Effective date: 28 January 2026

At Jack & Jill, operated by Tinker Tailor Talent Limited ("we," "us," "our"), we take your privacy seriously. However, in order to provide you with the amazing user experience we aspire to, we'll need to collect and process some of your personal data from time to time.

This document provides you with all the important legal details around what data we collect, why, on what legal basis, who we share it with, and, most importantly, your rights.

1. The Headlines

To make things easier to follow we've set out below a summary of the really key points. However, it's really important you still read through everything in full to make sure you understand how your personal data is used.

If you have any questions or concerns once you've had a read through then please do reach out to us. You can contact us using the details provided below.

• We'll collect certain personal data from you during your journey. This includes your contact details, professional profile, voice calls, and marketing preferences.
• We do this for a number of reasons, most importantly to enable us to deliver our Services to you to an exceptional standard, and to help you find that perfect role, but also to fulfil our own legal obligations.
• We may share your personal data with third parties, such as prospective employers, if you agree to it by setting your profile to "Public", and other partners and service providers, but only where necessary to deliver our Services or to meet our obligations, and always subject to strict safeguards.
• We may collate aggregated data sets based on your anonymised data for market reports.
• Where particularly sensitive personal data is used or shared we'll always seek your consent. We will also never sell your personal data to others.
• We keep your personal data safe, secure, and only for as long as we really need it.
• You have a number of rights under the law in relation to your personal data, which you can exercise at any time.
• If you're using the Platform from outside of the UK please make sure you're also aware of your home country's own rules and regulations.

2. Who We Are

Legal Entity: Tinker Tailor Talent Limited is registered in England and Wales, Company No. 16324763, with registered address at 86-90 Paul Street, London, England, EC2A 4NE.

Brand Name:"Jack & Jill" is the brand name we operate under. Where you see a reference to "Jack & Jill" or "we" or "us" or "our", this means our legal entity, which is called Tinker Tailor Talent Limited.

Data Controller:We are the "data controller" for all the personal data we collect on the Platform. This means it's us that decides who does what with your data.

3. What Data We Collect

We'll collect personal data from you at different stages of your user journey. This includes:

Contact Information:When you sign up with us you'll be asked for your first name, last name, email address, and phone number.

Professional Details:Our ambition is to find you that dream role you've been looking for. To do that we'll need your professional details such as your CV/Resume, LinkedIn profile, role preferences, salary expectations, location preferences, and similar recruitment-related information.

Voice Calls & Transcripts:When you chat to our AI assistant "Jack", we will record and transcribe your voice calls. This would therefore include any personal information you choose to share during the conversation, such as your experience, goals, or any other information you think might be helpful. However, recordings and transcripts will never be shared with prospective employers.

User-Generated Files: This would include any other files, documents or materials you upload to the Platform.

Cookies & Analytics:Cookies are small digital files that are created and downloaded when you visit or use the Platform. We may collect some of these for device and usage data (e.g., IP address, login details, cookie IDs) to give you the best user experience and more generally to improve our service. You're free to disable or refuse cookies at any time but bear in mind this may impact your use of the Platform, and mean you're not able to access certain parts.

Marketing and Communications:We'd like to be able to tell you about all the interesting new things we're devising for our users, and any offers you may be eligible for, so we'll need to record your preferences on receiving marketing materials when you sign up.

Public Professional Profiles: We may collect publicly available professional information about you from sources such as LinkedIn, professional networking sites, and publicly accessible databases. We use this data under our legitimate interest to search for and identify potential candidates for open roles, and to facilitate relevant introductions.

4. How We Use Your Data

We may use your personal data collected for a variety of reasons, but rest assured this will only ever be as much as we need to in order to achieve each purpose, including:

Initial Account Set-Up and Administration: To set you up on our Platform and provide you with our Services.

Recruitment Matching:To identify and suggest relevant job opportunities for you, arrange introductions to employers, and tailor our AI-driven recommendations. From time to time, this may come about through data shared with us by our partners (e.g., public professional profiles), but we'd only ever use that data to affect an introduction where it's clear this would be within your reasonable expectations.

Communication and Marketing: To reach out to you about new roles, gather feedback, or communicate on behalf of partner companies. You can opt out of marketing and promotional campaigns at any time by emailing legal@jackandjill.aior clicking "Unsubscribe" on the emails we may share. We may also use larger batches of aggregated, anonymised data for marketing and analytics, but this will never identify you personally.

AI Processing & Improvement: We may use AI tools to assess how your skills and experience may align with open roles. This may include generating a fit score, rankings and creating profile summaries to support recruitment.

We may also use anonymised transcripts and aggregated usage data to improve our matching algorithms and AI systems. We'll never use your voice recordings to create biometric voiceprints, or sell or license your personal data to train third-party AI models. Call recordings are used only for quality assurance and to improve the Services we provide to you.

Platform Security & Maintenance: We may occasionally need to use personal data to protect our rights or the rights of others, for example by preventing misuse, fraud, as well as detecting and addressing security issues.

Compliance:We have lots of legal obligations we need to comply with, so we may also use your data as needed to ensure we're above board and doing things properly.

We may use your data in other ways outside this list, but where any additional uses are outside what you and your fellow users would reasonably expect, we'll always seek your consent first.

5. Legal Basis for Processing

Whenever a business such as ours uses your personal data, it must have a lawful basis under data protection law. Sometimes, we'll ask for your express consent to use your data. In other cases, we'll be relying upon one of the "lawful bases" set out below.

Fulfilling our Contractual Obligations to You:We want to make sure we do a good job and deliver on our promises to you, so we'll need to use your personal data to do this. This includes providing access to the Platform, communicating with you, and managing your account.

Legitimate Interests:A "legitimate interest" means something we reasonably need to do in order to run our business and to provide our Sourcing feature and our Services to you (like finding you a suitable employer). Even so, we'll always ensure that how we use that data is proportionate, and balanced against your own rights and freedoms.

Consent:We may sometimes ask for your express consent to share certain personal data, in particular "Special Category Data" (see below). You can of course change your mind. Simply email us at legal@jackandjill.ai letting us know.

Special Category Data:"Special Category Data" means anything that's particularly sensitive, like health, religious beliefs, and sexual orientation. We will only ever share such information where you say we can, and would only collect it where you specifically share it with us, e.g., during a conversation with "Jack" (our AI). However, we encourage our users to keep conversations focussed on their career goals.

Complying with Our Legal, Regulatory, and Audit Obligations:We've covered this above, but we'll need to use your data where it's necessary to make sure we're also operating in a legal and compliant way.

6. How Our AI Works & Your Control

Automated Decision-Making: We use automated decision-making for matchmaking but regularly audit decision outcomes to ensure they are accurate and free of bias and do whatever we need to subsequently to correct instances where we fall short in meeting the standards we set for ourselves.

Sourcing: Our Sourcing feature uses AI tools to analyse public professional profiles to generate candidate fit scores, rankings and creating profile summaries to support recruitment. Sourcing does not involve making automated decisions. Any decisions about whether to engage with a candidate are made by humans using the Platform.

Transparency and Explainability:If you'd like to better understand how "Jack" (our AI) and "Jill" (the 2nd AI) make decisions, or would like a decision reviewed by one of the humans on our team, you're always welcome to send us an email at legal@jackandjill.ai.

7. Data Sharing & Transfers

From time to time we may share your personal information with other parties, such as:

Employers:If you sign up through "Jack" (our AI), we will automatically share your candidate profile, professional details, and contact information with potential employers who work with "Jill" (the 2nd AI), provided they're a fit for your professional experience, skills, and interests. You can change this feature in your account settings.

Third-Party Providers:We need to use third-party AI and hosting Services to find you unmissable roles. Sometimes these providers may be based outside the UK/EEA, but we'll always implement additional safeguards if so.

Other Service Providers: We may also share personal data with our professional advisors, such as lawyers, accountants, auditors, and insurers, but only if and to the minimum extent needed.

Regulators and Government/Law Enforcement Agencies:We may have to share personal data with these parties where it's necessary to comply with a legal or regulatory obligation, or otherwise to protect our rights or the rights of any third party.

No Selling: Rest assured, we do not sell your personal data to third parties.

Finally, we take your right to privacy extremely seriously and we make sure that others do the same. We'll always ensure that any parties we share your information with also have appropriate safeguards and protections in place.

8. Data Retention Policy & Security Measures

Retention: We will delete your personal data upon request, except for data we are legally or commercially required to retain, which we will keep for a maximum of 2 years. This includes:

• Keeping business records for analysis and/or audit purposes;
• Complying with legal record retention requirements;
• Dealing with any complaints regarding our Services.

Whilst we hold your personal data, we make sure that we put both technical and organisational tools in place to help protect your personal data from theft or unauthorised access. We regularly review these measures to ensure they remain effective in protecting your personal data.

If there's any information we're unable to delete completely (e.g., for technical reasons), then we'll make sure we put safeguards in place to prevent any further use of the data.

Deletion Requests:If you'd like to ask for your account and/or data to be deleted then:

• Log in to your Jack & Jill account, click on the profile picture in the bottom left corner, select Manage account > Settings, and follow the instructions.
• If you encounter any issues, then please email us at: legal@jackandjill.ai or support@jackandjill.ai.

9. Your Rights

You have various rights under the UK GDPR and other data protection laws, which include:

• Access: Obtain a copy of any personal data we hold about you.
• Rectify: Correct errors or gaps in your personal data.
• Delete: Request that we delete your personal data.
• Object or Restrict: Limit or object to certain use cases, including the use of your personal data for our Sourcing feature.
• Data Portability: Ask to receive your data in a portable, transferable format.
• Complain:If you have any reason to complain, we will investigate and respond to your complaint as a priority. If you're unhappy with our response for any reason then you have the right to complain to the body responsible for looking after privacy in the UK, being the Information Commissioner's Office through their website https://ico.org.uk/.

If you'd like to exercise any of these rights, email us at legal@jackandjill.aiand we'll get back to you within 30 days, or sooner than that if we're legally obliged to.

One additional point just to note: any user request relating to your personal data will also be balanced against our own interests (in particular, complying with any legal and regulatory requirements) and those of any third parties. If this means we can't carry out your request for any reason, then we will tell you this and explain why.

10. International Users*

If you're using our Platform outside the UK then please ensure your use of the site complies with any local rules.

We may need to transfer your personal data to other countries where our partners are based. When we do this, we'll always make sure similar rules on privacy exist, and where they don't we'll take additional action to keep your information safe.

*U.S. users: For U.S. state privacy rights (including California), see Section 11.

11. U.S. State Privacy Rights

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA). Residents of certain other U.S. states may have similar rights as described below.

Right to Know:Request details about the personal information we've collected about you in the past 12 months, including categories of personal information, categories of sources, purposes, and categories of third parties to whom we disclose it, and (where applicable) the specific pieces of personal information.

Right to Delete: Request deletion of your personal information, subject to certain exceptions.

Right to Correct: Request correction of inaccurate personal information.

Right to Opt-Out of Sale/Sharing/Targeted Advertising/Profiling:We do not sell your personal information. If our use of cookies or other online identifiers is considered a "sale," "sharing," "targeted advertising," or profiling in furtherance of decisions that produce legal or similarly significant effects under applicable U.S. state privacy laws, you may opt out by setting yourself to "Incognito" in Manage Account > Settings or emailing legal@jackandjill.ai.

Right to Limit Use of Sensitive Personal Information:If you share sensitive information (e.g., health data) during conversations with "Jack" (our AI), you may request we limit its use to providing our Services.

Right to Non-Discrimination: We will not discriminate against you for exercising these rights.

How to Exercise Your Rights: Email legal@jackandjill.ai or use your account settings. We will respond within 30 days (and may extend as permitted by law). We may need to verify your identity. You may designate an authorised agent to make requests on your behalf. Where required, you may appeal our decision by emailing legal@jackandjill.aiwith the subject line "Privacy Appeal." Where required, we also process opt-out preference signals (such as the Global Privacy Control).

Categories of Personal Information: We collect the categories described in Sections 3 and 4 (including identifiers, professional information, call recordings and transcripts, cookies, and inferences) and disclose categories as described in Section 7. We do not collect biometric voiceprints.

Disclosure: We disclose personal information to employers (when you authorise it), service providers, professional advisors, and government entities when required by law, as described in Section 7. We do not have actual knowledge that we sell or share the personal information of consumers under 16 years of age.

12. Changes to This Policy

We might sometimes need to make changes to this Privacy Policy where we're introducing new products or Services, or where the laws may change. If we do then any changes will be posted on this page, so please do check back now and again.

If those changes are pretty substantial, we'll let you know via email or clearly signpost them on our website. Make sure you read through any changes as we'll assume by continuing to use the Platform you accept these.

13. Contact Us

If you have questions or concerns at all once you've read through this Privacy Policy, please get in touch. We're always happy to help.

Email: legal@jackandjill.ai

Address: 86-90 Paul Street, London, England, EC2A 4NE

Company No.: 16324763