JobRelay Ltd

Privacy Policy

Last updated: 5 August 2026

This Privacy Policy explains how JobRelay Ltd collects, uses, shares and protects Personal Data when acting as a Controller.

JobRelay Ltd is registered in England and Wales under company number 15514526. Our registered-office and other corporate details are available on our Company Information page.

JobRelay Ltd is part of the Highrise Digital group. Highrise Digital Ltd is our parent company and provides administrative, technical and operational support to JobRelay.

In this policy, JobRelay Ltd is referred to as “JobRelay”, “we”, “us” or “our”.

Who this policy applies to

JobRelay provides a subscription service that connects recruitment CRMs, applicant-tracking systems, job multi-posting platforms and XML job feeds with WordPress websites.

This policy applies to Personal Data we collect about people who:

• visit jobrelay.io or another website operated by JobRelay;
• contact us about JobRelay or request a consultation;
• are customers, prospective customers or representatives of customers;
• create or use a JobRelay account;
• purchase or manage a JobRelay subscription;
• request technical support or assistance with an integration;
• receive marketing communications from us;
• work with us as a supplier, contractor, integration provider or business contact; or
• otherwise interact with JobRelay in a business capacity.

In this policy, the JobRelay website, hosted integration platform, WordPress Connector Plugin, onboarding, monitoring, updates and support are collectively referred to as the “Service”.

When we act as a Controller or Processor

JobRelay acts as a Controller for account, billing, security and operational information that it uses for its own business purposes.

JobRelay acts as a Processor where it handles Personal Data contained in Job Data solely to provide the Service on the customer’s instructions. In those circumstances, the customer is normally the Controller.

The customer determines which jobs are published, what information they contain, which individuals are identified and how long the information remains publicly available. JobRelay processes that information only as necessary to transfer, map, publish, update, remove or troubleshoot jobs in accordance with the customer’s instructions.

This processing is governed by the data-processing provisions in our Terms and Conditions of Service, any separate Data Processing Agreement and the customer’s documented instructions.

Questions about Personal Data controlled by one of our customers should normally be directed to that customer.

This Privacy Policy principally covers processing for which JobRelay decides why and how Personal Data is used and therefore acts as the Controller.

Personal Data we collect

We collect Personal Data only where we have a reason to do so, such as providing the Service, responding to an enquiry, processing a subscription, protecting our systems or meeting a legal obligation.

Information you provide to us

The Personal Data you provide depends on how you interact with JobRelay and may include:

• Enquiry and consultation information – your name, email address, telephone number, organisation, recruitment software provider and information included in an enquiry, consultation request or contact form.
• Customer and business contact information – your name, job title, organisation, postal address, email address, telephone number and relevant company information.
• Account information – your name, contact details, username, account preferences, website address, subscriptions, licences and purchase history.
• Billing and transaction information – billing address, organisation details, VAT information, invoice records, subscription status and information about payments and purchases.
• Payment information – information needed to process a payment. Full payment-card details are collected and processed by our payment provider and are not stored directly by JobRelay.
• Integration information – details of your WordPress website, job-board system, Posting Provider, field mappings, feed configuration and technical requirements.
• Access credentials – temporary WordPress, hosting, SFTP, server or other credentials provided so that we can install, configure or support the Service.
• Website and system copies – files, databases, exports or backups supplied for testing, integration or troubleshooting.
• Support information – support requests, screenshots, diagnostic information, files and other information supplied when requesting assistance.
• Marketing information – your name, email address, communication preferences and information about your interaction with our communications.
• Correspondence – emails, meeting notes, feedback and other communications between you and JobRelay.

Please do not provide special-category, criminal-offence or other highly sensitive Personal Data unless it is necessary for the relevant Service, you are authorised to provide it and appropriate arrangements have been agreed with JobRelay.

Job and integration data

When the Service is active, we may receive or retrieve information from a customer’s Posting Provider and transmit that information to the customer’s WordPress website.

This information may include:

• job titles, descriptions, locations, salaries and employment details;
• job identifiers, categories, sectors, skills and taxonomy information;
• consultant or recruiter names and business contact details;
• application links, routing addresses or tracking identifiers;
• the dates and times on which jobs were received, updated, processed, published, expired or deleted;
• delivery statuses, error messages and diagnostic information; and
• other information selected or supplied by the customer or Posting Provider.

Most Job Data processed by JobRelay consists of vacancy and business information intended for publication on the Customer Website. Information such as a job title, description, salary, location, company name or generic business contact address is not normally Personal Data unless it relates to an identifiable individual.

Job Data may contain Personal Data where, for example, a recruiter or consultant is named or personally identifiable contact details are included. The fact that this information is intended to be publicly available does not prevent it from being Personal Data. Where JobRelay transfers such information according to the customer’s instructions, the customer is normally the Controller and JobRelay acts as its Processor.

Customers are responsible for ensuring that they are authorised to provide this information to JobRelay and publish it on their WordPress websites.

Applicant tracking

JobRelay may configure technical information that enables applications made on a Customer Website to be attributed or routed to the relevant job within the customer’s Posting Provider. This may include job identifiers, tracking codes or destination information.

Applicant Personal Data does not pass through JobRelay’s hosted servers. JobRelay does not receive, store, log or otherwise process application forms, CVs, applicant contact details or other candidate information.

Applicant Personal Data is processed directly by the Customer Website, the customer and its Posting Provider. Those organisations are responsible for explaining how they collect and use applicant information and for complying with applicable Data Protection Laws.

Information collected automatically

When you use our website, account area or Service, we may automatically collect:

• Technical information – your IP address, approximate location, browser type, operating system, device type and language.
• Website and account logs – the date and time of access, pages or resources requested, account events, error information and security records.
• Service logs – job identifiers, Customer Website addresses, Posting Provider information, processing times, delivery statuses, error messages and diagnostic information.
• Website statistics – aggregated information about visits, pages viewed and how visitors arrive at our website. We use Fathom Analytics, which does not use cookies or create persistent profiles of individual visitors.
• Cookie and similar-technology information – information used for secure payments, authentication, fraud prevention and protecting forms against spam or automated abuse.

More information is available in our Cookie Policy.

Information obtained from other sources

We may receive Personal Data from:

• your employer, colleague or another representative of your organisation;
• a customer who asks us to communicate or work with you;
• Highrise Digital Ltd, where it provides administrative, technical, sales or support services to JobRelay;
• Posting Providers and other integration partners;
• a customer’s WordPress website, hosting provider, developer or job-board supplier;
• payment, accounting, fraud-prevention and identity-verification providers;
• referral partners and professional contacts;
• public sources, including business websites, professional profiles and Companies House; and
• service providers that help us operate, monitor and secure the Service.

How and why we use Personal Data

UK data-protection law requires us to have a lawful basis for each purpose for which we process Personal Data.

Responding to enquiries and arranging consultations

We use contact and enquiry information to respond to questions, assess integration requirements, arrange consultations and prepare proposals or quotations.

Our lawful basis is taking steps at your request before entering into a contract or our legitimate interest in responding to business enquiries and developing our business.

Providing and managing the Service

We use customer, account, integration, credential and communication information to:

• create and administer customer accounts;
• install and configure the Connector Plugin;
• set up Posting Provider integrations;
• create and maintain field mappings;
• operate, monitor and support the Service;
• communicate about integrations, subscriptions and accounts;
• provide updates and technical support; and
• manage renewals, cancellations and termination.

Our lawful basis is performing our contract with you. Where the customer is an organisation rather than an individual, we rely on our legitimate interests in performing the contract and communicating with the customer’s personnel and representatives.

Processing and delivering jobs

We process Job Data to receive or retrieve jobs from Posting Providers, apply customer-configured mappings, transmit jobs to Customer Websites and keep those websites synchronised with the relevant source.

Where JobRelay determines how operational information is used for its own service-management, security or reliability purposes, our lawful basis is our legitimate interest in operating, monitoring and improving the Service.

Where JobRelay processes Personal Data contained in Job Data solely on a customer’s instructions, JobRelay acts as a Processor and the customer is responsible for establishing the applicable lawful basis.

Applicant tracking

JobRelay may configure job identifiers, tracking codes or destination information that enables the Customer Website and Posting Provider to attribute an application to the correct job.

Applicant Personal Data is transmitted directly between the Customer Website, the customer and its Posting Provider. It does not pass through JobRelay’s hosted servers and is not received, stored or otherwise processed by JobRelay.

Billing, payments and financial records

We use customer, transaction and billing information to process payments, issue invoices, manage subscriptions, maintain financial records, recover debts and meet tax, accounting and company-law obligations.

Our lawful bases are performing our contract, complying with legal obligations and our legitimate interests in administering our business and recovering amounts owed to us.

Security, fraud prevention and service reliability

We use technical, log, account, integration and transaction information to:

• protect our website, platform, Connector Plugin and customers;
• authenticate users and validate subscriptions;
• detect and prevent fraud, spam, misuse and unauthorised access;
• monitor job delivery and integration performance;
• investigate errors, failed posting requests and security events;
• manage service capacity and fair use; and
• maintain the availability, integrity and reliability of the Service.

Our lawful bases are our legitimate interests in protecting our business, customers and systems and, where applicable, compliance with our legal security obligations.

Supporting and troubleshooting integrations

We use support information, logs, credentials and website or system copies to investigate problems, reproduce errors, restore job-processing activity and provide requested assistance.

Our lawful basis is performing our contract or our legitimate interest in supporting customers and maintaining a reliable Service. Where support gives us access to Personal Data controlled by a customer, we normally process that information as the customer’s Processor.

Improving the Service

We use feedback, support information, service-performance information and aggregated statistics to understand how JobRelay is used and improve its compatibility, usability, reliability and relevance.

Where practicable, information used for analysis and improvement is aggregated or anonymised.

Our lawful basis is our legitimate interest in understanding and improving the Service. We do not use this information to create behavioural advertising profiles.

Marketing communications

We may use your contact details to send information about JobRelay features, relevant products, service updates, guides or events.

We rely on consent where consent is required. In other circumstances, we may rely on our legitimate interests in promoting relevant services to existing customers and business contacts where the law permits this.

You can opt out at any time by using the unsubscribe link in a marketing email or by contacting us.

Opting out of marketing will not prevent us from sending necessary account, billing, security, transaction, service or legal communications.

Testimonials and business promotion

We may identify customer organisations and display examples of websites using JobRelay where this is permitted by our agreement with the customer or separately agreed.

We will not intentionally publish confidential information or Personal Data about an identifiable individual as part of a testimonial or case study without an appropriate basis and, where necessary, permission.

Legal obligations and claims

We may use Personal Data to comply with law, respond to lawful requests from public authorities, enforce our agreements and establish, exercise or defend legal claims.

Our lawful bases are compliance with legal obligations and our legitimate interests in protecting our legal rights and business.

Highrise Digital Ltd

Highrise Digital Ltd is JobRelay’s parent company and provides services that may include administration, finance, development, infrastructure management, sales, marketing and customer support.

We may share Personal Data with Highrise Digital where reasonably necessary for these purposes. Highrise Digital is required to protect that information and use it only for authorised purposes.

Where Highrise Digital processes Personal Data solely on JobRelay’s instructions, it acts as our Processor. Where Highrise Digital decides independently why and how it uses Personal Data for its own purposes, it acts as a separate Controller and its own Privacy Policy applies.

We will not treat acceptance of this Privacy Policy as consent to unrelated marketing from Highrise Digital.

When we share Personal Data

We do not sell Personal Data.

We may share Personal Data with the following recipients where reasonably necessary:

• Highrise Digital Ltd, where it provides administrative, financial, technical, sales or support services to JobRelay.
• Personnel and contractors who need the information to provide or support the Service and who are subject to appropriate confidentiality obligations.
• Customers, where information is processed or returned as part of the Service they control.
• Posting Providers and integration partners, where required to establish, operate or support an integration.
• Hosting and infrastructure providers used to operate the JobRelay website, platform, databases, logs and backups.
• Cloud storage and document providers used to store business records, integration files and support materials.
• Email, calendar and communication providers used to arrange consultations and send, receive or store business communications.
• Project-management and support providers used to organise integrations, communicate with customers and manage support requests.
• Accounting and invoicing providers used to administer subscriptions, transactions and financial records.
• Payment and fraud-prevention providers, including Stripe, where required to process and secure payments.
• Analytics providers, including Fathom Analytics, used to provide aggregated website statistics.
• Spam and abuse-prevention providers, including Google reCAPTCHA where it is used to protect forms.
• Professional advisers, including accountants, solicitors, insurers and consultants.
• Public authorities, regulators, courts and law-enforcement bodies where disclosure is required or permitted by law.
• Potential purchasers, investors or advisers involved in a proposed merger, restructuring, investment or sale of all or part of our business, subject to appropriate confidentiality safeguards.

Where a recipient processes Personal Data on our behalf, we require it to provide appropriate contractual, organisational and technical protections.

International transfers

Some of our service providers or integration partners may process Personal Data outside the United Kingdom.

Where a transfer is restricted under applicable Data Protection Laws, we will ensure that it is protected by an appropriate legal mechanism. This may include:

• UK adequacy regulations;
• the UK International Data Transfer Agreement;
• the UK Addendum to the EU Standard Contractual Clauses;
• applicable EU Standard Contractual Clauses; or
• another safeguard or exception recognised by applicable law.

Where required, we will undertake a transfer risk assessment or other applicable data-protection test and implement additional safeguards.

You may contact us for further information about the safeguards used for a particular transfer.

How long we keep Personal Data

We keep Personal Data only for as long as reasonably necessary for the purpose for which it was collected, including satisfying contractual, legal, accounting, security and reporting requirements.

Our normal retention periods and criteria include:

• Unsuccessful enquiries – normally up to one year after our last substantive communication.
• Customer and subscription records – for the duration of the customer relationship and normally up to seven years afterwards where required for contractual, legal or record-keeping purposes.
• Invoices and transaction records – normally seven years to support tax, accounting and company record-keeping obligations.
• Account and licence information – while the account or Subscription remains active and afterwards where necessary to maintain transaction, licensing, security or support records.
• Job-processing records – for the period reasonably required to deliver jobs, investigate errors, replay failed requests, provide logs and maintain the reliability and security of the Service.
• Job Data retained for support or recovery – only for as long as reasonably necessary for the operational, support or recovery purpose for which it was retained, after which it will be deleted or anonymised.
• Applicant-tracking configuration – job identifiers, tracking codes and destination information may be retained while required to operate or support the relevant integration. This information does not include applicant Personal Data.
• Credentials – only while reasonably necessary to complete an integration or provide authorised continuing support, after which they will be deleted or access will be removed where practicable.
• Website, database and system copies – normally deleted within 30 days after the relevant integration or support work ends, with securely protected backup copies removed through their normal lifecycle, ordinarily within 90 days.
• Technical and security logs – for a period proportionate to their operational and security purpose, or longer where required to investigate an incident.
• Marketing information – until you withdraw consent, object or unsubscribe, or until we determine that the information is no longer needed. We may retain a minimal suppression record so that we can respect an opt-out.
• Legal disputes – for as long as reasonably necessary to establish, exercise or defend legal claims.

We may retain information for longer where required by law, a regulator, a court, an insurer or an active legal claim.

We may anonymise information so that it can no longer be associated with an identifiable person. Anonymised information may be retained and used for statistical, security and service-improvement purposes.

Security

We use appropriate technical and organisational measures designed to protect Personal Data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access.

Depending on the nature of the information and processing, these measures may include:

• access controls based on role and business need;
• unique credentials and secure credential-management tools;
• temporary or restricted administrative access to Customer Websites;
• multi-factor authentication where supported and appropriate;
• encryption in transit and at rest where appropriate;
• device encryption and automatic screen locking;
• software maintenance and risk-based security updates;
• service logging, monitoring and error detection;
• backups and restoration arrangements;
• confidentiality obligations for personnel and contractors;
• security and data-protection guidance; and
• procedures for identifying, investigating and responding to security incidents.

No method of transmission or storage can be guaranteed to be completely secure. We review our measures in response to changes in technology, risk and the Service.

Personal Data Breaches

If a Personal Data Breach occurs, we will take reasonable steps to contain and investigate it, assess the risks to affected people, mitigate potential harm and record the incident.

Where JobRelay acts as a Controller and notification is legally required, we will notify the Information Commissioner’s Office without undue delay and, where feasible, within 72 hours of becoming aware of the breach.

Where a breach is likely to result in a high risk to an affected person’s rights and freedoms, we will also inform that person without undue delay unless an applicable legal exception applies.

Where JobRelay acts as a Processor, we will notify the relevant customer without undue delay after becoming aware of a Personal Data Breach affecting Personal Data processed on that customer’s behalf.

Your data-protection rights

Depending on the circumstances, you may have the right to:

• Access the Personal Data we hold about you and receive information about how it is used.
• Rectify inaccurate or incomplete Personal Data.
• Erase your Personal Data where there is no lawful reason for us to continue using it.
• Restrict how we use your Personal Data in certain circumstances.
• Object to processing based on legitimate interests and to direct marketing.
• Receive or transfer certain Personal Data in a structured, commonly used and machine-readable format.
• Withdraw consent at any time where we rely on consent. Withdrawal does not affect processing already carried out lawfully.
• Complain about how we have handled your Personal Data.

You have an absolute right to object to the use of your Personal Data for direct marketing. If you object, we will stop using your Personal Data for that purpose.

These rights are subject to legal conditions and exceptions. For example, we may need to retain information to comply with law, perform a contract or establish or defend legal claims.

You can exercise your rights by emailing support@jobrelay.io or by contacting us.

We may ask for information needed to confirm your identity and understand your request. We will respond within the period required by applicable Data Protection Laws.

If JobRelay holds the relevant Personal Data solely as a Processor for one of our customers, we may refer your request to that customer or ask you to contact it directly.

Data-protection complaints

If you are concerned about how we have handled your Personal Data, you can make a complaint by emailing support@jobrelay.io, using our contact form or writing to our registered office shown on our Company Information page.

We will acknowledge a data-protection complaint within 30 days, investigate it appropriately and communicate the outcome without undue delay.

You also have the right to complain to the Information Commissioner’s Office. Information about making a complaint is available on the ICO website.

Automated decision-making

JobRelay automates the transfer, mapping, updating and removal of job information according to rules configured for each integration.

This operational automation is not used by JobRelay to make solely automated decisions about individuals that produce legal or similarly significant effects.

JobRelay does not receive candidate applications or decide whether a candidate should be interviewed, shortlisted, rejected or offered employment.

Children’s information

Our website and Service are intended for businesses and are not directed at children.

We do not knowingly collect Personal Data directly from children through our own website except where necessary and lawful.

Applicant Personal Data, including information about applicants who may be under 18, does not pass through JobRelay’s hosted servers. Any such information is processed by the Customer Website, the customer and its Posting Provider.

Information required to provide the Service

Some Personal Data is required so that we can respond to an enquiry, enter into or perform a contract, process a payment, provide an integration or meet a legal obligation.

If required information is not provided, we may be unable to create an account, process a transaction, complete an integration, provide support or continue providing the Service.

We will explain where providing particular information is mandatory.

Changes to this policy

We may update this Privacy Policy when the Service, our processing activities or our legal obligations change. The latest version will be published on our website with its revision date shown above.

If a change materially affects how we use Personal Data, we will take reasonable steps to bring it to the attention of affected people where required.

How to contact us

JobRelay Ltd is the Controller responsible for the processing described in this policy.

Our registered-office and corporate details are available on our Company Information page.

Email: support@jobrelay.io

You can also contact us using our contact form.