Legal
Privacy Policy
How Backlog Agency collects, uses, and protects your personal data — and what rights you have over it.
Last updated: April 2026
Who we are and what this covers
Backlog Agency ('Backlog', 'we', 'us') is a boutique recruitment agency specialising exclusively in Product Management and AI Product Management placements. We are based in the United Kingdom and operate the website backlog.agency.
This Privacy Policy explains what personal data we collect, why we collect it, how we use and protect it, and what rights you have over it. It applies to candidates who register with us or browse our site, to hiring teams and employers who engage our services, and to visitors who contact us via any channel.
We process personal data in accordance with UK GDPR and the Data Protection Act 2018. If you have questions about this policy or your data, please contact us at team@backlog.agency.
What personal data we process
Candidates
- Identity data: name, email address, LinkedIn profile URL
- Professional data: resume, work history, skills, seniority level, salary expectations, visa and right-to-work status
- Preference data: location preferences, remote/hybrid requirements, role type and company stage preferences
- Communication data: messages sent via our contact form, portal, or email
- Usage data: pages visited, time on site, browser and device type (collected via analytics tools)
Employers & Hiring Teams
- Identity data: name, job title, email address
- Company data: company name, stage, headcount, tech stack, hiring context
- Role briefs: job specifications, salary bands, cultural requirements shared during a search
- Communication data: messages, briefs, and feedback exchanged during a placement process
All visitors
- Contact form submissions: name, email, and any message content you provide
- Technical data: IP address, browser type, referrer URL (via server logs and analytics)
Our purposes and legal bases
We use your data only for the purposes described below. Where we rely on legitimate interests, we have balanced those interests against your rights.
| Purpose | Legal basis |
|---|---|
| Matching candidates to open roles | Legitimate interests / contract performance |
| Communicating search progress and outcomes | Legitimate interests / contract performance |
| Sending role alerts and new PM openings you've opted into | Consent |
| Responding to contact form enquiries | Legitimate interests |
| Running our candidate portal (auth, profile, pipeline) | Contract performance |
| Improving our website and services | Legitimate interests |
| Complying with legal obligations | Legal obligation |
Third parties and onward transfers
We do not sell your personal data. We share data only where necessary to deliver our services:
Hiring teams: with your explicit consent, we share your resume and a written brief with the specific employer we are presenting you to. We will always tell you before making a submission.
Supabase: our database and authentication provider. Data is stored on EU-based infrastructure.
Resend: our transactional email provider. Used to deliver contact form notifications and portal emails.
Vercel: our hosting provider. Processes request logs and serves the site.
Anthropic (Claude API): used to parse and structure resume content you upload. Data is processed transiently and not used to train models.
We may also disclose data where required by law, court order, or to protect our legal rights.
How long we keep your data
Candidate profiles are retained for 24 months from your last active engagement with us (login, application, or response to a communication). After this period, inactive accounts and associated data are deleted unless you request otherwise.
Employer contact data related to a completed search is retained for 3 years for record-keeping purposes.
Contact form submissions are retained for 12 months.
You can request deletion at any time — see Your Rights below.
What you can ask us to do
To exercise any of these rights, email team@backlog.agency. We will respond within 30 days. If you are unhappy with our response, you have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.
Access: request a copy of the personal data we hold about you.
Correction: ask us to correct inaccurate or incomplete data.
Deletion: ask us to delete your data ('right to be forgotten').
Restriction: ask us to pause processing while a dispute is resolved.
Portability: receive your data in a machine-readable format.
Object: object to processing based on legitimate interests.
Withdraw consent: where processing is based on consent, you can withdraw it at any time without affecting the lawfulness of prior processing.
How we protect your data
We apply appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, or disclosure. This includes encrypted connections (TLS), role-based access controls in our database, and private storage buckets for uploaded documents.
Despite these measures, no internet transmission is completely secure. If you suspect a security incident affecting your data, please contact us immediately.
Cookies and tracking
We use a minimal set of cookies. Strictly necessary cookies support authentication and session management in the candidate portal. We may use a lightweight analytics tool that collects aggregated, anonymised usage data without identifying individuals.
You can control cookies through your browser settings. Blocking strictly necessary cookies may prevent the portal from functioning correctly.
Updates to this policy
We may update this policy from time to time to reflect changes in our services or legal requirements. Material changes will be communicated via email to registered users or via a notice on the website. The date at the bottom of this page shows when it was last updated.
For any privacy-related questions, data requests, or concerns, reach us at team@backlog.agency. We aim to respond to all requests within 5 business days and will always meet the 30-day statutory deadline.