UK GDPR
Privacy policy
This notice was last changed on
Data controller
Rocky-Messissi Limited (company number 16464554)
Unit 36 Silk Mill Industrial Estate, Brook Street, Tring, HP23 5EF, United Kingdom
Scope
What this notice covers
This notice covers civilengineeringjobs.co.uk only. It does not cover our job partner, the job board whose feed supplies the adverts. When you click an apply button you leave this site for our job partner’s site, and from that point our job partner is the controller of anything you give them — your name, your email address, your CV, your application. We never see it, we are never sent it, and we cannot answer for it. Read their privacy notice before you register.
We do not run accounts on this site. There is nothing to log in to, so there is no profile, no password and no application history held here.
What we collect
What we collect and why
Apply-click log: the job you clicked, our job partner’s id for it, the time, the page you came from, any utm_source/utm_medium in the link, your browser’s user-agent string, a salted SHA-256 hash of your IP address, the two-letter country code our host reports at the edge, and whether the click looked automated.
- Purpose
- To know which pages send people to our job partner, to reconcile the referral fees our job partner pays us, and to detect the click fraud this kind of site attracts.
- Lawful basis
- Legitimate interests (UK GDPR Article 6(1)(f)) — operating and protecting a referral service. We hold a hash rather than your IP address specifically to reduce what this involves.
- Kept for
- 24 months
Crawler log: the user-agent string, the path and the response status for requests from named search-engine and assistant crawlers.
- Purpose
- To see whether search engines and AI assistants can actually read the site. These are automated agents, not people.
- Lawful basis
- Legitimate interests (Article 6(1)(f)) — keeping the site indexable and diagnosing faults.
- Kept for
- 12 months
Job alerts: your email address, the role and city you asked about, the exact consent wording you agreed to, and the times you confirmed, and later unsubscribed.
- Purpose
- To send you the job alert you asked for, and to be able to prove you asked for it.
- Lawful basis
- Consent (Article 6(1)(a)), given by double opt-in: nothing is sent until you click the link in the confirmation email. You can withdraw it at any time from the one-click unsubscribe in every message.
- Kept for
- Until you unsubscribe. The consent record is kept 24 months after you unsubscribe.
Hosting and security logs held by our hosting provider, in the ordinary course of serving a web page.
- Purpose
- To keep the site available and to investigate abuse.
- Lawful basis
- Legitimate interests (Article 6(1)(f)) — security and availability.
- Kept for
- As set by the provider’s standard retention, which is short.
IP addresses
Why there is a hash and not an address
The apply-click log needs to be able to tell one visitor apart from another for an hour at a time, because a real person does not click apply sixty times in an hour and a click farm does. It does not need to know who you are.
So when you click an apply button, your IP address is combined with a secret salt and put through SHA-256, and only the resulting hash is stored. The address itself is never written to the log, never written to a log line, and never sent anywhere. The hash cannot be reversed, and because the salt is secret it cannot usefully be looked up either.
That has a consequence for your rights, and it is only fair to state it: given a hash we cannot work out whose it is. If you ask us for the records relating to you, we will need the IP address you used and roughly when, and even then — under Article 11 — we may be unable to confirm that a record is yours.
AI search
What happens to the words you search with
The search box at the top of the home page can be switched to AI search, and is marked “AI search” when it is. You describe the job you want in your own words — “Highways engineer in Birmingham, permanent” — and the words you type are sent to Anthropic, the AI company whose model turns them into this site’s own search filters, such as a role, a place, or contract or permanent. You then see the ordinary results page, with what was picked shown at the top so you can remove any of it.
Only those words are sent. Not your IP address, not your browser details, and nothing else that identifies you: the request to Anthropic is made by our server, not by your browser, and it carries your words and nothing about you. So that one visitor cannot run up the cost, the server counts AI searches against a hash of your IP address rather than the address itself. That count is held in the server’s memory only: it is never written to the database or to a log, and it is gone whenever the server restarts.
We do not store the words. They are not written to our database or to any log of ours. They do appear in the web address of the results page, after “ask=”, so that you can see exactly what was searched and change it — and so, like any web address, they can appear in your browser’s history and in the hosting provider’s request logs described above.
Please do not type personal details into it: your name, your email address, anything about your health, or anything about anyone else. It is a job search, and the role and the place are all it needs.
When AI search is switched off, the box is the ordinary keyword search, and the words you type go nowhere but this site.
Cookies and analytics
What is stored in your browser
This site sets no analytics, advertising or profiling cookies. There is no third-party tracker embedded in these pages. Nothing on this site needs your consent for a cookie, because nothing sets one that would require it.
If that changes, a consent banner will ask first, no non-essential cookie will be set before you agree, and this notice will be updated and re-dated before it happens.
One thing we commit to either way: we will never put an email address, a name or a one-time token into a page title, a URL or anything sent to an analytics provider.
Processors and sharing
Who else touches this data
We use two processors to run the site: a hosting and content-delivery provider, and a managed Postgres database provider. Both act only on our instructions under written processor terms. We do not sell data, and we do not share it with advertisers or data brokers.
When AI search is switched on, there is a third: Anthropic, an AI company based in the United States, which receives the words typed into the AI search box and nothing else, as the AI search clause above explains.
Following an apply link sends our job partner an ordinary web request, which necessarily includes your IP address and browser details, as visiting any website does. It also includes the full address of the page on this site you clicked from — which, on a search results page, contains the search you typed — because we ask your browser to send it: our job partner uses it to recognise visitors referred by partner sites. That is a visit to their site, not a disclosure by us of anything we hold.
Where a processor stores or handles data outside the UK, the transfer is covered by UK adequacy regulations or by the UK International Data Transfer Addendum to the standard contractual clauses.
Your rights
What you can ask us to do
Under UK GDPR you have the right to:
- be told what we hold about you, and be given a copy of it;
- have inaccurate data corrected;
- have data erased, where we have no overriding reason to keep it;
- restrict how we use it while a dispute is sorted out;
- object to processing we do on the basis of legitimate interests — including the apply-click log;
- receive data you gave us in a portable form;
- withdraw consent at any time where consent is the basis, which for job alerts means the unsubscribe link in any message; and
- complain to the Information Commissioner’s Office (ico.org.uk, 0303 123 1113) — we would rather you came to us first, but you do not have to.
Write to the controller at the address at the top of this page. We will answer within one month. There is no charge, and we may ask you for enough information to be sure the request is yours.
Also worth stating
Children, profiling and changes
This site is aimed at people looking for professional civil engineering work in the UK. It is not directed at children, and we do not knowingly collect anything from under-16s.
We do not make automated decisions about people with legal or similarly significant effects, and we do not build profiles of individuals. The bot checks on the apply route judge a click, not a person, and a click flagged as automated still gets a working link to our job partner — being wrong about a click must never cost someone their application.
We do not collect special category data. Please do not send any to us; there is nowhere on this site that asks for it.
If this notice changes materially we will change the date at the top of it. The terms of use explain what this site does, and about and method explains where the pay figures come from.