Last updated: 31 October 2026
Who is responsible for your information?
WorkFirstCV is operated by Donald Mahobele. For questions about this notice, your information or a deletion request, email cv@workfirstcv.com.
Information you provide
When you request a free CV review, place an order request or contact us, we collect the information you submit. This can include your name, email address or WhatsApp number, preferred contact method, target roles, selected services, enquiry text and any CV you upload. CVs may contain employment, education and other personal information. Please only include information relevant to the service and avoid unnecessary sensitive information or identity documents.
We also record a request reference, submission time, the form's privacy acknowledgement and a protected representation of the submitting IP address for abuse prevention. Our hosting provider may keep technical access and security logs. The website's current order form requests a service; it does not collect card details or process an online payment.
How we use information
We use your details to review your CV, understand the roles you are targeting, prepare the services you request, answer questions and communicate with you using your preferred method. If you select email for a review or order request, we send a submission acknowledgement. We also use limited technical information to operate and protect the website. Submitting a request does not subscribe you to a marketing mailing list.
Where information is handled
Website submissions are stored in our Bluehost-hosted database, and uploaded CVs are stored outside the public website directory. Access is restricted to the people and systems needed to manage your request. Hosting, backup and email services also process information needed to provide those services. No online system can be guaranteed completely secure.
We use Bluehost for hosting and website email delivery, and Gmail and Microsoft Outlook to manage service correspondence and submission notifications. If you contact us through WhatsApp or another social platform, that provider processes your messages under its own terms and privacy policy. These providers may process information in countries other than your own. We do not sell your CV or contact details.
How long we retain CVs and contact details
We retain submitted CVs and contact details until the candidate requests deletion. To request deletion, email cv@workfirstcv.com and provide enough information for us to identify your request. We may need to verify that the request comes from the person concerned. We review deletion requests across the submission record, uploaded file and service correspondence. Any information that must be retained for a legal obligation or a dispute will be considered separately; we will explain any applicable exception when responding.
Deleting an active record may not immediately remove copies held in hosting backups or by a third-party communication service. Their removal is subject to the relevant provider's retention and recovery processes. There is no automatic age-based deletion of submitted CVs in the current service.
Optional analytics and cookies
The cookie dialog offers two one-click choices: “Accept all” enables both Google Analytics and Microsoft Clarity, and “Reject all” keeps both off. Both services are optional. Neither loads without the relevant permission. The centred dialog asks for a choice before you continue using the page; either choice gives access to the full website. The privacy notice remains accessible before choosing. Rejecting optional analytics does not affect browsing, CV uploads or service requests. We remember your choices in this browser for up to 180 days. Supported Global Privacy Control and Do Not Track signals keep both services off.
We ask for a new choice when introducing Clarity: an earlier Google-only acceptance does not enable session recording. A previous rejection remains respected. If you previously accepted Clarity when checkout was excluded, we ask for a fresh Clarity choice before recording any further activity; your separate Google Analytics choice remains unchanged. Existing saved preferences, including separate earlier choices, remain respected until you change them. The new dialog changes both services together. Pressing Escape is treated as “Reject all”, never as permission.
Google Analytics
With your permission, we use Google Analytics through Google Tag Manager to understand public-page visits, successful free CV review requests, successful order requests and WhatsApp-link clicks. An order request is not a completed payment. Google receives technical information such as your network address, browser/device information, cookie identifiers, approximate location and the page or action measured.
We do not include names, email addresses, phone numbers, target roles, CV contents, uploaded filenames, request references or other submitted form text in Analytics events. The page addresses sent to Google exclude query strings and fragments, and referring addresses are limited to the referring website's origin. Automatic form, outbound-link, file-download and contact-detail detection are disabled.
Microsoft Clarity
If you accept Microsoft Clarity, we and Microsoft collect website-use information to understand usability: clicks, scrolling, page layout, navigation, technical browser/device information, network address and approximate location. Clarity creates heatmaps and masked session recordings, which reconstruct interactions rather than recording your camera or microphone. Microsoft processes this information under the Microsoft Privacy Statement, including its provisions on service operation, security, product improvement and data use.
Clarity runs on Home, Services, How it works, Packages, About and checkout after you accept it. On checkout it helps us understand service-selection, scrolling and form usability; names, contact details, target roles, file names, form answers and request references remain masked. CV file contents are not sent to Clarity. We do not record Contact, this privacy page, admin pages, submission endpoints or private upload storage.
Recorded checkout addresses may include one predefined service-selection parameter containing only one of our six fixed service or package names. Other query parameters, duplicated parameters, unknown values and URL fragments are excluded from recording. We also skip visits when an incoming referring address does not meet our clean-address checks. This means Clarity will not show every visit.
We apply strict content masking and an explicit mask to the page body, including dynamically displayed forms, filenames and receipts. CV files are not uploaded to Clarity, and we do not add names, contact details, form answers or customer identifiers to Clarity. Page text and form contents are masked before transmission; basic layout and interaction information can still be measured. Keep unnecessary sensitive information out of service enquiries.
After permission, Clarity may use first-party cookies such as _clck and _clsk to connect visits into sessions. Our integration denies Microsoft advertising-storage consent; we have not connected Microsoft Ads or enabled remarketing. Microsoft may process information internationally. Clarity normally retains recordings for 30 days; labelled or favourite recordings and heatmap data are retained for 9 months, subject to Microsoft's current service policies. For current details, see Clarity's retention information.
Changing or withdrawing your choice
Use “Cookie settings” in the footer to accept or reject both optional services together. Withdrawal disables new Google Analytics events and stops the Clarity recorder, removes our first-party analytics cookies and preserves unsaved form entries. A recorder already stopped on the current page does not restart there; if you re-accept, recording resumes on a later eligible page. Code already loaded can remain in memory until you leave or reload; data already sent is not recalled by withdrawing permission. Provider-controlled third-party cookies cannot be removed directly by this website.
Analytics reporting and service records are separate: the 180-day preference period is not a deletion schedule for CVs or provider reports. This setup does not enable advertising cookies, remarketing, Google Signals, ad personalization or enhanced conversions. Read how Google uses information from partner sites and Google's privacy policy.
Other browser storage and external services
The website separately remembers your currency choice and caches exchange rates in your browser. It uses country.is to estimate a country from your network address for the initial currency display, and Frankfurter to obtain exchange rates. These requests share technical connection information, not your CV or form answers. Website fonts are requested from Google Fonts. These existing services are separate from optional Analytics; rejecting Analytics does not block every external website resource.
The free-review offer uses session storage to avoid repeatedly showing its promotional pop-up. External links to WhatsApp, Facebook, Instagram and other sites lead to services with their own privacy policies.
Your choices
You can ask what information we hold about you, request a correction, ask for deletion or raise a privacy concern at cv@workfirstcv.com. We may need to verify your identity before acting. Google Analytics and Microsoft Clarity are optional; use “Reject all” to withdraw permission for both without affecting a service request. Applicable privacy rights depend on your circumstances and location.
Updates to this notice
We may update this notice when the service or its data handling changes. The date above identifies the latest version. If online payments, advertising tracking or materially different uses are introduced, this notice and any required choices will be updated.