Sending CVs to clients without losing control
How an agency shares a candidate's CV with a client through a personal link that expires, can block downloads and can be withdrawn at any time.
By Achekam · · 5 min read · For Recruitment businesses in South Africa, Nigeria, Kenya
A candidate's CV is the most valuable thing an agency sends out, and usually the least protected. It goes to a hiring manager as an e-mail attachment, gets forwarded to a colleague, saved to a shared drive, printed for the panel, and sometimes passed to a second agency or straight to the candidate's current employer by mistake. Once it has left your outbox, you cannot get it back.
That causes two problems at once. Commercially, a client who has your candidate's full details can approach them directly and later argue that the introduction was not yours. And the CV is personal information about someone who trusted you with it: their address, phone number, work history and sometimes their identity number. This article shows how to share CVs with clients in Achekam in a way you can still control after you press send.
Why attaching CVs to e-mails loses control of them
An attachment is a copy. Every forward makes another copy, and none of them expire. When a candidate withdraws, accepts another offer or asks you to stop sharing their details, there is no way to recall the copies already sitting in client inboxes.
There is also no record. If a client claims they found the candidate themselves, an e-mail with an attachment proves you sent something, but not what version, or that anyone opened it.
A personal link solves most of this, because the client looks at the document you hold rather than receiving their own copy.
A personal link with an expiry and an optional one-time code
In Achekam, a document can be shared by e-mailing a personal link to the recipient. When you create the share you set:
- An expiry. The link stops working after the date you choose. For a CV, tie it to the interview process: long enough for the hiring manager to read it and decide on a shortlist, not so long that it outlives the vacancy.
- An optional one-time code. The recipient must enter a code before the document opens. Use it when the CV contains an identity number or when the hiring manager's mailbox is shared with others.
- Whether downloading is allowed. More on that below.
Send each share to a named person at the client, not to a general recruitment mailbox. A personal link sent to a named hiring manager makes it much clearer later who saw the candidate through you.
Allowing or blocking downloads
You can allow the recipient to download the document or block downloading so they can only view it.
For a first introduction, blocking downloads is usually right. The hiring manager can read the CV, decide whether to interview, and come back to you. Once the client has decided to interview and needs to print it for the panel, you can send a new share that allows a download.
Be realistic about what blocking does. It stops the easy route of saving and forwarding a file. It does not stop someone photographing their screen or copying the text by hand. Blocking downloads is a strong nudge, backed up by your terms of business, not a lock.
Revoking the link when the candidate withdraws
A share can be revoked. When a candidate withdraws, accepts another offer, or asks you to stop sharing their details, revoke every open share of their CV the same day. The client's link then stops working, even if it has not expired.
Make revoking part of your close-out routine for each vacancy:
- When a vacancy is filled or cancelled, list every candidate whose CV was shared for it.
- Revoke the shares for everyone who was not appointed.
- Note on the candidate's record which clients saw their CV and when.
- Tell the candidate, if they asked, that their details have been withdrawn.
Data-protection law in each of the three countries gives candidates rights over how their personal information is used. Kenya's Data Protection Act, 2019 on Kenya Law sets out the principles for processing personal data and the rights of the people it describes. South African and Nigerian agencies should read POPIA and the Nigeria Data Protection Act with the same question in mind. A candidate's consent to be put forward for one role is not consent to be sent everywhere.
Keeping the CV, its versions and its fingerprint in Document Centre
Document Centre is a folder-based store. A business can upload files or whole folders, preview, download, rename, move, tag, archive and search them, and uploading a new version keeps the earlier ones. Uploads go in batches of up to 25 files, at up to 100 MB each by default.
For an agency, that means one place for each candidate's documents, with every version kept. If the candidate updates their CV after an interview, the new version sits on top and the one the client first saw is still there underneath.
Every stored file also gets a SHA-256 fingerprint, a value that changes if even one character of the file changes. If a client later disputes which CV they received, the fingerprint of the version you shared settles it. Executable files are refused by default, and every upload passes a malware check, which matters when candidates send CVs from their own devices. The check uses ClamAV only where the server is configured for it; otherwise a built-in check runs instead.
One practical warning about the menu. The entries Client Folders, Engagement Files, Shared Documents, Evidence Vault and Document Templates all open the same document store, with no filter between them. Do not rely on choosing a menu entry to keep candidate documents apart from client documents. Build your own folder structure instead, such as one folder per vacancy with a sub-folder per candidate, and tag each CV with the candidate's name.
Once a candidate is placed, the next documents to control are the ones they sign; see temp contracts signed electronically. And when the introduction turns into a hire, when to issue the placement invoice covers the fee.
Take the next CV you are about to e-mail as an attachment and send it as a personal link instead, with an expiry and downloads blocked.
General guidance only, not advice on your own circumstances. Tax and payroll rules change: check the current position with the authority or your adviser.
