UnionPrivacy notice
Version 2026-10-06.1 · Prepared 6 October 2026
Who operates UnionRelay?
UnionRelay operator — details awaiting completion. Business address must be added before launch. Contact: the contact channel shown on your order or account invitation. UnionRelay is the product name and does not, by itself, identify a separate legal entity.
Our role
We control account administration, subscriptions, security and support information. For prospect lists, campaign conversations, client files and candidate data uploaded or collected on a customer’s instructions, that customer normally determines the purpose and we act as its processor. An agency may itself be processing for its client. Contact the relevant business about its campaign as well as us where appropriate.
Information and sources
The software can store names, work contact details, passwords in hashed form, organisation and membership data, public business research and source URLs, messages, schedules, files, CV text, applications, proposals and acceptance evidence. Connected services supply records you authorise. Technical logs and request information may be processed for security. Payment card entry takes place with Stripe, not in our application forms. Do not upload patient records, special-category data or children’s profiles into this general-purpose service.
Why information is used
Account access and contracted service administration rely on contractual necessity where applicable. Security, fraud prevention and appropriate business administration may rely on legitimate interests, assessed against individuals’ rights. Statutory records rely on legal obligation. Optional consent-based activities require a genuine choice and withdrawal route. Customers must identify their own lawful basis for prospecting or recruitment. Public availability does not itself give permission to market.
AI and external recipients
Authorised inputs and relevant context may be sent to the chosen AI, discovery, messaging, calendar or audit provider. Host administrators and authorised support staff may access information for their work. Access is scoped by organisation and client assignment. We may disclose information when legally required. See the provider register for actual recipients and transfer arrangements. This application does not contain an advertising-data resale feature or a model-training pipeline. A provider’s separate retention or training terms must be checked before enabling it.
Storage and retention
Hosting: not yet confirmed for deployment. The deployment retention schedule is not yet configured. Records and backups are not automatically erased merely because a subscription expires. A completed retention and deletion procedure is required before live personal data is accepted. Minimal suppression information may be retained to respect an objection. Specific legal holds must be justified and access restricted.
Rights and contact
Ask the contact channel shown on your order or account invitation about access, correction, deletion, restriction, portability or objection where applicable, and withdraw consent for consent-based processing. Identity checks may be needed. We aim to respond within the applicable legal timeframe, normally one month for UK GDPR requests, and explain any lawful extension or refusal. You can complain to the ICO or your competent regulator. Customer-controlled records may need to be handled with that customer.
Changes
We date policy versions and should notify affected users of material changes. This notice explains processing and is not a request to consent to every activity. Marketing permission must be managed separately.
Related policies: Privacy · Terms · Cookies · Contact and complaints