MatrixRec
Start free trial
  1. Home
  2. Privacy policy

Privacy policy

Last updated 2026-09-09

MatrixRec (“MatrixRec”, “we”, “us”) provides a recruitment CRM for UK recruitment agencies at matrixrec.com and recruit.matrixrec.com (the “Service”). This policy explains what personal data we collect, why, where it is stored and what your rights are. It is written to comply with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

Contact for anything in this policy: hello@matrixrec.com.

1. Two roles: controller and processor

For visitors and account holders (people who browse this website, sign up for a trial or administer an agency account) we are the data controller.

For candidate, client and contact data that an agency enters into the Service the agency is the data controller and we are the data processor, acting on the agency’s instructions under our Terms of Service. If you are a candidate whose details are held in MatrixRec by an agency, please contact that agency to exercise your rights; we will assist them.

2. Data we collect as controller

  • Account data: your name, work email, agency name, phone number if you give it, role, and password hash. Collected when you sign up or are invited by your agency.
  • Billing data: plan, billing status and Stripe customer and subscription identifiers. Card details are entered directly into Stripe and never touch our servers.
  • Usage data: pages visited within the Service, timestamps, IP address, browser and device type, and a per-session identifier. We use this to keep the Service secure, detect abuse and understand which features are used. Page-visit logs are kept for 24 months and then deleted.
  • Website analytics: Google Analytics on matrixrec.com records page views and interactions such as clicking “Start free trial”. IP addresses are truncated by Google.
  • Signup protection: Cloudflare Turnstile runs on the signup form to block automated signups. It may process your IP address and browser characteristics.
  • Correspondence: emails you send us and our replies.

3. Why we use it (lawful bases)

  • To provide the Service you signed up for (contract): creating and running your account, billing, support.
  • To keep the Service secure and prevent abuse (legitimate interests): audit logs, session tracking, trial-abuse detection, signup protection.
  • To improve the product (legitimate interests): aggregated usage analytics.
  • To tell you about the Service (legitimate interests, or consent where required): trial reminders, billing notices, product updates. You can opt out of non-essential email at any time.
  • To comply with law (legal obligation): tax and accounting records, responding to lawful requests.

4. Data agencies enter (we are processor)

Agencies use the Service to store candidate, client and prospect records, call notes, placements, weekly plans, SMS campaigns and Right to Work documents including passport or BRP images, visa share codes and identity cards. We process this only to provide the Service to the agency. We do not use it for our own purposes, sell it, or use it to train models. A data processing agreement is available on request.

Candidates who receive a document-upload link from an agency are authenticated by a single-use link sent to them; we record when the link was used and the documents uploaded, for the agency’s audit trail.

5. Where data is stored

The Service and its database run on Microsoft Azure in the United Kingdom (UK West region). Data is encrypted in transit (TLS) and at rest. Each agency’s data is isolated by tenant.

6. Sub-processors

We use the following third parties to run the Service. Each is bound by a data processing agreement and, where data leaves the UK, by the UK International Data Transfer Addendum or an adequacy decision.

  • Microsoft Azure (UK): hosting, database, storage.
  • Stripe (EU/US): subscription billing and card processing.
  • Google Analytics (EU/US): website analytics on matrixrec.com.
  • Cloudflare Turnstile (EU/US): bot protection on signup.
  • Microsoft Azure Static Web Apps: hosting for this marketing website.
  • SMS providers (TextMarketer, Esendex): agencies connect their own SMS account. Messages sent through the Service pass to the provider the agency has chosen under that agency’s own agreement with them.

7. Retention

  • Account and agency data: for the life of the account and 90 days after closure, unless you ask us to delete it sooner or law requires longer.
  • Billing records: 6 years, as required by UK tax law.
  • Page-visit and audit logs: 24 months.
  • Candidate and client data entered by agencies: as instructed by the agency. On closure of an agency account we export the data on request and then delete it.

8. Your rights

Under UK GDPR you can ask us to: access the personal data we hold about you; correct it; delete it; restrict or object to processing; and provide it in a portable format. To exercise any of these, email hello@matrixrec.com. We respond within one month. If you are unhappy with how we handle your data you can complain to the Information Commissioner’s Office at ico.org.uk.

9. Cookies

The Service uses strictly necessary cookies and browser storage to keep you signed in and remember your preferences. matrixrec.com uses Google Analytics cookies to measure how the site is used. You can block analytics cookies in your browser without affecting the Service.

10. Security

We use TLS for all traffic, encryption at rest, hashed passwords, short-lived signed session tokens, tenant isolation in the database, rate limiting on public endpoints, and an audit log of access. No system is perfectly secure; if we become aware of a breach affecting your data we will notify you and, where required, the ICO within 72 hours.

11. Changes

We will post any changes to this policy here and update the date at the top. Material changes will be emailed to account holders.

Start free 14-day trial