Privacy Policy
Last updated: 12 August 2026
1. Who we are
Cutover Manager Services Ltd is the data controller for personal data
processed through the Cutover Manager platform at
community.cutovermanager.com.
- Registered in England and Wales, company number 14519429
- Registered office: 224 Bournemouth Road, Chandler's Ford, Eastleigh, SO53 3AF, England
- Contact: privacy@cutovermanager.com
We have not appointed a Data Protection Officer, as we are not required to.
2. What we collect
Information you give us when you register and build a profile
| Category | Examples |
|---|---|
| Identity and contact | Name, email address, phone number, city, country |
| Professional profile | Profile headline, biography, years of experience, availability and availability date, contract type and location preferences, skills, IT systems, industries, application categories, languages, LinkedIn URL |
| Work history | Role, client or employer, dates, location, and a free-text description of each engagement |
| Documents and images | Profile photograph, cover image, CV/resume |
| Company details (company accounts) | Company name, type, description, address, website, logo |
Information generated by using the Platform
| Category | Examples |
|---|---|
| Account data | Password (stored only as a secure hash), role, approval status, profile visibility setting, timestamps |
| Messages | The content of messages you send to other members, and who they were sent to |
| Reviews | Ratings and written reviews you give or receive |
| Technical data | IP address and browser user-agent stored with your login session; server logs |
Information from the previous platform. If you were a member of the earlier Bubble-based community site, we migrated your existing profile, work history, files and messages to this platform in August 2026. We did not migrate passwords — those were never available to us — which is why migrated members are asked to set a new one.
We do not collect a home or street address. We ask only for your city and country, because that is all a client needs to know about where you are based.
We do not collect special category data. Please do not include health information, political opinions, religious beliefs or similar sensitive details in free-text fields such as your biography or work history.
3. Why we use it, and our lawful basis
| What we do | Lawful basis |
|---|---|
| Create and run your account; authenticate you; let you set a password | Contract — performing our agreement with you (the Terms of Use) |
| Publish your profile in the public directory and on your profile page, subject to your visibility setting and our approval | Contract |
| Let members message each other | Contract |
| Publish reviews given and received | Legitimate interests — a credible marketplace requires visible reputation signals |
| Review profiles before publication ("Verified") | Legitimate interests — protecting members and the credibility of the Platform |
| Send service emails: invitations, password resets, notices about your account | Contract |
| Keep the Platform secure, investigate misuse, enforce our terms | Legitimate interests — security and prevention of misuse |
| Keep records, respond to legal claims | Legal obligation, and legitimate interests in defending claims |
| Send marketing or newsletters | Consent — we send none today; if we ever do, we will ask you first |
Where we rely on legitimate interests, we have considered the impact on you and concluded that our interests do not override your rights. You can object at any time (section 8).
4. What is public, and what is not
This matters more than the legal basis for most people, so it is stated plainly.
Public — visible to anyone on the internet, and to search engines: your name, profile photograph, headline, biography, location (city and country), experience, skills, systems, industries, applications, languages, LinkedIn link, your work history entries, and reviews of you — but only if your profile visibility is set to public and your profile has been approved by us. A profile set to private, or not yet approved, is not shown anywhere publicly.
Never public: your email address, phone number, the content of your messages, and your account settings.
Your CV is yours to publish or not. It is private by default — including every CV migrated from the previous platform — and you can make it publicly downloadable from your profile settings at any time, or make it private again. Before you publish it, check what is in it: a CV commonly contains a home address and a personal phone number, and publishing it makes that information available to anyone on the internet.
You control publication. You can switch your profile between public and private at any time in your account, and you can hide individual work-history entries.
5. Who we share it with
We do not sell personal data, and we do not share it for anyone else's marketing.
We use a small number of service providers who process data on our instructions:
| Provider | What they do | Where | Safeguard |
|---|---|---|---|
| Hostinger | Hosts the server the Platform and its database run on | United Kingdom | Server location |
| Resend | Delivers transactional emails only: password setup, password reset, email verification | United States | UK Addendum to Standard Contractual Clauses; EU-US Data Privacy Framework certification |
We may also disclose personal data where we are legally required to, or to establish, exercise or defend legal claims.
The previous platform. Until it is decommissioned, a copy of the migrated data also remains with our former provider, Bubble. We expect to decommission it by 27 August 2026, after which that copy will be deleted.
6. International transfers
Our servers and our database are in the United Kingdom.
Resend processes our transactional emails (password setup, password reset, email verification) outside the UK, in the United States. These transfers are protected by:
- The UK International Data Transfer Addendum to the Standard Contractual Clauses, incorporated into Resend's Data Processing Addendum
- Resend's certification under the UK Extension to the EU-US Data Privacy Framework
Resend's Data Processing Addendum is available at https://resend.com/legal/dpa and is legally binding upon your account creation with Resend.
7. How long we keep it
- While your account is open, we keep your data for as long as you use the Platform.
- When you close your account, we immediately remove your name, email address, phone number, biography and LinkedIn link, delete your photograph, cover image and CV from our storage, and your profile stops being publicly visible.
- Content shared with others stays visible but is no longer attributed to you. Messages remain readable by the people you sent them to, and reviews you wrote remain on the profile you wrote them about, shown as from a deleted user. This is deliberate: erasing them would remove other people's records of their own conversations.
- Backups are kept for 30 days, after which they are deleted. Data you have asked us to erase may persist in a backup until that period expires, and will not be restored into the live system.
- Login sessions expire after 2 hours of inactivity. Invitation links expire after 14 days.
8. Your rights
Under UK data protection law you have the right to:
- access the personal data we hold about you;
- rectify it if it is inaccurate — most of it you can correct yourself in your account at any time;
- erase it — you can delete your account yourself, and section 7 explains exactly what that does;
- restrict or object to our processing, including any processing based on legitimate interests;
- portability — receive the data you gave us in a machine-readable format;
- withdraw consent where we rely on it, without affecting processing that already happened.
To exercise any of these, email privacy@cutovermanager.com. We will respond within one month. We may ask you to confirm your identity first.
If you are unhappy with how we have handled your data you can complain to the
Information Commissioner's Office — ico.org.uk, 0303 123 1113 — though we
would prefer the chance to put it right first.
9. Cookies
The Platform uses only strictly necessary cookies. There is no analytics, no advertising, no tracking, and no embedded third-party content.
| Cookie | Purpose | Lasts |
|---|---|---|
| Session cookie | Keeps you signed in as you move between pages | Until you close your browser, or 2 hours of inactivity |
| CSRF token | Security — prevents forged requests from other sites | Session |
| "Remember me" | Keeps you signed in between visits, if you choose it | 1 year or until you sign out, whichever comes first |
Because these cookies are necessary for the Platform to work, we do not ask for consent to set them — but you can block or delete cookies in your browser, in which case you will not be able to sign in.
Our transactional email provider (Resend) does not place cookies on the Platform.
If we ever add analytics or other non-essential cookies, we will ask for your consent first.
10. Security
The Platform is served over HTTPS. Passwords are stored only as salted hashes and are never readable by us or recoverable — which is why a forgotten password is reset rather than retrieved. Access to the production server and database is restricted to the operator. Administrative access to member data is limited to accounts with an admin role.
No system is perfectly secure. If a breach occurs that is likely to affect your rights, we will notify the ICO within 72 hours and tell you where required.
11. Children
The Platform is for working professionals and is not intended for anyone under 18. We do not knowingly collect data about children. If you believe a child has registered, contact us and we will remove the account.
12. Changes to this policy
We may update this policy. If a change materially affects how we use your data we will tell you by email or through the Platform before it takes effect. The date at the top shows when it was last changed.
13. Contact
Cutover Manager Services Ltd 224 Bournemouth Road, Chandler's Ford, Eastleigh, SO53 3AF, England Company number 14519429 privacy@cutovermanager.com