Last updated: 24 October 2026
Shortlisted is a trading name of SHORTLISTED TODAY (PTY) LTD, registration number 2026/368921/07, registered in South Africa. We are the responsible party under POPIA and the controller under the GDPR for the information described here. Our Information Officer is Simon Strehler, whom you can reach at simon@shortlisted.today.
This policy covers our clients, people who ask us for a free CV review or book a call, people who apply to work with us, visitors to our website, and the hiring managers and recruiters we contact on our clients' behalf (section 6).
We don't train AI models on your information, and we don't let our providers do so.
Matching roles to you is automated. On plans with an account manager, a person reviews the results before they reach you, and you can ask them to look again. No decision with legal or similarly significant effects on you is made by software alone.
We don't sell your information and we don't share it with advertisers. We rely on these providers:
Our team is Simon Strehler and a contractor who works on client searches under a written confidentiality agreement. Each of them signs in with their own account. We share your information with an employer only as section 6 describes, when we submit an application you've asked us to submit, or when you tell us to.
If you're a hiring manager or recruiter and we've emailed you, this section is for you. We find your name, role and work email on your company's website, on professional profiles such as LinkedIn, and in other public sources. Where no address is published, we may infer one from your company's usual format. We use these details, with help from the AI providers in section 5, to introduce one of our clients for a role or for opportunities at your company. Our basis is our legitimate interest, and our client's, in a direct introduction. We keep a record of whom we've emailed, when, and whether the email arrived, for 2 years after our last email. If you'd rather not hear from us, reply or email simon@shortlisted.today. We'll add you to our do-not-contact list, which we keep permanently so that we keep honoring your request.
Information travels over encrypted connections and is stored with providers that encrypt it at rest. Only the people working on your search can open your files. Job-site passwords get extra protection. Each one is locked in the browser before it reaches us, so our servers hold it only in a form they can't read. Simon alone can unlock it, on his own computer, and only to submit an application for you, and we keep a record of every time he does. We keep our system keys off the website and off third-party services. If a security breach affected your information, we would tell you without undue delay and tell the regulator where the law requires.
Our database is in Frankfurt, in the European Union. Some of the providers above process information in other countries, including the United States. Where information is transferred internationally, we rely on those providers' standard contractual clauses. Where POPIA applies, those agreements are our basis under section 72, because they bind the recipient to protection substantially similar to the Act's.
When we delete your information, older copies can remain for a while in a few places: in the history of our version-controlled files until we clear it, in our database backups for about five weeks, and in sent emails. If you want everything erased, tell us, and we'll clear all of it and confirm when it's done.
We use a few strictly necessary cookies to keep you signed in and remember your preferences. We use Google Analytics only if you accept analytics cookies in the banner, and until then it stays off. We also count visits with Cloudflare Web Analytics, which sets no cookies, doesn't recognize you between visits, and shows us only totals. If you decline analytics in the banner, we switch that off too. Our basis for Google Analytics is your consent, and for Cloudflare it's our legitimate interest in knowing how the site is used. IP addresses are anonymized, and our own admin pages are left out of analytics. You can change your choice at any time with the link at the foot of this page.
If you sign in with Google, Google sends us your name, email address and profile picture, and nothing else. We use them only to create your account, sign you in and address you by name. When you book a call, we create the meeting on Shortlisted's own Google Calendar, and we never read or write your calendar. Our use of information from Google APIs follows the Google API Services User Data Policy, including its Limited Use requirements. We never send information we receive from your Google account to any AI model, never sell it, never use it for advertising, and don't let people read it except with your consent, for security, or where the law requires.
You can ask us for a copy of your information, to correct it, to delete it, to export it, or to stop using it for a purpose you object to. Email simon@shortlisted.today and we'll respond within 30 days. You can also complain to the South African Information Regulator (inforeg.org.za) or, where the GDPR applies, to your local data protection authority.
Our service is for people aged 18 and over, and we don't knowingly collect information about anyone younger.
We may update this policy. If a change materially affects you, we'll email you at least 14 days before it takes effect.
Email simon@shortlisted.today.