Sigmentix Privacy Policy

1. Who we are

Sigmentix ("Sigmentix", "we", "us", "our") provides a platform where professionals own and manage their career record. This policy explains what personal information we collect, how we use it, and the rights you have. It covers people with a Sigmentix account and people who use our CV review without an account.

Sigmentix is operated by Cian MCD Ltd, a company registered in Ireland (company number 574894), based in Dublin, Ireland. Cian MCD Ltd is the data controller for the information described here. You can contact us about privacy at DPO@sigmentix.com.

2. The information we collect

We only collect what we need to run the platform and the services you choose to use.

• Profile information: your first name, last name, and location (city and country); your work history (roles, employers and dates); your education; your skills, certifications and qualifications; your languages; and professional accomplishments such as publications, projects, honours, courses and organisations.
• Account and contact information: the email address and any contact details you give us when you sign up, and your account settings.
• CV review information: if you use our CV review, the CV you upload, the review we generate, any messages you exchange with the review tool, and any contact details you give us if you ask for a formatted CV.
• Regulatory register information: where relevant, the regulated roles associated with your name in publicly available regulatory registers (see section 5).
• Usage and technical information: basic information about how you use the platform and the device you use, which helps us keep it secure and working. This includes technical connection data processed by our security check (see section 9). Our Cookie Policy explains the cookies involved.

We do not need your date of birth, photo, nationality, health information or similar personal details. Please leave these out of any CV you upload.

3. How we collect it

We collect your information in the ways you choose:

• Directly from you, when you enter your details, upload your CV or your own LinkedIn data export, use our CV review, or contact us.
• From LinkedIn, where you authorise LinkedIn to share a copy of your data with us through its data portability service under the EU Digital Markets Act. You authorise this with LinkedIn directly, and we receive the data only after you have done so. This route is available to LinkedIn members in the EEA.
• From public regulatory registers, as described in section 5.

We do not build your profile by scraping websites or by buying your information from data brokers.

4. What we take from your LinkedIn import, and what we do not

Where you import from LinkedIn, LinkedIn's service can technically make far more data available than we need, including your private messages, searches, connections, contacts, and advertising data. We do not request or retain any of that.

We take only the profile items listed in section 2: your name and location, work history, education, skills, certifications and qualifications, languages, and professional accomplishments.

5. Cross-referencing public regulatory registers

To help build an accurate record, we may compare the roles and dates you give us with publicly available regulatory registers, such as the register maintained by the Central Bank of Ireland. For example, if you tell us you were Head of Compliance at a firm during a period when that firm held a licence, we may ask you to confirm the regulated role you held, or whether you were involved in that process.

We only ask. We do not add anything to your profile from this unless you confirm it, and we do not use these registers to gather wider information about you. We do not do this for people using the CV review without an account.

6. Why we use your information and our legal basis

You can withdraw your consent at any time by editing or deleting your profile, or by contacting us. Withdrawing consent does not affect anything we did before you withdrew it.

7. Using the CV review without an account

You can use our CV review without creating an account. Before you upload your CV, we ask for your consent and link you to this section.

What happens to your CV. The text of your CV is sent to our AI model provider, Perplexity, to generate your review. Perplexity processes it within the EU (see section 9). It does not use your CV to train its models, and it does not keep it after generating your review.

The review is automated feedback. It is produced by AI and is for your own use. It is not shared with any firm, and no decision about you is made from it.

Formatted CVs. If you ask us for a formatted version of your CV, a member of the Sigmentix team prepares it and sends it to you. Your CV is not shared with anyone outside Sigmentix to do this.

How long we keep it. See section 11. In short, if you do not ask for anything further, we delete your CV and review within 24 hours.

8. Who we share it with

You decide how you take part in Sigmentix, and firms and partners do not get open access to your profile.

We may share your information with:

• Firms and partners, only through the options you have opted into, and only to the extent you have chosen. We never share CV review information with firms or partners.
• Our AI model provider, Perplexity, which processes CV text to generate reviews. It acts on our instructions, does not use your information to train its models, and does not retain it.
• Our security check provider, Cloudflare (Turnstile), which processes technical connection data such as your IP address and browser and connection characteristics. It does not receive your CV. Cloudflare also uses these signals to improve its bot detection.
• Other service providers who help us run the platform, such as hosting and technical logging providers, including Langfuse. They act on our instructions and are bound to protect your information.
• Authorities or advisers, where we are required to by law, or to protect our rights or the safety of others.

We do not sell your personal information.

9. Where your information is held

We host and process your information within the EU. This includes your account and profile, your CV reviews, which Perplexity processes in the EU, and our technical logs, which Langfuse holds in the EU.

One of our providers may process limited data outside the EU:

• Security check: Cloudflare Turnstile processes technical connection data, not your CV, and may do so outside the EU.

Where your information is transferred outside the EU or EEA, we rely on the EU-US Data Privacy Framework and/or Standard Contractual Clauses approved by the European Commission to make sure it stays protected to the standard required by law.

10. Anonymised and aggregated insights

We may combine information across the platform to produce anonymised and aggregated insights, for example trends in roles, skills or markets. These insights are designed so that no individual can be identified from them, and they are not personal information about you.

11. How long we keep it

If you have an account. We keep your profile for as long as your account is active. If you do not log in for two years, we treat your account as inactive. Before we delete anything, we will contact you so you can keep your profile if you still want it. If you do not respond, we delete your information, except anything we are required to keep by law or need to keep to resolve a dispute, for a limited period. You can also delete your profile yourself at any time, and we will delete your information on the same basis.

If you use the CV review without an account:

• If you do not ask for anything further, we delete your CV and review 24 hours after you decline our offer, or after 24 hours of inactivity.
• If you ask for a formatted CV, we keep your information until we send it to you, then delete it 14 days later. If we cannot fulfil your request, we delete it after 60 days at the latest.
• If you create an account, your information becomes part of your profile and the account rules above apply.

Logs and backups. Copies of CV review content and messages stay in our technical logs for up to 3 days, even after the review itself is deleted. Deleted information may also remain in our database backups for up to 30 days, after which it is permanently removed. We do not use backups for any other purpose.

12. Your rights

You have the right to:

• access the information we hold about you;
• correct anything that is wrong or out of date;
• delete your information;
• restrict or object to certain uses;
• withdraw consent at any time;
• port your information, by receiving it in a usable format; and
• complain to a data protection authority.

To use any of these, contact us at DPO@sigmentix.com. If you used the CV review without an account, tell us the email address you used, if any, so we can find your information. If you are in Ireland, you also have the right to complain to the Data Protection Commission (www.dataprotection.ie).

13. How we protect your information

We use appropriate technical and organisational measures to protect your information, including secure hosting and access controls. No system is completely secure, but we work to keep your information safe and to respond quickly if anything goes wrong.

14. Children

Sigmentix is for professionals and is not intended for anyone under 18. We do not knowingly collect information about children.

15. Changes to this policy

We may update this policy from time to time. If we make a significant change, we will let you know. The date at the top shows when it was last updated.

16. Contact

For any questions about this policy or your information, contact us at DPO@sigmentix.com.