RealCV/src/RealCV.Web/Components/Pages/Privacy.razor

@page "/privacy"

<PageTitle>Privacy Policy - RealCV</PageTitle>

<div class="container py-5">
    <div class="row">
        <div class="col-lg-10 mx-auto">
            <h1 class="fw-bold mb-4">Privacy Policy</h1>
            <p class="text-muted mb-5">Last updated: @DateTime.UtcNow.ToString("dd MMMM yyyy")</p>

            <div class="card border-0 shadow-sm mb-4">
                <div class="card-body p-4 p-lg-5">
                    <h2 class="h4 fw-bold mb-3">1. Who We Are</h2>
                    <p>
                        RealCV is a CV verification service that helps employers verify the employment history
                        and educational qualifications claimed by job candidates. We are the data controller
                        for the personal data processed through our service.
                    </p>

                    <h2 class="h4 fw-bold mb-3 mt-5">2. Information We Process</h2>
                    <p>We process the following types of personal data:</p>
                    <ul>
                        <li><strong>CV Content:</strong> Employment history, educational qualifications, names,
                            job titles, dates of employment/education, and other information contained in uploaded CVs</li>
                        <li><strong>Verification Results:</strong> Information obtained from Companies House,
                            educational institution registers, and other public sources</li>
                        <li><strong>User Account Data:</strong> Email addresses and authentication information
                            for registered users of our platform</li>
                    </ul>

                    <h2 class="h4 fw-bold mb-3 mt-5">3. How We Use Your Information</h2>
                    <p>We use personal data for the following purposes:</p>
                    <ul>
                        <li>Verifying employment claims against Companies House records</li>
                        <li>Checking educational institution accreditation status</li>
                        <li>Identifying timeline inconsistencies in CVs</li>
                        <li>Generating verification reports for our clients</li>
                        <li>Improving our verification algorithms and service quality</li>
                    </ul>

                    <h2 class="h4 fw-bold mb-3 mt-5">4. Legal Basis for Processing</h2>
                    <p>
                        We process personal data on the basis of <strong>legitimate interests</strong> (GDPR Article 6(1)(f)).
                        Our legitimate interests include:
                    </p>
                    <ul>
                        <li>Helping employers make informed hiring decisions</li>
                        <li>Preventing CV fraud and misrepresentation</li>
                        <li>Maintaining trust and integrity in the hiring process</li>
                    </ul>
                    <p>
                        We have conducted a Legitimate Interests Assessment to ensure that our processing is
                        necessary and does not override the rights and freedoms of data subjects.
                    </p>

                    <h2 class="h4 fw-bold mb-3 mt-5">5. Information About Candidates</h2>
                    <p>
                        When an employer uploads a candidate's CV for verification, the candidate becomes a
                        data subject under UK GDPR. In accordance with Article 14, we recognise that candidates
                        have rights regarding their personal data, including:
                    </p>
                    <ul>
                        <li><strong>Right to be informed:</strong> Candidates should be informed by the employer
                            that their CV may be subject to verification checks</li>
                        <li><strong>Right of access:</strong> Candidates may request a copy of any personal data
                            we hold about them</li>
                        <li><strong>Right to rectification:</strong> Candidates may request correction of inaccurate
                            personal data</li>
                        <li><strong>Right to erasure:</strong> Candidates may request deletion of their personal data
                            in certain circumstances</li>
                        <li><strong>Right to object:</strong> Candidates may object to processing based on legitimate
                            interests</li>
                    </ul>
                    <p>
                        Employers using our service are required to ensure appropriate notice is given to candidates
                        about the verification process in accordance with their legal obligations.
                    </p>

                    <h2 class="h4 fw-bold mb-3 mt-5">6. Data Retention</h2>
                    <p>We retain personal data as follows:</p>
                    <ul>
                        <li><strong>Verification reports:</strong> Retained for 2 years from the date of generation,
                            unless earlier deletion is requested</li>
                        <li><strong>Uploaded CV files:</strong> Automatically deleted 30 days after processing</li>
                        <li><strong>User account data:</strong> Retained until account deletion is requested</li>
                    </ul>

                    <h2 class="h4 fw-bold mb-3 mt-5">7. Data Security</h2>
                    <p>
                        We implement appropriate technical and organisational measures to protect personal data,
                        including:
                    </p>
                    <ul>
                        <li>Encryption of data in transit and at rest</li>
                        <li>Secure authentication and access controls</li>
                        <li>Regular security assessments</li>
                        <li>Staff training on data protection</li>
                    </ul>

                    <h2 class="h4 fw-bold mb-3 mt-5">8. Third-Party Services</h2>
                    <p>We may share personal data with the following categories of recipients:</p>
                    <ul>
                        <li><strong>Cloud infrastructure providers:</strong> For hosting and data storage</li>
                        <li><strong>AI service providers:</strong> For CV parsing and analysis</li>
                        <li><strong>Public registries:</strong> Companies House and educational institution registers
                            (publicly available data)</li>
                    </ul>

                    <h2 class="h4 fw-bold mb-3 mt-5">9. International Transfers</h2>
                    <p>
                        Personal data may be transferred to and processed in countries outside the UK. Where such
                        transfers occur, we ensure appropriate safeguards are in place in accordance with UK GDPR
                        requirements.
                    </p>

                    <h2 class="h4 fw-bold mb-3 mt-5">10. Your Rights</h2>
                    <p>You have the right to:</p>
                    <ul>
                        <li>Request access to your personal data</li>
                        <li>Request correction of inaccurate data</li>
                        <li>Request deletion of your data</li>
                        <li>Object to processing based on legitimate interests</li>
                        <li>Request restriction of processing</li>
                        <li>Lodge a complaint with the Information Commissioner's Office (ICO)</li>
                    </ul>

                    <h2 class="h4 fw-bold mb-3 mt-5">11. Contact Us</h2>
                    <p>
                        For any questions about this privacy policy or to exercise your data protection rights,
                        please contact us at: <strong>privacy@realcv.co.uk</strong>
                    </p>
                    <p>
                        You also have the right to lodge a complaint with the Information Commissioner's Office:
                        <a href="https://ico.org.uk" target="_blank" rel="noopener noreferrer">ico.org.uk</a>
                    </p>
                </div>
            </div>

            <div class="text-center mt-4">
                <a href="/" class="btn btn-outline-primary">Back to Home</a>
            </div>
        </div>
    </div>
</div>