Privacy policy
Version 1.0 · Effective 11 November 2026
The short version
- We collect what we need to run a board-appointments community: your account details, your profile and board CV, your application, and how you use the platform.
- Your CV and contact details are never public. An approved organisation sees your full profile and CV only if you apply for its vacancy, or if you choose to appear in CV search.
- Other members can see your name, headline, region, skills, sectors and LinkedIn link in the Member Profiles directory unless you switch that off.
- We do not sell your information or use it for advertising. Analytics cookies are used only if you accept them.
- You can edit your profile, or permanently delete your account and data yourself, at any time. Otherwise we delete your profile and CV 12 months after your membership or application ends.
- You have rights over your information, including to see it, correct it, delete it and object to how we use it. Email hello@nedhunter500.com to use them.
1. Who we are
Nedhunter500 is run by Nedhunter Limited, a company registered in England and Wales. We are the controller of the personal information described in this policy, which means we decide how and why it is used and we are responsible for protecting it.
If you have any questions about this policy or your information, contact us at hello@nedhunter500.com. Members can also use Chat with the founders.
This policy covers the Nedhunter500 website, the iOS and Android apps, our emails, events and calls, and any other way we collect information about you in connection with Nedhunter500. It applies to applicants, members, people who use the platform for organisations, and visitors.
2. The information we collect
Information you give us
- Account details: your name, email address and password (stored only in an irreversibly scrambled form). If you sign in with Google or LinkedIn, we receive your name, email address and, if available, your profile photo link from them. We do not receive your Google or LinkedIn password.
- Profile: your headline, biography, region, skills, sectors, board experience, preferred roles, availability, location preferences and LinkedIn profile link, and your privacy and sharing choices.
- Board CV: the file you upload and everything in it.
- Your application: the membership type you apply for, any invitation code, why you want to join, a summary of your experience, your region and, for Founding and some invited applicants, your agreement to promote the platform.
- Opportunity eligibility: if you apply for Opportunity membership, a short statement about your circumstances, for example that you are not currently in paid work. We do not ask for or keep any documents.
- Calls: when you book a call through Calendly, the details you give when booking. During and after calls with the founders, we may make brief notes about your application, onboarding or offboarding. We do not record calls.
- Payment details: your billing address and payment card are collected and held by our payment provider, Stripe. We never see or store your full card number. We hold a Stripe customer reference and a record of your payments, invoices and refunds.
- Platform activity: vacancies you apply for and your cover notes; application status and feedback from organisations; approaches from organisations and your responses; event registrations; forum threads and posts; messages with the founders; requests for optional services; and appointments you report, including any testimonial and whether you have given permission for us to celebrate it.
- Organisation users: if you use the platform for an organisation, your name, email address and phone number, your organisation's details, your role on its team, the vacancies you post, and the outcomes and feedback you record about applicants.
- Registering interest: if you join the list on our home page, your name, email address, whether you are an individual or an organisation, your organisation's name and any message you send.
- Contacting us: anything you tell us when you email us, message us or make a complaint.
Information we collect automatically
- Account and security information: when you last signed in, sign-in events, and technical information such as your IP address, browser and device, which our hosting and authentication providers record in security logs.
- Membership information: your membership type and status, trial and free-period dates, and the dates of reminders and notices we send you.
- Emails we send you: a record of each email we send, including its content and whether it was delivered.
- Analytics (only with your consent): which pages you visit and key actions such as applying or registering for an event, with a pseudonymous ID and whether you are using the website, iOS app or Android app. See Cookies and analytics.
Information from other people
- Organisations record the status of your applications to their vacancies and feedback on them, and may tell us that they have appointed you.
- Stripe tells us whether payments succeed or fail.
- Google and LinkedIn provide the details listed above if you choose to sign in with them.
Sensitive information
We do not ask for information about your health, ethnicity, religion or beliefs, sexual orientation, political opinions, trade union membership, genetics or biometrics (special category data), or about criminal convictions. Please do not include it in your profile, CV, forum posts or messages unless you are comfortable with the people who can see them seeing it. If you choose to include such information in your CV, we process it only as part of your CV, on the basis of your explicit consent, which you can withdraw at any time by replacing your CV or deleting your account.
3. How we use your information and our lawful bases
Data protection law requires us to have a lawful basis for each way we use personal information. The table below sets out what we do and why.
| What we do | Lawful basis |
|---|---|
| Create and manage your account, and let you sign in securely | Contract |
| Consider your application, hold your call, manage releases and the waiting list, and decide whether to approve you, including Opportunity eligibility | Contract (taking steps at your request before entering into a contract) |
| Provide membership: the Job Board, applications, training, events, forums, messaging and services you request | Contract |
| Share your profile and CV with an organisation when you apply for its vacancy | Contract |
| Include your full profile and CV in CV search for approved organisations | Consent, which you give and can withdraw on your profile page |
| Show your name, headline, region, skills, sectors and LinkedIn link to other members in the Member Profiles directory | Legitimate interests: helping members connect with each other, which is central to the community. You can switch this off at any time. |
| Take payments, manage subscriptions and failed payments, and issue invoices | Contract |
| Keep accounting and VAT records | Legal obligation |
| Send service emails, such as trial and free-period reminders, inactivity reminders and notices, application updates and changes to our terms | Contract, and legitimate interests in running the community fairly |
| Send news about the platform, events and new releases of places to members and to people who have registered interest | Legitimate interests (members) and consent (people who register interest). You can opt out at any time. |
| Manage success and exit: record appointments, hold offboarding calls and end memberships | Contract |
| Publish testimonials and success stories | Consent, which you can withdraw at any time |
| Moderate the forums, enforce our terms and Code of conduct, prevent fraud and repeat free trials, and keep the platform secure, including virus-scanning uploaded CVs | Legitimate interests in protecting members, organisations and the platform; legal obligation where the law requires us to act |
| Handle complaints, questions and requests to exercise your rights | Legitimate interests; legal obligation for data protection requests |
| Understand how the platform is used, using analytics cookies | Consent |
| Produce anonymous statistics, for example how many members have been appointed | Legitimate interests in understanding and reporting on our impact |
| Establish, exercise or defend legal claims, and respond to lawful requests from regulators, courts and law enforcement | Legitimate interests; legal obligation |
Where we rely on legitimate interests, we have balanced our interests against your rights and expectations, and you have the right to object (see Your rights). Where we rely on consent, you can withdraw it at any time; this does not affect anything we did before you withdrew it.
If you do not give us information we need to provide membership, such as a board CV, we may not be able to consider your application.
Decisions about you
We do not make decisions about you based solely on automated processing that have legal or similarly significant effects. People decide who is approved, whose membership ends for inactivity, and whether an appointment ends a membership. Some platform rules apply automatically to everyone, for example a vacancy closing when it reaches its application limit, or a membership pausing after a payment fails and the grace period ends.
4. Who can see your information
| Who | What they can see |
|---|---|
| The public | Nothing about you, unless you have given permission for us to publish a testimonial or success story. |
| Other members | If you are in the Member Profiles directory (on unless you switch it off): your name, headline, region, skills, sectors and LinkedIn link. Your forum posts. Never your CV, email address or application details. |
| An organisation you apply to | Your profile, board CV and cover note for that application, and the status and feedback it records. It can see the CV for as long as the application exists on the platform. |
| Approved organisations, if you opt in to CV search | Your full profile and board CV. They can approach you through the platform and see your response. You can opt out at any time; they will then no longer find you in search. |
| The founders and authorised Nedhunter staff | Your account, profile, CV, application, call notes, membership and payment status, messages with the founders and other platform activity, as needed to run the platform. Administrator access requires two-factor authentication. |
Organisations never see your email address or phone number unless you give it to them. Your CV is only ever made available through a secure, short-lived link after we check the person opening it is allowed to.
Once an organisation has your information. If an organisation downloads or copies your CV or profile, it becomes responsible for that copy as a separate controller. Our Organisation terms require organisations to use member information only to recruit for genuine board roles, to keep it confidential and secure, and to delete it when they no longer need it.
6. International transfers
We store our main database and CV files in the UK. Some of our service providers are based in, or access information from, the United States or other countries outside the UK. Whenever your information is transferred outside the UK, we make sure it is protected by one of the safeguards UK law requires: the destination has been found by the UK Government to provide adequate protection (including, in the US, organisations certified under the UK Extension to the EU–US Data Privacy Framework, known as the UK–US data bridge), or we use the International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses. Contact us for more information about the safeguard for a particular provider.
7. How long we keep your information
We keep information only for as long as we need it for the purposes described above.
| Information | How long |
|---|---|
| Profile, board CV, applications, messages, forum posts and other member activity | While you are a member, then deleted automatically 12 months after your membership ends |
| Applicants who are not approved, or who withdraw | Deleted automatically 12 months after the decision or withdrawal |
| If you delete your account yourself | Deleted from the live platform immediately, including your CV, and your Stripe customer record and saved card |
| Payment, invoice and VAT records | 6 years from the end of the financial year they relate to, as required by tax law (held by Stripe) |
| Organisation users and organisation records | While the organisation's account is open, then deleted within 12 months of it closing, except invoice records |
| Registrations of interest | Until you join or ask us to remove you, and no more than 24 months |
| Records of emails we have sent | 24 months |
| Analytics data | 14 months |
| Security logs held by our providers | Normally no more than 90 days |
| Backups | Overwritten on a rolling cycle, normally within 30 days |
We may keep information for longer where we need it to deal with a complaint or legal claim, or where the law requires us to. A record that you have had a free trial, or that your membership was ended for breaching our terms, may be kept for as long as needed to apply those rules. We may keep anonymous statistics indefinitely.
8. Your rights
You have the following rights over your personal information:
- Access: to ask for a copy of the information we hold about you.
- Correction: to have inaccurate information corrected and incomplete information completed. You can update most of it yourself on your profile page.
- Erasure: to have your information deleted. Members can do this themselves using “Delete my account and data” on their profile page.
- Restriction: to ask us to limit how we use your information, for example while we check it is accurate.
- Objection: to object to our using your information where we rely on legitimate interests. You can always object to direct marketing.
- Portability: to receive the information you gave us in a structured, machine-readable format, or have it sent to someone else.
- Withdraw consent: where we rely on consent, for example for CV search, testimonials or analytics.
Some rights apply only in certain circumstances. To use any of them, email hello@nedhunter500.com. We may need to confirm your identity first. We will respond within one month, which may be extended by up to two further months for complex or multiple requests; if so, we will tell you why. We do not charge a fee unless a request is clearly unfounded or excessive.
9. How we protect your information
We use appropriate technical and organisational measures to protect your information, including:
- encryption of information in transit and at rest;
- access rules enforced in the database itself, so that each person can reach only the information they are allowed to see;
- CVs stored privately and opened only through links that expire after five minutes, after a permission check;
- virus scanning of every uploaded CV before organisations can open it;
- two-factor authentication for everyone with administrator access, and limiting that access to people who need it; and
- never handling card details ourselves.
No system is completely secure. If a personal data breach occurs that is likely to put your rights at risk, we will report it to the ICO within 72 hours and, where the risk is high, tell you without undue delay.
11. Our mobile apps
The Nedhunter500 apps show the same platform as the website, and this policy applies to them in the same way. The apps do not access your contacts, photos, location, camera or microphone. When you upload a CV, you choose the file. The apps do not track you across other companies' apps or websites. Your cookie choice is stored on your device and applies in the apps too.
12. Children
The platform is for adults only. You must be 18 or over to create an account. We do not knowingly collect information about children. If you believe a child has given us information, please contact us and we will delete it.
13. Other websites
The platform links to other websites, such as organisations' sites, partners and LinkedIn profiles. We are not responsible for how they handle personal information; please read their privacy policies.
14. Changes to this policy
We will update this policy when how we use personal information changes. The date at the top shows when it last changed. If we make significant changes, we will tell members by email or on the platform before they take effect.
15. Questions and complaints
If you have a question or concern about how we handle your information, please contact us first at hello@nedhunter500.com. We will acknowledge your complaint within 30 days and investigate it without undue delay, and tell you the outcome.
You also have the right to complain to the Information Commissioner's Office, the UK regulator for data protection: ico.org.uk/make-a-complaint, or call 0303 123 1113. We would appreciate the chance to resolve your concern first.