Privacy notice

This notice explains what personal data HIRING UK collects, why we collect it, what we do with it and the rights you have. It is written to meet the UK GDPR and the Data Protection Act 2018, and it follows the Information Commissioner's employment guidance on recruitment and selection, which covers everything from advertising a vacancy to deleting the information afterwards.

1. Who we are

HIRINGUK LTD, trading as HIRING UK, operates the job board at www.hiringuk.co.uk and is the data controller for the personal data described below.

Data protection contact: Grigore Octavian Pupazan, Data Protection Lead and director of HIRINGUK LTD (appointed 21 August 2026, on the public register at Companies House). Write to dpo@hiringuk.co.uk, or to privacy@hiringuk.co.uk, which reaches the same person, or to the postal address below. Anything about your own data goes to him directly rather than into a queue.

We are not required to appoint a statutory Data Protection Officer under Article 37: we are not a public authority, we do not monitor people on a large scale, and our core activity is not large scale special category processing.

We have deliberately not appointed one voluntarily either, and it is worth explaining why, because the address above says dpo. If an organisation appoints a DPO voluntarily, the full statutory duties in Articles 37 to 39 apply exactly as if the appointment were compulsory. One of those is independence: Article 38(6) says a DPO must have no conflict of interest, and the Court of Justice has held that a DPO cannot be somebody who determines the purposes and means of the processing. In a company this size that is the director, so appointing him as the Data Protection Officer would create the conflict the law is designed to prevent, and would be worth less than nothing to you.

So the role is named honestly as Data Protection Lead: the accountable person, who owns the business, answers your emails himself and has nobody to pass them to. The dpo address is used because it is the one people try first. If we grow to the point where a DPO is required, or worth appointing, it will be somebody independent of the day to day decisions, and this page will say so on the day it happens.

1a. What we do not do, in recruitment terms

The Information Commissioner's recruitment guidance asks organisations to be clear about sourcing, automated tools and vetting. Ours is a short list because we do none of it:

• We do not source or research candidates online. We do not look you up, scrape profiles, or buy candidate data from anybody.
• We do not use artificial intelligence to sift, score, rank or reject applications, and we do not use video interviewing or automated assessment tools.
• We do not carry out vetting or background checks, credit checks or criminal record checks. Where a role legally requires a DBS check, the employer arranges it.
• We do not ask for special category data and we actively discourage you from including it (section 5).
• We do not use your CV to train any model.

2. The data we collect

Candidates

• When you apply for a job: your name, email address, phone number if you give one, your covering note and your CV file, plus the advert you applied to and the date.
• If you ask us to keep your CV on file: a copy of that CV, your name, email, phone number, the role you were looking at, the sector and the town, plus the record of your consent (the wording, the version and when you gave it).
• If you create a candidate account while applying: your name, email address, phone number and a password stored only as a salted hash, so you can see the applications you have sent and delete them yourself.

Employers

• Company name, contact name, work email, phone number, website and a password stored only as a salted hash (we cannot read it).
• The adverts you publish, the orders you place and their payment status.

Everybody

• Messages you send through the contact form.
• Standard server logs generated when a page is requested, which can include an IP address, and the strictly necessary cookies listed in the cookie policy, including the one that stores your cookie choice.

Special category data: we would rather not have it

Special category data is the most sensitive kind of personal data: information about your health or disability, racial or ethnic origin, religion or belief, political opinions, trade union membership, sex life or sexual orientation, and genetic or biometric data. UK GDPR allows it to be processed only in narrowly defined circumstances.

It matters on a job board because it arrives without anybody intending it to. A CV or a covering note might mention an accident and the adjustments somebody needs, a disability, a union role, a religious holiday, or a country of origin. None of that is asked for and none of it is needed.

We actively discourage candidates from including special category data (health, disability, ethnicity, religion, political opinions, trade union membership, sex life or sexual orientation, genetic or biometric data) in a CV or covering note. We do not need this information to process an application. You do not need to give your date of birth, marital status, health, religion, ethnicity, a photograph, or your nationality beyond confirming your right to work, and a good UK employer will not expect any of it. Our CV guide says the same thing for the same reason.

If a candidate nevertheless includes such data, we process it only on the basis of their explicit consent under Article 9(2)(a) UK GDPR, and only for the purpose of that specific application. We do not use it for any other purpose. We do not extract it, index it, search on it, build any profile from it, or make any decision using it. It stays inside the document you attached, travels to the employer you applied to, and is deleted with that application on the published schedule.

If you ticked the separate box asking us to keep your CV on file for roles we recruit for ourselves, the same limit applies: explicit consent, for that purpose only, withdrawable in one click, and erased with the record.

The exact wording of that box, as it appears on the form and as it is stored with the consent record (v1, 28 August 2026):

Keep my CV and details on file at HIRINGUK LTD so the HIRING UK team can contact me about other jobs, including roles HIRINGUK LTD recruits for as an employment agency or employment business. I understand my CV is not shared with any other employer or sold to anybody, that only the HIRING UK team can see it, that it is erased after twelve months unless I confirm again, and that I can withdraw at any time with one click.

Needing an adjustment is different, and you should ask for one. If you need something changed to attend an interview or to do the job, telling the employer is sensible and the Equality Act 2010 requires them to consider it. You can tell the employer directly in your covering note, or ask us and we will pass the request to that employer for that application and nothing else. You never have to explain a diagnosis to get an adjustment considered.

Criminal offence data under Article 10 is treated the same way. We never ask about convictions. Where a role legally requires a DBS check, the employer arranges it, not us.

3. Why we use it, and our lawful basis

What we do	Lawful basis
Send your application and CV to the employer who placed the advert	Performance of a contract with you, and your consent when you press send
Keep your CV on file so we can tell you about roles we are recruiting for ourselves	Your consent, given with a separate tick box, withdrawable in one click. Explicit consent under Article 9(2)(a) for anything special category that a CV happens to contain
Send you job alerts you asked for	Your consent, given with two separate tick boxes, withdrawable with one click in every email
Run employer accounts, publish adverts, raise and collect invoices	Performance of a contract with the employer, and our legal obligation to keep accounting records
Answer contact form messages	Legitimate interests: replying to somebody who contacted us
Keep the site secure, prevent spam and fraud, keep server logs	Legitimate interests: security and integrity of the service
Meet tax, accounting and legal obligations	Legal obligation

2a. Keeping your CV on file, if you ask us to

HIRINGUK LTD is a recruitment business as well as a job board, so we sometimes fill roles ourselves, permanent and temporary. When you apply for a job you can tick a separate, optional box asking us to keep your CV on file so that we can contact you about those roles.

• It is off unless you tick it. The box is never pre ticked, it is separate from the application itself, and leaving it alone changes nothing: your application still goes to that employer in the usual way.
• Our lawful basis is your consent (Article 6(1)(a) UK GDPR). Where a CV happens to contain special category data, for example about health or ethnicity, we rely on your explicit consent under Article 9(2)(a). We ask you not to include anything of that kind, because we do not need it.
• We record what you agreed to. The exact wording, the version and the date and time are stored with your record, so we can always show you, or the ICO, precisely what was consented to.
• Who can see it: the HIRING UK team, and nobody else. It is not visible to any employer, it is not searchable by advertisers, there is no public route to it, and it is never sold, rented or shared. If you also ask for an anonymous card under section 2b, what appears publicly is that card and never the CV. The copy an employer received from your application is separate and is governed by the section below.
• What we use it for: contacting you about a role we are recruiting for. Nothing else. No marketing, no profiling, no automated decisions.
• How long: twelve months from the last time you confirmed it. We email you before the twelve months are up, and if you do nothing the record and the CV file are erased automatically.
• Withdrawing: one click, from any email we send or from your candidate area, or by emailing dpo@hiringuk.co.uk. It takes effect immediately, the CV copy is deleted, and it does not affect anything you did before you withdrew.

Plain English version: keeping your CV on file.

2b. The anonymous card on our available now list, if you ask for one

If your CV is on file you may also ask us to publish a short, anonymous card about you on our available now page, so that employers can enquire about you without knowing who you are. This is a second, separate decision with its own tick box and its own wording. Being on file does not put you on that page, and taking the card down does not take your CV off file.

• Our lawful basis is your consent (Article 6(1)(a) UK GDPR), given separately for this purpose. We store the exact wording you agreed to, its version, the page it was given on and the date and time.
• What the card shows: what you do, the sector, the area you can work in, your years of experience, the tickets or cards you hold, when you can start, and a description you wrote yourself. That is the complete list; the page is built from those fields alone.
• What it never shows: your name, your initials, your email address, your telephone number, your address or postcode, your date of birth, your CV, and the employers you have worked for. We refuse wording that contains any of it, and a person here reads every card before it is published.
• Special category data (health, disability, religion, race, sexuality, trade union membership, convictions) is not accepted on a card at all, and wording containing it is rejected rather than edited.
• Enquiries do not identify you. An employer who is interested writes to us. We then ask you whether you would like to hear about that company and that role. Nothing about you is passed on unless you say yes to that employer and that job. Silence is a no.
• How long: the card lives with your CV on file, so it disappears at the same twelve month point, and immediately if you withdraw. Search engines are asked not to index individual cards.
• Taking it down: one click, from the link in any email we send you, without a reason and without a conversation. It leaves the page at once.
• You are never charged. Work seekers pay us nothing, for this or for anything else.

You can read your own card exactly as an employer reads it, at any time, from the link in your emails.

3a. Job alerts and marketing

If you set up a job alert we use your email address to send matching adverts, at most once a week, on the basis of your consent. Every alert page and every email carries a one click stop link, and stopping takes effect immediately. We do not sell your address, we do not pass it to employers, and we do not send you anything else without asking first. Employers who hold an account may receive occasional service emails about their adverts, invoices and account, which are necessary to the contract rather than marketing.

Stop means stop, and it is enforced by the software. When you press the stop link we do three things at once: we switch off every alert on your address, not only the one you clicked from, we mark the consent as withdrawn with the date, and we add your address to a do not email list. That list is checked at the moment of sending, inside the one piece of code that sends anything, so no later sign up, no import and no future mailing can reach you by mistake. The only thing that lifts it is you asking us for something again on our own form, and if that happens we record the new consent and the lifting together.

You can also tell us to stop by simply replying to any email, or by writing to dpo@hiringuk.co.uk. It counts exactly the same and goes on the same list the same day. You may ask us to stop marketing only, which leaves us able to confirm that an application arrived, or to stop everything, which means we send you nothing at all.

One thing we keep, and we would rather tell you than surprise you. If you ask us to erase everything we hold about you, we keep the do not email entry: your address and the date you asked us to stop, and nothing else. If we deleted that too we would be free to email you again the next day, which is the opposite of what you asked for. It is the one record that outlives an erasure, and it exists only to protect you.

3b. Children and young people: you must be 16 or over

This site is for people aged 16 and over. It is not designed for children and we do not knowingly collect data about anybody under 16.

• If you are under 16, please do not apply through this site, create an account, set up a job alert or ask us to keep your CV. Nothing here is age appropriate work.
• If you are 16 or 17, you can use the site, and we suggest showing an advert to a parent, carer, tutor or careers adviser before you give anybody your details. Employers must still follow the law on hours and duties for young workers.
• If we learn that an account, application or CV belongs to somebody under 16, we delete it and the file with it, without needing a request, and we tell the employer it was sent to.
• A parent or carer who believes we hold data about a child can email dpo@hiringuk.co.uk and we will erase it the same working day. No proof, no forms, no argument.

Because the service is for adults, and the content is job adverts, it is not a service likely to be accessed by children under the ICO's Age Appropriate Design Code. We keep that judgement under review and will say so here if it changes.

4. Who we share it with

• The employer you applied to. They receive your application and CV and become an independent controller of that copy. What they then do with it is governed by their own privacy notice.
• Nobody else. We do not operate a candidate database, so no employer can browse or buy candidate details. An employer only ever receives what a candidate deliberately sent to their advert.
• Service providers who host the site and its database, on written terms that allow them to process the data only on our instructions.
• Authorities, where the law requires it.

We never sell personal data, and we do not use it to train third party artificial intelligence models.

5. Where it is stored

Data is stored on servers in the United Kingdom or the European Economic Area. If any provider we use processes data outside that area, we rely on UK adequacy regulations or the International Data Transfer Addendum to the EU standard contractual clauses.

6. How long we keep it

Data	Retention
An inactive candidate account, and the CV files attached to it	Erased automatically after 6 months with no activity. We email a keep or erase link at 5 months, and using it starts a fresh 6 months
Job applications and attached CVs	12 months from the date of application, then deleted
CVs kept on file at your request	12 months from the last time you confirmed, then erased automatically, file included. We ask you before the twelve months are up, and withdrawing erases it immediately
An anonymous card on the available now list	As long as the CV it belongs to, so 12 months at the most. It comes down the moment you take it down, and it is erased with the record
An enquiry an employer made about a card, or a note of the staff a company told us it was short of	12 months, then erased
A request for a telephone call, or a booked call	12 months, then erased. Your number is used to ring you about that one thing and is never added to any list
Employer accounts	For as long as the account is open, then 12 months
Invoices and payment records	7 years, as required by tax law
Contact form messages	24 months
Server logs	90 days

7. Your rights

No automated decision making or profiling that produces legal or similarly significant effects takes place on this site. No algorithm scores, ranks, filters or rejects your application. Every application is passed to the employer exactly as you sent it, and a person at that employer decides. Our job search ranks adverts by how well they match the words you typed, which is a search result and not a decision about you.

Under the UK GDPR you have the following rights. Each one is free, and we answer within one month.

• The right to be informed. To know what we hold and why, which is what this notice is for.
• The right of access. To get a copy of the personal data we hold about you, and to be told who we have shared it with. Ask and we send it, usually within days rather than the month the law allows.
• The right to rectification. To have anything wrong or out of date corrected. Tell us what is wrong and we fix it.
• The right to erasure. To have your data deleted. In your candidate area this is a button. Otherwise ask, and we erase your account, your applications and the CV files with them, then confirm in writing. The single exception is the do not email entry described in section 3a, kept so that erasing you cannot accidentally make you contactable again.
• The right to restrict processing. To have us keep your data but stop using it while something is checked or disputed.
• The right to data portability. To receive the data you gave us in a common, machine readable format, or to have it sent to another provider.
• The right to object. To stop us processing your data where we rely on legitimate interests. Say so and we stop, unless we have grounds that override yours, which we would have to explain.
• The right to withdraw consent. Where we rely on consent, for job alerts or for keeping your CV on file, you can withdraw at any time with one click, and it takes effect immediately. Withdrawing does not affect anything done lawfully before you withdrew.
• Rights in relation to automated decision making. There is none here, so there is nothing to object to, and we will tell you on this page if that ever changes.

The quickest way to use any of these rights is our data request form, which goes straight to Grigore Octavian Pupazan, our Data Protection Lead. You can also email dpo@hiringuk.co.uk. We respond within one month and it costs you nothing. If you gave consent (for example, for job alerts) you can withdraw it at any time, which does not affect processing carried out before you withdrew it.

8. Security: the measures we actually take

Article 32 asks for appropriate technical and organisational measures. Here is what that means in practice on this site, so you can judge it rather than take a word for it.

The short version: traffic is encrypted, files are encrypted at rest, passwords are never stored in a readable form, CVs sit outside the public part of the website, access follows the principle of least privilege, every release and erasure of a CV is logged, backups are taken automatically and carry the same protections, and deletion happens on a schedule enforced by the software. The detail is below.

Technical measures

• Encryption in transit. The whole site is served over HTTPS. There is no unencrypted route to any page or file.
• Encryption at rest. The database and uploaded files sit on an encrypted volume provided by our hosting platform. Nothing is stored on a laptop, a phone or a memory stick.
• Passwords. Stored only as salted PBKDF2-SHA256 hashes with 200,000 iterations. Nobody here can read your password, including the director. A reset link is single use and expires in an hour.
• Sessions. Signed with HMAC-SHA256 and a key generated on the server, marked HttpOnly and SameSite, so a session cannot be forged or read by a script.
• CV files. Stored outside the public web root under unguessable names. There is no URL that lists them and no way to browse them. A file is served only to the employer whose advert that application answered, or to our own admin, and every employer download is logged.
• Access control, on the principle of least privilege. Nobody gets more access than their job needs. Employers see only their own adverts and their own applications, candidates see only their own account, and the software checks that on every single request rather than trusting a link. The API uses a per employer key, scoped to that employer's data, replaceable instantly if it leaks.
• The admin area is behind a separate password, held as a hash, with signed and time limited sessions, and it refuses to open at all until the starter password has been changed.
• Hardening. Security headers on every response, no third party scripts, no advertising or analytics tags, uploads restricted by type and size, and a honeypot on public forms.
• Data minimisation by design. We do not ask for a date of birth, a national insurance number, an address or bank details, because we never need them.

Organisational measures

• Least privilege, applied to people as well as software. One person has administrative access, the director named above. There is no shared login, no agency with a password, no offshore support desk, and no standing access for anybody who does not need it. If that ever changes, this page changes with it.
• Access and deletion logs. We record every CV downloaded by an employer with the date, every consent with its exact wording and timestamp, every erasure with what was erased and why, every data request, and every advert taken down after a report. That is how we can answer you, or the ICO, with evidence rather than assurance.
• Automatic deletion. Retention is enforced by the software on a schedule, not by somebody remembering: applications at twelve months, CVs held on consent at twelve months from the last confirmation, dormant accounts at six months, adverts at thirty days.
• Regular backups. The database and the uploaded files are backed up automatically by the hosting platform on a rolling schedule, so a fault or a mistake does not lose anybody's data. Backups carry the same encryption and the same access restrictions as the live system, and anything restored from them arrives under the same protections. Deletions work through to backups within the backup cycle, so an erasure is not quietly undone by a restore.
• Change control. Every change to this site is recorded in version control with a reason, so any change to how data is handled can be traced to a date.

If something goes wrong

If there is a personal data breach we investigate immediately, contain it, and record it, whatever its size. Where the breach is likely to result in a risk to people's rights and freedoms we report it to the Information Commissioner's Office within 72 hours of becoming aware of it, as Article 33 requires, and where it is likely to result in a high risk we tell the people affected directly and without undue delay, in plain English: what happened, what data was involved, what we have done, and what they should do. We keep a written record of every breach and of the reasoning where we decide one is not reportable, which the ICO can ask to see.

8a. Who processes data for us (Article 28)

We use a small number of carefully selected service providers, called processors, who host the website, the database and the email system, and who take card payments. Each processor is bound by a written contract that requires it to process personal data only on our documented instructions, to keep it secure and confidential, to use approved sub processors only, to help us answer your requests, and to delete or return the data when the work ends. None of them may use it for their own purposes.

We keep the list deliberately short, and here it is in full:

Who	What they do	What they can see	Where
Our hosting and infrastructure provider	Runs the servers and the storage the site sits on, and takes the backups	Everything stored by the site, as any host technically can	United Kingdom or European Economic Area
Our email provider	Sends applications to employers, job alerts and password reset links	The contents of those emails, including a CV attached to an application	United Kingdom or European Economic Area
Our payment provider	Takes card payments from employers	The employer's own billing details. No candidate data at all, and no card number ever reaches this website	United Kingdom or European Economic Area

That is the complete list. There is no analytics company, no advertising network, no data broker, no marketing platform and no artificial intelligence service in it. Nothing on this site is processed by a third party for its own purposes.

A current list of processors, naming the companies, is available on request from dpo@hiringuk.co.uk. We answer that in writing, usually the same working day. We keep this section up to date: if we add or change a processor, this page changes with it, and where the change is significant we tell account holders before it takes effect.

8b. Where your data is, and what happens if that changes

Your data is stored in the United Kingdom or the European Economic Area, and it stays there. We do not routinely transfer personal data outside those areas, and we have deliberately chosen suppliers so that we do not have to.

If that ever changes, we will rely on one of the following, in this order, and we will say so on this page before the transfer starts:

• UK adequacy regulations, where the destination country has been assessed by the UK government as providing adequate protection;
• otherwise the International Data Transfer Agreement (IDTA), or the UK Addendum to the EU standard contractual clauses, together with a documented transfer risk assessment (the data protection test) showing the protection in the destination is not materially lower than under UK law.

One case is worth naming: if you apply to an advert placed by an employer based outside the UK, your application goes to that employer, in that country, because that is what applying means. The advert shows where the employer is, and you decide whether to apply.

8c. If this business is sold, or stops

Most privacy notices deal with this in one sentence: if the company is bought, your data goes with it. That is true as far as it goes, and it is not much of a promise to somebody who trusted us with their CV. So here is ours, in full.

• If the business is sold or merged, personal data may transfer to the buyer as part of it. We will tell you before your data becomes subject to a different privacy notice, and you will have the chance to withdraw and have your data erased first rather than after.
• Any buyer takes the promises with the data. We will not sell the business to anybody who will not agree, in the sale contract, to honour the retention periods, the consent wording and the no candidate database rule set out on this page. If a buyer wants the data on different terms, they must ask you themselves, and you are free to say no.
• Your data is not an asset to be sold on its own. We will not sell, licence or transfer a candidate list, a CV database or a mailing list separately from the business itself, in a sale, an insolvency or anything else. There is no candidate database here to sell, which is the surest form of that promise.
• If the business simply stops, we do not leave the data sitting on a server for somebody to find. Everything that is not required to be kept by law, principally tax records, is erased, files included, and the erasure is recorded in the same way as every other erasure we make.
• You will be told. Whichever of these happens, we write to the address we hold for you before it takes effect, not afterwards.

8d. If you work at a business we have written to

This section is not about candidates. It is about the person whose name is on a company's contact page, and it exists because we hold that kind of information and had not written it down here.

What we hold. Your name where a published one exists, your job title, a work telephone number, a work email address, the company, and a note of where each of those came from. Nothing about you personally, and nothing we would not expect to find on the company's own website or its Companies House record.

Why. Legitimate interests, Article 6(1)(f): offering a business service to a business that looks like it needs one. We keep the balancing test in writing and you can ask for it.

Where we got it. Published sources. A company website, a Companies House filing, a trade listing, a job advert the company placed itself. Never bought, never scraped in bulk, and never taken from a candidate's CV. If we write to you, the letter tells you which of those it was, in the letter, not in a link.

What we will not do. We do not approach an address we cannot tell is a business address. That test fails closed: if we cannot classify it, nobody writes to it. We screen telephone numbers before anybody rings, because the rules on unsolicited calls apply to a business line too. And we do not pass your details to anybody, at any price.

How long. Until you tell us to stop, or twelve months after the last approach that got no reply, whichever comes first. A company that never answers is not a prospect. It is an address we are wasting.

How to stop it. One line back to us, or dpo@hiringuk.co.uk. No reason needed, no form, and it takes effect the same day. We keep the fact that you asked, and nothing else, so that we cannot write to you again by accident later.

8e. What the legal words actually mean

Three phrases do most of the work in a notice like this, and they are usually left undefined. Here they are in plain English.

The phrase	What it means when we use it
Performance of a contract	You asked us to do something and we cannot do it without the information. You press apply, so we have to send your CV somewhere. There is nothing to weigh up: without the data there is no service.
Legal obligation	The law makes us. Tax records, the checks an employment business has to carry out, a court order. We have no discretion about these and neither do you, which is why an erasure request cannot reach them.
Legitimate interests	The one that needs explaining. It means we have weighed what we want to do against what it costs you, and concluded we can do it. That weighing is written down and it is published in full, not summarised and not available on request: read the assessment. If you disagree with the conclusion, you can object, and we stop unless we can show grounds that override your objection. Say so at dpo@hiringuk.co.uk.

The reason for spelling this out: "we process your data on the basis of our legitimate interests" is a sentence a person can read and learn nothing from. It sounds like permission somebody else granted. It is actually a decision we made, which you are entitled to see and entitled to challenge.

9. Complaining to us, and to the regulator

You have the right to complain to us directly about how we handle your personal data, under section 164A of the Data Protection Act 2018. You can use the data request form, choosing "something else", or email dpo@hiringuk.co.uk with the word "complaint" in the subject line, or write to us at the address above.

When you do, we will:

• acknowledge it within 30 days of the day after we receive it;
• investigate it without undue delay and take appropriate steps to put it right;
• tell you the outcome in writing, in plain English, and what we have changed;
• keep a record of the complaint, what we did and what we decided.

You do not have to complain to us first, but it is usually the quickest way to fix something. You can complain to the Information Commissioner's Office at any time: Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF, telephone 0303 123 1113, ico.org.uk. For anything that is not about data, use our service complaints procedure.

9a. Cross border transfers, in short

Our systems and our data stay in the United Kingdom or the European Economic Area. If that ever changes we will rely on UK adequacy regulations, or the International Data Transfer Agreement or the Addendum to the EU standard contractual clauses, and we will say so here before the transfer starts.

10. Changes

If we change this notice we update the date at the top of the page, and for significant changes we email account holders. Continuing to use the site after a change means you accept the updated notice.