Compliance & Data Protection
The Job Evaluation Platform is built with privacy-by-design principles and meets stringent UK and European compliance standards. This guide explains our security framework and your data protection rights.
Compliance Framework
🇬🇧 UK GDPR Compliance
General Data Protection Regulation (UK GDPR) - ✅ Lawful Basis: Legitimate business interests for job evaluation - ✅ Data Minimization: Collect only necessary information - ✅ Purpose Limitation: Use data solely for evaluation purposes - ✅ Storage Limitation: Automated data retention policies - ✅ Data Subject Rights: Full rights implementation - ✅ Privacy by Design: Built-in privacy protection
📋 Data Protection Act 2018 (DPA 2018)
UK Implementation of GDPR - ✅ Processing Principles: Fair and lawful processing - ✅ Individual Rights: Access, rectification, erasure, portability - ✅ Accountability: Documented compliance procedures - ✅ Security Measures: Technical and organizational safeguards - ✅ Breach Notification: 72-hour breach reporting procedures - ✅ Impact Assessments: Regular privacy impact reviews
🔒 ISO 27001 Information Security
International Security Standard - ✅ Information Security Management: Systematic approach - ✅ Risk Assessment: Regular security risk evaluation - ✅ Access Controls: Role-based permission systems - ✅ Incident Management: Structured incident response - ✅ Business Continuity: Service availability planning - ✅ Continuous Improvement: Regular security updates
♿ WCAG 2.1 AA Accessibility
Web Content Accessibility Guidelines - ✅ Perceivable: Content accessible to screen readers - ✅ Operable: Keyboard navigation support - ✅ Understandable: Clear language and instructions - ✅ Robust: Compatible with assistive technologies - ✅ Color Contrast: Minimum 4.5:1 contrast ratios - ✅ Responsive Design: Works on all devices
🔐 TLS 1.3 Encryption
Transport Layer Security - ✅ End-to-End Encryption: All data transmissions secured - ✅ Certificate Validation: Valid SSL certificates - ✅ Perfect Forward Secrecy: Past session protection - ✅ Modern Cipher Suites: Strong encryption algorithms - ✅ HSTS Headers: Enforced HTTPS connections - ✅ Certificate Transparency: Public certificate logs
🏠 UK Data Hosting
Data Sovereignty Protection - ✅ UK-Based Servers: Data stored within UK borders - ✅ British Data Centers: Tier 3+ certified facilities - ✅ Local Support: UK-based technical support - ✅ Regulatory Compliance: Follows UK data protection laws - ✅ Brexit Compliance: Post-Brexit data handling - ✅ Geographic Restrictions: No overseas data transfers
Data Protection Measures
Data Collection
What We Collect: - Job evaluation responses and scores - User account information (name, email) - System usage analytics (anonymized) - Technical logs for security purposes
What We Don't Collect: - Personal sensitive data (race, religion, health) - Financial information beyond salary ranges - Social media profiles or external accounts - Personal communications outside evaluations
Data Processing
Processing Activities: - Job evaluation score calculations - Performance analytics and reporting - User authentication and authorization - System security monitoring
Legal Basis: - Legitimate Interest: Job evaluation business purposes - Consent: Analytics and non-essential features - Contract: Service delivery to subscribers - Legal Obligation: Compliance and audit requirements
Data Storage
Security Measures: - Encryption at Rest: AES-256 database encryption - Encrypted Backups: Secure backup procedures - Access Logging: All data access recorded - Regular Audits: Quarterly security assessments - Data Minimization: Automated cleanup processes - Retention Policies: Configurable data lifecycle
Data Sharing
Internal Sharing: - Organization administrators see organizational data - Managers access direct report evaluations - HR teams view organization-wide analytics - Evaluators see only assigned evaluations
External Sharing: - No Third Parties: No data sharing with external parties - No Marketing: No marketing or advertising use - No Sales: No data commercialization - Service Providers: Limited to essential service providers only
Your Data Rights
Right of Access (Article 15)
What You Can Request: - Complete copy of personal data we hold - Information about data processing purposes - Data retention periods - Data sharing details (if any)
How to Request: - Email: privacy@jobeval.com - Include: Full name, email, organization - Response: Within 30 days - Format: Structured data export
Right to Rectification (Article 16)
What You Can Correct: - Incorrect personal information - Outdated contact details - Inaccurate evaluation data - Organizational affiliations
How to Request: - Update via user settings - Email corrections to privacy@jobeval.com - Provide supporting documentation - Changes implemented immediately
Right to Erasure (Article 17)
When You Can Request Deletion: - No longer need data for original purpose - Withdraw consent for processing - Data processed unlawfully - Legal obligation to delete
Process: - Submit deletion request - Verification of identity - Impact assessment - Complete data removal
Right to Data Portability (Article 20)
What You Can Export: - Evaluation responses and scores - User profile information - Analytics data (where applicable) - Historical evaluation records
Export Formats: - JSON (structured data) - CSV (spreadsheet compatible) - PDF (human readable) - API access (for developers)
Right to Object (Article 21)
What You Can Object To: - Analytics data processing - Marketing communications (none currently) - Profiling activities - Direct marketing (none currently)
How to Object: - Cookie consent settings - Email preferences - Privacy settings page - Direct communication with privacy team
Security Measures
Technical Safeguards
- Multi-Factor Authentication: Available for all accounts
- Session Management: Secure session handling
- Input Validation: Protection against injection attacks
- Rate Limiting: Protection against brute force
- Regular Updates: Security patch management
- Vulnerability Scanning: Regular security assessments
Organizational Safeguards
- Staff Training: Regular privacy and security training
- Background Checks: Verified personnel
- Access Controls: Principle of least privilege
- Audit Trails: Comprehensive activity logging
- Incident Response: 24/7 security monitoring
- Business Continuity: Disaster recovery planning
Physical Security
- Data Centers: Tier 3+ certified facilities
- Access Controls: Biometric and card access
- CCTV Monitoring: 24/7 video surveillance
- Environmental Controls: Fire and flood protection
- Power Systems: Redundant power supplies
- Network Security: Dedicated secure networks
Compliance Monitoring
Regular Assessments
- Monthly: Security monitoring reports
- Quarterly: Compliance audits
- Annually: Full GDPR compliance review
- As Needed: Incident response evaluations
Third-Party Validation
- Security Audits: Independent security assessments
- Penetration Testing: Regular vulnerability testing
- Compliance Certification: Third-party compliance validation
- Privacy Impact Assessments: Regular DPIA updates
Continuous Improvement
- Policy Updates: Regular policy reviews
- Training Programs: Ongoing staff education
- Technology Updates: Security enhancement deployment
- Stakeholder Feedback: User privacy feedback integration
Incident Response
Data Breach Response
- Detection: Automated and manual monitoring
- Assessment: Impact and scope evaluation
- Containment: Immediate threat mitigation
- Investigation: Root cause analysis
- Notification: Required party notification
- Recovery: Service restoration procedures
- Lessons Learned: Process improvement
Contact Information
Data Protection Officer: - Email: dpo@jobeval.com - Phone: +44 (0)20 7946 0959 - Response: Within 24 hours
Security Team: - Email: security@jobeval.com - Emergency: Available 24/7 - Response: Within 2 hours
General Privacy: - Email: privacy@jobeval.com - Phone: +44 (0)20 7946 0958 - Response: Within 5 working days
This compliance framework is regularly reviewed and updated to maintain the highest standards of data protection and regulatory compliance.