Privacy, GDPR & Cookies Policy

Effective Date / Last Updated: 22 October 2026

I. Introduction and Data Controller Status

1. BRIGHT FUTURE BG LTD (registered in the Commercial Register of the Republic of Bulgaria under UIC 205623291, with registered address: Sofia 1618, Vitosha District, r.c. Buxton, bl. 16, ent. B, fl. 7, ap. 35, Republic of Bulgaria), operating the platform www.jobbri.co.uk (hereinafter "Jobbri", "We", or "Us"), is the primary Data Controller of your personal data uploaded to our Platform.

2. Because we are an European Union legal entity providing services specifically tailored to users in the United Kingdom, we process and protect your personal data in strict compliance with both:

   • The UK General Data Protection Regulation (UK GDPR) and the UK Data Protection Act 2018; and

   • The EU General Data Protection Regulation (EU GDPR - Regulation (EU) 2016/679) and the Privacy and Electronic Communications Regulations (PECR).

II. Categories of Personal Data We Collect

1. From Job Candidates:

   • Identity & Contact Data: First and last name, email address, phone number, city/postcode, profile avatar photo, and (if using Google Social Login / OAuth) your Google account email, public name, and profile picture.

   • Professional & CV Data: Work experience, education history, fields of study, skills, languages, driver's license categories, hobbies, social media links (LinkedIn, X, Facebook), salary and job type preferences, UK work authorization status, and uploaded files (CVs, Cover Letters, References in PDF/DOCX format).

   • Audio-Visual Recordings (Non-Biometric): If you voluntarily record a 60-second Video CV or complete an Employer's One-Way Video Task, we collect and store the video and audio recording. Important: We treat these strictly as standard audio-visual recordings; we do not extract biometric templates, perform facial recognition, or process special category biometric data under Article 9 of the GDPR.

   • Activity & Responsiveness Metadata: Online/last-seen timestamps, chat message response times, interview attendance statuses, and your "Immediate start" availability toggle.

2. From Employers & Team Members (RBAC):

   • Company name, Company Registration Number (CRN), VAT number, office address and postcode, HR representative names, work emails, role permissions for invited team sub-accounts, office gallery photos, employee quotes, billing history, and Stripe transaction references (we do not store raw credit card numbers on our servers).

3. From Service Providers (Services Market):

   • Service titles, descriptions, pricing, approximate location/postcode, and contact details voluntarily made available to registered users.

4. Communications & Community Hub Data:

   • Posts, questions, comments, likes, bookmarks, and abuse reports submitted in the Community Hub, as well as messages and file attachments sent via the internal Jobbri Chat System.

5. Automatically Collected Technical & Behavioural Data:

   • IP addresses, browser type, operating system, device identifiers, login timestamps, page interaction logs, and (subject to your cookie consent) website analytics, advertising conversions, and anonymized session heatmaps.

III. How We Use Your Data and Our Legal Bases (GDPR Art. 6)

We process your personal data only when we have a valid legal basis:

1. Performance of a Contract (Art. 6(1)(b) GDPR):

   • Creating and managing your Candidate or Employer account, authenticating logins, generating downloadable PDF CVs, delivering Job Alerts, scheduling interviews, facilitating the internal Chat System, and processing JBC coin transactions.

2. Explicit Consent (Art. 6(1)(a) GDPR):

   • Recording and hosting your optional Video CV or One-Way Video Task answers; sharing your job application with a specific Employer; sending optional marketing emails; and deploying non-essential cookies (Google Analytics 4, Meta Pixel, Microsoft Clarity). You may withdraw your consent at any time via your dashboard or cookie settings.

3. Legitimate Interests (Art. 6(1)(f) GDPR):

   • AI Assisted Processing (Google Cloud Vertex AI): Processing CV text and job descriptions to pre-fill onboarding forms and generate assistive AI Match Scores & Cheat Sheets for Employers.

   • Anti-Ghosting & Activity Badges: Running automated daily checks on chat response speeds and interview statuses to award the "Highly responsive" and "Recently active" badges, helping maintain a reliable recruitment marketplace.

   • Automated Moderation & Security: Scanning platform posts and chat messages via automated regex filters to block phishing links, malware, and profanity, and protecting the Platform via Cloudflare WAF and Fail2Ban.

4. Legal Obligation (Art. 6(1)(c) GDPR):

   • Retaining B2B billing records, Stripe invoices, and tax documentation as required by Bulgarian and UK tax authorities.

IV. Cloud Infrastructure, Sub-Processors, and International Data Transfers

We do not sell your personal data to third parties. To deliver a fast, enterprise-grade platform, we use carefully vetted infrastructure partners (Data Processors) bound by strict Data Processing Agreements (DPAs):

1. Core Server & Database Hosting (London, UK): Our primary application servers and databases are hosted on dedicated virtual private servers provided by OVHcloud located in London, United Kingdom.

2. Cloud File & Video Storage (London, UK): All uploaded PDF/Word CVs, profile photos, company galleries, Video CVs, Video Tasks, and chat attachments are securely stored in DigitalOcean Spaces (S3-compatible object storage) located in the London (lon1), United Kingdom data center.

3. Artificial Intelligence Processing (Belgium, EU): When AI features (CV parsing, AI Match Score, Job Description generator) are triggered, stripped text data is transmitted via encrypted connection to Google Cloud Vertex AI (Google Gemini) hosted in Google's europe-west1 (Belgium, European Union) data center. Strict AI Privacy Guarantee: Under our commercial Google Cloud Vertex AI terms, Google is strictly prohibited from using your personal data or CVs to train its public AI models, and data is not retained by the AI model after generating the response.

4. Payments, Security, Social Media & Email Delivery:

   • Stripe: Secure B2B payment processing and invoicing.

   • Cloudflare: DNS, SSL encryption, and DDoS/WAF security protection.

   • Hostinger SMTP: Transactional email delivery ([email protected]).

   • Make.com & LinkedIn: Automated publishing of public Premium Job Postings (contains no Candidate personal data).

5. Legal Basis for UK <-> EU Data Transfers: Because our company is established in Bulgaria (EU), our servers are in London (UK), and our AI processor is in Belgium (EU), personal data moves between the UK and the European Economic Area (EEA). These transfers are fully lawful and protected under the UK Adequacy Regulations (recognizing EU data protection standards) and the European Commission's Adequacy Decision for the United Kingdom, supplemented by Standard Contractual Clauses (SCCs) and the UK International Data Transfer Addendum (IDTA) where US-parented cloud providers (DigitalOcean, Google, Meta, Microsoft, Stripe) are involved.

V. Sharing Data with Employers & Public Visibility

1. Employers as Independent Data Controllers: When you apply for a job, or when a registered Employer spends JBC credits to unlock your profile in the Talent Search or saves your profile to a Talent Pool, that Employer becomes an independent Data Controller of your shared data. Employers are bound by our Terms to comply with the UK GDPR and use your data solely for recruitment.

2. Blurred Profiles in Talent Search: Until an Employer unlocks your profile (or unless you apply directly to them), your contact details, full name, and avatar photo remain blurred/masked in the Talent Search and Candidate Comparison matrix. We also apply an automated filter to hide your profile from Employers whose registered company name matches your current listed employer.

3. Public Sections: Content you voluntarily post in the Community Hub or the Services Market is visible to other users. Do not post sensitive personal data in public discussions.

VI. Cookies, Analytics, Heatmaps, and Meta Pixel (PECR Compliance)

In compliance with the UK Privacy and Electronic Communications Regulations (PECR) and UK GDPR, Jobbri uses cookies and tracking scripts managed via Google Tag Manager (GTM):

1. Strictly Necessary (Essential) Cookies: Required for core platform operation, including Laravel session cookies, CSRF security tokens, authentication state, and Cloudflare security cookies. These are active by default as the site cannot function without them.

2. Analytics & Behavioural Heatmaps (Consent Required):

   • Google Analytics 4 (GA4): Helps us understand visitor traffic, page views, and search trends in an aggregated format.

   • Microsoft Clarity: Captures anonymized user interaction metrics, scroll depth, and visual heatmaps to help us identify broken UI elements and improve mobile/desktop usability. Clarity automatically masks sensitive input fields.

3. Marketing & Conversion Tracking (Consent Required):

   • Meta (Facebook) Pixel: Measures the effectiveness of our social media advertising campaigns and tracks sign-up or job-posting conversions.

4. How to Manage Cookie Consent: Non-essential scripts (GA4, Microsoft Clarity, Meta Pixel) are blocked by default and are only activated if you explicitly click "Accept" on our Cookie Consent Banner. You can withdraw your consent or clear cookies at any time via our Cookie Settings link in the footer or through your browser preferences.

VII. Data Retention Periods

We retain personal data only as long as necessary for the purposes described above:

1. Active Accounts: Your profile data, CVs, and Video CVs are retained for as long as your account remains active.

2. Employer Dashboards & Unlocked Profiles: In accordance with the GDPR data minimization principle, Candidate CVs and unlocked profile access granted to an Employer automatically expire and are removed from the Employer's active access view 6 (six) months after the application or unlock date.

3. Account Deletion ("Danger Zone"): You may permanently delete your account at any time via Account Settings -> Danger Zone. Upon deletion, your personal profile, CVs, Video CVs, Video Tasks (in DigitalOcean Spaces), and active Job Alerts are permanently purged within 30 days. Community Hub posts may be deleted or permanently anonymized.

4. Security Logs & Financial Records: Server security logs, IP logs, and notification logs are retained for up to 1 (one) year. B2B financial transactions and invoices are retained for 10 (ten) years to comply with mandatory Bulgarian and UK tax accounting laws.

VIII. Your GDPR Rights (Including Automated Profiling Rights)

Under the UK GDPR and EU GDPR, you have the following rights free of charge:

1. Right of Access (Art. 15): Request a copy of the personal data we hold about you.

2. Right to Rectification (Art. 16): Edit or correct inaccurate profile or CV data directly in your Dashboard.

3. Right to Erasure / "Right to be Forgotten" (Art. 17): Delete your account, CVs, and videos permanently.

4. Right to Restriction & Objection (Art. 18 & 21): Object to processing based on legitimate interests or opt out of marketing emails with one click.

5. Right to Data Portability (Art. 20): Request your data in a structured, machine-readable format.

6. Rights Related to AI & Automated Profiling (Art. 22): While Jobbri does not make automated hiring decisions, you have the right to request human intervention, express your point of view, and contest any automated AI Match Score or Responsiveness Badge calculation if you believe your CV data was inaccurately parsed.

IX. Contact Information and Supervisory Authorities

For any privacy questions, Data Subject Access Requests (DSARs), or data deletion inquiries, please contact our Data Protection Team at:

• Email: [email protected] or [email protected]

• Postal Address: BRIGHT FUTURE BG LTD, Sofia 1618, Vitosha District, r.c. Buxton, bl. 16, ent. B, fl. 7, ap. 35, Republic of Bulgaria.

If you believe your data protection rights have been infringed, you have the right to lodge a complaint with the relevant supervisory authority:

• In the United Kingdom: The Information Commissioner's Office (ICO) at www.ico.org.uk (Tel: 0303 123 1113).

• In the European Union (Bulgaria): The Commission for Personal Data Protection (CPDP / КЗЛД) at www.cpdp.bg.