Privacy Policy

Who we are and how to contact us

Goalwalker provides a website, candidate and company accounts, and tools for recruitment and related business enquiries. This policy covers personal information about visitors, applicants, candidates, company representatives and account users.

Operator review required: Confirm the legal entity responsible for this information, its registered address and registration details, and a monitored privacy email or postal contact. Confirm any data protection officer or representative details that must be provided.

Account holders can submit export and deletion requests through Privacy requests in the platform after signing in. If you do not have an account, use your existing Goalwalker contact to ask for help with your information. A dedicated public privacy contact must be confirmed before publication.

Information we collect

• Candidate and applicant details: names, email addresses, phone numbers, country, work experience, languages, professional links, role interests, availability and other profile or application information you provide. Optional uploads may include a CV, profile image or introduction video.
• Company and representative details: your name, work email, phone number, company name and website, account membership, company onboarding information and recruitment requirements you provide.
• Account and service records: account identifiers, password verification data, email verification, sign-in and session information, recruitment activity, communications, support enquiries and privacy requests. If you choose Google sign-in, we receive the identity information needed to sign you in, including your Google identifier, name and email.
• Source and technical information: signup links, referral and campaign details, submission times and references, and security information such as IP addresses and browser information. Website submissions can include selected UTM campaign tags and the referring website origin and path.

Information can come directly from you, from a company representative, or from recruitment sources recorded by our team, including configured Meta lead forms. Required form fields are identified when you provide information. Without them, we may be unable to create an account, accept a request or progress an application. Please only include information relevant to your application or enquiry and avoid unnecessary sensitive personal details.

How we use information

We use information to:

• Receive applications and business enquiries, respond and arrange next steps.
• Create, verify and secure accounts and manage access to company workspaces.
• Maintain candidate profiles, assess profile readiness and support recruitment.
• Process CVs and videos and make permitted recruitment information available.
• Record recruitment sources, prevent duplicate intake and understand campaign attribution.
• Send service messages, provide support, investigate abuse and handle privacy requests.

Submitting a website application or business enquiry does not create a platform account and is not a marketing subscription. Account creation takes place separately.

Operator review required: Confirm the applicable legal basis for each purpose, any legitimate interests relied on, and any consent or statutory requirements. This draft does not assign unconfirmed legal bases to these activities.

Recruitment, CVs and videos

Goalwalker staff use application and profile information to follow up with candidates and support recruitment. Company users can view candidate information made available through the platform, subject to company access, profile visibility and recruitment permissions. Company-facing views limit identity and contact details; these limits do not guarantee that a person cannot be identified from a CV or video they provide.

CVs and other uploads are stored and processed for the service, including file validation, malware scanning and media preparation. Videos can include your image, voice and anything you choose to say or show. When enabled, subtitle preparation uses speech transcription and translation services to create captions and edited video versions. Generated captions can contain errors and may be reviewed or edited within the available workflow.

The platform uses automated checks for profile completeness, visibility and media processing. These checks do not themselves constitute an offer of employment. An application or a visible profile does not guarantee a placement.

Meta Lead Ads

If you submit a Goalwalker lead form on Facebook or Instagram, our configured Meta Lead Ads integration can retrieve your submitted name and contact details, such as email or phone number, and supported answers such as the languages you speak. We also receive lead, Page and form identifiers, submission time, and available ad and campaign details.

We use these details to record your interest in recruitment, create or match a candidate record, retain source information and allow our team to follow up. An imported lead does not automatically create a login account or send an account invitation. Language answers can be retained as internal source notes; they do not automatically verify language levels.

Lead information is handled within the recruitment service by authorized staff and the providers supporting that service. The integration retrieves leads from configured forms; it does not give us general access to your private Facebook or Instagram activity. Meta also processes information under its own Privacy Policy.

You can ask about or request deletion of information received through a Meta form even if you never created a Goalwalker account. See your privacy rights and the contact details awaiting confirmation above.

Cookies and browser storage

The platform uses cookies for authentication, session security and related account functions. Browser storage is also used for preferences such as language, theme and saved interface settings, and to preserve signup-source information during registration. Blocking cookies or clearing storage may sign you out or remove saved preferences.

The website uses Cloudflare Turnstile for form protection when forms are enabled. This involves requests to Cloudflare and processing of technical information for bot and abuse detection. See Cloudflare’s Privacy Policy. Application fields and CV contents are not saved in website local storage.

The current website implementation does not include a Meta Pixel or an optional analytics or advertising cookie integration. Campaign tags submitted with a form are separate from an advertising cookie. Any additional tracking introduced through hosting or future integrations must be reviewed and disclosed, with consent controls where required.

Data sharing and service providers

Information is available to the people and services involved in providing Goalwalker:

• Authorized Goalwalker staff supporting applications, accounts and recruitment.
• Company users with permission to access relevant recruitment information.
• Providers of hosting, database and file storage, email delivery, security, monitoring and media processing, according to the services configured by the operator.
• Google if you choose Google sign-in; Meta for lead-form retrieval; and Cloudflare for website form protection. When enabled, AssemblyAI processes video audio for transcription and OpenAI processes subtitle text for translation.

Companies receiving information for their recruitment activities may have their own privacy responsibilities. You should also review their notices. Our deletion workflows cannot automatically remove copies already held independently by a recipient.

Operator review required: Confirm the current provider list, contractual roles, any disclosures required by law or legal claims, and any other sharing or marketing activity before this policy is published.

International processing

The location of processing depends on the hosting and service providers configured for Goalwalker. This draft does not promise that all information remains in a particular country or region.

Operator review required: Confirm the countries where personal information is processed, any international transfers, the applicable safeguards and how people can obtain information about them.

Retention and deletion

Retention depends on the type of record and the purpose for which it is held. A complete retention schedule for applications, candidate and company records, communications, recruitment history, audit records and backups is awaiting operator approval. This policy does not set an unconfirmed retention period for those records.

Technical cleanup is separate from that schedule. Background jobs remove eligible abandoned CV uploads and files scheduled for removal. Meta intake retry payloads become eligible for cleanup after 30 days; lead identifiers and imported candidate and source records are separate and are not all deleted by that cleanup.

Account export and deletion requests are reviewed and require identity verification before processing. Active recruitment, employment relationships or signed contracts can block the current deletion workflow and require further review. Approved personal deletion closes account access, hides the candidate profile, removes selected identifying and website application data, and starts relevant media and transcript cleanup. Organization deletion closes the organization; it does not erase every company record.

Account closure is not immediate erasure of every record. Some profile, source, recruitment, audit and related records can remain, and file or provider cleanup takes place separately. Copies in backups or held by recipients also need separate handling. The operator must confirm the reasons, retention limits and process for these remaining records before publication.

Your privacy rights

Depending on the law that applies to you, you may have rights to access and obtain a copy of your personal information, correct inaccurate information, request erasure, restrict or object to processing, and receive portable data. Where processing relies on consent, you may withdraw it without affecting the lawfulness of processing before withdrawal. You may also have the right to complain to a competent data protection authority.

Signed-in users can use Privacy requests to submit and track an export or deletion request. Other requests, including requests from Meta leads or applicants without accounts, need assistance from Goalwalker. Use your existing Goalwalker contact while the dedicated privacy contact is awaiting confirmation. Do not include passwords or unnecessary identity documents in your initial request. We may need information to verify your identity and understand the scope of your request.

Operator review required: Provide the public request contact, applicable response deadlines, relevant supervisory authority details and arrangements for requests that cannot be completed through the account workflow. Confirm any applicable rights relating to automated decisions and explain any such decision-making used in practice.

Security

The service includes access controls, authenticated file access, upload validation, malware scanning and security checks on public submissions. Website intake payloads and Meta retry payloads are encrypted in the implemented intake workflows. These measures reduce risk, but no system can guarantee absolute security. Keep account credentials and personal invitation links private.

Policy updates

This policy should be updated when the service or its data-handling practices change. The approved effective date and policy version must be added before publication, together with any additional notification required for a material change.

Details awaiting operator approval

These items are unresolved publication requirements, not confirmed statements about Goalwalker:

• Legal entity, registered address and registration details.
• Monitored privacy contact, and any required data protection officer or representative.
• Applicable jurisdictions, legal bases per purpose and any legitimate interests.
• Retention periods or criteria, remaining records after deletion, and backup handling.
• Active providers, processing locations, contractual roles and transfer safeguards.
• Live cookie inventory, any additional tracking and required consent controls.
• Rights procedures, response deadlines and competent supervisory authority.
• Any automated decision-making, additional disclosures and sensitive-data handling.
• Approved effective date, policy version and alignment with form notices.