Heading present but text cuts off before explaining legal bases like SCCs or adequacy decisions.

References GDPR but provides no concrete steps, forms, or timelines for exercising access, deletion, or portability rights.

Lists multiple vendors but states the notice does not apply to them and omits Data Processing Agreement references.

Acknowledges collection of special categories but provides no enhanced safeguards or explicit consent triggers.

No mention of security measures or breach notification timelines.

We process this data for recruitment purposes... on the grounds of our legitimate interest as a business that is premised on finding and developing the best entrepreneurial talent

The policy outlines GDPR alignment and reasonable recruitment retention but relies on broad legitimate interest for profile scraping, shares data with numerous vendors without detailing contractual safeguards, and omits explicit cross-border transfer mechanisms and user control processes.