Privacy & Cookie Policy

For personal data of visitors, prospects, and registered account users (e.g. account holder name, work e-mail, billing data), TechMagic UK Ltd acts as the data controller.

For personal data contained within CVs/profiles that a customer (a consulting firm) uploads about its own consultants/employees, TechMagic UK Ltd acts as a data processor on the customer's behalf; the customer is the data controller. Processing of that data is governed by the Data Processing Agreement (DPA), not by this Policy.

• Account and contact data: name, work e-mail, company, role, password (hashed).
• Billing data: billing name/address, payment method tokens (we do not store full card numbers).
• Usage data: log-in activity, feature usage, device/browser data, cookies (see Section 4).
• CV/profile data (processed as a processor, per customer instructions): name, contact details, work history, skills, certifications, education, languages, availability.
• Communications: support requests, feedback, correspondence.

• Providing and maintaining the Service — performance of a contract (Art. 6(1)(b)).
• Account security, fraud prevention, service integrity — legitimate interests (Art. 6(1)(f)).
• Billing and tax compliance — legal obligation (Art. 6(1)(c)) and contract.
• Product improvement and, where data is anonymised or aggregated, model/feature development — for MagicCV's own account, usage, and billing data (of which MagicCV is controller), on the basis of legitimate interests. For CV Data (of which Customer is controller), MagicCV never relies on its own legitimate interest — see Section 8 for the applicable rule.
• Marketing communications to prospects/customers — consent or legitimate interests, with an opt-out in every communication.

We use cookies and similar technologies (e.g. local storage) on getmagic.cv.

• Strictly necessary — required for login, security, and core site functionality. Cannot be disabled.
• Functional — remember preferences (e.g. language).
• Analytics — help us understand site usage (GA4)

UnresolvedNon-essential cookies are set only after you provide consent via the cookie banner; you may withdraw consent at any time via the cookie settings link in the site footer. A current cookie table (name, provider, purpose, duration) is available at getmagic.cv/privacy-policy, generated from an actual site scan.

We retain account and billing data for the duration of the contractual relationship and for 5 years thereafter to meet legal, accounting, and tax obligations. CV/profile data processed on behalf of customers is retained and deleted in accordance with the customer's instructions and the DPA. When an individual user is deleted, all associated personal data, including backups, is deleted within 3 months, per the DPA.

Where personal data is transferred outside the UK or EEA (for example, to a hosting or AI-processing sub-processor), we rely on adequacy decisions or appropriate safeguards, including the UK International Data Transfer Addendum and/or the EU Standard Contractual Clauses (2021 modules), as set out in Annex C to the DPA.

We use a limited number of sub-processors (e.g. cloud hosting, AI model providers, e-mail delivery, analytics, payment processing) under written data processing agreements. The current list is Annex A to the DPA, available at getmagic.cv/dpa; customers may contact to update notifications at hello@techmagic.co.

For CV Data, of which Customer — not MagicCV — is the controller, MagicCV does not use such data to improve the Service or to train, fine-tune, retrain, or otherwise develop any AI model unless and until Customer has given its prior, explicit, and documented instruction authorising such use, as set out in the DPA. MagicCV does not rely on its own legitimate interest as a basis for this use: determining the legal basis for processing CV Data, and deciding whether to authorise such use, is Customer's responsibility as controller. Absent such an instruction, CV Data is used solely to provide the Service. Customers wishing to authorise such use may contact hello@techmagic.co

For MagicCV's own account, usage, and billing data (of which MagicCV is the controller), MagicCV may use anonymised or aggregated data to improve the Service on the basis of legitimate interests, as described in Section 3.

Subject to applicable law, you may have the right to: access, rectify, or erase your personal data; restrict or object to processing; request data portability; withdraw consent; and lodge a complaint with the ICO (UK) or your local EU supervisory authority. To exercise these rights, contact hello@techmagic.co.

In accordance with the UK Data (Use and Access) Act 2025 (mandatory from 19 June 2026), we maintain the following complaints-handling process for data protection complaints:

• Submit your complaint to hello@techmagic.co, describing the issue and the data concerned.
• We will acknowledge receipt within 30 days.
• We will investigate and respond substantively within 90 days, or explain any delay and revised timeline.
• If you are not satisfied with our response, you may escalate the complaint to the ICO (ico.org.uk) or, for EU data subjects, your local supervisory authority.

We apply technical and organisational measures appropriate to the risk, summarised in Annex B to the DPA (Security & Trust), including our approach to certifications, access control, and vulnerability disclosure.

The Service is intended for business use by consulting firms and their personnel and is not directed at children. We do not knowingly collect personal data from children.

We may update this Policy from time to time. Material changes will be notified via the Service or by e-mail.

TechMagic UK Ltd, 41 Devonshire Street, Ground Floor, London, W1G 7AJ, United Kingdom. E-mail: hello@techmagic.co.