Privacy policy

Version 1.1, last updated 20 October 2026

1. Who we are

Mentum ("we", "us", or "our") is the data controller responsible for your personal data.

• Contact email: privacy@mentumjobs.com
• Privacy contact: dpo@mentumjobs.com

Aaron Gordon operates Mentum as a sole trader registered in England before launch and is our named privacy lead. We have not designated a Data Protection Officer. Both privacy email addresses above reach Aaron. We review whether a DPO is required as the service grows and at our annual review.

Launch emails (no account needed)

If you ask to hear when Mentum opens, we use your email address, whether you are looking for work or hiring, a campaign tag, timestamps and the version of the consent wording you saw. With your consent, we send an email to confirm your address (sent again if you ask, up to 3 times in all) and 1 when Mentum opens. These are emails you have requested, not a marketing subscription or a soft opt-in. Joining does not create an account.

Supabase stores the list, Railway runs the service and SendGrid sends the emails. Cloudflare Turnstile checks requests where it is enabled. We delete unconfirmed addresses after 7 days, every entry after 6 months of joining, and entries 30 days after we send the launch email, whichever comes first. Use the remove link in either email or your email service's one-click unsubscribe action to withdraw your consent and delete your address. You can also contact us at privacy@mentumjobs.com. Our lawful basis is your consent under UK GDPR Article 6(1)(a); these emails are solicited under PECR.

We use your IP address for abuse prevention and rate limiting. It is held briefly in the rate limiter, sent to Cloudflare when Turnstile is enabled, and not stored with your launch-list entry.

2. Data we collect

We collect the following categories of personal data depending on how you use our platform:

Account data

• Full name, email address, password (stored as a secure hash)
• Authentication identifiers from third-party providers (Google, LinkedIn) if you choose to log in via OAuth

Profile data (candidates)

• Phone number, postcode, profile photograph
• LinkedIn profile URL
• Curriculum vitae (CV), uploaded as PDF, DOCX or RTF
• Work history: job titles, company names, duration, industries
• Education: institution names, qualifications, fields of study, grades, years
• Skills and professional interests
• Availability and scheduling preferences
• Career preferences, notes, and desired/unwanted career paths

Eligibility declarations (candidates)

Many roles have requirements such as a driving licence, a DBS check or a security clearance, a professional registration, a specific qualification, or availability for night, weekend or early-and-late shifts. Against a fixed list of 41 such requirements, you can tell us whether you hold it, do not hold it, are working towards it, or are willing to obtain it. Every answer is self-declared, every question is optional, and each one can be left unanswered.

• What we suggest from your CV. When you save a CV, a fixed set of rules reads its text for the licences, registrations and qualifications on that list, and for whether you have your own vehicle. For example, an HGV licence or NMC registration. We never suggest DBS, BPSS, SC or DV answers from a CV. AI is not used for this reading. Where your CV plainly says you hold one, or are working towards one, and you have not answered that question yourself, we show it to you as a suggestion under Licences and checks on your profile. A suggestion is not an answer. Until you say yes it is not used in your matches, it is not shown to any employer and it is not sent to an AI provider. If you say yes, it becomes your own answer and is used like any answer you gave yourself. If you say no, we remove the suggestion and record no answer, and a CV that says the same thing again does not bring it back. We never suggest a “no” from a CV, we never replace or suggest over an answer you gave, and we do not read shift availability or willingness to travel from a CV.
• What we use them for. We check your declarations against the requirements an employer has marked essential on a job. DBS, BPSS, SC and DV answers never give skill credit. A non-clearance licence or registration you tell us you hold also counts in the match calculation as the skills that stand for it: an HGV Class 1 licence counts as the skill of Class 1 driving. We do not send your answers to an AI provider, and the skills that stand for them are left out of what AI reads about you. The lawful basis is performance of our contract with you under Art. 6(1)(b). For volunteered DBS declarations we also rely on your consent under Schedule 1 paragraph 29 of the Data Protection Act 2018. You can leave them unanswered or clear an answer at any time.
• What they change. Only an explicit “no” against a requirement the employer marked essential hides that job from you, and hides you from that job's employer. No other answer filters anything, and a question you have left unanswered never filters anything.
• What employers see. For the requirements on their own job, an employer sees only Confirmed, In progress or Not confirmed. A “no” reaches them as Not confirmed, which is indistinguishable from a question you never answered. A suggestion from your CV that you have not said yes to is not an answer, so an employer sees that question as one you never answered. Where you tell us you hold a non-clearance licence or registration, the skills that stand for it are shown like any other skill: an employer whose job lists one of them sees it among the skills you match.
• Your control. Your answers are included in your data export, are deleted when you delete your account, and can be cleared back to unanswered at any time from your profile. Suggestions from your CV are in your data export too, listed apart from your answers, and are deleted with your account.

Profile data (employers)

• Company name and profile information
• Job listings including descriptions, salaries, and requirements

Accessibility and inclusion data

• Visa sponsorship requirements, a preference for Disability Confident employers, equal opportunity employer filters, and reasonable adjustments preferences

Equality monitoring data (candidates, optional)

• 9 categorical answers, if you choose to give them: sex, age band, ethnicity, disability, sexual orientation, religion or belief, parental occupation at age 14, free school meals, and first-generation university attendance. Every question defaults to “Prefer not to say” and the whole section can be skipped. We ask for no date of birth, no identifier and no free text. See § 4.

Communication data

• Chat messages exchanged between matched candidates and employers

Documents an employer asks for

An employer hiring for a job can ask you for a document: proof of identity, proof of address, a qualification, a reference or something else they describe. You choose whether to send it, and only that employer can open it. Please don't send a criminal-record certificate. The documents you keep in My Documents for yourself are private to you.

AI-generated data

• Match explanations, career recommendations, Enhanced Insights, and the work-style answers and skills AI suggests for your profile

Technical data

• Authentication tokens, session data, and browser-generated identifiers necessary for platform functionality

3. How and why we use your data

4. Special category data

Accessibility and inclusion preferences

Inclusion preferences are optional. We ask for your explicit consent before we save them, and we protect all 4 as special category data. A need for reasonable adjustments can reveal health information. A preference for Disability Confident or equal-opportunity employers doesn't in itself reveal a protected characteristic, and needing visa sponsorship isn't an Article 9 category, but we protect them the same way.

Your Disability Confident, equal-opportunity and reasonable-adjustments preferences move employers with those commitments up your list. If you tell us you need visa sponsorship, jobs that explicitly rule it out leave your list and you leave those employers' candidate lists for those jobs. Jobs that do not state a sponsorship position stay visible. Your explicit permission covers that two-way decision under Article 22B(2). Withdrawing inclusion consent clears all 4 preferences and stops their use. You can ask a person to check an exclusion from this settings section.

Equality monitoring (optional, and separate)

Under Settings → Equality monitoring you can answer 9 optional questions about sex, age band, ethnicity, disability, sexual orientation, religion or belief, parental occupation at age 14, free school meals, and first-generation university attendance. Several of these are special category data under Art. 9. Every question defaults to “Prefer not to say”, and you can skip the section entirely.

• Lawful basis. Consent under Art. 6(1)(a), and explicit consent under Art. 9(2)(a) for the special category answers. This is a separate consent from the accessibility and inclusion consent above and from every other consent we ask for: we record it as its own consent, and you have to tick it before we can save a single answer.
• What it is for. Helping an employer review grouped recruitment outcomes on jobs they post on Mentum.
• What it never affects. Your answers, your refusal to answer, and your withdrawal never reach matching, scoring, your profile as an employer or adviser sees it, shortlisting, or any AI prompt. Declining costs you nothing: no match, application or interview is affected.
• Who receives it. Only suppressed aggregate counts, and only to owners, recruiters and hiring managers at the company whose job you matched with. They never see an individual answer, and they are not told whether any particular person answered. Groups below 5 people and stages below 10 are withheld, along with the further figures needed to stop a withheld group being worked out by subtraction. A withheld figure is not a zero.
• How long we keep it. Answers stop counting towards reports 24 months after you last saved them, and are then deleted.
• How to withdraw. Turn the consent off in Settings. Your answers and the private token that links them to you are erased immediately, and deleting your account does the same. A report an employer has already downloaded cannot be recalled.

We keep the answers apart from your profile, linked only by a random private code that no one using Mentum can read. Our Equality Statement § 3.4 describes the separation in full, and we keep a voluntary appropriate policy document for this consent-based processing. We do not rely on Schedule 1 paragraph 8 to continue after withdrawal. Ask privacy@mentumjobs.com for a copy.

5. Who we share your data with

Matched employers

When you're matched with a job posted on Mentum, that employer can see your profile, but not your name, photo, contact details or current employer until you say yes to one of its jobs. In Who can see you you can also hide your name, photo, contact details, past employers and schools, and choose whether employers can see you before you say yes.

Right-to-work and DBS checks an employer records

After you and an employer both say yes to the same job posted on Mentum, the employer can record a right-to-work check or a DBS check on Mentum. We keep the check method or DBS level, the result, the check and expiry dates, who at the employer did the check and, for a DBS check, the certificate number. We don't keep notes about a check. Please don't upload a criminal-record certificate to Mentum. Show it to the employer instead, so they can record its number. If the employer used an online share code, we delete the code as soon as they settle the check, and a code that's never settled is deleted after 30 days.

The employer is in charge of these records, and we keep them on its instructions. Only the people at that employer who work on hiring can see them, after you have said yes to that job. They become due for deletion 6 months after the hiring process for that job ends. A passed right-to-work check is kept until 30 days after its expiry date if that is later. Our nightly clean-up can take longer when there's a lot to delete. The employer keeps its own legal evidence of the check separately. Your job page tells you when a check was recorded and on what date. To see the full record or ask for a correction, use “Ask us about your data” in Account Settings, under “AI and your data”, or email privacy@mentumjobs.com.

Third-party service providers

The complete sub-processor list includes the contractual transfer mechanism and external attestations for each vendor. It is published at /legal/subprocessors.

We do not sell your personal data to any third party. We do not share your data with advertisers.

People named in job adverts

Job adverts we receive from job sites sometimes name a recruiter or hiring contact. We remove email addresses before we store an advert, but a person's name may stay in it. We use it only to show the advert, under our legitimate interest in running a job board. Contacting each person named would take disproportionate effort, so we rely on Article 14(5)(b) and give this notice instead. To ask us to remove a name, email privacy@mentumjobs.com with the advert link and the name, and we'll respond within one calendar month.

6. International data transfers

Several of our third-party service providers process your data outside the United Kingdom and European Economic Area, principally in the United States. The processors involved, their locations, and the data each receives are listed in the table in Section 5 above (and, in full, at /legal/subprocessors). Where such a transfer occurs, we ensure appropriate safeguards are in place, including:

• Standard Contractual Clauses (SCCs) approved by the UK Information Commissioner's Office
• UK International Data Transfer Agreement (IDTA) where applicable
• Supplementary technical measures including encryption in transit (TLS 1.2+) and at rest

7. How long we keep your data

The table below summarises how long we keep your data. For each type of record, when its retention period starts and how it is deleted, see Mentum's Data Retention Schedule.

For erasure-window and statutory-carve-out detail (consent records retained for 7 years, breach register retained indefinitely), see §§ 8 and 9 of the Data Retention Schedule.

8. Your rights

Under the UK GDPR and Data Protection Act 2018, you have the following rights:

• Right of access (Art. 15). Request a copy of the personal data we hold about you
• Right to rectification (Art. 16). Ask us to correct inaccurate or incomplete data
• Right to erasure (Art. 17). Request deletion of your personal data ("right to be forgotten")
• Right to data portability (Art. 20). Receive your data in a structured, commonly used, machine-readable format
• Right to restrict processing (Art. 18). Ask us to limit how we use your data
• Right to object (Art. 21). Object to processing based on legitimate interest
• Rights related to automated decision-making (Arts. 22A to 22D). See section 9 below

9. Automated decisions and AI

Your match is a calculation over your profile. AI suggests some entries, including culture answers and skills read from your CV. You can see and change each one. AI also writes explanations and career guidance. Employers make every hiring decision.

We assess automated decisions under UK GDPR Articles 22A to 22D. We treat the eligibility and visa gates as significant decisions on a conservative reading: an explicit No to an essential requirement, or your need for sponsorship where a job explicitly refuses it, can remove an opportunity in both directions. The visa decision relies on your explicit consent under Article 22B(2).

Article 22C gives you safeguards: information about the decision, a way to give your views, human intervention and a way to contest it. Use “Ask a person to check” on a match, on Licences and checks, or in inclusion preferences. You can question an exclusion without an existing match or AI consent, about a named job or your search as a whole. We give you a written response. Our target is acknowledgement within 5 working days and an outcome within one calendar month. You can also email privacy@mentumjobs.com.

The AI Transparency Notice explains the other rules, including score and skill floors, the advert's minimum fit and title words you choose to leave out.

10. Cookies

By default we use strictly essential cookies only, to keep you logged in and maintain your session security. We offer an optional first-party analytics preference that is off by default: if you enable it in Cookie Settings, product-usage events are sent only to Mentum's own backend. No events go to a third-party analytics provider. We use no third-party analytics or marketing cookies. For the full per-key record and to change your choice, see our Cookie Policy.

11. How to exercise your rights

You can exercise your data rights in the following ways:

• In-app settings: Update your profile, privacy preferences, and notification settings directly in your account
• Account deletion: Use the account deletion feature in your settings to permanently erase your data
• Data export: Download your data in a portable format from your settings
• Email: Contact us at privacy@mentumjobs.com for any data rights request. We will respond within one month of receiving your request, as required by UK GDPR Art. 12(3).

We may ask you to verify your identity before processing your request to protect your data from unauthorised access.

12. Complaints

To complain about how we use your personal data, email privacy@mentumjobs.com or send a support request in the app. Aaron Gordon, our privacy lead, looks into every complaint and keeps you updated. We aim to acknowledge your complaint within 5 working days, and the law gives us 30 days at most. We aim to give you the outcome within one calendar month, and if it will take longer we'll tell you why and when to expect it. If you're unhappy with our answer, you can complain to the Information Commissioner's Office (ICO):

• Information Commissioner's Office (ICO)
• Website: ico.org.uk/make-a-complaint
• Telephone: 0303 123 1113
• Address: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF

13. Changes to this policy

We may update this Privacy Policy from time to time. When we make material changes, we will:

• Update the "Last updated" date at the top of this page
• Notify you via email and/or an in-app notification
• Where required by law, seek your renewed consent

Related: Terms of Service | Cookie Policy