Last updated: 5 November 2026
Heritage Talent Limited is a recruitment software company. We make Heritage, an applicant tracking system (ATS) for recruitment agencies, freelance recruiters and in-house hiring teams. We also publish free learning resources for recruiters, such as courses and guides.
In this policy, "Heritage", "we" and "us" mean Heritage Talent Ltd, a company registered in Nigeria (RC 9959882), whose registered address is in Lagos, Nigeria.
If you have a question about this policy or your personal data, contact us at info@heritagetalent.io.
This policy explains how we handle personal data when you:
For data that our customers put into the Heritage ATS (for example, candidates' CVs), the customer decides how it is used. Section 5 explains how this works.
| Who you are | What we collect | Where it comes from |
|---|---|---|
| Free resource or course sign-up | Name, email, the details you give on the sign-up form (for example, your role and the tools you use today), and whether you agreed to marketing emails. Where a course saves your progress in your own browser, that data doesn't come to us. | You, through the sign-up form |
| ATS customer or user | Name, work email, phone number, company name, job title, login details, billing details, and how you use the product | You or your organisation, and our payment provider |
| Job candidate | Name, contact details, CV, work history, skills, application answers, interview notes and feedback, offer details. If you have your own candidate portal account, we also hold your login details, profile and visibility settings. | You, when you apply or set up a candidate portal account, or the recruiter or employer using Heritage |
| Website visitor | IP address, device and browser type, pages viewed, and similar technical data | Your browser, through cookies and similar tools (see section 9) |
| Anyone who contacts us | Name, email and the content of your message | You |
We do not ask for sensitive data, such as health, religion or ethnicity, through our own forms. If a customer collects it through Heritage (for example, for diversity monitoring), it's that customer's responsibility to have a lawful basis for doing so.
We only use your data where the law allows it. The table shows the legal basis for each use, as set out in the NDPA and the UK and EU GDPR. Where you live in another country, we also follow the data protection law that applies to you there.
| What we do | Legal basis |
|---|---|
| Give you access to our free courses and resources, and send related emails | Contract: providing the service you asked for |
| Send you recruiting tips and Heritage product news | Consent: only if you ticked the box. You can unsubscribe at any time. |
| Follow up personally about whether Heritage could help your team, based on what you told us at sign-up | Legitimate interests: telling relevant professionals about our product. You can object at any time. |
| Provide the Heritage ATS, manage your account, take payment and give support | Contract |
| Keep our services secure, prevent fraud and fix problems | Legitimate interests |
| Understand how our website, resources and product are used, so we can improve them | Legitimate interests, or consent where the law requires it for cookies |
| Keep accounting records and respond to lawful requests from authorities | Legal obligation |
We do not sell your personal data. We do not use it to make decisions about you that have legal or similarly significant effects without a human being involved.
When a recruitment agency, freelance recruiter or employer uses Heritage to manage hiring, they are the data controller for their candidates' data. They decide what is collected and how it is used. Heritage acts as their data processor. That means we store and process that data only on their instructions and under a data processing agreement.
If you create your own candidate portal account. When you sign up for a Heritage candidate account yourself, for example to build a profile, upload your CV or track your applications, Heritage is the data controller for that account. We use your profile to run the portal for you (contract). We only use it to suggest roles, or to make you visible to recruiters, if you choose those settings (consent). You can change those settings or delete your account at any time.
When you apply for a role or share your profile with a recruiter or employer, they receive a copy of the details you chose to share. From then on, they are the controller of that copy, and Heritage processes it for them as described above. If you delete your portal account, we delete your profile. However, recruiters you already applied to keep their copy under their own privacy policy, and you can ask them to delete it.
If you want to see, correct or delete data that a recruiter or employer holds about you, please contact them directly. For your own portal account, contact us. If you contact us, we'll pass your request on to them and help them respond.
Heritage includes AI features that help recruiters screen and summarise CVs. These features help a person make the decision. They do not make hiring decisions on their own. We do not use customers' candidate data to train AI models for anyone else's use.
| Data | How long we keep it |
|---|---|
| Free resource and course sign-ups | 2 years after your last activity, or until you ask us to delete it. If you unsubscribe from marketing emails, we stop sending them straight away. |
| ATS account data | While your account is active, plus 12 months |
| Billing records | 6 years, as tax law requires |
| Candidate data in the ATS | As our customer instructs. When a customer leaves Heritage, we delete it within 90 days. |
| Website analytics | 26 months |
We protect data with encryption in transit and at rest, access controls and regular backups. Only staff who need data for their work can access it. If a breach puts your rights at risk, we will tell the regulator and you as the law requires. For the NDPC, that means within 72 hours.
You have the right to:
To use any of these rights, email info@heritagetalent.io. We'll reply within 30 days. If you're unhappy with our response, you can complain to the Nigeria Data Protection Commission. If you're in the UK, you can complain to the Information Commissioner's Office.
If you live elsewhere, you can complain to the data protection authority in your country.
Our services are for working professionals and are not aimed at anyone under 18. We do not knowingly collect children's data.
If we make important changes to this policy, we'll update the date at the top and, where appropriate, tell you by email.