Privacy Policy

Who we are

Zepa is a recruitment and onboarding platform operated by Zepa Technology Ltd ("we", "us"), a private limited company registered in England and Wales, company number 17413149. Our registered office is Ground Floor Flat, 77 Farleigh Road, London, United Kingdom, N16 7TD.

Registered with the Information Commissioner's Office, registration number ZC269300.

Our role: controller or processor

Our role depends on whose data it is.

• Processor. A recruitment agency or employer (our "client") uses Zepa to manage its candidates, applicants and new starters. For that data the client is the controller and decides why and how it is used. We act only on its instructions. The client's own privacy notice explains its use of your data.
• Controller. For the accounts of the people who use Zepa (client staff and our own team), for sign-in and security, and for billing and account data of the businesses that buy Zepa, we decide why and how the data is used.

If you are a candidate or new starter and want to use your rights, ask the agency or employer that holds your application first. We will help them and, if you write to us, we will pass your request to them where they are the controller.

Data we process

Depending on how Zepa is used:

• Candidates and applicants (as processor) — name, email, phone, answers to application questions, CV and other documents you upload (which can include right-to-work documents such as a passport), text read from your CV, an optional recorded video introduction and its transcript, your nationality or residency status and your answers on right to work and student or post-graduate visas (from the application form), ratings and notes made by the client's staff, scheduling and interview records, and the emails and text messages sent to and from you. If the client switches on reply tracking, your email replies (subject and text) are stored on your record in Zepa and forwarded to the client's reply address. Applications can come from you directly, from a job board the client advertises on, or from a CV emailed in.
• New starters and reps in onboarding (as processor) — contact details, date of birth, emergency contact, bank account and, where relevant, company and tax details, photo ID, badge photo, signatures, contracts, the IP address and browser details recorded when you sign a contract or accept a self-billing agreement, and the name and address of anyone who witnesses your signature.
• Client staff and our team (as controller) — name, work email, role and permissions, sign-in records, and activity in the console that is kept in an audit log.
• Customer and billing data (as controller) — the contact details of the person who buys Zepa, the licence and seats bought, and a Stripe customer reference. Card details are entered at Stripe and never reach our servers.
• Technical data — error reports and service logs needed to run and secure the service.

We get candidate and new-starter data from you, from the client that is recruiting you, and from CVs sent in by email. We do not buy personal data.

Data from other people (Art 14). If you are named by someone else, for example as a witness to a contract or an emergency contact, we hold your name and contact details because they gave them to the client using Zepa. We use them only for that purpose, keep them as long as the record they belong to, and you have the same rights as everyone else here.

Is giving us data required? For client staff, a name and work email are required to create an account; without them we cannot give you access. For candidates and new starters, what is required is set by the client (for example contact details, right to work, and bank details to be paid). If you do not provide it, the client may be unable to progress your application or onboarding.

Why we process it & lawful basis

As processor, the client chooses the lawful basis for its candidates' and new starters' data, and we process it only to provide Zepa to that client. As controller we rely on:

• Contract — to give client staff an account, supply the service and take payment.
• Legitimate interests — keeping Zepa secure, preventing misuse and fixing faults, and keeping an audit trail of privileged actions. You can object (see Your rights).
• Legal obligation — keeping accounting and tax records, and responding to lawful requests.

We do not currently send marketing messages. If that changes we will ask for your consent where the law requires it, and you will be able to withdraw it at any time.

Sensitive & criminal-offence data

Zepa is not built to collect special category data (for example health, ethnicity or religion). An ID document or photo you upload may show some of it, and it is handled like the rest of your documents.

Zepa does not carry out DBS or other criminal-record checks. Where a client records the outcome of a check it arranged, that client is the controller and relies on the conditions in Schedule 1 of the Data Protection Act 2018 and its own appropriate policy document. We store what the client records and process it only on its instructions.

AI screening

Only if the client agency switches it on, Zepa can send the text of a CV, application answers and a video transcript to an AI service (Anthropic) to produce a score and a short written reason. It looks at text only. It does not look at your face, voice or any biometric signal. The score is advice for a person at the client: Zepa does not reject or progress anyone automatically on the strength of it, and a member of the client's staff makes the decision. You can ask the client for a human review of any outcome.

How long we keep it

For candidate and new-starter data, the client sets the retention period. How Zepa applies it today:

• Candidate & application data — 12 months from the date of the application by default. The recruitment agency that controls the data can set a shorter or longer period. When the period ends, Zepa blanks the candidate's personal details and deletes their documents and files. A client can shorten the period after a seven-day delay.
• DBS outcome (if the client records one) — deleted with the rest of the candidate record when the retention period above ends; we only hold a check outcome your agency chooses to record.
• Right-to-work documents — deleted with the rest of the candidate record when the retention period above ends.
• New-starter onboarding records — kept while the client needs them. Automatic deletion is not switched on for these records. Ask the client or us, and our team will carry out the erasure within one month.
• Email replies (if the client uses reply tracking) — kept on the candidate's record until the client deletes the record or an erasure request is carried out, and they are also cleared when the client's retention period ends (12 months by default). Resend receives inbound email as our processor. For mail that cannot be matched to a candidate we keep only the sender's address, for troubleshooting, with no fixed time limit yet.
• Staff accounts — for as long as the account is active; ask us to delete it at any time.
• Audit log — entries are kept to show what was done and when, and may include names. They are kept for as long as the client account exists; there is no automatic deletion of audit entries today.
• Billing & accounting records — 6 years after the end of the financial year they relate to. This is what UK company and tax law requires.
• Technical & log data — error reports and service logs sit with our hosting and error-tracking providers and are kept for as long as each provider's own settings keep them; we do not copy them elsewhere.

You can ask for deletion at any time. Our team handles erasure requests within one month (see Data Deletion). Where the law requires us or the client to keep something, we keep only that.

Who we share data with

We share data only to provide the service:

• The client (agency or employer) you are dealing with, and its staff. Each client sees only its own data.
• The service providers below, who process data for us under written terms. We do not sell personal data.
• Authorities or advisers where the law requires it.

We tell you about new providers by updating this page. Providers are only used for the features a client has switched on.

Referral partners

Onboarding may offer you an optional business bank account with a partner, currently Tide. You do not have to take it, nothing in your application or your work depends on whether you do, and you are free to use any bank you like.

We do not send your details to Tide. If you choose to apply, you follow a link or use a referral code and give your information to Tide directly, under Tide's own privacy policy, and Tide is the controller for it. Tide tells us only whether a referral resulted in an account being opened, so that the referral can be paid.

We are paid a commission for each account opened this way, and we may pass part of it to the office that recruited you. We tell you this so you can weigh it up. Our lawful basis for handling the limited confirmation data we receive back is our legitimate interests in running and being paid for the referral; you can object at any time using the contact details below.

International transfers

Our main database is in Ireland. Twilio and Anthropic process data in the United States, and Resend and Stripe are US-based companies. Vercel (a US company) runs our servers in Dublin, Ireland; limited access from the US is covered by its data processing agreement. Sentry (a US company) stores our data in the EU; limited access from the US is covered by its data processing agreement. Transfers outside the UK need a safeguard. We are putting these in place with each provider: the ICO's International Data Transfer Agreement or the UK Addendum to the EU standard contractual clauses, or the UK-US data bridge where the provider is certified. For Twilio, Anthropic and Speechmatics these are still being confirmed. Write to us if you want to know where things stand for a particular provider.

Security

Each client's data is kept separate from every other client's by database-level access rules. Files are held in private storage. Staff access is by role, privileged actions are written to an audit log, and error reports are stripped of request contents before they leave the platform. No system is perfectly secure; if a breach puts your rights at risk we will tell the controller and, where we are the controller, you and the ICO as the law requires.

Your rights

You have the right to be told how your data is used, and to access, correct, delete, restrict, object to, and receive a copy of your data (portability) — each subject to the conditions in UK GDPR. Where you gave consent, you can withdraw it.

To use a right, write to privacy@zepa.uk or use the Data Deletion / Request page. We answer within one month (it can be extended by up to two more months for complex requests, and we will tell you). It is free. We may ask you to confirm who you are. If an agency or employer is the controller, we will pass your request to them.

Children

Zepa is for recruitment of adults and is not aimed at anyone under 16. We do not knowingly collect data from children. If you think we have, write to us and we will delete it.

Cookies & browser storage

We use only cookies and browser storage that are strictly necessary, or that remember a choice you made. Cookies keep you signed in, carry a secure booking, offer or onboarding link session, and remember a dismissed card prompt. Browser storage on your device remembers your light or dark display choice, whether the navigation sidebar is pinned, where the feedback button sits, whether the setup checklist is pinned or already seen, which alerts you have already seen, and whether you dismissed the scheduling notice. None of these track you or are shared with anyone. We do not use advertising or analytics cookies and have no cookie banner because none is needed. The application form loads a Cloudflare Turnstile check to stop automated submissions.

Complaints

Please tell us first and we will try to put it right. You can also complain to the Information Commissioner's Office (ICO), the UK data protection regulator, at ico.org.uk or on 0303 123 1113.

Changes to this policy

We will update this page when our use of data changes and show the date at the top. This version was last updated on 8 October 2026.

Contact

Zepa Technology Ltd, Ground Floor Flat, 77 Farleigh Road, London, United Kingdom, N16 7TD. Data-protection enquiries: privacy@zepa.uk. Data protection contact: privacy@zepa.uk.