Recruitment Privacy Notice
Curved Stone Limited (trading as Curvestone) Registered in England No. 09249565
Last updated: April 2026
1. Introduction
This notice explains how Curvestone collects, uses, stores and shares your personal data when you apply for a role with us. It applies to all candidates, whether you apply directly or via a third-party platform.
By ticking the confirmation checkbox on our application form, you confirm that you have read this notice.
2. Who is responsible for your data
Curved Stone Limited (trading as Curvestone) is the data controller for personal data collected during recruitment.
Contact:The Data Protection OfficerCurvestone – WeWork, Aviation House, 125 Kingsway, London, WC2B 6NH Email: dpo@curvestone.io
3. What personal data we collect
We may collect and process:
- Identity data: full name, preferred name
- Contact data: email address, phone number, location
- Application data: CV/résumé, cover letter, work history, qualifications, skills
- Assessment data: responses to screening questions, interview notes, test results
- Right to work data: nationality, visa/work permit status (where required by law)
- Referral data: details provided by references, with your prior consent
We do not ask for special category data (e.g. health, religion, ethnicity) as part of our standard hiring process. If you choose to share such information, we will restrict access to it and delete it promptly once it is no longer needed.
4. How we collect your data
We collect data directly from you via our application form. We may also receive data from:
- LinkedIn or other professional platforms
- Referrers or recruiters acting on your behalf
- Publicly available professional profiles
5. Why we process your data and our legal basis
- Evaluating your application and suitability for the role — Pre-contractual steps (Art. 6(1)(b))
- Communicating with you throughout the recruitment process — Pre-contractual steps (Art. 6(1)(b))
- AI-assisted CV screening and scoring — Legitimate interests (Art. 6(1)(f)), see Section 6
- Right to work verification — Legal obligation (Art. 6(1)(c))
- Retaining your details for future suitable vacancies — Consent (Art. 6(1)(a))
Where we rely on legitimate interests, we have assessed that our interests are not overridden by your rights as a candidate.
6. AI-assisted screening
We use an AI-assisted tool to help score and shortlist CVs. The tool analyses your application data against the requirements of the role and produces a scoring output to assist our hiring team.
This does not constitute solely automated decision-making. A member of our team reviews all AI-generated scores before any decision is made about your application. The AI output is one input into the process, not a final decision.
Your application data processed through this tool is not used to train AI models.
If you have questions about how AI screening may have affected your application, contact us at dpo@curvestone.io.
7. Who we share your data with
We share your data only where necessary, with:
- Airtable: cloud-based platform used to store and manage applications
- AI screening tool provider: used for CV scoring (see Section 6). Current provider details available at dpo@curvestone.io
- Internal teams: hiring managers and interviewers within Curvestone, including team members based in Poland
- Regulatory authorities or law enforcement: where required by law
We do not sell your personal data or share it with third parties for marketing purposes.
Where data is transferred outside the UK or EU, we rely on appropriate safeguards, including Standard Contractual Clauses (SCCs), the UK International Data Transfer Agreement (IDTA), or adequacy decisions where applicable.
8. How long we keep your data
- Successful candidates — Data transferred to your employee record and retained per our HR data retention policy
- Unsuccessful candidates — 6 months from the date we notify you of our decision, then securely deleted
- Candidates who consent to future contact — 2 years from the date of consent, unless you withdraw earlier
After the applicable retention period, your data is permanently deleted or anonymised.
9. Your rights
Under UK GDPR and EU GDPR, you have the right to:
- access the personal data we hold about you
- rectification of inaccurate or incomplete data
- erasure of your data in certain circumstances
- restriction of how we use your data
- portability to receive your data in a structured, commonly used format
- object to processing based on legitimate interests
- withdraw consent at any time where processing is consent-based (e.g. future contact). This won't affect anything we've already done lawfully
To exercise any of these rights, contact us at dpo@curvestone.io. We will respond within one calendar month.
10. How to complain
If you are unhappy with how we have handled your data, you can lodge a complaint with the relevant supervisory authority.
UK candidates:Information Commissioner's Office (ICO)Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF Helpline: 0303 123 1113 | www.ico.org.uk
EU candidates (including Poland):You may contact your local supervisory authority. In Poland: Urząd Ochrony Danych Osobowych (UODO) ul. Stawki 2, 00-193 Warsaw | www.uodo.gov.pl
11. Changes to this notice
We may update this notice from time to time. The current version will always be available at the link provided in our application form. We will notify you of material changes where we hold your contact details.
