Privacy notice

01Who is responsible

Tanveer, Cardiff, United Kingdom. This is a private, non-commercial site: it exists so that employers and recruitment agencies can assess me for a role. Nothing on it is sold, and no data collected through it is used for any other purpose.

For anything in this notice, including a request to see or delete what is held about you, write totanveer@example.com.

02Visiting the public site

The public pages set no cookies at all and run no analytics. Every font and every script is served from this domain, so opening a page makes no request to any other company: no font CDN, no tag manager, no embedded widgets.

The site is hosted by Vercel, which records ordinary server request data, including your IP address, in order to serve pages and defend against abuse. That processing is Vercel's; I do not receive those logs and cannot search them.

03Detailed-record links

The full record — complete contact details, and whichever sections the link is granted — is released only through a private link issued to one agency at a time. Issuing one stores:

• A label and organisation name, so the link can be told apart from others and revoked individually.
• The recipient email address, where the link is set to verify who opens it.
• The sections released, any expiry date and any view limit.
• A SHA-256 hash of the link itself, never the link. A copy of the stored data yields no working link.

The lawful basis is Art. 6(1)(b) and (f) GDPR: the details are needed to take steps at your request before a possible employment relationship, and I have a legitimate interest in controlling who holds my own personal data. Nothing here is used to contact you for any purpose other than the role in question.

04Cookies

Two cookies exist on this site. Both are strictly necessary, they do nothing but keep a session open, and neither is used for analytics, advertising, profiling or tracking across sites.

There is no consent banner, and that is deliberate. Strictly necessary cookies are exempt from the consent requirement under Art. 5(3) of the ePrivacy Directive and § 25(2) TDDDG. A banner offering you a choice would be misleading, because refusing would simply mean the record cannot open. Instead you are told what the cookie does on the page where you choose to open your link, before anything is set, and closing that page sets nothing.

05Access log

When an access link is opened, or an attempt on one fails, a single line is recorded: the time, which link it was, whether it was granted, a coarse client description such asChrome / Windows, and the country reported by the hosting edge.

No IP addresses are stored. Where an address is needed to slow down repeated guessing, it is hashed before it is used as a key and the original is never written down. The log keeps the most recent 300 entries and discards the rest.

06Email

Where a link is set to verify its recipient, a one-time code is emailed to the address the link was issued to. The address you type is only compared against that one; it is not stored anywhere new, and the response is identical whether it matches or not, so the page never reveals who a link belongs to. Codes expire after 15 minutes, work once, and are stored only as a hash.

I also receive a short notice when a link is opened, so that an unexpected opening can be revoked. These messages are sent through Gmail, so Google processes them as it does any other email.

07Who else is involved

Three companies, each doing one job. Some are based in the United States; transfers rely on the EU–US Data Privacy Framework and the standard contractual clauses in their terms.

• Vercel: Hosting and delivery of the site.
• Upstash / Vercel KV: Stores the record, the issued links and the access log.
• Google (Gmail): Sends verification codes and notices.

Nothing is shared with anyone else. No data from this site is sold, and none of it feeds advertising or profiling anywhere.

08How long anything is kept

• Issued links: Until I revoke or delete them. Expired and exhausted links stop working immediately but stay listed until deleted, so the record of what was released remains accurate.
• Access log: The most recent 300 entries.
• Verification codes: 15 minutes, or one use.
• Session cookies: As set out in section 04.

09Your rights

Under Art. 15–21 GDPR you can ask for a copy of what is held about you, have it corrected or erased, have its use restricted, object to it, or receive it in a portable form. Emailtanveer@example.comand you will get an answer within a month.

In practice, deleting an issued link removes everything stored about its recipient, and you are welcome to ask for that at any time, including as soon as a recruitment process ends.

You also have the right to complain to a data protection supervisory authority (Art. 77 GDPR). For this site that is the Landesbeauftragte für den Datenschutz und für das Recht auf Akteneinsicht Brandenburg, or the authority where you live or work.