Privacy notice
What TopGrads collects, why, who can see it, how long it is kept, and what you can do about it. Last updated 2 November 2026.
This notice is not final
It accurately describes what the product does today, and the retention periods below are enforced by the system rather than merely stated. It has not been reviewed by a qualified adviser, and the lawful bases named are our working position rather than settled advice.
Who is responsible for your data
HUMAND TALENT LIMITED, company number 12379847, registered office 1 Abbey Street, Eynsham, England, OX29 4TB, is the data controller.
For anything about your data, contact admin@humand.co.uk.
Every route we do have is listed on our contact page.
What we collect, and why
Only from people who create an account. TopGrads collects nothing about you when you browse, apart from the apply-click counts described below, which do not identify you; you can read every job and every Career Hub page without telling us anything. What the platforms hosting and protecting the site set in your browser is listed under cookies below.
Apply clicks. When you click Apply on a job, we count the click. Each count records which job it was, when the click happened and where the link led: the employer's application page, or TopGrads membership. No name, account, IP address or cookie is stored with it, so a count cannot be traced back to you. We use the counts to show employers how much interest their roles receive. There is no fixed retention period yet: a count is kept until we delete it, or until the job it belongs to is removed from TopGrads.
| What | Why | Basis | Who can see it |
|---|---|---|---|
| Your sign-in email address | To let you sign in and to contact you about your account | Contract | You. TopGrads administrators when supporting your account. |
| Your name and graduation year, given when you join | To run your membership and confirm you are eligible for it | Contract | You and TopGrads administrators |
| Your career profile: headline, location, education, qualifications, experience, skills, links, the roles and industries you are interested in, and your preferences | To run your workspace. Everything except your name is optional. | Contract | You. TopGrads administrators only while you are in the Talent Network, to verify it. |
| Your CVs and other documents | To keep them for you | Contract | You only. Stored privately, never published, never sent to anyone automatically. |
| Applications you track and jobs you save | To run your application tracker and shortlist | Contract | You only |
| Your Talent Network choice, TopGrads' verification decision, and the history of both | So employers can find you only if you choose, and so every change is accountable | Consent | You and TopGrads administrators. If you choose to be discoverable and are verified, approved employers see a summary: headline, education, graduation year, country, preferred locations, interests, skills and way of working. Never your name, contact details, right to work, salary expectation or documents. |
| Your consent choices and when you made them | To honour them, and to be able to show that we did | Legitimate interests | You and TopGrads administrators |
| Marketing email preference | To send you graduate jobs and news, only if you ask us to | Consent | You and TopGrads administrators |
| If you applied before October 2026: that application, its status history, and the CV you sent with it | Kept as a record of what you sent and what was decided, until you delete it | Legitimate interests | You and TopGrads administrators. The CV is visible to you only. |
| If you request an employer account: your organisation's name and website, and your place in it | To check and run the employer account | Contract | You, the other people in your organisation's account, and TopGrads administrators |
Your CVs and documents
Your documents are stored privately. They are not published, they are not reachable from any public address, and there is no link to them that works without an authorisation check. Only you can open them. TopGrads staff cannot, and no employer ever receives one automatically.
We accept PDF and DOCX only, up to 5 MB, and we check that an uploaded file genuinely is one of those formats. We do not scan files for malware. TopGrads has no scanning infrastructure, and we would rather tell you that than let you assume otherwise.
Employers and the Talent Network
No employer sees anything about you unless you choose to be discoverable. You start private. Joining TopGrads, saying yes to marketing email, or completing your profile never changes that.
If you choose to be discoverable, TopGrads checks your profile first. Only once it is verified can employer accounts that TopGrads has approved find a summary of it: your headline, education, graduation year, country, preferred locations, interests, skills and way of working. They never see your name, email, right to work, salary expectation, documents or tracked applications. There is no way for an employer to contact you through TopGrads today.
You can go private again at any time in your settings, and employers stop finding you straight away. Every change, and every verification decision, is recorded.
We do not sell your data, and we do not share it with advertisers or data brokers.
How long we keep it
This is enforced by the system, not just written here.
- While you are a member, we keep your workspace for as long as you are one.
- If you applied under the old membership process and never joined, that application, its CV, status history and consent records are deleted 24 months after its last status change.
You do not have to wait. You can delete everything at any time from settings.
Cookies and what is stored in your browser
TopGrads sets no analytics or advertising cookies and runs no third-party trackers of any kind. What we store ourselves is either needed to make the site work or put there by something you did.
Some of the items below are not ours. They are cookies set by the platforms that host and protect the site, on the page response itself, before any TopGrads code runs. They are listed with what can actually be evidenced about each one: what sets it, what it holds and how long it lasts. Whether they need your permission is under legal review — we would rather say so than claim an exemption we have not had confirmed.
- Supabase session (browser storage, set by TopGrads, until you sign out or clear your browser storage) — Keeps you signed in between pages. Set only once you sign in.
- topgrads.saved-jobs (browser storage, set by TopGrads, until you clear your browser storage) — Opportunities you have saved. Held in this browser only.
- __dpl (cookie, set by Hosting platform, 24 hours) — Holds the identifier of the deployment currently serving the site. Its value is the same as the x-deployment-id header on the same response.
- __cf_bm (cookie, set by Cloudflare, about 30 minutes of inactivity) — Cloudflare's bot protection. Cloudflare documents it as needed by its Bot Management and Bot Fight Mode products, generated separately for each site, and not corresponding to any application user ID.
Clearing your browser storage removes all of it. Doing so signs you out, but does not touch anything held on your account.
What you can do
All of this is available to every account holder, whether or not you joined.
- See what we hold. Download everything, as a file, from settings.
- Correct it. Edit your profile, documents and tracked applications whenever you like.
- Leave TopGrads. Deletes your profile, documents and their files, tracked applications, saved jobs, Talent Network choices and consent records, and keeps your sign-in. You can join again later.
- Delete your account. Does all of that and removes your sign-in too. There is no waiting period and you do not have to give a reason.
- Leave the Talent Network. Go private at any time without leaving TopGrads. Employers stop finding you straight away.
- Change your mind about marketing. It is off unless you turn it on, and it is separate from everything else.
Go to settings to do any of it.
Complaints
If you are unhappy with how we have handled your data you can complain to the Information Commissioner's Office at ico.org.uk. We would rather you told us first, but you do not have to.
See also our terms and conditions.