This policy explains how Talana Labs Ltd processes the personal data of people who apply for a job through talanalabs.com. We process personal data in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and, where it applies, the EU General Data Protection Regulation (GDPR).
1. Who is responsible for your data
The data controller is Talana Labs Ltd, a company registered in England and Wales, 167-169 Great Portland Street, Fifth Floor, London W1W 5PF, United Kingdom (the “Company”, “we”).
For any question about this policy or your personal data, contact us at hello@talanalabs.com.
2. What personal data we collect
When you send an application or a CV through the form on our website, we collect:
- identification and contact data: first and last name, email address, phone number;
- your CV (PDF) and the information it contains, such as work experience, education and skills;
- a link to your portfolio, GitHub, LinkedIn or another profile, if you provide one;
- your cover letter, if you provide one;
- the position you applied for, the date of your application and the language version of the site you used.
We also process limited technical data to keep the form secure: your IP address and the time of submission (used for rate limiting and spam protection, kept in server memory for no longer than 24 hours and not linked to your application) and standard web server logs (IP address, requested page, time, browser type), kept for no longer than 14 days.
When you browse the website, Yandex Metrica (see section 10) collects usage data: pages visited, clicks, scrolling and mouse movements, session recordings, approximate location derived from your IP address, device and browser information, referrer and cookie identifiers.
Please do not include special category data (for example, information about your health, ethnic origin, religious or political beliefs) in your CV or cover letter. We do not need it to assess your application.
3. Why we use your data and our legal basis
- Assessing your application for the position you applied for and communicating with you about it (interviews, feedback, our decision). Legal basis: steps taken at your request before entering into a contract (Art. 6(1)(b) GDPR / UK GDPR) and your consent (Art. 6(1)(a)).
- Considering you for future openings if you send a CV without choosing a position, or if your application is not successful but your profile may fit another role. Legal basis: your consent (Art. 6(1)(a)).
- Protecting the website and the form from spam, fraud and abuse. Legal basis: our legitimate interest in keeping our systems secure (Art. 6(1)(f)).
- Understanding how the website is used to improve its content and usability (web analytics). Legal basis: our legitimate interest in running and improving our website (Art. 6(1)(f)).
- Establishing, exercising or defending legal claims, if necessary. Legal basis: our legitimate interests (Art. 6(1)(f)).
We do not use your data for marketing, we do not sell it and we do not share it with third parties for their own purposes.
4. Automated processing
Our HR management system may generate AI-assisted summaries of CVs to help recruiters review applications faster. These summaries only support our team: every decision about your application is made by a person. We do not make decisions based solely on automated processing, including profiling, that produce legal or similarly significant effects for you (Art. 22 GDPR / UK GDPR).
5. Who has access to your data
Your application is stored in the HR management system (applicant tracking system) that the Company uses for recruitment. Access is limited to Company staff involved in hiring — HR and the managers responsible for the position — and to the people who maintain the system.
We use carefully selected service providers acting as data processors on our behalf, under written agreements that require them to protect your data and use it only on our instructions:
- the provider of our HR management system;
- our hosting provider (the website server is located in the Netherlands, EU);
- network and security providers that deliver and protect traffic to our systems;
- Yandex LLC (Russian Federation), the provider of the Yandex Metrica web analytics service.
We may disclose data where required by law or to protect our legal rights.
6. International transfers
Our team and some of our service providers may be located outside the United Kingdom and the European Economic Area. Where your data is transferred to a country that is not covered by an adequacy decision, we put appropriate safeguards in place, such as the European Commission’s Standard Contractual Clauses and the UK International Data Transfer Addendum. Website usage data collected by Yandex Metrica is transferred to and processed in the Russian Federation, which is not covered by an adequacy decision; please take this into account and see section 10 for how to object or opt out. You can request a copy of the relevant safeguards by contacting us.
7. How long we keep your data
We keep your application for the duration of the recruitment process and for up to 3 years after it ends, so that we can consider you for other suitable positions and respond to any questions or claims. After that period your data is deleted or anonymised. If you are hired, the relevant data becomes part of your employee file and is governed by our employee privacy notice. If you withdraw your consent, we delete your data within 30 days unless we are legally required to keep it.
8. Your rights
Under the GDPR and UK GDPR you have the right to:
- access your personal data and receive a copy of it;
- have inaccurate data corrected;
- have your data erased;
- restrict the processing of your data;
- receive your data in a structured, machine-readable format and transmit it to another controller (data portability);
- object to processing based on our legitimate interests;
- withdraw your consent at any time, without affecting the lawfulness of processing carried out before the withdrawal.
To exercise any of these rights, email hello@talanalabs.com from the address you used in your application. We will respond within one month. We may ask you to confirm your identity before acting on your request.
You also have the right to lodge a complaint with a data protection supervisory authority: in the United Kingdom, the Information Commissioner’s Office (ico.org.uk); in the EU, the authority of the country where you live, work or where the alleged infringement took place. We would, however, appreciate the chance to address your concerns first.
9. Security
We protect your data with appropriate technical and organisational measures, including encrypted connections (HTTPS), access restricted to authorised staff accounts and spam protection on the application form.
10. Cookies and analytics
We use Yandex Metrica, a web analytics service provided by Yandex LLC (16 Lev Tolstoy St., Moscow, 119021, Russia). It uses cookies and similar technologies to count visits and understand how the website is used, including click maps and session replay (Webvisor). The contents of the job application form are excluded from session recordings. Yandex processes this data under its own terms: yandex.com/legal/metrica_termsofuse.
You can object to analytics at any time: block or delete cookies in your browser settings, use a tracker-blocking extension, or install the Yandex Metrica opt-out add-on (yandex.com/support/metrica/general/opt-out.html). The website works fully without analytics cookies.
To display fonts, pages also load files from Google Fonts, which means Google receives your IP address in the same way as with any external resource.
11. Changes to this policy
We may update this policy from time to time. The current version is always available on this page, with the date of the last update shown at the top.