Summit Talent — Privacy Policy

**DRAFT — NOT FINAL LEGAL ADVICE**

This document is an operational draft for Summit Talent. It has **not** been reviewed by a qualified solicitor or data protection specialist and should **not** be relied upon as final legal advice. Kevin has decided to post these drafts now and obtain solicitor review after publication. A reviewer familiar with UK GDPR, the Data Protection Act 2018, and international data transfer rules should still review them.

*Last updated: 11 July 2026 | Version: Draft 3*

1. Who We Are

Summit Talent ("**we**", "**us**", "**our**") is the trading name of **Summit Talent Consulting Ltd**, a company registered in England and Wales under Companies House number **17065247**. Summit Talent Consulting Ltd is the **data controller** for the personal data described in this policy.

Legal entity / data controller: Summit Talent Consulting Ltd (Companies House No. 17065247)
Registered office: 86-90 Paul Street, London, EC2A 4NE
Website: summittalent.uk
Contact for data protection queries: kevin@summittalent.uk
Based in: England, United Kingdom

2. What Personal Data We Collect

Depending on the service you use, we may collect:

**Contact details**: name, email address, phone number, and any other contact information you provide.
**CV and career content**: your CV, cover letter drafts, work history, qualifications, achievements, career narrative, and related background information.
**Payment information**: payment amount, payment reference, and related billing details processed via Tide, Wise, and/or Stripe. We do not store full card numbers ourselves; those are handled by the payment provider.
**Coaching session notes**: notes from coaching or interview preparation sessions, goals, and progress, used to provide continuity of coaching.
**Communications**: emails, messages, or form submissions you send us.
**Website usage data**: if analytics tools are added later, we may collect basic usage data such as pages visited, device/browser type, and approximate location (see Section 10). Currently, no non-essential analytics are in use.

3. How We Use Your Data (Purposes and Lawful Basis)

| Purpose | Data Used | Lawful Basis (UK GDPR) |

|---|---|---|

| Providing the CV/cover letter rewrite, coaching, or interview prep service you purchased | CV content, contact details, session notes | Performance of a contract with you |

| Processing your payment | Payment reference/amount (via Tide/Wise/Stripe) | Performance of a contract with you |

| Responding to enquiries and support requests | Contact details, communications | Legitimate interests (customer support) |

| Sending service-related updates (e.g. session reminders, delivery confirmation) | Contact details | Performance of a contract with you |

| Marketing communications (e.g. newsletters, offers) — only if you opt in | Contact details | Consent |

| Improving our coaching methodology and service quality using anonymised/aggregated learnings (not identifiable personal content) | Anonymised/aggregated data | Legitimate interests |

We do not use your data for any purpose beyond what is described here without asking for your consent first.

4. How AI Tools Process Your Data

To deliver CV rewrites, cover letters, and coaching preparation materials, we currently use third-party AI tools including **ChatGPT (OpenAI)** and/or **Gemini (Google)**. In future, we may also use AI agents built specifically for Summit Talent (for example via the Cofounder platform).
When you submit your CV or career narrative content, relevant parts of it may be sent to these AI providers to generate a draft. **All AI-generated output is reviewed by a human member of the Summit Talent team before anything is delivered to you.** AI is a drafting aid, not an unsupervised decision-maker.
These AI providers process data under their own terms and data processing arrangements.

Use of your data to train AI models

**Summit Talent does not use client CVs, personal narratives, or coaching session content to train or fine-tune any AI model** (whether OpenAI's, Google's, or a future Summit Talent / Cofounder-built agent).

Where available, we use AI product settings that keep training off for customer content. Current practice is that training is off. If this ever changes, we will update this policy and, where required, obtain clear consent or provide an opt-out before using identifiable client content for model training.

5. How Long We Keep Your Data (Retention)

**CVs, cover letters, career narrative content, and coaching session notes**: retained for **6 months** after your last interaction with us, then deleted or anonymised, unless you ask us to delete them sooner.
**Payment and billing records**: retained for **at least 6 years**, as generally required for UK tax and accounting purposes, even after other personal service data is deleted.
**Marketing contact data**: retained until you unsubscribe or withdraw consent.

You can ask us to delete your data earlier at any time, subject to our legal obligations to retain certain financial records (see Section 8 — Your Rights).

6. Who We Share Your Data With (Third-Party Processors)

We share personal data with the following categories of third-party service providers, only as needed to deliver our services:

|---|---|---|---|

| **Supabase** | Application data storage/hosting for Summit Talent's own tools | CV content, account/contact details, as applicable | Account available; to be connected when the site/app goes live |

We do not sell your personal data to third parties. We only share data with processors who need it to help us deliver the service, and we expect them to protect it appropriately. Data processing agreements (or equivalent contractual terms) should be confirmed with each active processor before launch.

7. International Data Transfers

Summit Talent is based in England, UK, and our existing client base already includes clients in **Brazil** and **Australia**, alongside UK clients.

Where we transfer personal data outside the UK (for example, to AI providers or payment processors with servers or operations outside the UK, or in delivering services to clients based outside the UK), we rely on appropriate safeguards required under UK GDPR, such as the UK's International Data Transfer Agreement (IDTA) or Standard Contractual Clauses (SCCs) with our processors, or reliance on an adequacy decision where one applies.
If you are based outside the UK (e.g. in Brazil or Australia), by using our services you understand that your data will be processed in the UK and may be transferred to processors located in other countries (including the US, where OpenAI, Google, and some payment providers operate).
A qualified data protection advisor should confirm the specific transfer mechanisms actually in place with each processor Summit Talent uses.

8. Your Rights

Under UK GDPR, you have the right to:

**Access** the personal data we hold about you.
**Rectify** inaccurate or incomplete data.
**Erase** your data ("right to be forgotten"), subject to legal retention obligations (e.g. payment records).
**Restrict** or **object** to certain processing.
**Data portability** — receive your data in a portable format where technically feasible.
**Withdraw consent** at any time where we rely on consent (e.g. marketing emails), without affecting the lawfulness of processing before withdrawal.
**Complain** to the UK's data protection regulator, the Information Commissioner's Office (ICO), at ico.org.uk, if you believe we have not handled your data properly.

To exercise any of these rights, contact us at kevin@summittalent.uk. We will respond within the timeframes required by law (generally one month).

If you are based outside the UK, you may also have rights under your local data protection law (e.g. Brazil's LGPD or Australia's Privacy Act); we aim to honour equivalent rights requests regardless of your location.

9. Data Security

We take reasonable technical and organisational measures to protect your personal data, including limiting access to CV content and session notes to those who need it to deliver your service, and relying on reputable third-party providers (OpenAI, Google, Tide, Wise, Stripe, Supabase, and any future processors) who maintain their own security standards. No system is 100% secure, and we cannot guarantee absolute security of data transmitted to us.

10. Cookies and Analytics

Summit Talent currently does **not** use non-essential website analytics or tracking cookies on summittalent.uk.
Only strictly necessary cookies required for the website or payment flow to function may be used.
If analytics tools (for example Google Analytics, Plausible, PostHog, or similar) are added later, this section will be updated to disclose which tool is used, what data is collected, and how visitors can manage cookie preferences. Where legally required under UK PECR rules, a cookie consent banner will be used for non-essential cookies.

11. Children

Our services are intended for adults seeking career support and are not directed at children. We do not knowingly collect personal data from children.

12. Changes to This Policy

We may update this policy as our services, tools, or data practices evolve (for example, as we connect Supabase, expand Stripe usage, or add analytics). We will post the current version on our website with an updated "Last updated" date, and will notify active clients directly of material changes affecting how their data is used.

13. Contact Us

Questions about this Privacy Policy or how we handle your data should be sent to kevin@summittalent.uk.

Remaining open items before publish

Complete the DPA checklist below for each active processor.
Formal solicitor / data protection review is still recommended; these drafts may be posted now, with solicitor review after publication.
Engineering should link this document in the website footer and signup/checkout flow.
Update this policy if website analytics are added later.

DPA checklist (exact instructions for Kevin)

A Data Processing Agreement (DPA) is the contract that says a third-party tool can process client personal data only on your instructions, keep it secure, and not use it for their own unrelated purposes.

For each processor below, do these steps:

Confirm the tool is actually handling client personal data (CVs, emails, payment data, notes).
Sign or accept the provider's DPA / data processing terms (usually in the account privacy/compliance settings, or via a click-to-accept terms update).
Check the provider's AI / training settings and keep training **off** for client content where the setting exists.
Save a copy/screenshot or confirmation email of the accepted DPA for your records.
Note the date completed next to the item.

|---|---|---|---|---|

| **OpenAI (ChatGPT / API)** | CV drafting with client CV content | OpenAI account → Settings / Organization → Data controls + Business / API terms and DPA. Prefer API/business usage with training off. | [ ] | |

| **Google (Gemini)** | Fallback AI drafting | Google Cloud / Gemini / Workspace admin privacy terms and DPA if used via Google Cloud; consumer Gemini terms if used only as a manual tool. Prefer enterprise/API path with training controls. | [ ] | |

| **Stripe** | Payment processing once connected | Stripe Dashboard → Settings → Legal / Privacy / Data Processing Agreement. Accept Stripe DPA and confirm business details. | [ ] | |

| **Supabase** | App/database storage once site is live | Supabase project → Organization / Project settings → Legal / DPA or privacy docs. Accept Supabase DPA before storing live client CVs. | [ ] | |

Practical order for launch:

OpenAI first (already used for CV work).
Stripe and Supabase before website checkout/storage go live.
Tide and Wise if still used for payments.
Google/Gemini only if actually used for client content.

If a provider only offers standard terms (no separate DPA button), keep a PDF/screenshot of the accepted terms and privacy policy version on the date you accepted them.