Effective September 29, 2026
This notice supplements our Privacy Policy and applies only to residents of the State of California. It is provided under the California Consumer Privacy Act, as amended by the California Privacy Rights Act (together, the "CCPA").
Terms defined in the CCPA have the same meaning here. Where this notice conflicts with our Privacy Policy in respect of a California resident, this notice prevails.
1. Summary
We do not sell your personal information. We do not share it for cross-context behavioural advertising. We have never done either, and we have no plans to.
Because we do not sell or share personal information as the CCPA defines those terms, we are not required to provide a "Do Not Sell or Share My Personal Information" link, and we do not display one. We state this here so that its absence is explained rather than merely observed.
We do not use or disclose sensitive personal information for any purpose other than those permitted by the CCPA without a right to limit, and we therefore do not provide a "Limit the Use of My Sensitive Personal Information" link.
2. Personal information we collect
In the twelve months preceding the effective date of this notice, we have collected the following categories.
| CCPA category | Do we collect it? | Examples | Source | Business purpose | Disclosed to |
|---|---|---|---|---|---|
| A. Identifiers | Yes | Name, email address, IP address, cookie identifier | You; automatically | Responding to enquiries; operating and securing the site; measuring readership | Form, email, analytics, and hosting providers |
| B. Customer records (Cal. Civ. Code §1798.80) | Yes | Name, employer, professional history in a curriculum vitae | You | Evaluating a job application | Email and mailbox providers |
| C. Protected classifications | No | — | — | — | — |
| D. Commercial information | No | — | — | — | — |
| E. Biometric information | No | — | — | — | — |
| F. Internet or network activity | Yes | Pages viewed, referring URL, user-agent, request logs | Automatically | Operating and securing the site; measuring readership | Analytics and hosting providers |
| G. Geolocation data | Coarse only | Approximate region inferred from IP address | Automatically | Analytics aggregation | Analytics provider |
| H. Sensory data | No | — | — | — | — |
| I. Professional or employment information | Yes | Current role, organisation, industry, curriculum vitae | You | Evaluating an application; contextualising an enquiry | Email, mailbox, and form providers |
| J. Education information | Yes, if you provide it | Qualifications stated in a curriculum vitae | You | Evaluating a job application | Email and mailbox providers |
| K. Inferences | No | We draw no profile and make no inferred characteristics | — | — | — |
| L. Sensitive personal information | No | We do not collect government identifiers, financial account details, precise geolocation, racial or ethnic origin, religious beliefs, union membership, health data, or the contents of your private communications | — | — | — |
We collect this information for the business and commercial purposes described in Section 4 of our Privacy Policy, and we retain each category for the periods set out in Section 11 of that Policy.
3. Sale and sharing
We have not sold personal information, and we have not shared personal information for cross-context behavioural advertising, in the twelve months preceding the effective date of this notice.
We have not sold or shared the personal information of consumers we know to be under 16 years of age, and we do not knowingly collect personal information from anyone under 16.
4. Disclosure for a business purpose
We disclose personal information to the service providers and contractors listed on our Subprocessors page, each for the limited business purpose stated there. Each is bound by a written contract that restricts it to processing the information for that purpose and prohibits it from selling the information or retaining, using, or disclosing it outside the direct business relationship.
5. Your California rights
Subject to the exceptions in the CCPA, you have the right to:
Know and access. To request that we disclose the categories and specific pieces of personal information we have collected about you, the categories of sources, the business or commercial purpose, the categories of third parties to whom we disclose it, and whether we have sold or shared it. You may request this for the twelve-month period preceding your request, or, where technically feasible, for a longer period.
Delete. To request that we delete personal information we have collected from you, subject to the exceptions in Cal. Civ. Code §1798.105(d) — including where the information is necessary to complete a transaction, detect security incidents, comply with a legal obligation, or exercise a legal right.
Correct. To request that we correct inaccurate personal information we maintain about you, taking into account its nature and the purpose of processing.
Opt out of sale or sharing. We do not sell or share personal information, so there is nothing to opt out of. Should that ever change, we would provide the required link and mechanism, and update this notice, before the change took effect.
Limit the use of sensitive personal information. We do not collect sensitive personal information for any purpose that carries a right to limit.
Non-discrimination. To not be discriminated against for exercising any of these rights. We will not deny you access to the site, charge you a different price, or provide a different level of service because you exercised a right. We operate no financial incentive programme.
6. How to exercise your rights
Submit a request to privacy@devencelab.com with the subject line "California Privacy Request". Tell us which right you are exercising and provide enough information for us to locate your records — typically the email address you used to contact us.
Verification. We will verify your request by matching the information you provide against the information we hold. For a request to know specific pieces of personal information, we apply a reasonably high degree of certainty, which may mean asking you to confirm details only you and we would know. We use information provided for verification solely for that purpose.
Timing. We confirm receipt within 10 business days and respond within 45 calendar days. Where we need more time, we will tell you within that period and may extend by a further 45 days.
Authorised agents. You may use an authorised agent. We require written permission signed by you, and we may ask you to verify your own identity with us directly. An agent acting under a valid power of attorney under Cal. Prob. Code §§4000–4465 need not provide separate written permission.
No fee. We do not charge for responding, unless a request is manifestly unfounded or excessive, in which case we will explain the reason and any fee before proceeding.
7. Requests received
Businesses that process the personal information of 10,000,000 or more California residents in a calendar year are required to publish annual request metrics. We are below that threshold and do not publish metrics.
8. Notice at collection
This notice, together with Sections 3, 4, and 11 of our Privacy Policy, constitutes our notice at collection. It is linked from the footer of every page, and so is available at or before the point at which any personal information is collected.
9. Other US state privacy laws
Residents of other US states with comprehensive privacy laws — including Virginia, Colorado, Connecticut, Utah, Texas, Oregon, and Montana — have rights broadly comparable to those described above, including rights of access, correction, deletion, and portability, and the right to opt out of targeted advertising, sale, and certain profiling.
We do not engage in targeted advertising, sale of personal data, or profiling with legal or similarly significant effects. Residents of those states may exercise their access, correction, deletion, and portability rights, and appeal a refusal, by writing to privacy@devencelab.com. We will respond within the period required by the applicable state law.
10. Contact
| privacy@devencelab.com |
11. Changes
We review this notice at least annually, as the CCPA requires, and update it when our practices change. The effective date above records when the current version took effect.