Data processing

When you upload a candidate’s resume, your organisation is the controller of that personal data and Oceanblue Solutions is a processor acting on your instructions. Your instruction is the upload itself: read this document, check it, return it in the selected template, and add it to your organisation’s talent heat map.

• Identifiers in the resume: name, email, phone, address, profile links.
• Employment history, education, skills, certifications, and projects.
• Anything else the candidate chose to put in the document.

Nothing is inferred or added. Fields that do not appear in the source document are left empty rather than guessed.

The uploaded file is retained only for the duration of the request. The structured record is kept in your browser’s local storage under your control, and a copy is kept server-side, encrypted at rest, in US East (Ohio) until you instruct us to delete it. The talent heat map draws on that copy and shows only employer, job title, skills, years of experience, and location, never contact details.

• Amazon Web Services: hosting, authentication, storage of extracted records, and map location lookups, US East (Ohio).
• A large language model provider: structures the resume text and returns it. It does not retain it for training under our agreement.

We will give notice before adding a sub-processor that handles candidate data.

Processing takes place in the United States. If you are transferring personal data from the UK or EEA, standard contractual clauses should be put in place as part of your agreement with us.

We will help you respond to data subject requests, and will notify you without undue delay if we become aware of a breach affecting your data.