How we use your information when you apply to Yestella
Recruitment privacy notice · Version 1.2 · October 2026
1. Who we are
OverCap UK Limited, trading as Yestella, runs this recruitment for Yestella UK Limited, a company being set up in England and Wales. OverCap UK Limited is registered in England and Wales (company number 13731322), at Third Floor, 207 Regent Street, London W1B 3HH. For now, it is the controller of your information. Offers are made only once Yestella UK Limited has been incorporated. When that happens, we will transfer your application to Yestella UK Limited and it will become the controller. We will tell you when that happens.
Contact, including for adjustments and the written alternative: email careers@yestella.com, or write to OverCap UK Limited (Recruitment Privacy), Third Floor, 207 Regent Street, London W1B 3HH, United Kingdom.
2. What we collect, and from where
You apply by email to careers@yestella.com.
- From you: what you send us. That is typically your contact details, CV, right to work, experience, licences, languages and markets, notice period and any covenants, expected pay range, answers to any questions in the advert, and how you heard about us. The advert says what we need in order to consider you; anything else is optional.
- The advert or link that brought you here, for example "LinkedIn, Lisbon".
- From the Yestella Academy, which is also run by OverCap UK Limited, but only if you give us your completion code. We send the code and a hashed form of your email address. The Academy tells us only whether the code is valid, the programme, and the date you passed. It never tells us your score, your answers, your activity, or your date of birth.
- Until our automatic check is available: a member of our recruiting team checks the code you give us by hand against the Academy's records. They see only the same three things: whether it is valid, the programme and the pass date. Nothing else from your Academy account is looked at or copied.
- From a job board, if you apply through one that passes your details to us.
- From our assessment: your stage, our decision and reasons, notes and scorecards, and our emails with you.
- Adjustment requests. Health or disability information you share so we can adjust the process is special-category data. We use it only for the adjustment, under UK GDPR Art 9(2)(b) and DPA 2018 Sch 1 para 1, and we keep an appropriate policy document for it. Only the person running your assessment sees it.
Please leave your photo, date of birth and health details out of your CV. If you need an adjustment, tell us separately and we will treat it confidentially. We never ask about your current or past pay.
3. Why we use it (UK GDPR lawful basis)
| Purpose | Basis |
|---|---|
| Considering your application and taking steps towards an offer, at your request | Art 6(1)(b), steps before a contract |
| Checking an Academy code you give us; measuring which adverts work (totals only); spotting duplicates; legal claims | Art 6(1)(f), legitimate interests (and Art 9(2)(f) for claims involving special-category data) |
| Adjustments you ask for | Art 6(1)(c), under the Equality Act 2010, with Art 9(2)(b) |
| The talent pool for other roles | Art 6(1)(a), your consent, which you can withdraw at any time |
You can object to any use based on legitimate interests.
4. No automated decisions
We never decide about you by automated means alone, and a person reviews every application in full.
- The Academy assessment is marked automatically, but it is only one part of our review.
- The course is optional when you apply. Before a first interview we ask for your code or a short written alternative, which counts the same. If neither works for you, tell us and a person will decide.
- Not passing the Academy test, or having no code, is never on its own the reason we decline you. You can always use the written alternative instead, and a person reviews every application.
- A person marks the written alternative. If it does not meet the standard, that can be a reason we decline you; you can ask for it to be reviewed again by someone else.
You can ask us to explain a decision, give us your view, and have it reviewed by someone who was not involved.
5. Who we share it with
Our service providers act only on our instructions, under contract:
- Google Workspace, for email (including careers@yestella.com, where your application arrives) and for a tracking sheet that holds no names;
- Hetzner Online GmbH (Germany), for our servers, which are located in Germany, in the European Economic Area.
Yestella UK Limited receives your application when it takes over. Otherwise, we share your information only where the law requires it. We never sell it or use it for marketing.
6. International transfers
We hold your application in the UK and the EU. Where providers or their subcontractors handle data elsewhere, including the US, we rely on an adequacy decision (such as the UK–US data bridge) or on standard contractual clauses (the UK IDTA or Addendum, or the EU clauses). You can ask us for a copy.
- Lisbon and Limassol: the EU recognises the UK as adequate.
- Zurich: Switzerland recognises the UK as adequate, and we use only information about your suitability for the role (Code of Obligations Art 328b).
- Dubai: where UAE or DIFC law requires a safeguard for sending your information to the UK, we use contractual clauses.
- Miami: your information reaches the US only through the providers above, on these safeguards.
7. How long we keep it
We delete your application, including your CV and our emails, 6 months after we tell you our decision. If you are in our talent pool, we delete it 12 months after the decision. Backups clear within 35 days after that. If a legal claim is made, we keep what we need until it is settled.
We also keep a short record of our decision for 12 months after we tell you it, so that we can respond to any legal claim. It holds a reference derived from your email address, the role, the dates, the stage you reached and the reason for our decision; no CV, contact details or health information. We rely on our legitimate interest in establishing and defending legal claims.
8. Your rights
You can ask to see, correct or delete your information, restrict or object to how we use it, or receive what you gave us in a portable format. You can also withdraw consent and use the rights in section 4. It is free, and we reply within one month.
9. Complaints
Please contact us first. You can also complain to the ICO (ico.org.uk, 0303 123 1113), or to the regulator where you live or work:
- Portugal: the CNPD;
- Cyprus: the Commissioner for Personal Data Protection;
- any other EU country: its national authority;
- Switzerland: the FDPIC;
- Dubai: the DIFC Commissioner of Data Protection if a DIFC-based entity is involved, otherwise the UAE Data Office.
10. Equal opportunities, and changes
We do not collect equal-opportunities information. If we ever do, it will be optional, on a separate form, anonymised, and never seen by the people assessing you. We will tell you about any change that affects you, including the move to Yestella UK Limited.