Privacy Policy – How CVwerk Handles Your Data (UK)
Transparent information about the collection, processing and protection of your personal data.
1. Privacy at a glance
General information
The following information provides a simple overview of what happens to your personal data when you visit this website. Personal data is any data that can be used to identify you personally. If you are in the United Kingdom, we process your personal data under the <strong>UK General Data Protection Regulation (UK GDPR)</strong> and the <strong>Data Protection Act 2018</strong>; the competent regulator for you is the Information Commissioner's Office (ICO).
Data collection on this website
Who is responsible for the data collection on this website?
The data processing on this website is carried out by the website operator. You can find their contact details in the legal notice of this website.
How do we collect your data?
Your data is collected in part by you providing it to us. This may be, for example, data that you enter into a contact form or during registration.
2. Hosting
This website is hosted by an external service provider (host). The personal data collected on this website is stored on the host's servers. This may include, in particular, IP addresses, contact requests, meta and communication data, contract data, contact data, names, website accesses and other data generated through a website.
The host is used to perform the contract with you (Article 6(1)(b) UK GDPR) and on the basis of our legitimate interest in a secure, fast and efficient provision of our online offering (Article 6(1)(f) UK GDPR).
3. General information and mandatory disclosures
Data protection
The operators of these pages take the protection of your personal data very seriously. We treat your personal data confidentially and in accordance with the UK GDPR, the Data Protection Act 2018 and this privacy policy.
Information about the responsible party
The party responsible for data processing on this website is:
CVwerk
Email: info@cvwerk.com
Storage period
Unless a more specific storage period has been stated within this privacy policy, your personal data will remain with us until the purpose for the data processing no longer applies. If you assert a justified request for deletion or revoke your consent to data processing, your data will be deleted, unless we have other legally permissible reasons for storing your personal data.
4. Data collection on this website
Cookies
Our website uses so-called "cookies". Cookies are small text files and do not cause any harm to your device. They are stored on your device either temporarily for the duration of a session (session cookies) or permanently (permanent cookies).
Server log files
The provider of the pages automatically collects and stores information in anonymized form in so-called server log files, which your browser automatically transmits to us. These are:
- Browser type and browser version
- Operating system used
- Referrer URL
- Host name of the accessing computer
- Time of the server request
- IP address (anonymized)
Registration on this website
You can register on this website to use additional features on the site. We use the data entered for this purpose only for the purpose of using the respective offer or service for which you have registered. The mandatory information requested during registration must be provided in full. Otherwise we will reject the registration.
For important changes, such as to the scope of the offer or for technically necessary changes, we use the email address provided during registration to inform you in this way.
Saved CVs
If you save a CV in your user account, the CV data you enter (e.g. master and contact data, professional history, education, qualifications and optionally a photo) is stored in our database and assigned to your user account. This storage is carried out to provide the storage, editing and retrieval functions you have asked for (Article 6(1)(b) UK GDPR). You may access, edit or delete saved CVs at any time in your account.
PDF downloads and proof logging
When downloading a CV as a PDF, we collect and store log data (such as your IP address, the time of download, file size, email address and confirmation of the acknowledgement of the loss of the right to cancel). This serves as evidence in payment and refund disputes (chargebacks) on the basis of our legitimate interest (Article 6(1)(f) UK GDPR).
Use of Google OAuth for authentication
You can register and sign in on this website with your Google account. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google sends us your name, your email address, your unique Google account ID and, optionally, your profile picture. We store this information solely to identify your account and to let you sign in. We never receive your Google password.
The legal basis is Art. 6(1)(b) GDPR (performance of the user contract). Signing in with Google is voluntary; registration and sign-in with email address and password remain available at any time. We do not pass the data on to third parties, do not use it for advertising, and do not access any other Google data. We do not offer sign-in with Apple or LinkedIn.
In this context personal data may be transferred to Google LLC in the USA. This is based on the EU-US Data Privacy Framework and, in addition, on the EU Standard Contractual Clauses (Art. 46 GDPR). Further information: https://policies.google.com/privacy. The link to your Google account is deleted together with your account; you may request deletion at any time via info@cvwerk.com.
Purpose of processing: we use the data received from Google exclusively to create and manage your user account, for secure authentication and to provide our services (creating application documents and CVs). The data is not passed on to unauthorised third parties and is not used for advertising. It is stored only for as long as your user account exists; you can have your account and the associated data deleted at any time in the account settings or by contacting info@cvwerk.com. Provider of the sign-in service: Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA.
The use and transfer of information received by CVwerk from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. More: https://developers.google.com/terms/api-services-user-data-policy
Use of Microsoft OAuth for authentication
You can register and sign in on this website with your Microsoft account. The provider is Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland. Microsoft sends us your name, your email address, your unique Microsoft account ID and, optionally, your profile picture. We store this information solely to identify your account and to let you sign in. We never receive your Microsoft password.
The legal basis is Art. 6(1)(b) GDPR (performance of the user contract). Signing in with Microsoft is voluntary; registration and sign-in with email address and password remain available at any time. We do not pass the data on to third parties, do not use it for advertising, and do not access any other Microsoft data. We do not offer sign-in with Apple or LinkedIn.
In this context personal data may be transferred to Microsoft Corporation in the USA. This is based on the EU-US Data Privacy Framework and, in addition, on the EU Standard Contractual Clauses (Art. 46 GDPR). Further information: https://privacy.microsoft.com. The link to your Microsoft account is deleted together with your account; you may request deletion at any time via info@cvwerk.com.
Purpose of processing: we use the data received from Microsoft exclusively to create and manage your user account, for secure authentication and to provide our services (creating application documents and CVs). The data is not passed on to unauthorised third parties and is not used for advertising. It is stored only for as long as your user account exists; you can have your account and the associated data deleted at any time in the account settings or by contacting info@cvwerk.com. Provider of the sign-in service: Microsoft Corporation, One Microsoft Way, Redmond, WA 98052, USA.
5. Payment processing via Freemius
To purchase CVwerk Premium, we use the payment service provider and reseller Freemius, Inc. (4023 Kennett Pike, Wilmington, DE 19807, USA). Freemius acts as the Merchant of Record (reseller) and handles the payment process, invoicing as well as the calculation and remittance of VAT.
As part of a purchase, the data required for payment processing is transmitted to Freemius or collected directly by Freemius - in particular:
- Name and email address
- Billing and country details
- IP address
- Payment data (e.g. credit card data)
The complete payment data (e.g. card number) is processed exclusively by Freemius or its payment partners and is not stored by us. We only receive from Freemius the information required to fulfil the contract and for tax verification purposes (e.g. transaction ID, amount, currency, date as well as the assignment to your user account).
The legal basis for the processing is Article 6(1)(b) UK GDPR (performance of the purchase contract) and Article 6(1)(c) UK GDPR (compliance with tax and record-keeping obligations).
Data processing & transfer to third countries: Freemius, Inc. is based in the USA. On purchase, the data required for payment processing is transferred outside the United Kingdom. That restricted transfer is covered by appropriate safeguards – the International Data Transfer Addendum to the EU standard contractual clauses – or by another mechanism permitted under the UK GDPR. You can find further information on data processing by Freemius in their privacy policy.
6. Web analytics and advertising
We use the analytics and advertising services listed below only with your express consent. You grant this via our cookie banner ("Accept all"). Without consent, no analytics or marketing cookies are set and no corresponding data is transmitted to the providers. The legal basis is your consent under Article 6(1)(a) UK GDPR and regulation 6 of the Privacy and Electronic Communications Regulations 2003 (PECR), which governs storing information on, and accessing information from, your device. You can withdraw your consent at any time.
Google Analytics 4
This website uses - with your consent - Google Analytics 4, a web analytics service provided by Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland). Google Analytics uses cookies and similar technologies to evaluate the use of our website (e.g. pages viewed, time spent, approximate location, device and browser). These evaluations help us to improve our offering.
We use Google Consent Mode: as long as you have not given your consent, no analytics cookies are set. A transfer of data to Google LLC in the USA (third country) is possible; it takes place under the same transfer safeguards described above (International Data Transfer Addendum / another permitted mechanism). You can find further information in the Google privacy policy.
Google Ads - conversion tracking
If you have given your consent, we use Google Ads (Google Ireland Limited) with conversion tracking. This allows us to measure the success of our advertisements: if you reach the website via one of our ads and subsequently carry out an action (e.g. a purchase), Google recognises this via a cookie or a click identifier ("gclid"). We only receive statistical evaluations and cannot identify individual users. Google Consent Mode also applies here; without consent, no advertising cookies are set. A transfer to Google LLC (USA) takes place on the basis of the EU standard contractual clauses.
Matomo
In addition, we use - with your consent - the web analytics service Matomo to evaluate the use of our website. Matomo also only becomes active after your consent; without consent, no statistics cookies are set.
7. Your rights
Under the UK GDPR you have the right at any time:
- To obtain information about your personal data stored by us (Article 15 UK GDPR)
- To request the correction of incorrect data (Article 16 UK GDPR)
- To request the deletion of your data (Article 17 UK GDPR)
- To request the restriction of data processing (Article 18 UK GDPR)
- To object to data processing (Article 21 UK GDPR)
- To request data portability (Article 20 UK GDPR)
If you believe that the processing of your personal data infringes the UK GDPR or the Data Protection Act 2018, you have the right to lodge a complaint with the UK supervisory authority, the <strong>Information Commissioner's Office</strong> (<a href="https://ico.org.uk" target="_blank" rel="noopener" class="text-blue-600 hover:underline">ico.org.uk</a>).
8. SSL or TLS encryption
For security reasons and to protect the transmission of confidential content, such as orders or requests that you send to us as the site operator, this site uses SSL or TLS encryption. You can recognise an encrypted connection by the fact that the address line of the browser changes from "http://" to "https://" and by the lock symbol in your browser line.