death.techprivacy
Privacy notice
What this careers site collects, why and what you can ask us to do about it. It covers death.tech only. The rest of Octopus Legacy has its own notice.
last updated 18 oct 2026
We built this site to show engineers what working here is like. It asks for your details when you apply, or if you ask us to keep in touch. Nothing on this site sets a cookie until you say yes.
Who we are
death.tech is run by Octopus Legacy Limited, registered in England and Wales (company number 11111047), at The Northern & Shell Building, 10 Lower Thames Street, London EC3R 6AF. We’re the controller of the personal data described here: we decide how it’s used, and we’re responsible for it.
Questions about this notice, or about your data, go to our Data Protection Lead at hello@octopuslegacy.com.
What we collect, and why
UK data protection law says we need a lawful reason for each thing we do with your data. Here’s everything, and the reason for each.
| what | why, and on what basis |
|---|---|
| ApplicationsYour name, email, phone number, where you’re based, CV, cover letter if you add one, links you share (like GitHub or LinkedIn) and your answers to the role’s questions, such as notice period, salary expectations and right to work in the UK. | To consider you for the role you applied for, arrange interviews and keep you posted on how it’s going. Once the role is filled, we keep it for a while in case we need to show how we made our decision, for example under the Equality Act.
|
| AI help with CVsAn AI model, run for us by Amazon Web Services in the UK, reads a trimmed-down copy of your CV against what the role asks for, and notes the evidence it finds. It doesn’t score you, and it’s never trained on your data. | To help the person reviewing your application look at every CV the same way. They read your CV themselves and make every decision; the AI never moves or rejects an application. You can object (see Your rights).
|
| Talent poolIf you sign up to stay in touch, or ask us to keep you in mind when you apply: your name, email, what you mostly work on, the page you signed up from and when you agreed. | So one of us can write when a role comes up that fits. Nothing else: no newsletter.
|
| Page views and speedPages visited, where you came from, country, device and browser type. Vercel counts these without cookies and without building a profile of you. | To see which pages are useful and keep the site fast.
|
| How the site gets usedOnly if you allow it. PostHog (EU-hosted) records pages viewed and time on page against a random ID in a cookie. No session recording, no click tracking. | To understand which parts of the site people find and which they skip.
|
| Errors and server logsYour IP address, browser and the time of each request (Vercel), and what broke when something fails (Sentry). We strip personal data from error reports before they’re sent. | To run the site, protect it from abuse and fix bugs.
|
| The team’s songsOnly if you allow it. Spotify’s player receives your IP address and browser details and sets its own cookies. | To play each person’s funeral song on the team cards. Until you say yes, the song is plain text.
|
When you apply, your application and CV go straight to our applicant tracking system, which holds them in the UK. This site passes them on and keeps nothing. Please leave out anything sensitive we haven’t asked for, like health details, religion or a photo.
Cookies
Nothing here sets a cookie until you choose “Allow all” in the cookie banner. “Essential only” keeps it that way. Your choice is stored in your browser, not on our servers, and you can change it any time from “Cookie settings” in the footer.
If your browser sends a Global Privacy Control signal and you haven’t chosen yet, we take that as a no and don’t ask.
| name | what it’s for | when |
|---|---|---|
| death-tech:consent | Remembers your cookie choice. Browser storage, not a cookie; never sent to us. | Once you choose |
| ph_*_posthog | PostHog’s random visitor ID, so repeat visits count once. | After “Allow all” |
| Spotify’s cookies | Set by Spotify’s player on the team cards, under Spotify’s own policy. | After “Allow all” |
Who we share it with
Inside Octopus Legacy, your application is seen by the people hiring for that role and our People team, and no one else. We don’t sell your data or use it for advertising. A few suppliers help us run the site, under contracts that only let them use your data to provide their service to us:
- Vercel
- Hosting, page analytics and server logs. Applications and sign-ups pass through on their way to us; the site doesn’t keep them
- Amazon Web Services
- Runs our applicant tracking system in the UK, which holds applications and sign-ups, and the AI that helps review CVs
- Google Workspace
- Our email and calendars, including interview invitations and video calls
- PostHog
- Usage analytics, EU-hosted, only with your consent
- Sentry
- Error reports, with personal data removed
Spotify isn’t one of them: if you allow its player, Spotify decides what it collects. We may also share data with our professional advisers, with regulators or the police where the law requires it, or with a buyer if the business changes hands.
Some of these suppliers are in the USA. When your data goes to them, it’s protected by the UK’s data bridge with the US where the supplier is certified to it, and otherwise by the UK’s addendum to the EU’s standard contractual clauses. For a copy of the safeguard, email our Data Protection Lead at hello@octopuslegacy.com.
How long we keep it
We keep your data only as long as we need it for the reasons above, then delete it.
- Talent pool
- 24 months from when you agreed, or until you withdraw your consent.
- Applications
- 12 months after your last application closes, or after we hire you (your employee record then takes over).
- Page views and speed
- Up to 24 months, as counts that don’t identify you.
- How the site gets used
- Up to 7 years in PostHog, against a random ID that isn’t linked to your name or email. Clearing this site’s cookies and stored data breaks the link to you.
- Errors and server logs
- Server logs for up to 30 days, error reports for up to 90 days.
Your rights
You can ask us, free of charge, to:
- show you the data we hold about you
- correct it, or delete it
- stop or limit how we use it
- send you a copy in a format another service can read
- withdraw your consent, which stops what happens next but not what’s already happened
- object to how we use it, including AI help with your CV
Email hello@octopuslegacy.com and tell us which of these you’d like and what it relates to. A person, not software, decides on every application.
To leave the talent pool, email talent@octopuslegacy.com and we’ll take you off it.
Objecting to AI help
If you’d rather AI didn’t read your CV, email talent@octopuslegacy.com, before or after you apply. We’ll delete any notes it has made about you and won’t use it on your applications again. It makes no difference to how we consider you: a person reads every CV either way.
Keeping it safe
Only the people who need your data can see it, and they’re bound by confidentiality. If something goes wrong, we’ll tell you and the regulator wherever the law requires us to.
Complaints
If you’re unhappy with how we’ve handled your data, tell us first and we’ll try to put it right. You can also complain to the Information Commissioner’s Office, the UK regulator:
- phone
- 0303 123 1113
- post
- Wycliffe House, Water Lane, Wilmslow SK9 5AF
Changes to this notice
When this notice changes, the date at the top changes with it. If a change affects data you’ve already given us, we’ll tell you before it applies.