Privacy Policy

Last updated: 7 August 2026

EXPND ("we", "us", "our") is committed to protecting your privacy. This policy explains how we collect, use, and protect personal data when you use expnd.co.uk (the "Site"), whether you're a candidate ("work-seeker"), a business ("hirer"), or simply browsing.

We are the data controller for the purposes of UK GDPR and the Data Protection Act 2018.

Data controller details:

• Company name: EXPND LTD
• Company number: 17146646
• Registered address: 24 Oswald Road, Chorlton-Cum-Hardy, Manchester, Greater Manchester, M21 9LP
• Contact email: james@expnd.co.uk
• ICO registration number: [ICO REGISTRATION NUMBER — see note below]

Note for James: if you're processing personal data as described here, you likely need to register as a data controller with the ICO (a small annual fee unless exempt). Confirm this and add your registration number above before publishing.

1. What data we collect

If you're a candidate (work-seeker):

• Name, email, phone number, location, timezone
• CV/resume, work history, references
• Sales experience details (role type, industries, ticket sizes closed, appointment/show rates)
• Video introduction, if submitted
• Availability, expected earnings, employment type preferences
• Internal assessment notes and scoring (communication, experience, coachability, etc.) — used only to match you to suitable roles
• Account login details

If you're a business (hirer):

• Company name, owner/hiring manager name, website, industry
• Job listing details (role, salary, commission structure, requirements)
• Hiring history and preferences
• Account login details

For all visitors:

• Basic technical data (IP address, browser type, device type) via standard website analytics
• Cookie data (see our separate Cookie Policy)

2. How we use your data

We use your data to:

• Match candidates with relevant job opportunities, and businesses with relevant candidates
• Communicate with you about applications, placements, and account activity
• Verify identity and conduct reference checks (candidates only, with consent)
• Maintain records required for our regulatory obligations as a recruitment business
• Improve our Site and services
• Send you updates you've opted into (e.g. new roles matching your profile)

3. Legal basis for processing

We process your data under the following legal bases:

• Contract: to provide our recruitment/placement services once you've registered
• Legitimate interest: to match candidates and businesses, and to improve our service
• Consent: for marketing communications and optional data (e.g. video introductions)
• Legal obligation: where required by employment or recruitment law

4. Who we share your data with

• Candidates: your profile (excluding internal scoring/notes) may be shared with businesses you're being considered for. We never share your data with a specific business without your knowledge that you're being put forward for that role.
• Businesses: your job listing is visible to relevant candidates on the Site.
• Service providers: we use third-party providers for hosting, database, and email (Supabase for database and authentication, Vercel for hosting, Brevo for email notifications, Stripe for agency subscription payments, and Calendly for call booking) who process data on our behalf under data processing agreements.
• We do not sell your data to third parties.

5. How long we keep your data

• Active candidate/business accounts: for as long as your account is active plus 2 years after your last activity, so we can re-engage you for future opportunities (talent pool).
• Data related to a completed placement: retained for 6 years to meet our record-keeping obligations as a recruitment agency and for guarantee/replacement purposes.
• You can request deletion at any time (see Section 7).

6. Your rights

Under UK GDPR, you have the right to:

• Access the data we hold about you
• Correct inaccurate data
• Request deletion of your data ("right to be forgotten")
• Object to or restrict certain processing
• Data portability
• Withdraw consent at any time where we rely on consent

To exercise any of these rights, contact us at james@expnd.co.uk. You also have the right to complain to the Information Commissioner's Office (ico.org.uk) if you believe we've mishandled your data.

7. Data security

We use industry-standard security measures, including encryption and access controls, to protect your data. Sensitive documents (CVs, ID verification) are stored securely with access limited to authorised staff.

8. International transfers

Most of your data stays in the UK or the EEA. Where a provider processes it elsewhere, the transfer is covered by appropriate safeguards — UK International Data Transfer Agreements, the UK Addendum to the EU Standard Contractual Clauses, or an adequacy decision — under the terms of our agreements with them.

Where your data is handled:

• Website and application processing (Vercel): London, United Kingdom. Everything you submit through the Site is processed here.
• Database and accounts (Supabase): Ireland. Inside the EEA and covered by an adequacy decision.
• Email notifications (Brevo): France. Inside the EEA and covered by an adequacy decision.
• Payments (Stripe) and call booking (Calendly): United States, under their standard data processing terms. Stripe handles agency subscription billing only — candidates never enter payment details.

You can ask us at any time which providers hold your data and on what basis — see Section 7 for how to contact us.

[A solicitor should confirm this section before launch. The transfer mechanisms named above depend on the current agreements with each provider and on the UK–US data bridge remaining in force.]

9. Changes to this policy

We may update this policy from time to time. We'll post the updated version here with a new "last updated" date.

10. Contact us

Questions about this policy or your data: james@expnd.co.uk