1. Data Controller

The data controller responsible for your personal data is AJ Tech Consulting Services Ltd, a company registered in England and Wales (Companies House No. 17193930), with registered office at 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ. AJ Consulting is a trading name of AJ Tech Consulting Services Ltd.

We are registered with the UK Information Commissioner's Office (ICO) under reference ZC138626.

Privacy enquiries: [email protected]

2. Services Covered

This privacy policy applies to all AJ Consulting services, including:

3. Data We Collect

We collect different types of personal data depending on which service you use:

3.1 Contact Information (All Services)

Data Type	Purpose	Lawful Basis (UK GDPR Art. 6)
Name	Identification and communication	Legitimate interests / Contract
Email Address	Communication and account access	Contract performance
Phone Number	Support communication (optional)	Legitimate interests

3.2 Service-Specific Data

Service	Additional Data Collected	Purpose
Job Search (jobs.aj-consulting.uk)	CV content, employment history, job preferences, payment info	CV tailoring and job matching
Support (support.aj-consulting.uk)	Issue descriptions, device information	Technical support provision
CV Hosting (cv.aj-consulting.uk)	CV content, access codes	CV hosting and access control
E-Signature (sign.aj-consulting.uk)	Signatory name, email address, the signature you provide, and a completion audit trail (IP address, timestamps, and actions taken)	Preparing, sending, executing and evidencing electronically signed documents

3.3 Automatically Collected Data

• IP address and browser information (for security)
• Session cookies for authentication
• Aggregated usage analytics (page views, referrer, country) collected via self-hosted Umami — cookieless, no third-party trackers

4. Lawful Basis for Processing

Under UK GDPR Article 6, we rely on the following lawful bases:

• Contract: to deliver a service you have requested or signed up to (e.g. processing an order, hosting your CV, providing support).
• Legitimate interests: to operate, secure and improve our services, and to respond to enquiries you send us — balanced against your rights.
• Consent: where you have actively opted in, for example to optional marketing or where a form asks you to agree before submitting. You may withdraw consent at any time.
• Legal obligation: to comply with our legal and regulatory duties (e.g. retaining financial records).

5. How We Use Your Data

Your data is used to:

• Provide and operate our services
• Respond to your enquiries and support requests
• Process payments where applicable
• Send service-related communications
• Improve and develop our services
• Comply with legal obligations

We will never use your data for unsolicited marketing without your explicit consent.

6. AI Processing

Where AI is used:

• Job Search Service: AI is used to tailor CVs and match job listings
• Local processing: we use locally-hosted AI models on our own infrastructure
• No third-party AI: your data is NOT sent to external AI providers (OpenAI, Google, etc.)
• Human oversight: you review and approve all AI-generated content before use

7. Data Sharing

We do NOT sell your personal data. We may share data with:

• Service providers (processors): payment processing (Stripe), transactional email delivery (Resend), delivery of e-signature request emails (SMTP2GO), and content-delivery/security (Cloudflare), acting on our instructions under a data processing agreement
• Legal requirements: when required by law or to protect our rights
• Business transfers: in case of merger or acquisition (with prior notice)

Our e-signature service uses DocuSeal, open-source e-signature software that we host on our own infrastructure in the United Kingdom. Your documents, signatures and audit trail are stored on our servers; only the email that notifies a signatory of a signing request is sent through the third-party provider named above (SMTP2GO).

8. Data Storage & Security

Your data is stored and processed on servers located in the United Kingdom. We implement:

• Encryption of data in transit (HTTPS/TLS)
• Secure password hashing (bcrypt)
• Access controls and authentication
• Regular security assessments
• Secure hosting infrastructure

9. International Transfers

We store and process your personal data in the United Kingdom. Some of our processors (for example Stripe, Resend, SMTP2GO and Cloudflare) may process limited data outside the UK. Where that happens, the transfer is protected by appropriate safeguards recognised under UK GDPR — such as the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, or an adequacy decision.

10. Data Retention

Data Type	Retention Period
Contact enquiries	2 years from last contact
Account data	Duration of account + 30 days
Support tickets	3 years from resolution
Payment records	7 years (legal requirement)
Signed documents & e-signature audit trail	Duration of the agreement, then up to 7 years (to meet legal and limitation-period requirements)
Server logs	90 days

11. Your Rights (UK GDPR)

Under UK GDPR, you have the right to:

• Access: request a copy of your personal data
• Rectification: correct inaccurate personal data
• Erasure: request deletion of your data ("right to be forgotten")
• Restrict processing: limit how we use your data
• Data portability: receive your data in a machine-readable format
• Object: object to processing based on legitimate interests
• Withdraw consent: where processing is based on consent

To exercise these rights, contact: [email protected]. We will respond within one month.

12. Cookies

We use essential cookies for:

• Session management (authentication)
• Security (CSRF protection)

We do not use tracking or advertising cookies, and we do not use Google Analytics or similar services.

We use Umami, a privacy-friendly, cookieless analytics tool self-hosted on our own infrastructure at analytics.aj-hosted.uk. Umami does not set cookies, does not track users across sites, and no data is shared with third parties.

13. Children's Privacy

Our services are not intended for users under 18 years of age. We do not knowingly collect data from children.

14. Changes to This Policy

We may update this policy. We will notify you of significant changes via email or through our services. The "Last updated" date indicates when changes were last made.

15. Complaints

If you have concerns about our data practices, please contact us first. You also have the right to lodge a complaint with the Information Commissioner's Office (ICO):

Website: ico.org.uk

Phone: 0303 123 1113

16. Contact Us

For privacy-related questions or to exercise your rights:

Email: [email protected]

Postal: AJ Tech Consulting Services Ltd, 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ