Privacy policy

This policy explains how GHIJK Ltd ("we", "us") handles personal information in Arku. It covers three groups of people: people who use an Arku account for their organisation, candidates who apply for jobs through Arku, and visitors to our website.

Who is responsible

For account users and website visitors, GHIJK Ltd is responsible for your information.

For candidates, the organisation you apply to is responsible for your application. It decides what to ask and how to use your answers, and its own privacy statement applies. We store and process your application for that organisation under our data processing agreement. If you want to see, correct or delete your application, contact the organisation first. You can also contact us and we will pass your request on.

Where your information is stored

All Arku data is stored in the United Kingdom (London), including information about people and organisations in New Zealand, Australia and the United States. Some of the companies that help us run Arku process information in other countries, as listed on our sub-processors page.
When information leaves the UK we rely on adequacy decisions or standard contractual safeguards.

Account users

We collect your name, email address, password (stored only as a secure hash), two factor and passkey details, your organisation's details, your role and what you do in the account, such as jobs you publish and notes you add. We use this to provide Arku, keep it secure, prevent fake job scams, send service emails and handle billing. Payment details are collected by Paddle, our merchant of record, and we do not see your card number.

Candidates

When you apply, the organisation receives what you send: usually your name, contact details, CV and answers to its questions. Arku also records your consent, the stage of your application, messages you exchange and, if you opt in, your agreement to receive text messages.

Arku does not use automated tools to rank, score or reject you. People at the organisation read your application and make every decision. Application forms on Arku cannot ask for bank details, passport numbers or other government identity numbers. If a background check is part of the process, Arku records only its status and date, never the check itself.

Each organisation sets how long it keeps applications. When that period ends after your last activity, Arku removes your personal details and files, and keeps only anonymous figures, such as how many people applied, for the organisation's reports.

Website visitors

Our website does not use advertising or tracking cookies. We use privacy friendly analytics that count visits without identifying you, and short lived cookies needed to sign in and protect forms. If you contact us we keep your message and contact details to reply.

Legal bases

Where the UK or EU GDPR applies, we rely on our contract with your organisation to provide the service, on legitimate interests to keep Arku secure, prevent fraud and improve it, on consent for text messages where the law requires it, and on legal obligations for billing records.

Your rights

Depending on where you live, you can ask to see the information we hold about you, correct it, delete it, restrict or object to its use, or receive a copy. In New Zealand these rights come from the Privacy Act 2020, in Australia the Privacy Act 1988, and in the UK the UK GDPR. To make a request, email privacy@arkuhq.com.

You can also complain to your privacy regulator: the Office of the Privacy Commissioner in New Zealand, the Office of the Australian Information Commissioner, or the Information Commissioner's Office in the UK.

Security

Information is encrypted in transit and at rest. Access inside Arku is limited by role, and some fields, such as salary expectations, are only shown to people with permission to see them. We keep records of important changes so organisations can see who did what.

Changes

We will update this page when our practices change and show the new effective date. If a change is significant, we will tell account owners by email.

Contact

GHIJK Ltd, Tauranga, New Zealand. Email privacy@arkuhq.com.