CV Builder privacy

How the CV service uses information

A service-specific explanation for participants, parents, schools and commissioning organisations.

Status

This is the published service summary. The live retention schedule and email-delivery supplier are recorded; the detailed DPIA remains in progress before organised school or council rollout.

Status
Published current summary, DPIA in progress
Owner
Data Protection Lead
Version
1.1 · 4 August 2026
Related
CV Builder DPIA in progress

Purpose of the service

The CV Builder uses information supplied by a user to create, deliver, recover and manage a CV. It is not intended to create an advertising profile or sell participant information.

Information used

Depending on the answers provided, information may include name, email, telephone number, address details, postcode, professional links, experience, skills, confidence levels, qualifications, interests, goals and personal-statement content. Date of birth is not required in the standard CV process.

Service communication

Email needed to deliver a CV, provide a secure return route or respond to a support request is service communication. Optional programme, fundraising or promotional messages must be treated separately and require an appropriate positive choice.

Young users

The service is likely to be used by some people under 18. Privacy information, defaults, support and risk controls should be appropriate to age and context. Organised school or council rollout should not begin until the relevant DPIA and responsibilities have been completed and agreed.

AI position

The participant-facing CV Builder does not expose AI chat, prompts, API keys or direct AI-generated advice. ChatGPT may be used behind the scenes for development and internal drafting, but user-facing information remains based on what the participant supplies.

Hosting and digital services

The CV Builder is delivered through Google Apps Script and associated Google Workspace services. Resend is used to send operational CV delivery and secure return-link emails from the verified mail.thehwbco.com sending domain. The digital-services register identifies the current platforms and the supplier review still required before organised delivery.

Retention and deletion

Inactive CV Builder records are archived after 12 months and permanently deleted after 24 months. A participant can use the secure deletion route or contact privacy@thehwbco.com to request earlier deletion. The schedule will be reviewed if the live service or an agreed school or council arrangement changes.

Optional paid service

The standard CV is free. An optional £5 custom-design service links to Square for payment. Square’s own privacy terms apply to the payment service, and the relationship must be recorded accurately in the final digital-services register.

Your rights

Depending on the circumstances, users may have rights to access, correct, delete or restrict information, object to some processing, or withdraw consent where consent is the lawful basis. Requests can be made through the data-request page.

Privacy controls

Cookie, storage and statistics status

Essential preferences

Language, colour theme, text size and your acknowledgement of this notice. These choices are stored in your browser only.

Active
Aggregate site statistics

IONOS SiteAnalytics may create aggregate statistics through hosting logs or a pixel without analytics cookies. This page can record your objection to any optional analytics controlled by HWB; essential hosting and security logs may still be created by IONOS.

Aggregate only

Objecting stops any optional statistics script that HWB may control now or introduce later. The current website does not load Google Analytics, Meta Pixel or advertising trackers.

Advertising and profiling

No advertising cookies, Meta Pixel, Google Analytics, behavioural profiling or cross-site tracking are used.

Not in use
External media

No YouTube, map, social-media or other third-party embeds load automatically. External services are contacted only after you choose to follow a link.

Not loaded