Privacy policy

Who we are

SchoolJobs.uk (“we”, “us”) is the data controller for personal data processed through this website. Contact: use our contact page.

What we collect

• Account data: name, email, password hash, role (candidate/school/agency), phone and postcode where you provide them.
• Candidate data: CV content, work history, saved jobs, saved searches, job alerts and application activity.
• School/agency data: organisation name, verified contact, claim evidence and content you publish.
• Usage data: pages viewed, search terms, IP address, device/browser and cookies (see our cookie policy).

Why we use it (lawful bases)

• Contract: to run your account, deliver job alerts, and process applications.
• Legitimate interests: to keep the service secure, prevent fraud, and improve search quality.
• Consent: for non-essential cookies and marketing emails, which you can withdraw at any time.
• Legal obligation: to comply with UK law, safeguarding duties and lawful requests.

Who we share with

• Schools and agencies you apply to (only data you submit for that application).
• Infrastructure providers (hosting, email, analytics) under written data-processing terms.
• Authorities where legally required.

We never sell your personal data.

Applications to employers that haven't claimed their account: your application is held in private storage and is not shared with anyone. We email an official organisation contact address to say an application is waiting, without including your name, CV or any other detail about you. Your data is released only after the organisation is claimed and the person accessing it is verified as authorised; otherwise the held application is deleted when the hold expires.

International transfers

Where processors operate outside the UK, transfers are protected by UK adequacy regulations or the UK International Data Transfer Addendum.

Candidate Search (employer discoverability)

Candidate Search is not in operation. No employer can currently search for candidates, buy access to candidate profiles, or see your CV other than through an application you have chosen to send. There is no employer-searchable database of candidates.

The discoverability setting in your profile records a choice for the future only. If we ever open Candidate Search, we will say so before it starts, and the rules below are the rules it would have to satisfy. You are never included by default, and you can withdraw the choice at any time.

• Redacted by default: an employer would see an anonymised profile (headline, location, experience, subjects, phases, qualifications, availability) with no name, email, phone or CV.
• Unlocking: contact details would only ever be released one candidate at a time, to one organisation, and only where you are discoverable. Nothing is released today.
• CV access: CVs are held in private storage. Access is by short-lived signed link only; there is no permanent public URL, and no bulk download or export exists.
• Organisation access controls: access is checked per request against organisation membership and role. Unlocks belong to one organisation and are never shared across organisations.
• Payment never overrides consent: a subscription grants an allowance, nothing more. Paying can never widen who is visible, and cannot reveal a candidate who has withdrawn or was never discoverable.
• Lawful basis: your consent for discoverability, recorded separately from applying, uploading a CV, setting job alerts or registering an account — none of those makes you discoverable.

Payments and billing records

• Paid products are for organisations only. There is no charge to candidates for any part of the candidate experience.
• Card payments are processed by our payment provider on a hosted checkout. We do not see or store full card details.
• We keep billing records — what was purchased, amount, date, purchasing organisation and the provider's reference — for accounting and tax purposes, normally for six years.
• We send transactional messages about purchases, subscriptions, cancellations, payment failures and promotion expiry. These are service messages, not marketing, and are separate from any marketing consent.

Retention

• Candidate accounts: while active, plus 24 months of inactivity, then deleted.
• Applications: 12 months from submission (or as required by the employer).
• CV-access records: 24 months, so we can investigate misuse and answer candidate queries.
• Billing and purchase records: 6 years, as required for accounting.
• Server logs: up to 90 days.

Your rights

You have the right to access, correct, delete, restrict or port your data, and to object to processing. Delete your account at any time from your candidate profile, or contact us through our contact page.

You can complain to the Information Commissioner's Office at ico.org.uk.

Security

We use encrypted transport (HTTPS), encrypted storage, row-level access control and least-privilege access for staff.

Changes

We'll update this page when our practices change and note the date at the top.