Yay Monday – Privacy Notice

1. Introduction

This Privacy Notice explains how Yay Monday ("we", "us", or "our") collects, uses, and protects personal information. We provide an online platform that allows employers to manage job vacancies and receive applications. We handle data in line with the UK GDPR and the Data Protection Act 2018. This notice applies to both employers using Yay Monday and applicants submitting applications through the platform.

2. Our role under data protection law

• For employer account data (account, billing, login), Yay Monday is the Data Controller.
• For applicant data (CVs, cover letters, contact details), Yay Monday is a Data Processor acting on behalf of the employer (the Data Controller).

3. Information we collect

From employers/business users: business contact details, account credentials, billing information (processed via Stripe), and usage data (e.g., vacancy posts, credits used).

From applicants: personal details (name, email, phone, postcode), uploaded documents (CV, cover letter), and any information provided in the application.

We also log basic technical data (e.g., IP address, browser type) for security and performance monitoring.

4. How we use the information

For employers: create and manage accounts, process payments, deliver and support the platform, send service and billing communications, detect and prevent fraud or misuse, and maintain security.

For applicants: deliver your application securely to the employer, store your application on behalf of that employer, provide a secure environment for review, and assist with lawful data management and deletion.

We do not use applicant data for marketing, analytics, or profiling.

5. Lawful bases for processing

• Contract: necessary to provide the service to employers (Data Controllers).
• Consent: applicants submitting data for recruitment purposes.
• Legal obligation: accounting, fraud prevention, and data protection compliance.
• Legitimate interests: maintaining and securing the platform, preventing abuse, and improving services.

6. Data sharing

• Stripe: for secure payment processing (employer billing only).
• DigitalOcean: hosting and operating our servers and databases.
• Postmark (ActiveCampaign): sending transactional and notification emails securely on our behalf.

We do not sell or share data with third parties for marketing purposes. If a vacancy is suspected to be fraudulent, we may share relevant information with affected applicants or lawful authorities.

7. Data retention

Employers: account and billing data is kept for up to 6 years for accounting and legal purposes.

Applicants: application data is stored while the vacancy is active. The employer determines how long applicant data is retained. Once a vacancy expires, data may be kept up to 30 days for export before deletion. Yay Monday may not retain applications beyond the vacancy's active or export period. Applicants may request deletion sooner via the employer.

8. Data location and security

Data is stored in the UK or within the EEA with appropriate technical and organisational safeguards. We use encryption, secure hosting, access controls, and data minimisation to protect your information.

9. Your rights

• Access, correction, deletion, portability, and restriction/objection.
• Applicants should contact the employer (Data Controller) to exercise these rights. For employer account data, contact [email protected].

11. Changes to this notice

We may update this notice from time to time. Updates will be posted on our website with a revised “last updated” date. Continued use of the service after an update means you accept the changes.