Privacy Policy
At CVMatch, we recognize the importance of protecting your personal information. This Privacy Policy explains how we collect, use, store, protect, and manage personal data when you access or use our CV-matching platform.
CVMatch is designed to process CVs and job descriptions for matching purposes only. The original CV file is not intended to be retained after text extraction. Extracted text, submitted job descriptions, and analysis results may be stored to provide scan history and related account features. See the sections below for the details and retention rules that apply.
1. Introduction
This Privacy Policy applies to the CVMatch website, platform, tools, and related services ("CVMatch", "we", "our", or "us").
CVMatch helps users compare CVs or resumes against job descriptions. The Platform may extract text, identify skills and keywords, classify terms, calculate matching scores, and display analysis results.
This Policy is intended to explain our personal data practices in a clear and transparent manner and to support compliance with applicable data protection laws, including the Kenya Data Protection Act, 2019, and its regulations where applicable.
By using CVMatch, you acknowledge that you have been provided with this Privacy Policy. Where consent is the appropriate legal basis for a particular processing activity, we will seek consent as required by law.
2. Who We Are and Our Role
CVMatch is operated by:
Legal Name: [Insert Legal Name]
Platform: CVMatch
Website: https://[your-domain]
Contact Email: [Support Email]
Privacy Contact: [Privacy Contact Email]
Address: [Insert Business Address, if applicable]
A data controller is a person or organization that determines the purposes and means of processing personal data. A data processor processes personal data on behalf of a controller.
Depending on the activity, CVMatch may act as a data controller for account information and service administration. Third-party providers may act as data processors when they process information on our behalf.
The exact roles of each provider depend on the services and arrangements in place.
3. Personal Information We Collect
We collect and process information that is necessary to provide, secure, and improve CVMatch, subject to applicable law.
3.1 Account and Registration Information
This may include:
- Full name.
- Email address.
- Username or account identifier.
- Password credentials stored in protected form.
- Phone number, if requested or provided.
- Account preferences and settings.
- Account creation and relevant activity dates.
3.2 CV and Resume Information
When you submit a CV or resume, it may contain personal information such as:
- Name and contact details.
- Employment history and work experience.
- Education and qualifications.
- Skills, certifications, and professional achievements.
- Other information you choose to include in your CV.
CVMatch may extract and process text from the submitted document to perform matching and generate results.
3.3 Job Description Information
We process job description text submitted by users. This may contain job titles, employer names, required qualifications, responsibilities, skills, and other employment-related details.
A job description may also contain personal information if the text includes names or contact details. Users should avoid submitting unnecessary personal information about third parties.
3.4 Scan and Analysis Information
Depending on the features used, we may process:
- Extracted CV text.
- Submitted job description text.
- Identified hard skills, soft skills, and other keywords.
- Skill coverage and matching scores.
- Analysis outputs and scan history.
- Scan dates and related account activity.
3.5 Technical and Usage Information
When necessary for service operation and security, we or our service providers may process technical information such as:
- IP address.
- Browser type and version.
- Device and operating system information.
- Login and security events.
- Pages or features accessed.
- Technical error and diagnostic information.
The specific technical information collected depends on the hosting, security, analytics, and other services actually enabled.
3.6 Payment Information
If CVMatch introduces paid features, payment providers may process transaction information. We will explain the relevant payment data practices before or when paid services are introduced.
4. How We Collect Personal Data
We may collect information through the following methods:
4.1 Directly From You
- When you register for an account.
- When you update your profile.
- When you upload a CV or resume.
- When you submit a job description.
- When you contact support or make a privacy request.
4.2 Automatically Through Platform Use
Some technical and usage information may be collected automatically through server logs, security systems, cookies, or similar technologies where enabled.
4.3 Through Service Providers
We may receive information from service providers that support account authentication, hosting, security, payment processing, or other functions, where applicable.
5. How We Use Personal Data
We use personal data for specified and legitimate purposes related to operating CVMatch.
5.1 Account Management
- Create and maintain user accounts.
- Authenticate users and manage access.
- Provide account-related support.
- Manage account settings and preferences.
5.2 CV and JD Matching
- Extract text from CVs and resumes.
- Process submitted job descriptions.
- Identify skills and keywords.
- Classify terms into relevant categories.
- Calculate matching scores and skill coverage.
- Display analysis results.
5.3 Scan History
Where scan history is provided, we may retain extracted text, job description text, and analysis results so users can revisit previous scans.
5.4 Platform Security
We may process relevant information to detect suspicious activity, protect accounts, prevent abuse, investigate security incidents, and maintain the integrity of the Platform.
5.5 Service Maintenance and Improvement
We may use appropriate operational information to diagnose errors, maintain functionality, and improve the reliability and usability of CVMatch.
We will not use identifiable CV or JD content for unrelated purposes unless an appropriate legal basis exists and the use is explained to users as required.
5.6 Legal and Regulatory Obligations
We may process or retain information where necessary to comply with applicable legal obligations, respond to lawful requests, establish or defend legal claims, or protect legally recognized rights.
6. Lawful Basis for Processing
Under the Kenya Data Protection Act, personal data must be processed lawfully, fairly, and transparently. Processing must have an appropriate lawful basis.
Depending on the processing activity and circumstances, CVMatch may rely on one or more of the following bases where applicable:
6.1 Performance of a Contract
Processing may be necessary to provide services requested by users, such as account access, CV analysis, and scan history features.
6.2 Consent
We may rely on consent for specific activities where consent is the appropriate legal basis. Where consent is required, it should be freely given, specific, informed, and unambiguous, and users may withdraw it as provided by law.
6.3 Legal Obligation
Processing may be necessary to comply with obligations imposed by applicable laws or lawful regulatory requirements.
6.4 Legitimate Interests
Where permitted by law, processing may be necessary for legitimate interests, such as maintaining Platform security, preventing misuse, and ensuring reliable operation. Such processing must respect the rights and freedoms of data subjects.
The lawful basis for a particular activity depends on the actual purpose and circumstances. We will not treat this list as a blanket authorization to process personal data for any purpose.
7. How CV and Job Description Data Are Processed
7.1 CV Upload and Text Extraction
When you upload a CV, CVMatch processes the file to extract text for analysis. The original file is intended to be processed temporarily rather than retained as a stored CV document.
After extraction, the application may retain extracted CV text and matching results to support scan history and account functionality.
Extracted CV text is still personal data when it relates to an identifiable person. It is therefore subject to the protections described in this Policy.
7.2 Job Description Processing
Submitted job descriptions are processed to identify role requirements, skills, keywords, and other relevant terms for comparison with the CV.
Job description text may be retained alongside scan history where the feature is available and according to the applicable retention period.
7.3 Matching and Analysis
CVMatch compares relevant information from the CV and JD to produce matching results. These results may include matching scores, skill coverage, detected terms, and categories.
The analysis is intended to assist the user. It is not a definitive judgment of a person's competence or suitability for employment.
7.4 User Responsibility
Users should submit only CVs and job descriptions they are authorized to use. They should avoid including unnecessary sensitive personal information in submitted documents.
9. International Data Transfers
Some hosting or service providers may process or store information outside Kenya, depending on the infrastructure and services used by CVMatch.
Where personal data is transferred outside Kenya, CVMatch will take the steps required by applicable law, which may include ensuring adequate safeguards, relying on an applicable legal mechanism, or obtaining consent where legally appropriate.
The safeguards and locations relevant to actual transfers should be identified in the operational privacy documentation and, where required, explained to users.
You may contact us using the details in this Policy if you have questions about relevant international transfers.
10. How Long We Keep Personal Data
CVMatch retains personal data only for as long as necessary for the purposes for which it was collected, unless a longer retention period is required or permitted by law.
10.1 Original CV Files
The intended design is to process the uploaded CV for text extraction without retaining the original file as part of scan history. Temporary copies, server handling, backups, or technical storage may depend on the actual implementation and hosting configuration.
10.2 Extracted CV Text and Scan History
Extracted CV text, submitted job description text, and analysis results may be retained to provide users with access to previous scans.
Our retention period for this information is: [Insert actual retention period or explain the criteria used to determine it].
10.3 Account Information
Account information may be retained while an account remains active and for any additional period required or permitted for legal, security, or legitimate operational purposes.
10.4 Deletion and Backups
When personal data is no longer required, it will be deleted, anonymized, or otherwise handled in accordance with applicable law and our retention and disposal procedures.
Information in backups may remain temporarily until overwritten or securely deleted according to the relevant backup lifecycle, subject to applicable legal requirements.
11. How We Protect Personal Data
CVMatch takes appropriate technical and organizational measures designed to protect personal data against unauthorized access, unlawful processing, accidental loss, destruction, or damage.
Depending on the system and risks, safeguards may include:
- Access controls and account authentication.
- Secure password handling.
- Restricted access to stored information.
- Secure transmission using HTTPS where configured.
- Software updates and security maintenance.
- Monitoring and investigation of suspicious activity.
- Backups and recovery measures where appropriate.
- Reasonable procedures for data deletion and disposal.
No online service or storage system can be guaranteed to be completely secure. Users should also take reasonable steps to protect their accounts and devices.
12. Your Data Protection Rights
Under the Kenya Data Protection Act, 2019, and other applicable laws, you may have rights in relation to your personal data. These rights include:
12.1 Right to Be Informed
You have the right to be informed about the use to which your personal data is put.
12.2 Right of Access
You may request access to personal data concerning you that is held by CVMatch, subject to applicable law.
12.3 Right to Object
You may object to the processing of all or part of your personal data in circumstances provided by applicable law.
12.4 Right to Correction
You may request correction of false or misleading personal data concerning you.
12.5 Right to Deletion
You may request deletion of personal data in circumstances provided by applicable law, including where data is false or misleading or where deletion rights otherwise apply.
12.6 Other Applicable Rights
Depending on the circumstances and applicable law, you may also have rights relating to restriction of processing, portability, automated decision-making, or withdrawal of consent.
These rights are subject to applicable legal conditions and exceptions. Some requests may not be applicable to every type of information or processing activity.
12.7 How to Exercise Your Rights
To exercise your rights, contact us at: [Privacy Contact Email].
Please describe the request and provide enough information for us to identify the relevant account or data. We may take reasonable steps to verify identity before responding.
We will handle requests within the timelines and procedures required by applicable law.
14. Children's Personal Data
CVMatch is intended for users who have the legal capacity to use the Platform and is not designed specifically for children.
We do not knowingly collect children's personal data in circumstances where doing so would violate applicable law.
Where processing of children's personal data is permitted or required, we will apply the safeguards and requirements prescribed by applicable law, including any required parental or guardian involvement.
15. Automated Analysis and Decision-Making
CVMatch uses automated text analysis to identify skills and keywords, classify terms, and calculate matching scores between CVs and job descriptions.
These outputs are intended to help users review their own CVs and applications. They are not intended to make employment decisions on behalf of employers.
Automated analysis may produce errors, omissions, or classifications that do not reflect the full context of a person's experience. Users should review results before relying on them.
If CVMatch introduces processing that makes decisions about individuals with legal or similarly significant effects, the relevant notices, safeguards, and rights will be addressed as required by applicable law.
16. Personal Data Breaches
CVMatch maintains appropriate procedures to identify, assess, and respond to suspected personal data breaches.
Where a personal data breach occurs, we will assess the incident and take the steps required by applicable law. This may include notifying the Office of the Data Protection Commissioner, affected individuals, or other relevant parties where notification is legally required.
If you believe your personal information has been exposed, misused, or accessed without authorization in connection with CVMatch, contact us promptly using the details below.
17. Questions and Complaints
If you have concerns about how CVMatch processes your personal data, you may first contact us so we can review and address your concern.
You may also have the right to lodge a complaint with the Office of the Data Protection Commissioner (ODPC) in Kenya or another competent supervisory authority, as applicable.
Official ODPC information: Office of the Data Protection Commissioner .
18. Changes to This Privacy Policy
We may update this Privacy Policy to reflect changes in our data practices, Platform features, service providers, or legal obligations.
Where changes are material, we will provide notice through the Platform or another appropriate method where required by law.
The latest version will display its effective date and last updated date.
19. Contact Us
For privacy questions, requests to exercise your rights, or complaints about personal data processing, contact:
Legal Name: [Insert Legal Name]
Website: https://[your-domain]
Support Email: [Support Email]
Privacy Contact: [Privacy Contact Email]
Address: [Insert Business Address, if applicable]
We are committed to handling personal information responsibly and transparently in accordance with applicable data protection laws.