Skip to main content
CVSuite.aiLogin

Data Processing

Version 2026-07-12

This page summarises how CVSuite.ai processes student personal data on behalf of an institution. It is intended to support procurement and a Data Protection Impact Assessment (DPIA).

Roles

The institution is the controller of student CV, profile and application data; CVSuite.ai is the processor and acts only on the institution's documented instructions, which are the provision of this service.

Subject matter and duration

  • Subject matter: providing a CV builder and application tailoring and tracking to students.
  • Duration: for the term of the agreement; after 36 months of inactivity, identifiable account, profile and application data is deleted or anonymised. Genuinely anonymous aggregate counters may be retained.

Categories of data and data subjects

  • Data subjects: users at the institution who sign in.
  • Data: email, CV / profile content, application records and notes including job listings, consent records, and security/audit logs. No special-category data is required by the service. Students should not intentionally include special-category data.

Subprocessors

CVSuite.ai uses the subprocessors listed on the Subprocessors page. They process data only to deliver the relevant feature.

International transfers

Application storage runs in the UK. The AI and email providers process data outside the UK. Each transfer relies on the safeguard documented for that provider on the Subprocessors page, for example the Standard Contractual Clauses with the UK Addendum, or the UK-US Data Privacy Framework.

Security

Technical and organisational measures are described on the Security page, including access controls, tenant isolation, audit logging and data minimisation when using AI.

Assisting the controller

  • Students can self-serve access, export and erasure from their Account & privacy page.
  • Institution-wide export or deletion (for example at contract end) is carried out manually on request to privacy@cvsuite.ai.
  • We will assist the controller with data-subject requests and notify it without undue delay of any personal-data breach.

Return and deletion

On termination, the institution may request export and/or deletion of its students' data. Anonymous aggregate statistics that cannot identify an individual may be retained.