1. Information we collect
- Identity and contact data, including name, work email, phone number, job title, company and country or region.
- Inquiry data, including company size, workflow requirements and messages submitted through forms.
- Technical and security data, including IP address, browser information, request logs, timestamps and security events.
- Enterprise service data processed under customer instructions, which may include candidate, recruiter, interview, scheduling and audit information.
- Communications and support records when you contact us.
2. Why we use personal data
| Purpose | Typical lawful basis |
|---|---|
| Respond to quote and access requests | Steps requested before a contract and legitimate interests in enterprise sales |
| Operate, secure and diagnose the website | Legitimate interests and legal obligations |
| Provide contracted services | Contract and legitimate interests; processing instructions apply where we act as processor |
| Meet legal, regulatory and record-keeping duties | Legal obligation |
| Send relevant business communications | Consent where required or legitimate interests, with an opt-out in every marketing message |
3. Sharing
We may share data with vetted hosting, infrastructure, communications, security and support providers; professional advisers; regulators or law-enforcement bodies where legally required; and a business purchaser during a properly controlled corporate transaction. We do not sell personal data.
4. International transfers
Some suppliers may process data outside the United Kingdom. Where required, we use an adequacy regulation, the UK International Data Transfer Agreement, the UK Addendum to approved standard contractual clauses, or another lawful safeguard. Contact us for information about applicable safeguards.
5. Retention
- Quote and enterprise-access inquiries: normally up to 24 months after the last meaningful interaction.
- Website security logs: normally up to 90 days, unless required longer for an investigation.
- Contract, invoicing and compliance records: normally up to 7 years where legally or operationally necessary.
- Support communications: normally up to 3 years after closure.
- Customer-controlled recruiting data: according to the customer agreement, documented instructions and deletion schedule.
6. Your rights
Depending on the circumstances, you may have rights of access, rectification, erasure, restriction, portability and objection. Where processing is based on consent, you may withdraw consent at any time. The right to object to direct marketing is absolute.
Send requests to [email protected]. We may need to verify your identity. You may also complain to the UK Information Commissioner’s Office at ico.org.uk.
7. Automated decision-making and recruitment
The public website does not make solely automated decisions with legal or similarly significant effects. Tymivo is designed to coordinate recruiting operations, not to autonomously hire, reject or advance candidates. Enterprise customers remain responsible for lawful use, candidate notices and human decisions. See our AI transparency notice.
8. Security
We apply technical and organisational measures appropriate to risk, including access controls, encryption where appropriate, audit logging and restricted production access. No internet service can promise absolute security.
9. Children
The website and enterprise service are not directed to children. We do not knowingly solicit public-site inquiries from anyone under 18.
10. Changes
We may update this notice when our services, suppliers or legal obligations change. Material changes will be highlighted where appropriate.