Last updated: December 2024

​

Welcome to Clu, and thank you for taking the time to read our Privacy Policy. Clu is an inclusive, skills-based hiring platform designed to promote equity of opportunity in the job market. We are passionate about creating life-changing opportunities for all users and are committed to protecting your privacy and ensuring compliance with data protection regulations.​

​

1. Overview

​

This Privacy Policy explains how Included.AI Ltd and its affiliates (collectively referred to as "Clu", "we", and "us") collect, process, share, and utilise information that identifies or relates to an individual ("you" and "your") and their personal information ("Personal Data"). This includes information collected from:

• Visitors: Individuals visiting our website without creating an account or using the Platform's services.

• Individual Users: Job Seekers, employees, or other individuals engaging with Clu, whether referred through our Partner Organisations, Employer channels, or internal Employer processes.

• Business Users: Organisations subscribing to Clu to manage talent acquisition, workforce planning, or learning and development needs.

• Subscribers: Individuals opting to receive communications, including email subscriptions and updates from Clu.

 

This Privacy Policy applies to Personal Data provided through our site (www.getaclu.io), Clu’s Platform, Partner Organisation referrals, Employer channels, internal Employer workflows, events, and communications (collectively referred to as the “Platform”).

​

This Privacy Policy does not apply to information you provide directly to Employers, Partner Organisations, or third-party services integrated with Clu, including applications or services that Clu does not own, maintain, or control. Examples include:

• Employer Channels: If you apply for a job through an Employer's process, they may share your information with Clu to utilise our services for managing their talent acquisition or HR activities. Clu processes this data only in accordance with our agreement with that Employer. Your relationship with the Employer governs how they handle and share your information. For questions regarding their data practices, you should contact the Employer directly.

• Partner Organisations: When accessing Clu via Partner referrals (e.g., for employability purposes), the Partner Organisation's policies may govern how your data is collected and shared. Please refer to their privacy practices for more information.

• Third-Party Integrations: Services accessed via the Clu Application Programming Interface ("API") or linked websites are governed by the respective third party’s terms and privacy policies. Clu is not responsible for the privacy practices or data handling of these entities.

​

Commitment to Privacy and Data Protection
Clu is committed to safeguarding your Personal Data and ensuring compliance with applicable governance regulations, including but not limited to the General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA). We perform our responsibilities concerning the collection, processing, utilisation, and retention of Personal Data in accordance with these laws.

Clu uses your data solely for legitimate and lawful purposes, including:

• Enhancing the Platform’s functionality and user experience.

• Supporting equitable hiring practices and decision-making.

• Complying with applicable legal and regulatory obligations.

Clu employs robust security measures, including encryption, anonymisation, and regular audits, to ensure your data remains protected.

 

2. Personal Data Collection

​

2.1 Types of Data We Collect

You may choose to share various types of Personal Data with us through the Clu Platform. This data is collected to optimise the services we provide to both Individual and Business Users, as well as to support our inclusion-focused mission.

Examples include:

• Responses to marketing communications or surveys.

• Information shared via social media, forums, or event participation (e.g., business cards or contact details).

• Personal information submitted during demo requests, account creation, or job applications.

We collect the following Personal Data directly from you:

   2.1.1. Basic Information:

Full name, email address, and account log-in credentials when you create a Clu account.
Contact details (e.g., phone number) and professional information when completing forms for demos or applications.
   2.1.2. Profile Information:

Data added to your Clu profile, such as resumes, LinkedIn/social media links, professional biographical details, references, and results from skills profiling tools.
   2.1.3. Demographic and Sensitive Information:

• During profile setup, you may self-identify your demographic profile (e.g., gender, ethnicity, disability status) and share additional inclusion-focused information. Providing this information is optional. It will not impact your access to our services but may:

  • Help Clu provide safeguarding and inclusion-focused services.

  • Assist Employers and Partners in creating equitable opportunities aligned with your skills.

  • Improve Clu’s algorithms for identifying and mitigating bias.

• Sensitive demographic data is anonymised and aggregated for research or platform improvement purposes unless explicit consent is provided for specific uses.

   2.1.4. For Business Users Only:

• Contact and Organisation Details: Name, email address, job title, phone number, and company information during account creation or demo requests.

• Activity Data: Data shared through interaction with Clu tools (e.g., job postings, candidate profiling, and team management activities).

   2.1.4. Usage Data:

• Information collected from interactions with our platform, including IP address, device type, operating system, browser type, screen resolution, language preferences, and time spent on various pages.

   2.1.5. Application Information:

• Data provided to us by Employers about you (e.g., contact details, application data, or referral information).

 

2.2. Data Collection via Employers and Partners

• Employers: Employers using Clu may share your data (e.g., applications or profiles) with us to utilise Clu’s recruitment and talent management services. Clu processes this information solely as outlined in our agreements with these Employers.

• Partners: If referred to Clu via Partner Organisations, they may provide personal data to facilitate your access to the Clu Platform. Data collection and sharing practices are governed by the Partner’s policies, which you should review for further clarity.

For both scenarios, Clu acts as a Data Processor on behalf of the Employer or Partner, ensuring compliance with applicable privacy laws.

​

2.3. Cookies and Tracking Technologies
Our websites use cookies and other technologies to function effectively and provide analytics. These tools track:

• IP address, location, device type, browser type, screen resolution, operating system, and language preferences.

• Your usage data across websites and devices (e.g., time spent on pages, links clicked).

• Activity across third-party services integrated with Clu for functionality and diagnostics. Clu utilises Google Analytics and similar tools to analyse user activity. For details about cookies and analytics, review our Cookie Policy.

 

2.4. How We Handle Sensitive Data
Any sensitive demographic or personal data provided (e.g., ethnicity, gender, disability status) is optional and subject to strict confidentiality. This data:

• Is never disclosed to Employers, Partners, or third parties without your consent.

• May be aggregated and anonymised to improve platform insights and capabilities.

• Helps us fulfil our mission of equitable hiring and inclusion.

 

2.5. Optional Data Sharing
You may opt to enhance your profile with demographic or other sensitive information. By doing so, you acknowledge:

• The potential benefits, such as improved opportunity matching or insights.

• Your ability to request removal of this data at any time.

 

3. How We Use Personal Data

​

Clu processes your Personal Data in compliance with applicable data protection laws, including GDPR and CCPA. We use Personal Data to provide our services, support platform functionality, and pursue our legitimate business interests, as outlined below.

​

3.1. Providing Services
We use Personal Data to deliver the core functionalities of the Clu Platform, including:

   3.1.1. For Individual Users:

• Creating and managing Clu profiles for opportunity matching, skills mapping, and organisational inclusion initiatives.

• Supporting safeguarding and inclusion-focused services, where optional demographic or personal data is provided.

• Sharing anonymised and aggregated skills insights with Employers or Partners to improve job matching and talent management processes.

   3.1.2. For Business Users:

• Managing subscriptions, user access, and platform tools such as talent mapping, job posting, and analytics.

• Enabling collaboration between Business Users and Individual Users in compliance with Clu’s ethical and safeguarding standards.

   3.1.3. For Both User Types:

• Ensuring platform security, availability, and functionality.

• Providing customer support and responding to platform-related inquiries.

 

3.2. Marketing and Events Communications
We use Personal Data to keep you informed about Clu’s services, updates, and events:

• Sending email marketing communications about Clu products and services, invitations to events, or surveys (in compliance with applicable consent laws).

• Following up with Individuals or Business Users who have interacted with Clu at trade shows, conferences, or through other engagements.

• Offering tailored content and updates to enhance your experience and engagement with Clu.

You may manage your communication preferences or withdraw your consent for marketing communications at any time by contacting us at hello@getaclu.io.

 

3.3. Advertising
We may use cookies and similar technologies to provide targeted advertisements for Clu services on our Platform and third-party websites, where permitted by applicable laws. For example:

• Interest-Based Advertising: Using cookies to identify your device and serve ads for Clu services on external websites.

• Cookie Preferences: You can control the cookies used for advertising purposes through our Cookie Policy.

We do not share, rent, or sell Personal Data for interest-based advertising purposes. Clu does not respond to "Do Not Track" browser signals due to the absence of an industry standard.

​

3.4. Compliance and Legal Obligations
Clu may use Personal Data to comply with legal or regulatory requirements, including:

• Responding to lawful requests or court orders.

• Ensuring compliance with safeguarding, inclusion, and data protection standards.

• Auditing, security monitoring, and fulfilling our obligations under employment or discrimination laws.

​

3.5. Improving Our Services
We use Personal Data to:

• Enhance and optimise Clu’s technology, including AI tools such as TalentGPS.

• Conduct anonymised research and analysis to refine platform insights and mitigate bias.

• Develop new features and improve existing services based on aggregated user interactions.

​

3.6. Safeguarding Standards

No use of Personal Data will breach or jeopardise Clu Safeguarding Policy, including:

• Optional demographic or personal data shared by Individual Users is never disclosed to Employers, Partners, or third parties without explicit consent.

• Safeguarding standards apply across all Clu services to protect vulnerable individuals and ensure equity of opportunity.

 

4. How We Disclose Personal Data

 

We are committed to maintaining the confidentiality and security of your Personal Data. All Clu staff undergo training on privacy and data protection, including the correct processes for handling Personal Data in compliance with relevant laws and Clu’s policies.

Clu does not sell or rent Personal Data to marketers or unaffiliated third parties. We share your Personal Data only with trusted entities under the circumstances described below:

​

4.1. Service Providers
We work with a limited number of service providers who perform specific services on our behalf, such as:

• Website hosting and maintenance.

• Data analysis and analytics, including anonymised AI-based insights.

• IT infrastructure and security.

• Customer support and email delivery.

• Auditing and compliance monitoring.

These service providers may require access to Personal Data to perform their functions. We authorise them to use or disclose the Personal Data solely as necessary to provide their services or comply with legal requirements. All service providers are contractually obligated to protect the security and confidentiality of the Personal Data they process on our behalf.

​

4.2. Business Partners
We share Personal Data with trusted business partners when necessary to:

• Provide platform services to you, such as connecting Individual Users with relevant opportunities or Employers.

• Enable Business Users to utilise Clu’s tools for hiring, workforce planning, and skills-based initiatives.

Any Business Partner we procure must demonstrably prove they operate and manage data to the same standards as us.

​

4.3. Employers

• For Individual Users: We may share your Personal Data with Employers who use Clu’s services for recruiting, internal workforce planning, or skills-based initiatives. This includes sharing anonymised skills insights or specific application data with your explicit consent.

• Clu never discloses optional demographic or safeguarding data to Employers without your explicit consent. Any aggregated or anonymised insights shared with Employers are designed to ensure compliance with Clu’s Safeguarding Policy and inclusive hiring commitments.

 

4.4. Corporate Transactions
If Clu undergoes a business transaction such as a reorganisation, merger, sale, joint venture, transfer of assets, or change of control:

• Your Personal Data may be disclosed to the relevant third parties involved in the transaction.

• Any entity that acquires all or part of Clu’s business will have the right to use your Personal Data as described in this Privacy Policy, unless otherwise agreed.

 

4.5. Legal Compliance and Harm Prevention
We may disclose Personal Data where we believe it is necessary to:

• Comply with applicable laws, regulations, or legal obligations.

• Enforce our Terms of Service or contractual agreements.

• Protect the rights, privacy, safety, and property of Clu, its users, or others.

• Respond to lawful requests from courts, regulatory agencies, law enforcement, or other government authorities, including those outside your country of residence.

​

4.6. Transparency in Data Sharing
Where applicable, Clu ensures that:

• Any data shared is limited to the purpose it is required for and processed securely.

• Individual Users are informed and provided the opportunity to control data shared beyond the scope of anonymised or aggregated insights.

​

 

5. Your Rights and Choices

​

You have rights and choices regarding our use, processing, and disclosure of your Personal Data. We are committed to ensuring that you can exercise these rights easily and transparently.

 

5.1. Opting Out of Communications
You can opt out of receiving marketing or promotional communications from Clu:

• If you no longer wish to receive marketing-related emails, you may opt out by clicking the unsubscribe link included in such emails.

• We will comply with your request as soon as reasonably practicable. However, opting out of marketing emails will not affect our ability to send you important service-related or administrative communications that are required for using the Platform.

 

5.2. Managing Your Personal Data
You can review and manage your Personal Data through your account settings:

• Individual Users: You can review, correct, or update your Personal Data by signing into your Clu account and accessing your profile dashboard or contacting us at dpo@getaclu.io.

• Business Users: You can manage account-related Personal Data through your account's administrator or by contacting us at dpo@getaclu.io.

 

5.3. Your Data Protection Rights
Depending on your location and applicable law, you may have the following rights concerning your Personal Data:

• Right to Access: Request confirmation of whether Clu processes Personal Data relating to you, and if so, obtain a copy of that Personal Data.

• Right to Rectification: Request that Clu rectifies or updates inaccurate, incomplete, or outdated Personal Data.

• Right to Erasure: Request that Clu erases your Personal Data in certain circumstances, such as when it is no longer necessary for the purposes it was collected, or where you withdraw your consent.

• Right to Restrict Processing: Request that Clu restricts the processing of your Personal Data in specific situations, such as while a rectification or objection request is being processed.

• Right to Data Portability: Request that Clu exports your Personal Data in a structured, commonly used, and machine-readable format to another data controller, where technically feasible.

• Right to Object: Object to the processing of your Personal Data based on legitimate interests, including profiling, unless we can demonstrate compelling legitimate grounds for the processing.

• Right to Withdraw Consent: If the processing of your Personal Data is based on your consent, you have the right to withdraw your consent at any time.

​

5.4. Exercising Your Rights

• You can request a copy of your stored Personal Data or delete your account and associated data by contacting us at dpo@getaclu.io. We will process your request within the timelines required by applicable data protection laws.

• If you are an Applicant using Clu’s services via an Employer, please direct any data-related requests to the Employer as the data controller for your information in such circumstances.

• For safeguarding-related data, Individual Users can withdraw optional demographic or safeguarding information at any time via their profile dashboard.

​

5.5. Legal Restrictions
Some rights may be limited under applicable data protection laws. For example:

• Requests may be denied if fulfilling them would compromise the rights and freedoms of others.

• Certain data may need to be retained to comply with legal obligations, resolve disputes, or enforce agreements.

 

6. Security and Retention

​

6.1. Security Measures
We take the security of your data very seriously. To protect your Personal Data against unauthorised access, destruction, loss, alteration, or misuse, we maintain robust organisational, technical, and administrative measures, including:

• Role-Based Access Control: Personnel access to Personal Data is restricted to authorised employees, contractors, and service providers who require it to perform their duties in delivering the services.

• Encryption and Safeguards: We use encryption technologies, secure servers, and other safeguards to protect Personal Data during transmission and storage.

• Ongoing Monitoring and Training: Regular security audits, vulnerability assessments, and employee training ensure that our data security practices remain up-to-date and effective.

• Incident Reporting: In the event of a suspected data breach, we will take immediate steps to mitigate risks and notify affected parties in accordance with applicable laws.

If you suspect that your account has been compromised, please notify us immediately at dpo@getaclu.io.

 

6.2. Data Retention
We retain Personal Data for as long as it is necessary to fulfill the purposes outlined in this Privacy Policy, including:

• Individual Users: Personal Data will be retained as long as you remain a Member and maintain an active Clu account.

• Business Users: Data will be retained for the duration of the contractual relationship and as required for business or legal purposes.

• Legal and Regulatory Obligations: We may retain Personal Data beyond account termination to comply with applicable laws, such as tax, accounting, financial reporting, safeguarding, or employment regulations.

• Limitation Periods: Retention will align with applicable limitation periods for potential legal claims or as required by records retention laws.

 

6.3. Deletion or Anonymisation
When Personal Data is no longer required for the purposes outlined above, we will either:

• Delete the data securely, ensuring it cannot be reconstructed or retrieved; or

• Anonymise the data, rendering it non-identifiable and suitable for use in aggregated insights or analytics.

 

7. International Data Transfers

 

7.1. Data Storage and Processing
All Personal Data collected through the Clu platform is primarily stored and processed within the United Kingdom. However, in certain circumstances, Personal Data may also be stored or processed in other jurisdictions as required by law or to fulfill our contractual obligations to users.

​

7.2. Transfers to Other Countries
Where it is necessary to transfer Personal Data to countries outside the UK or European Economic Area (EEA), including jurisdictions that may not have data protection rules equivalent to those in your country of residence, we ensure that such transfers comply with applicable data protection laws. These measures include:

• Implementing contractual safeguards such as Standard Contractual Clauses (SCCs) approved by the UK or EU regulatory authorities.

• Ensuring data transfers are subject to adequacy decisions, where the UK recognises the receiving country as providing an adequate level of data protection.

 

7.3. Compliance with Local Laws
In cases where laws or regulations require processing or storage of data within specific jurisdictions (e.g., to comply with local employment, tax, or safeguarding laws), we will ensure such processing aligns with our commitment to data protection standards outlined in this Privacy Policy.

 

7.4. Third-Party Service Providers
We engage trusted third-party service providers to support our services. These providers are contractually bound to adhere to strict confidentiality and data protection standards. Where such providers operate outside the UK or EEA, we ensure that they provide safeguards consistent with UK and EEA data protection requirements.

 

7.5. Your Rights
You may contact us at dpo@getaclu.io for further information on:

• The specific mechanisms we use to safeguard your Personal Data during international transfers.

• Requests related to restricting or obtaining a copy of your transferred Personal Data.

By using the Clu platform, you acknowledge and consent to the potential transfer of your Personal Data in accordance with this section.

 

8. Use by Minors

The Platform is not intended for use by individuals under the age of seventeen (17), and we request that they not provide Personal Data through the Platform.

 

9. Updates To this Privacy Policy and Notifications

We are always finding ways to improve our Platform, which means we get new data and create new ways to use data. Our services are dynamic, and we often introduce new features, which may require the collection of new information. If we collect materially different personal data or materially change how we collect, use or share your data, we will notify you and may also modify this Privacy Policy. The “Last updated” designation at the top of this Privacy Policy indicates when this Privacy Policy was last revised. Any changes are effective when we post the revised Privacy Policy on the Platform. We may also provide you with disclosures and alerts regarding the Privacy Policy or Personal Data collected by posting them on our website and, if you are a Member, by contacting you through the email address listed in your Clu account.

​

10. Contact Us

To exercise your rights, to withdraw your consent to the processing, to unsubscribe from receiving marketing communications from us, if you have any questions about our privacy policy or about our processing of your personal data or to make a complaint, you can email us at dpo@getaclu.io or write to us at our registered office address:

Included.AI Ltd, Floor 3, Capital Tower Business Centre, Greyfriars Road, Cardiff, Wales, CF10 3AG

​

If you have unresolved concerns, and you live or work in the UK or believe that a personal data breach happened in the UK, you have the right to complain to the UK Information Commissioner's Office who can be contacted at:

• Telephone: 0303 123 11113

• Website: https://ico.org.uk/concerns/

• By post: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF.