Privacy Policy

Last updated: 19 May 2026

This Privacy Policy explains how Shearwater, a sole trader business operated by Josh Francis ("we", "us", "Shearwater"), collects, uses, stores, and protects your personal data. We are committed to handling your personal data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

1. Who We Are

Data Controller: Josh Francis, trading as Shearwater ICO Registration Number: C1937752 Email: hello@shearwatercareers.com Website: shearwatercareers.com Address: Devon, England

2. What Personal Data We Collect

2.1 Data You Provide Directly

When you use our services, we may collect the following personal data: Name and email address (provided at checkout and via intake forms) LinkedIn profile URL and associated profile content Curriculum vitae (CV) and career history information Academic qualifications and professional memberships Employment history and target role information Job application details where the Application Pack service has been purchased Right to work status in the UK (for International clients)

2.2 Data Collected Automatically

Our website is hosted on Squarespace, which may collect technical data including IP addresses, browser type, and pages visited. Please refer to the Squarespace Privacy Policy at squarespace.com/privacy for full details.

When you use the free Environmental CV Assessment, you may upload a CV in PDF or Word format or paste CV text directly into the assessment.

The assessment processes the information contained in your CV to generate an automated score and classification across Technical Visibility, Commercial Visibility, Regulatory Fluency and Market Positioning.

Your name and email address may be collected before the detailed results and priority action are displayed.

The free assessment is automated. It is not a personal review by Josh Francis and does not replace a paid Shearwater service.

2.3 Payment Data

Payment is processed by Stripe. We do not collect or store your payment card details. Stripe processes and stores payment data in accordance with their own privacy policy at stripe.com/gb/privacy.

3. How We Use Your Personal Data

3.1 Lawful Basis

We process your personal data on the following lawful bases under UK GDPR: Contract: to deliver the services you have purchased Legitimate interests: to improve our services and communicate with clients about their orders Consent: to send marketing emails to subscribers who have opted in via our self-assessment signup form Legal obligation: to comply with applicable UK law including tax and financial record-keeping requirements

3.2 Specific Uses

We use your personal data to: Deliver the Technical Audit, Application Pack, or other service you have purchased Communicate with you about your order, including delivery and follow-up Send you the Technical Invisibility Self-Assessment PDF and follow-up email sequence where you have signed up for this Send you occasional marketing emails where you have given consent to receive them Maintain financial records as required by HMRC

4. Third Parties We Share Data With

We share your personal data only with the following third parties, and only to the extent necessary to deliver our services.

Stripe (stripe.com) -- payment processing. Stripe processes your payment details in accordance with PCI DSS standards and acts as an independent data controller for payment data.

Google LLC (google.com) -- we use Google Forms for intake data collection, Google Docs for delivery of outputs, Google Drive for secure file storage, and Google Sheets for client tracking. Data is processed in accordance with Google's Privacy Policy and applicable data processing agreements.

MailerLite (mailerlite.com) -- email marketing platform. Used to store assessment leads and send assessment-related emails where the user has provided their email address. Where you have subscribed to receive emails from Shearwater, your name and email address are stored in MailerLite. You can unsubscribe at any time via the link in any email. We do not sell, rent, or otherwise share your personal data with any other third parties for their own marketing or commercial purposes.

Vercel
Used to host the Environmental CV Assessment application and process assessment submissions.

5. International Data Transfers

Some of our third-party processors may transfer or store your data outside the United Kingdom. Where this occurs, we ensure that appropriate safeguards are in place in accordance with UK GDPR, including Standard Contractual Clauses or adequacy decisions where applicable.

6. How Long We Keep Your Data

Client intake form data and delivered work: 2 years from the date of delivery Payment and transaction records: 6 years from the end of the relevant tax year, as required by HMRC Email subscriber data: until you unsubscribe or request deletion Testimonials: retained indefinitely unless you request removal After these periods, your data will be securely deleted or anonymised.

Where files are deleted after processing

Uploaded CV files are processed to generate the assessment and are not retained after processing. Email addresses and assessment results may be retained for the purposes described in this policy.

Where files or text are retained

Uploaded CV files or extracted CV text may be retained to operate the assessment, investigate technical errors and provide the assessment results. They are deleted after this period unless a longer retention period is required by law or the user purchases a paid service.

7. Your Rights Under UK GDPR

You have the following rights in relation to your personal data:

Right of access -- you have the right to request a copy of the personal data we hold about you.

Right to rectification -- you have the right to request that we correct any inaccurate or incomplete personal data.

Right to erasure -- you have the right to request that we delete your personal data in certain circumstances. This right does not apply where we are required to retain data by law, such as financial records.

Right to restrict processing -- you have the right to request that we restrict the processing of your personal data in certain circumstances.

Right to data portability -- you have the right to receive your personal data in a structured, commonly used, machine-readable format where processing is based on consent or contract.

Right to object -- you have the right to object to processing based on legitimate interests, and to object to direct marketing at any time.

Rights related to automated decision-making -- we do not use automated decision-making or profiling that produces legal or similarly significant effects.

Right to withdraw consent -- where processing is based on consent, you may withdraw your consent at any time. Withdrawal of consent does not affect the lawfulness of processing prior to withdrawal.

To exercise any of these rights, contact us at hello@shearwatercareers.com. We will respond within one calendar month of receiving your request.

8. Cookies

Our website is hosted on Squarespace, which uses cookies to operate the website and collect analytics data. You can manage your cookie preferences via the cookie banner displayed on your first visit to shearwatercareers.com. We do not use cookies for advertising or behavioural tracking purposes beyond the standard analytics provided by Squarespace.

9. Security

We take the security of your personal data seriously. Measures in place include: Client files stored in Google Drive with access restricted to Shearwater only Delivered work shared via private Google Doc links sent to the email address provided at purchase Payment processed by Stripe using industry-standard encryption and PCI DSS compliance Email communications secured via Google Workspace In the event of a personal data breach likely to result in a risk to your rights and freedoms, we will notify the ICO within 72 hours and notify affected individuals without undue delay where required.

10. How to Complain

If you are unhappy with how we have handled your personal data, please contact us in the first instance at hello@shearwatercareers.com. We will respond within one calendar month. If you remain dissatisfied, you have the right to lodge a complaint with the Information Commissioner's Office: Information Commissioner's Office Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF Telephone: 0303 123 1113 Website: ico.org.uk

11. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. The current version will always be published at shearwatercareers.com/privacy. We will notify active clients of any material changes by email where reasonably practicable.