Your application, and what happens to it.

What we collect

From the form: your name, your email address, a phone number if you give one, the country you would work from, any links you share, what you wrote about the role, your CV, and whether you ticked the box asking us to keep your details on file.

Automatically, to stop the form being abused: your IP address, which is turned into a one-way code the moment it arrives and is never stored or logged in its readable form, and a small cookie called vs_apply that carries a signed timestamp and a puzzle for your browser to solve. That cookie is strictly necessary for the form to work and is not used to track you anywhere.

We keep a record of whether a submission was accepted or refused and why, so that a refusal that turns out to be wrong can be found and fixed. That record carries no name, email address, message or filename.

Why, and on what basis

Reading and assessing your application: our legitimate interests in filling a role with the right person. We do not ask you to consent to this, because consent is the wrong basis for it, and asking would imply a choice that is not really there.

Keeping your details on file for future roles: your consent, given by ticking that box and nothing else. You can withdraw it at any time by writing to us, and withdrawing it has no effect on the role you applied for.

Checking your right to work, if we offer you the job: a legal obligation. We ask for nothing of the kind before an offer.

How long we keep it

Your CV and what you wrote are deleted four weeks after the decision on the role, whichever way it went.

After that we keep a short record of the decision itself for six months: the role, the date, the outcome and the reason. No CV, no message. Six months is how long somebody has to bring a claim about a recruitment decision in the United Kingdom, and destroying our own evidence before that window closes would serve neither of us.

If you ticked the box, we keep your name, contact details, links and CV for twelve months from the decision, and then delete them. We will write to you before we use them for anything.

If you are offered the role and accept, your application becomes part of your employment record and a different retention schedule applies. We will give it to you at that point.

Who else sees it

The people at Valten Studio involved in hiring for the role. Nobody else, and never an external recruiter.

Two processors are involved in getting it to us. Vercel, Inc. hosts the site and stores the CV file in a private blob store that needs our own credentials to open. Formspree, Inc. relays the notification email that tells us an application arrived; the CV itself does not travel through it, only a reference to it.

Both are United States companies and both process data outside the United Kingdom. We rely on their published transfer safeguards. If that is a problem for you, email your application instead and say so, and we will tell you exactly where it sits.

What we never ask

We do not ask about your health or any disability before an offer, we do not ask your date of birth, and we do not ask what you currently earn. Ask us what the role pays at any point and you will get a straight answer.

We do not collect diversity monitoring data. With a team of four, any answer would identify the person who gave it.

If any part of applying would be easier a different way, tell us and we will arrange it. Asking changes nothing about how your application is read.

Your rights

You can ask to see what we hold about you, to correct it, to have it deleted, to restrict or object to how we use it, and to receive a copy you can take elsewhere. Write to contacts@valtenstudio.com and we will act on it. Quote the role you applied for and the date, and it takes us minutes rather than days.

Because your CV is stored under a random key rather than your name, an erasure request is a genuine delete rather than a promise: the file goes, and so does the reference to it.

If you think we have handled your data badly, tell us first and we will answer. You can also complain to the Information Commissioner's Office in the United Kingdom, or to the CNPD in Portugal.

Changes

When the substance of this page changes, the date at the top changes with it.