Privacy Policy

DUNCO Privacy Policy

Last updated: 1 November 2026 · Version 1.0

At a glance

This summary is for orientation only; the rest of the policy is the operative text.

Who we are. DUNCO SITE LTD operates DUNCO, a UK construction recruitment platform. We decide how personal information is used, which makes us the “data controller”. Cavuno hosts and runs the platform for us.
16 and over. You must be at least 16 to create an account, and registration asks you to confirm that before the account is made. Workers aged 16 and 17, including apprentices and students on industry placements, are welcome, and their profiles start private like everyone else's.
New worker profiles start private. A new worker profile is hidden from recruitment agencies, set to “not looking” and “not currently available”, with no contact method and no CV sharing switched on, until the worker chooses otherwise.
Cards are optional. You do not have to record a construction card to create an account, keep a profile or apply for work.
Construction card numbers stay private. Card numbers are never shown to agencies, other workers or visitors. Our own team can see them, in the board's administration tools, in order to check a card. Verification statuses are shown to signed-in agencies, including “Re-check needed” where a card changed after it was checked.
Registration asks for a 16+ declaration. The checkbox is mandatory and unticked, and we do not ask for your date of birth.
CV sharing is opt-in. Nothing is shared with recruitment agencies unless the worker switches it on, and it can be switched off again.
Analytics are optional. Nothing beyond what the site needs to work runs until a visitor accepts in the cookie banner, and the choice can be changed at any time.
You have rights. You can ask for a copy of your information, ask us to correct or delete it, object to some uses, and complain to the Information Commissioner's Office.

1. Who we are

1.1 DUNCO is operated by DUNCO SITE LTD, trading as Dunco (“DUNCO”, “we”, “us”, “our”), a company registered in England and Wales under company number 17459669. Reference to “DUNCO” in this policy means DUNCO SITE LTD operating this platform at dunco.site.

1.2 Our registered office is 10 Waverley Court, Horsham, West Sussex, England, RH12 1TN. Our statutory company details — our registered company name, company number, place of registration and registered office — are set out in section 18.2.

1.3 For personal information, you can contact us at info@dunco.site. This is the address to use for any request about your information, including requests under section 15.

1.4 We are the data controller for the personal information described in this policy: we decide why it is used and how. Our platform is built, hosted and operated for us by Cavuno, which acts as our data processor and may only use your information on our instructions.

1.5 This policy explains what we collect, why, who we share it with, how long we keep it and what rights you have. It should be read with:

our Terms & Conditions (/terms-of-service), which govern your use of DUNCO;
our Cookie Policy (/cookie-policy), which lists the cookies we use.

1.6 This policy covers the DUNCO website and service. It does not cover any other website, including the website of an agency, employer or job board you reach by following a link from DUNCO.

2. Who this policy applies to

2.1 Workers. People who use DUNCO to look for construction work, create a profile, record construction cards and qualifications, apply for jobs, or be contacted by recruitment agencies.

2.2 Recruitment agencies, employers and their staff. Businesses that use DUNCO to search for workers, advertise roles, receive applications or message workers, and the individuals who use those accounts. General employer self-registration is not available on the public site: while the platform is in beta, agency access is set up for us by invitation.

Joining the agency waiting list does not create an account. See 2.6.

2.3 Visitors. Anyone who browses the site, signs up for job alerts, uses our contact form or sets cookie preferences.

2.4 Where an agency becomes responsible. When we pass an application, message or shared CV to an agency or employer at your request, that business decides what it does with its own copy and is a separate controller of it. Its own privacy notice applies from that point. We explain the limits of this in sections 8, 9 and 16.

2.5 Where DUNCO is today, and what happens next

2.5.1 DUNCO is launching in stages, and this policy describes the service as it is at each stage.

Worker registration is open from 1 November 2026. Anyone aged 16 or over can create a free worker profile, without an invitation and without recording a construction card, after confirming at registration that they are aged 16 or over (section 17.4).
Recruitment agencies begin joining in December 2026. Agency access is set up by invitation while the platform is in beta.
Founding agencies have a fixed free beta, 1 January to 28 February 2027. Selected founding recruitment agencies are invited, and each one has the same window whatever date it is invited or starts — it is not counted from the invitation or from registration. During that free beta we collect no payment or billing details. Paid agency subscriptions are expected from 1 March 2027; the free beta does not turn into a paid plan by itself, nothing is charged automatically when it ends, and an agency is charged only if it expressly agrees to a subscription after we have told it the price, how often it is billed and the date of the first payment. Section 3.2 sets out what we would then collect.
The full recruitment beta launches in January 2027. Vacancies and agency activity are expected to build from that point. DUNCO has no live vacancies for workers to apply to before then.

2.5.2 Some of what this policy describes therefore belongs to a stage that has not started. Where that is so it is marked, and nothing is described as running when it is not — for example paid agency plans, which clause 11 of our Terms and Conditions does not describe as available today.

2.6 The agency waiting list does not create an account

2.6.1 Our pricing page links to an agency waiting-list form. Completing it tells us an agency is interested. It does not create a DUNCO account, does not grant access to the platform, and does not make the agency a customer.

2.6.2 What you send through that form is covered by section 3.3 and section 11.8. Agency accounts themselves are set up separately, by invitation, as described in section 2.2.

3. The information we collect

3.1 If you are a worker

Account information: your name, email address and password, and — if you choose to sign in with Google or LinkedIn — the name, email address and profile picture those services return to us. We also record whether your email address has been verified.
Age declaration: your answer to the mandatory “I am aged 16 or over” checkbox at registration. It is unticked by default, the form will not submit until it is ticked, and we ask for no date of birth. The site checks it before the account is created and does not keep it as a separate record on your account; section 17 explains what it does and does not prove.
Profile information: your name, headline, a short introduction about yourself, your location, your avatar, and the languages you speak.
Trade and work history: your primary trade and any additional trades, your employment history, education and skills.
Construction cards: for each card or scheme you record — the scheme name, the card type, the card or registration number, the expiry date, the card colour where relevant, and any details the form asks for under that scheme.
Verification status: the status we record against each card — Unverified, Pending, Verified or Revoked — and the two states the site derives from the record itself: Re-check needed, where the card's details were edited after a check or no record of what was checked was ever kept, and Expired, where the card's expiry date has passed. Section 6 explains each of them.
Qualifications and tickets: for example SSSTS, SMSTS or First Aid, where you record them.
Availability and job search: your availability, your job-search status (for example actively looking, open to offers or not looking), your travel radius in miles, and any hourly or day rate you choose to record.
Contact preferences: which contact methods you are willing to be contacted by. Where you choose to be contacted by phone, text or WhatsApp, the number you give us. Your phone number is kept private and is only passed to a signed-in agency where you have chosen to share a contact number.
CV and CV sharing: any CV file you upload, the result of reading information out of it, whether you keep it on file, and whether you have switched on sharing with recruitment agencies.
Applications: the jobs you apply for, the information in each application (your profile, an optional cover note and an optional CV) and the date you applied.
Messages: messages you exchange with an agency or employer through DUNCO, and messages you send to us for support.
Preferences and activity: your notification preferences, your job-alert subscriptions, and when you were last active on the site (for example when you last signed in, updated your profile or applied for a job).

3.2 If you are an agency or employer

Account and contact information: the name, work email address and role of each person who uses the account, and the sign-in method used.
Company information: your company name, logo, description, website and location, and the details shown on your company page.
Recruitment activity: the jobs you post, the applications you receive, your shortlists, saved lists, pipeline stages and any notes you add about a worker, and the messages you exchange with workers.
Billing information, only if you agree to a paid plan. No billing or payment details are collected today, and none are collected during the free founding-agency beta (section 2.5.1). Paid agency subscriptions are expected from 1 March 2027, and they start only where the agency expressly agrees to one after being told the price, the billing frequency and the date of the first payment. If that happens, this section will say what is collected, whether card details are held by us or by a payment provider, and what that provider sees.

3.3 If you are a visitor

Job alerts: the email address and search criteria you give us when you ask for job alerts.
Contact form: your name, email address and the content of your message.
Agency waiting list: if you complete our agency waiting-list form, the name, email address and agency details you enter. We use them only to contact you about the beta and about agency access. Joining the list creates no account (section 2.6).
Cookie choice: the choice you make in the cookie banner, and the pseudonymous consent identifier attached to it. Section 10 explains this.

3.4 Technical information

Server and security logs: IP address, browser type and version, operating system, the pages you request, the referring page and the time of the request. These are produced by our hosting and network providers.
Client error reports: if the site fails, a short technical report is sent, containing the error, the page and the browser type. These reports are built to exclude your name, email address and session. They carry no account identifier, though a page address or an error message can contain text that was on the page.
We do not collect device identifiers. We do not read advertising identifiers or any unique device identifier, and we do not use advertising cookies. The only identifier created for analytics is a random session identifier set after a visitor accepts analytics cookies.

3.5 Where the information comes from

Most of it comes from you. Some comes from:

your CV, where you ask us to read information out of it to fill in your profile;
Google or LinkedIn, if you choose to sign in with them;
agencies and employers, who add notes, pipeline stages and messages about their own recruitment activity;
your device and browser, automatically, as described in 3.4.

We do not buy personal information from data brokers, and we do not collect it from social media profiles you have not connected.

4. New worker profiles start private

4.1 A newly created worker profile opens on cautious settings. Until you change them, your profile is:

hidden — it does not appear in the Find Workers directory and is not shown to recruitment agencies searching for workers;
“not looking” — you are not presented as looking for work;
“not currently available”;
without any preferred contact method — no phone, text, WhatsApp or DUNCO messaging is selected for you.

4.2 CV sharing starts off. No CV is shared with recruitment agencies unless you switch that on yourself (section 8).

4.3 DUNCO messaging. An agency can start a new conversation with you from our Find Workers directory only while your job-search status is one that indicates you are open to being contacted (actively looking, or open to offers). While your status is “not looking”, agencies cannot start a new conversation with you from that directory. An agency can still reply in a conversation that already exists, or contact you about an application you have sent it.

4.4 You can change any of these settings at any time from your profile page. The controls are the ordinary profile settings: profile visibility, job-search status, availability and preferred contact methods.

4.5 These defaults apply to new profiles only. They never overwrite a choice an existing worker has already saved.

4.6 If you change a setting, the change takes effect for future visits and future reads by agencies. It does not recall anything an agency has already received (sections 8.6, 9.4 and 16.5).

5. How we use your information, and our lawful basis

We must have a lawful basis under the UK GDPR for each use. The table below sets out each purpose and the basis we rely on. Where the basis is legitimate interests, section 5.3 explains what that means in practice and how to object.

What we do	Why	Proposed lawful basis
Create and run your account; verify your email address; keep you signed in	To give you the account you asked for	Performance of a contract
Store and display your profile, trades, cards, qualifications, availability and rates	To provide the profile you create	Performance of a contract
Show your profile to signed-in recruitment agencies and employers in Find Workers, where your visibility setting allows it, and show them roughly when you were last active (“Active this week”) while your job-search status is actively looking or open to offers	To provide the recruitment service you have signed up for, and to let genuine recruiters see that you are available for work	Legitimate interests — our interest, and the recruiting agency's, in matching workers with work. You can object at any time by setting your profile visibility to Hidden, which removes you from Find Workers on your next visit (section 7.1). No card number, private phone number or CV you have not shared is ever shown
Record and display construction card verification statuses	Accuracy and trust in the platform	Legitimate interests — our interest in the card information on the platform being accurate, and in agencies being able to rely on it (section 5.3)
Pass your application, and any CV or cover note in it, to the agency or employer you applied to	To make the application you asked for	Performance of a contract
Let you exchange messages with an agency or employer	To provide messaging you choose to use	Performance of a contract
Share your CV or a contact number with recruitment agencies only where you switch sharing on	To share your details on your instructions	Consent — you can withdraw at any time (section 8 and section 15.5)
Send you job alerts you subscribe to	To deliver the alerts you asked for	Consent — you submit the alert form, we email you a confirmation link, and nothing is sent until you open it. Every alert email carries a manage and unsubscribe link (section 5.4)
Send you application and message notifications you have switched on	To deliver the notifications you asked for	Performance of a contract
Send you the weekly email of jobs that match your profile, where you have switched it on	To help you find relevant work	Consent — a separate choice from job alerts, unticked by default, that you can switch off at any time in your account or from the link in the email (section 5.4)
Show you a personal list of jobs ranked from your profile and CV on your Job matches page	To help you find work that fits	Legitimate interests — our interest, and yours, in finding work that fits. Hiding your profile does not stop this ranking; there is no switch for it, and you can object at any time by writing to info@dunco.site (sections 5.3 and 5.4). It has no legal or similarly significant effect (section 5.1)
Keep the platform secure; detect fraud, scraping, spam and abuse; investigate reports	To protect workers, agencies and the platform	Legitimate interests — protecting the platform and the people who use it (section 5.3)
Understand how the site is used, in aggregate, through Cavuno Analytics	To improve the site	Consent, given in the cookie banner (section 10)
Answer your support or contact message	To respond to you	Legitimate interests, or steps taken at your request before a contract — we answer because you asked us to (section 5.3)
Keep records we are legally required to keep; respond to regulators and lawful requests	To comply with the law	Legal obligation
Establish, exercise or defend legal claims	To protect our legal position	Legitimate interests — establishing, exercising or defending a legal claim (section 5.3)

5.1 We do not use your information for automated decisions that have a legal or similarly significant effect on you. Card verification is a human decision made by our team, not an automated one. The job matching described in 5.4 ranks vacancies for you; it is not a decision about you, it never decides whether you can apply for a job, and it is never shown to an employer as a score or a reason.

5.2 We do not sell your personal information, and we do not share it with advertisers.

5.3 Where we rely on legitimate interests, we have recorded why the processing is necessary and why it does not override your rights. That written record — a legitimate interests assessment — is kept with our other records, and you can ask us for a copy at info@dunco.site. You can object to any use based on legitimate interests by writing to the same address; for Find Workers the quickest route is to set your profile to Hidden, which removes you from the directory on your next visit. For the Job matches list in your account, Hidden is not the opt-out — hiding your profile does not stop that ranking — so the route is to write to us; section 5.4 explains what we can do and what we are still confirming with our platform provider.

5.4 Job matching and job emails are three different things. We explain them separately because the basis is not the same for each, and because turning one off does not turn the others off.

Job alerts are emails about new vacancies that match a search you set up. They are sent on consent: you submit the alert form, we email you a confirmation link, and nothing is sent until you open that link. They are sent weekly, and only when there are new jobs matching your search — a week in which nothing matches sends nothing — and every alert email carries a manage and unsubscribe link.
The weekly matched-job email is a separate product from job alerts. It lists jobs that Cavuno ranks from your profile and the information read out of your CV. It is sent only if you switch it on: the choice is an unticked box in your account, it is not part of creating an account, and you can switch it off at any time from the notification settings in your account or from the link in any such email. Its basis is consent. Like job alerts, it goes out weekly and only when there are jobs that qualify; a week with nothing to send sends nothing.
The Job matches page in your account is the personal list of jobs ranked from your profile and CV. It is not an email and it is not sent to you. It is part of the service you create an account for, and we rely on legitimate interests for the ranking behind it — our interest, and yours, in finding work that fits. Jobs you have already applied to are left out, and the ranking never decides whether you can apply for a job, so it has no legal or similarly significant effect on you (section 5.1).

Hiding your profile does not stop job matching. Your visibility setting (section 7.1) decides whether signed-in agencies can find you in Find Workers. It does not turn off the ranking behind your Job matches page, and it does not change an email subscription you have made.

There is no switch that turns the in-app list off today, and we do not claim there is one. If you object to this use, write to info@dunco.site and we will answer within one month (section 15.2). You can also remove the CV and the profile details the ranking is built from, or delete your account (sections 8 and 16). We are confirming with our platform provider what we can actually do when someone objects — whether matching can be turned off for an individual account, or whether the profile and CV data behind it has to be removed — and this section will state exactly what happens, and how quickly, once that is confirmed.

6. Construction cards, qualifications and verification statuses

6.1 What you record. You can record each construction card you hold, across the schemes the site supports, together with its number, expiry date and, for some schemes, the card colour and type. You can also record qualifications and tickets such as SSSTS, SMSTS or First Aid.

Recording a card is optional. No card is required to create an account, keep a profile or apply for work. A worker with no card recorded is treated exactly like any other worker, and no feature is withheld for want of a card.

6.2 What stays private. Two things about a card are never shared with anyone who is recruiting, and what each of us can read follows the access the platform gives us.

The card number is a private field. It is never shown to recruitment agencies, employers, other workers or visitors, and it is withheld from every response the platform sends to anyone other than you and the board's administration tools. You can see and correct your own card number in your profile; authorised DUNCO personnel can see it in the administration tools, because they need it to check the card.
The verification evidence — a note, reference or document detail recorded against a card when a check is made — is a private field recorded by our team. It is never shown on a profile, to an agency, to an employer, to another worker or to a visitor. It is not shown to you in your profile and you cannot edit it; only authorised DUNCO personnel can read it, in the board's administration tools, and only to check the card.

What an agency or employer sees is the verification status the check produced, never the evidence behind it or the card number.

6.3 What is shown. The scheme, card type, expiry date and the verification status are shown on your profile to signed-in agencies (subject to your visibility settings).

6.4 Verification statuses. Each card record carries one of:

Unverified — recorded, not yet checked by us;
Pending — a check is in progress;
Verified — the details on record were checked by us and still match what was checked;
Re-check needed — we recorded a successful check, but the card's details have changed since (for example the scheme, card type or colour, occupation or expiry date was edited), or no record of what was checked was ever kept. The earlier check is not carried over: the card has to be checked again before it is shown as verified;
Revoked — the card is no longer valid, revoked by the scheme, or withdrawn;
Expired — shown where the expiry date on the card has passed.

Where a scheme holds several registrations for you, a combined status may be shown — for example “partially verified”, “partially expired” or “partially revoked” — to describe the set as a whole. A set is called “verified” only where every registration in it was checked and is unexpired, and a registration owed a re-check is never folded into a check that stands. Revocation takes precedence over expiry: a card that has been revoked is shown as revoked even if its expiry date has also passed.

6.5 How verification works. Verification is carried out by our team, not by any automated check, using the card details recorded in your profile and the information we hold about the card. It does not mean we employ you, vouch for you, or guarantee your competence, qualifications, suitability for employment, right to work or fitness for a site, and it is not a statement that a card is still valid after the date it was checked.

6.6 If a status is wrong. If you believe a card, its expiry date or its verification status is inaccurate, contact us at info@dunco.site and we will look at it. You can also correct the details yourself in your profile. Because agencies rely on these statuses, we will tell you the outcome and correct the record where it is wrong.

6.7 Qualifications you record yourself (for example SSSTS or SMSTS) are shown as you entered them and do not carry a verification status.

7. What agencies and employers can see, and what they cannot

7.1 Your visibility setting decides the audience. A worker can choose:

Hidden — not listed in Find Workers and not shown to agencies;
Signed-in members only — visible to signed-in agencies and employers.

Hidden is where every new profile starts, and you can choose Hidden at any time from your profile editor; from then on your profile is not listed in Find Workers and is not served to an agency reading the directory.

These are the only two options. A former Public option (“visible to anyone who has the link”) has been withdrawn: it is no longer offered, it is not shown as a choice, and saving your profile cannot set it. If your profile still carries that older stored setting, you can change it in your profile editor at any time, or ask us at info@dunco.site and we will change it for you.

7.2 Find Workers is for signed-in agencies and employers only. Visitors who are not signed in are asked to sign in rather than shown worker profiles, and a worker's profile is not shown to other workers.

7.3 Your profile page is not indexed. It is excluded from search engines, so it does not appear in search results. That does not make it public: it is shown only to the audiences section 7.1 describes.

7.4 What a signed-in agency or employer sees when your settings allow it:

the profile information you have filled in: name, headline, introduction, location, languages, trades, work history, education and skills;
your construction cards, including card type, expiry date and verification status — but never the card number;
your qualifications and tickets, availability, travel radius and any rates;
your preferred contact methods, and a contact number only if you have chosen to share one;
a link to your CV only while you have CV sharing switched on;
an approximate activity label (“Active this week”, and similar) while your job-search status is actively looking or open to offers.

7.5 What they never see: your construction card numbers, your private phone number, your email address (unless you apply to their job or send them a message), your CV when sharing is off, and your password.

7.6 Our team. DUNCO does not run a separate staff login on the public website, and there is no staff or administrator account type that can browse workers. Our team reaches profile, card and contact details, including private fields, through the administration tools that run the board (the Cavuno dashboard), and only where that is necessary to verify a card, investigate a report, provide support or keep the platform secure. Access is limited to those purposes.

7.7 Cavuno. Cavuno hosts and operates the platform for us as our processor (section 11).

8. Your CV, and optional CV sharing with recruitment agencies

8.1 Uploading a CV. If you upload a CV, we read information out of it (for example your work history and trades) to help fill in your profile. The file is private to you unless you choose to share it.

8.2 Keeping it on file. You can choose whether the file is kept on file. If you do not keep it on file, the file is deleted once it has been read and only the structured information remains in your profile. You can replace or delete your CV at any time from your account, which withdraws your agreement to keep it.

8.3 Sharing is opt-in. “Share my CV with recruitment agencies” is off by default. Nothing is shared unless you switch it on. While it is on, a signed-in agency on DUNCO can open or download your CV through an expiring secure link.

8.4 Switching it off. You can switch sharing off at any time. New reads stop immediately: no link is issued after you switch it off.

8.5 Withdrawal has limits. A link already issued stays valid until it expires, which is why we issue expiring links rather than permanent ones. Once an agency has opened or downloaded your CV, we cannot recall that copy — it is in their hands and subject to their own obligations. We say this plainly so you can decide what to share.

8.6 Applying to a job is separate. Applying to a specific job sends your profile, your optional cover note and any CV you attach to that agency or employer, whether or not you have switched on general CV sharing (section 9).

9. Job applications and messaging

9.1 Applying. Applications are made from your worker account; if you are not signed in, you are asked to sign in or create an account first. An application sends the agency or employer that posted the job your profile, an optional cover note and any CV you attach.

9.2 Who receives it. Only the agency or employer that posted the job receives your application. From the moment it receives your application, that business is a separate controller of its copy and its own privacy notice applies. We cannot control or delete what it does with it afterwards (section 16.5).

9.3 Messaging. If messaging is available to you, you and an agency or employer can exchange messages through DUNCO. Both parties can see the conversation. Messages are stored so the conversation can be displayed. Our team can reach messages through the board's administration tools where necessary to investigate abuse, a safety concern or a technical problem, or where the law requires it — not through a staff login on this website (section 7.6).

9.4 Who can start a conversation. From our Find Workers directory, an agency can start a new conversation with you only while your job-search status is actively looking or open to offers. While your status is “not looking”, agencies cannot start a new conversation with you from that directory. This does not affect a conversation that already exists, or an agency responding to an application you have sent it.

9.5 Notifications. You can choose which application and message notifications you receive, and you can turn them off at any time.

10. Cookies and analytics

10.1 A choice comes first. Our cookie banner asks you to Accept or Decline optional cookies. Until you accept, no analytics or other optional cookie is set, and the site runs only the cookies it needs to work.

10.2 If you decline, nothing optional is loaded. If you had previously accepted and then decline, the tracking cookies already set are cleared.

10.3 If you accept, Cavuno Analytics is switched on. This uses a randomly generated session identifier to record how pages are used, so we can see which parts of the site work and which do not. It is not used to build an advertising profile of you.

10.4 Changing your mind. Your choice is remembered for about 13 months. You can reopen the banner at any time using Cookie preferences in the footer of any page, and change your answer.

10.5 Consent records. We keep a record of the choice you made, with a pseudonymous consent identifier, the version of the banner you saw and the time, so that we can show your choice was respected. That record holds no IP address, browser identifier or analytics session identifier. We keep it for two years, then it is deleted.

10.6 No advertising trackers. We have no advertising or social-media tracking tags switched on today. If we ever add them, they will only run after you accept.

10.7 Full detail. The Cookie Policy at /cookie-policy lists the individual cookies, what they do and how long they last, together with the strictly necessary cookies that make signing in and applying work.

10.8 The agency waiting-list form is on HubSpot's own site. The pricing-page button that opens the agency waiting-list form takes you to a page hosted by HubSpot under its own address, where HubSpot's cookies and its own privacy notice apply. We do not load HubSpot on DUNCO itself, so it sets no cookie here and adds nothing to what our banner asks you about.

11. Who we share your information with

11.1 We do not sell your personal information.

11.2 Cavuno — our platform provider. Cavuno builds, hosts and operates DUNCO as our data processor. That covers the website and application hosting, the database, private file storage (including CVs), search, analytics, email delivery, logging and monitoring. Cavuno may only process your information on our instructions.

11.3 Cavuno's service providers. To run the platform, Cavuno uses the providers below, as published on its subprocessor list on 14 October 2026, with the category that list records for each one.

Provider	What it is used for	Where processing happens
Convex	Database and private file storage (profiles, applications, CVs)	United States
Hetzner	Application hosting and background processing	United States / Germany
Cloudflare	Network, content delivery, storage and hosting	Global (United States and EU storage)
OpenAI	AI processing, including reading information out of a CV	United States
Google	Cloud hosting and AI models	United States and other countries
Voyage AI, Qdrant	Search	United States / Germany
Tinybird	Analytics (Cavuno Analytics)	United States
PostShiba (Bento), Resend	Email delivery (alerts, notifications and account email)	Australia / United States / EU
Mapbox	Location and mapping	United States
Axiom, Better Stack	Logging and monitoring	United States / EU
Stripe	Payments, only if a paid plan is ever bought	United States
xAI, RunInfra	AI features restricted by Cavuno to profiles a board has made public, and to no other job-seeker data	United States / Sweden
Alibaba Cloud	As above	Singapore
Xiaomi MiMo	As above; no standard contractual clauses	Singapore / Netherlands
DeepSeek	As above; no transfer safeguard at all	China

Cavuno's list records Anthropic, TypeSafe AI, Exa, OpenRouter and DataForSEO as receiving no job-seeker data, so no worker information goes to them.

What this means for a worker's profile. The five providers in the last four rows may receive a published profile and nothing else. No worker can publish a profile any more (section 7.1), so no current setting places a profile in that category. Whether an older stored setting still does is an open question, and it is set out in 11.7.

11.4 Agencies and employers, as described in sections 7, 8 and 9 — only according to your visibility and sharing choices.

11.5 Professional advisers and authorities where necessary: our legal and accountancy advisers under confidentiality, and law enforcement, regulators or courts where the law requires it or where we need to establish, exercise or defend a legal claim.

11.6 A business transfer. If DUNCO is sold or merged, or its assets transferred, personal information may be transferred to the buyer as part of that transaction. We would tell you before that happened and the same protections would continue to apply.

11.7 AI and CV reading. The information read out of a CV is used to fill in your profile. That work is done by the AI providers listed in 11.3 as receiving job-seeker data (OpenAI and Google), on Cavuno's instructions.

The providers restricted to published profiles. The five providers in the last four rows of 11.3 may receive a profile that a board has made public, and nothing else about a job seeker. A worker profile on DUNCO cannot be made public (section 7.1), so we do not send your profile to any of them. We make no claim about whether an AI provider uses a CV, an application or a message to train its own models: that has not been confirmed to us, so it is not stated here either way. If you want to know more about what is sent for a particular feature, write to info@dunco.site.

11.8 HubSpot — the agency waiting list. The agency waiting-list form is hosted for us by HubSpot. If you send it, the name, email address and agency details you enter are processed by HubSpot so that we receive and can answer your enquiry, and we use them only to contact you about the beta and about agency access. Nothing you send through that form creates a DUNCO account or gives access to the platform.

12. International transfers

12.1 Some of our providers process personal information outside the United Kingdom, mainly in the United States, and also in Australia, Germany, the Netherlands, Sweden, Singapore and China. This is unavoidable for a platform of this kind, and we do not claim otherwise.

12.2 For most providers the transfer is protected by an approved mechanism — the UK International Data Transfer Addendum to the standard contractual clauses, or the UK Extension to the EU–US Data Privacy Framework where the provider is certified. Cavuno's published subprocessor list records the safeguard used for each provider.

There are exceptions, and we state them rather than call every transfer protected. Xiaomi MiMo is recorded as having no standard contractual clauses, and DeepSeek as having no transfer safeguard at all. Both are restricted to profiles a board has made public.

12.3 Cavuno's subprocessor list records the safeguard used for each provider, and section 12.2 states the two exceptions to it.

12.4 You can ask us for more information about the safeguards that apply to a particular transfer by writing to info@dunco.site.

13. How long we keep your information

13.1 We keep personal information only as long as we need it for the purposes in section 5, or as long as the law requires.

13.2 The periods below are the ones we can stand behind. Where a period is still being confirmed with our platform provider, the row says so and points to section 13.4 rather than naming a period nothing carries out.

Information	How long we keep it
Account and profile information	While your account is open, and afterwards only as set out below and in 13.3
Construction card records and verification statuses	While your account is open. Deleted with your profile when you delete your account (sections 13.3 and 16.3); a copy can remain in a daily backup for up to about seven days
CV kept on file	Until you delete or replace it, or close your account. No time limit is applied today
CV not kept on file	The file is deleted once it has been read
Applications	While your account is open and for as long as we need it to deal with your application (section 13.4)
Messages	While your account is open and for as long as we need them to deal with the conversation (section 13.4)
Job alerts	Until you unsubscribe or delete your account (section 13.5)
Contact-form messages	For as long as we need it to answer you and keep a record of how we dealt with your query (section 13.4)
Sign-in session cookie	30 days, refreshed when you sign in
Cookie consent choice	About 13 months
Cookie consent records	Two years, then deleted
Analytics records	13 months. Daily totals carry no identifier and are kept for as long as the board exists
Server and security logs, including IP addresses	Up to 30 days, then deleted automatically
Backups of the database, including CVs and applications	Daily encrypted backups kept for 7 days. A deleted record can remain inside a backup for up to about 7 days and cannot be removed from a backup on its own
Records we must keep by law	As long as the law requires

Three of these periods are not settled, and no period is stated for them as if it were. Section 13.4 says which, and why.

13.3 After you close your account, the login is removed and your profile and the details attached to it are deleted permanently — your trades, work history, education and skills, card records and the verification statuses our team set, qualifications, availability, rates, preferred contact methods, saved jobs, job alerts, avatar and any CV kept on file (section 16.3). Three limits apply: anything we must keep for a legal obligation; anything needed to establish, exercise or defend a legal claim; and copies already held by an agency or employer (section 16.5). A deleted record can remain inside a daily backup for up to about seven days and cannot be removed from a backup on its own, and analytics records are deleted 13 months after they are recorded, with the daily totals carrying no identifier at all. One thing is still being confirmed, and section 16.4 says so plainly rather than promising it: what happens on the board to applications you have already sent and to messages you have already exchanged.

13.4 Three periods we are still confirming. For the three categories below no period is stated, because nothing carries one out today; we would rather say that than publish a period we cannot keep. We are confirming each with our platform provider and will state it here once it is confirmed.

Applications. We keep an application while your account is open and for as long as we need it to deal with your application, and delete it once the vacancy is closed and any query about it is settled. If you withdraw an application, the platform deletes it permanently at once, and we keep no copy. The agency you applied to keeps its own copy (section 16.5).
Messages. We keep messages while your account is open and for as long as we need them to deal with the conversation, and delete them once it has been closed for a reasonable period. You can unsend a message within 15 minutes of sending it. The person or agency you messaged keeps their own copy (section 16.5).
Contact-form messages. We keep a message you send through our Contact page for as long as we need it to answer you and to keep a record of how we dealt with your query. We are confirming the exact period with our platform provider and will state it here once confirmed.

13.5 Job alerts. We keep a job alert until you unsubscribe or delete your account. If you unsubscribe but keep your account, we keep your email address with an “unsubscribed” marker so that we know not to email you again, and delete it when you delete your account or ask us to.

14. Security

14.1 We take the security of your information seriously, and we and Cavuno apply technical and organisational measures appropriate to what we hold — including private construction card numbers, private phone numbers and CVs.

14.2 What we can tell you about specifically:

sign-in sessions are held in cookies that are inaccessible to page scripts, marked secure, and restricted in how they can be sent;
construction card numbers and your private phone number are withheld from every response sent to an agency, an employer or another worker, and removed again by the site before a page is drawn;
a contact number you choose to share is stored in a sealed form and revealed only on the server to a signed-in agency;
CV links are expiring, and are withheld from everyone except a signed-in agency while you have sharing switched on.

14.3 We do not publish a list of every security measure we use, because a list of that kind would help someone attack the platform. If you need more detail — for example as part of a supplier or due-diligence review — write to info@dunco.site and we will answer what we can.

14.4 If something goes wrong. If a personal data breach occurs that is likely to result in a risk to your rights, we will report it to the Information Commissioner's Office within 72 hours of becoming aware of it, and we will tell you without undue delay where the breach is likely to result in a high risk to you.

15. Your rights

15.1 Subject to applicable law — including the exemptions and limits in the UK GDPR and the Data Protection Act 2018 — you have the following rights:

to be informed — through this policy, about how your information is used;
of access — a copy of the personal information we hold about you, and information about how and why we use it;
to rectification — correction of information that is wrong or incomplete;
to erasure — deletion of your information where there is no good reason for us to keep it;
to restrict processing — to limit what we do with your information while a question about it is resolved;
to data portability — a copy of information you gave us, in a commonly used machine-readable format, where we process it on the basis of your consent or a contract;
to object — to processing based on our legitimate interests, including profiling; we must then stop unless we have compelling grounds that override your interests, or need it for a legal claim;
in relation to automated decision-making — we do not make decisions about you by automated means alone that have a legal or similarly significant effect;
to withdraw consent — at any time, where we rely on consent. Withdrawing consent does not affect what we did before you withdrew.

15.2 How to exercise them. Write to info@dunco.site. We will respond within one month of receiving your request (or of receiving anything we reasonably need to identify you), and it is free of charge. If a request is complex we may extend that period by up to two further months and will tell you why.

15.3 Identity. To protect your information, we may ask you for information to confirm your identity before we act on a request.

15.4 Some limits. The rights are not absolute. For example, we may keep information where we have a legal obligation to do so, or where it is needed for a legal claim. Where we refuse a request we will explain why.

15.5 Withdrawing consent in practice. The controls are:

cookies and analytics — “Cookie preferences” in the footer of any page (section 10);
CV sharing — the “Share my CV with recruitment agencies” switch on your profile (section 8);
contact sharing — your preferred contact methods on your profile;
notifications, job alerts and the matched-job email — the notification settings in your account, the manage link in any alert email, and the unsubscribe link in any matched-job email.

Objecting to job matching. There is no switch that turns the in-app Job matches list off — setting your profile to Hidden does not stop it. Write to info@dunco.site and section 5.4 explains what we can do and what we are still confirming with our platform provider.

15.6 No automated export today. The site has no self-service data export, so a request for a copy of your information, or for information about how it is used, is handled for you by our team at info@dunco.site rather than by a button in your account. You do not need to use any particular form of words, and we answer within the period stated in 15.2.

15.7 Complaints to the regulator. If you are unhappy with how we have handled your information, please tell us first at info@dunco.site so that we can try to put it right. You also have the right to complain to the Information Commissioner's Office at any time:

Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF
Telephone: 0303 123 1113
ico.org.uk

15.8 You can also complain to the data protection regulator in the country where you live, if that is outside the UK.

16. Deleting your account

16.1 You can delete your account yourself. The control is in your account settings, in the danger zone, and it does not require you to contact us.

16.2 You can delete your CV yourself, separately, without closing your account.

16.3 What deletion does. When you delete your account, the login is removed and the account is deleted permanently. That erases your profile and the details attached to it — your trades, work history, education and skills, card records, qualifications, availability, rates, preferred contact methods, saved jobs, job alerts, avatar and any CV kept on file — and you can no longer sign in or be found by agencies. It cannot be undone.

16.4 What may still exist after you delete your account. Deleting your account removes your profile and everything attached to it (section 16.3), and we keep no separate copy of it. One thing we cannot yet describe precisely, so we say so instead of guessing: applications you have already sent and messages you have already exchanged are held on the board as a record of a conversation between you and an agency, and whether the board deletes them, or keeps them with your details removed, when your account goes is being confirmed with our platform provider — together with whether any of them can be deleted before then (sections 13.4 and 16.5). We promise no erasure of those records until that answer is confirmed and written here. What no one can delete for you is in 16.5: a copy an agency or employer has received is theirs.

16.5 What we cannot recall. Information already sent to an agency or employer — an application, a message, a CV they downloaded, a contact number they received — is held by that business as its own controller. We cannot delete their copy for them, though you can ask them to, and their own privacy notice and retention periods apply.

16.6 Before you delete. If you have applications in progress or a placement being arranged, deleting your account will end your access to them.

17. Children and young workers

17.1 DUNCO is intended for people who are old enough to work in the construction industry. You must be at least 16 to create an account. If you are under 16, you must not use DUNCO.

17.2 Workers aged 16 and 17 are welcome. This includes construction apprentices, trainees studying for a vocational qualification, and students on industry placements, which are all options on our trade list.

17.3 What is different for a young worker. In practice the protections are the same ones that apply to every new profile (section 4): the profile is hidden from recruitment agencies until you choose otherwise, the job-search status is “not looking”, availability is “not currently available”, no contact method is selected and CV sharing is off. Card numbers are private for every worker (section 6), and a phone number is only passed to an agency where you have chosen to share one (section 3.1). Your age makes no difference to those settings.

17.4 Age is not part of your profile. Worker registration asks you to tick a mandatory box confirming that you are aged 16 or over. The box is unticked by default; the form will not submit, and will not start Google or LinkedIn sign-up, until you tick it. We do not ask you for your date of birth, the declaration is not kept as a separate record on your account, and the Service does not show your age to agencies, employers or other workers. It is a self-declaration, not verified proof of age.

17.5 Some work is not open to under-18s. Site rules, the limits on working time for young workers, and some card schemes' rules for particular machinery can mean a role is not suitable for a 16 or 17-year-old. We do not assess suitability and do not check anyone's age; the agency or employer decides whether a role suits a young worker (section 9).

17.6 Using your rights as a young worker. You can exercise the rights in section 15 yourself, including withdrawing consent to CV sharing or contact sharing.

17.7 If a young person under 16 has an account. We do not knowingly allow under-16s to use DUNCO. Registration carries the declaration in paragraph 17.4, which must be given before an email-and-password account is created, but it is a declaration and not a check: we ask for no date of birth and we verify no identity document, so we cannot confirm anyone's age. There is also one limit we do not control: an account created with Google or LinkedIn is created by Cavuno at the provider's callback, after the DUNCO sign-up screen has been passed, so the declaration blocks those buttons on our page but cannot be enforced on that route by the site itself. If you believe an account is held by someone under 16, contact us at info@dunco.site and we will close it and delete the information.

18. Changes to this policy and how to contact us

18.1 We may update this policy. The current version is always on this page, with its effective date at the top. Where a change materially affects what we do with your information, we will tell you — by email or by a clear notice on the site — before it takes effect.

18.2 Contact. One address covers everything in this policy — a question, a copy of your information, a correction or deletion, a card or verification dispute, a complaint, or the withdrawal of consent: info@dunco.site. We monitor it, and requests sent there are answered under section 15.2. The full details are:

Email: info@dunco.site
Company: DUNCO SITE LTD, 10 Waverley Court, Horsham, West Sussex, England, RH12 1TN
Company number: 17459669 (registered in England and Wales)
Website: dunco.site

18.3 If you are not satisfied with our response, you can complain to the Information Commissioner's Office (section 15.7).