rights, email: hello@mashalcareers.com
We will respond within one month and may request proof of identity.
If you request deletion of your data, or fail to respond to an annual check-in within 30 days, your data will be:
Permanently removed from our systems
Confirmed to you via email (where possible)
Not retrievable after deletion
You have the right to lodge a complaint with the Information Commissioner's Office (ICO) if you believe we have not handled your data appropriately.
Information Commissioner's Office (ICO)
Website: ico.org.uk
Phone: 0303 123 1113
Address: ICO, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
We use minimal cookies necessary for site functionality. We do not use third-party advertising cookies or behavioural tracking tools.
Cookies we may use include:
Strictly necessary cookies — required for the website to work
Preference cookies — for example, remembering your cookie choices
Analytics cookies — to understand site usage and improve performance, where enabled
Users can control cookie settings through their browser preferences. Where required, we will also provide a cookie banner or settings tool so you can manage non-essential cookies. For full details, see our Cookie Policy.
We may update this Privacy Policy occasionally. Updated versions will be published on the MashalCareers website.
The "Last Updated" date will always reflect the most recent revision.
For questions, concerns, or data-related requests, contact:
Data Protection Officer
TalentStore Digital trading as "MashalCareers"
Email: hello@mashalcareers.com
Privacy questions? Reach out at hello@mashalcareers.com
© 2026 MashalCareers