Privacy policy

Last updated 10 August 2026.

This site is operated by Jobs Unlimited (“we”). We handle personal information under the Privacy Act 2020 and its information privacy principles.

This page describes what the site actually does. It is written to be checked against the software, not to cover us for things we don't do.

The short version

We collect what you type in, and nothing else. There is no advertising network, no analytics provider, and no third-party script of any kind on this site.
We set one cookie, to keep you signed in. It carries no identifier we can track you with outside this site, and it lasts 3 days after your last visit — keep using the site and it keeps renewing; walk away and it lapses.
Your CV goes to the employers you apply to. It is never sold, never shared with anyone else, and never published.
You can ask for a copy of everything we hold about you, or ask us to delete it, and we will do it. Use the contact form.

What we collect, and why

If you apply for a job

Your name, email address, phone number if you give one, your cover message, and your CV if you attach one. We collect it to pass to that employer — that is the whole purpose of an application, and we cannot process one without it.

If you create a candidate profile

Your name, email address, phone number if you give one, and the profile text you write. We use it to show you in search results to employers who have unlocked access, to let you track your applications, and to verify your email address.

If you set up a job alert

Your email address and the search terms you chose. Used only to send you that alert. Every alert email carries a one-click unsubscribe link, which needs no login and no reply from us.

If you register as an employer

Your company name, contact name, contact email address, and your domain name. The domain is the basis of the verification — we check that you control it, either by the address you registered from or by a DNS record you publish.

Everyone, automatically

Your IP address is used to rate-limit requests, so that one source cannot flood the site with fake applications or listings. It is held in memory for that purpose. Where a submission is refused as suspected spam, the IP address and the reason are written to a log file so we can investigate a pattern of abuse.

While you are signed in

We keep basic logs: signing in and out, posting or editing a listing, applying for a role or withdrawing an application, changing your profile, and — for employers — which candidate profiles and applications they looked at. Each entry holds the time, the email address on the account, the IP address the request came from, and what was done.

This exists to monitor misuse and provide an audit record for your benefit. Only site administrators can read it. It is not used for advertising or shared with anyone else.

We keep this record temporarily. You can ask us what it holds about you.

We count page views, searches and applications to understand which listings work. Those counts record what happened and when — there is no user identifier, no IP address and no cookie value in that table, by design.

Who can see it

Employers see the applications sent to their own listings, and nothing else. An employer can only download a CV attached to an application to a job they posted.
Employers who have unlocked talent search see the profile you chose to publish.
We can see everything, in order to administer and maintain the site, and to deal with abuse reports.
Nobody else. We do not sell personal information, and we do not share it for anyone else's marketing.

Suppliers, and information going overseas

Card payments are handled entirely by Stripe. Card numbers are entered on Stripe's systems and never reach ours — we store only the outcome of a payment and the reference for it. Stripe processes information outside New Zealand.

Email is sent through a mail provider, which necessarily sees the recipient address and the message.

Where a supplier holds information outside New Zealand, we rely on them being subject to comparable privacy safeguards, as principle 12 of the Privacy Act requires.

How it is protected

The site is served over HTTPS.
CVs are not publicly visible and are provided only to employers you apply to.
We do not store passwords. API keys are stored in a one-way hashed format that cannot be reversed.

No system is perfectly secure. If a breach happens that is likely to cause serious harm, we will notify the people affected and the Office of the Privacy Commissioner, as the Privacy Act requires.

How long we keep it

Job listings expire automatically and are removed from the site and from our sitemap at that point.
Applications, including CVs, are kept so that you and the employer can both refer back to them. We do not delete them automatically. If you want yours removed, ask us and we will remove it.
Candidate profiles and job alerts are kept until you delete them or ask us to.
Payment records are kept for seven years, which is what tax law requires.

We are being deliberately plain that application retention is currently a manual process rather than an automatic one, because a policy that promises a delete button we have not built would be untrue.

Your rights

Under the Privacy Act you can ask us for a copy of the personal information we hold about you, and ask us to correct it if it is wrong. There is no charge, and we will respond within 20 working days. You can also ask us to delete what we hold, and unless we are required to keep it — payment records, for example — we will.

Use the contact form. If you are not satisfied with how we handle it, you can complain to the Office of the Privacy Commissioner.

Changes

If we change this policy we will update the date at the top. Where a change materially affects how we use information you have already given us, we will tell you directly rather than relying on you re-reading this page.