Privacy Policy

1. Introduction

Eco Apprenticeships ("we," "our," or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, and protect your personal information when you use our site and services for eco apprenticeships across the UK.

2.1 Contact Form Submissions

When you submit our contact form, we collect:

• Name (required)
• Email address (required)
• Phone number (optional)
• Company name (required)
• Website URL (required)
• Reason for contact (required)
• Message/details (optional)
• GDPR consent confirmation (required)
• IP address and user agent (automatically collected)
• Submission timestamp

2.2 Job Postings (For Employers)

When employers post jobs through our platform, they provide:

• Company name and information
• Job details and descriptions
• Contact information

Important Note: Employers are responsible for their own GDPR compliance regarding candidate data. We are not responsible for how employers handle applications or candidate information.

2.3 Automatically Collected Data

Like most websites, we automatically collect certain technical information:

• IP address (server logs)
• Browser type and version
• Device type
• Pages visited and time spent
• Referring website

3. Legal Basis for Processing (GDPR)

We process your personal data based on:

• Consent: When you submit a contact form or accept cookies via the cookie banner
• Legitimate Interest: Operating and improving our job board service
• Contract: Fulfilling our obligations to employers and job seekers

4. How We Use Your Information

We use your personal data for the following purposes:

• Respond to contact form inquiries and provide customer support
• Display job postings to candidates
• Improve and optimize our website and services
• Comply with legal obligations
• Prevent fraud and maintain security

5. Data Sharing and Third Parties

We DO NOT sell, rent, or trade your personal data. Ever.

We may share your data only with the following trusted parties:

• Amazon Web Services (AWS): Cloud hosting infrastructure (DynamoDB, S3, Lambda). Data stored in EU region (London) only.
• Google: We use Google Analytics for aggregated, non‑personal analytics only when you opt in via the cookie banner. Google will only receive data after you have given consent.
• Legal Authorities: If required by law, court order, or to protect our legal rights.

Affiliate Links and Third‑Party Tracking

We use affiliate links on our site (for example, links to PurpleCV and JobOwl) to support the running of the service. When you click an affiliate link we may share a referral identifier or other non-sensitive information required for commission attribution. Affiliate partners may set cookies or other tracking technologies to record referrals and attribute purchases.

These affiliate cookies and trackers are provided and controlled by third parties and are not required for the basic operation of the site. We will only activate non-essential affiliate tracking after you have given explicit consent via our cookie banner. You can manage or withdraw this consent at any time using the cookie settings on our site.

We recommend you review the privacy policy of the affiliate partner (for example, PurpleCV's or JobOwl's privacy policy) to understand how they use any data collected as part of the referral process. We are not responsible for the privacy practices of third parties.

6. Data Security

We take data security seriously and implement industry-standard measures:

• Encryption at rest: All data stored in DynamoDB is encrypted
• Encryption in transit: HTTPS/TLS for all website traffic
• AWS security infrastructure: Enterprise-grade security controls
• Access controls: Strict authentication and authorization
• Regular security updates: Keeping all systems up to date

However, no method of transmission over the internet is 100% secure. While we strive to protect your data, we cannot guarantee absolute security.

7. Data Retention

We retain your data for the following periods:

• Contact Form Submissions: 2 years from submission date, or until the inquiry is resolved, whichever is longer
• Job Postings: Until deleted by the employer or after the posting expires
• Server Logs: 90 days for security and troubleshooting

8. Your Rights Under GDPR

Under the General Data Protection Regulation (GDPR), you have the following rights:

• Right to Access: Request a copy of all personal data we hold about you
• Right to Rectification: Correct any inaccurate or incomplete data
• Right to Erasure: Request deletion of your data ("right to be forgotten")
• Right to Restriction: Request that we limit how we use your data
• Right to Data Portability: Receive your data in a machine-readable format
• Right to Object: Object to certain types of data processing
• Right to Withdraw Consent: Withdraw cookie consent at any time via the cookie settings
• Right to Lodge a Complaint: File a complaint with the ICO (see Section 15)

9. How to Exercise Your Rights

You can exercise your rights in the following ways:

• Manage Cookie Preferences: Use the "Cookie Settings" button on our site to change your consent choices at any time
• Request Data Deletion: Email us at privacy@talentcircuit.co.uk
• Access Your Data: Email us at privacy@talentcircuit.co.uk
• Correct Your Data: Email us at privacy@talentcircuit.co.uk

Response Time: We will respond to all requests within 30 days (as required by GDPR).

10. International Data Transfers

Your data is stored on Amazon Web Services (AWS) servers located in the London (eu-west-2) region. We do not transfer your personal data outside the European Union or United Kingdom.

11. Children's Privacy

Our service is not intended for users under the age of 16. We do not knowingly collect personal data from children. If we become aware that we have collected data from a child under 16, we will delete it immediately.

If you are a parent or guardian and believe your child has provided us with personal data, please contact us at privacy@talentcircuit.co.uk.

12. Cookies, Tracking and Consent

We use a cookie consent banner to comply with ePrivacy and GDPR requirements. Strictly necessary cookies (required for the site to function) are always enabled. Performance/analytics cookies (for example, Google Analytics) are disabled by default and are only activated after you explicitly give consent in the cookie banner.

What we record when you make a cookie choice

When you make a choice in the cookie banner we record a consent event in our audit log. Each consent record contains the following fields:

• AnonId: a pseudonymous identifier stored to correlate consent choices with a browser session
• Consent choices: which categories were accepted (analytics, functional, marketing)
• Policy version: the version of this privacy/cookie policy in effect when consent was recorded
• Timestamp: when the choice was made
• User‑Agent: browser user agent string (for debugging/compatibility only)
• Anonymised IP: we truncate IP addresses before storage (IPv4 to /24, IPv6 to /64) to reduce identifiability

Where consent records are stored

Consent records are stored securely in our DynamoDB consent table (or our existing consent/audit table). Access to these records is restricted to authorised personnel and services only.

Purpose, legal basis and retention

We store consent records to demonstrate and manage your consent (legal basis: consent). We retain consent records for audit and compliance purposes. Recommended retention is 24 months (you may choose a different retention period if you prefer). Consent withdrawal will stop future processing under that consent but will not retroactively change analytics data already processed while consent was active.

Manage or withdraw consent

You can change or withdraw your cookie preferences at any time using the "Cookie settings" button visible on the site. Withdrawing consent will disable further analytics cookies and third‑party tracking.

Third parties and analytics

When you consent to analytics, aggregated usage data is shared with Google Analytics to help us understand and improve the site. Google will only receive data after you have given consent via the banner.

13. Changes to This Privacy Policy

We may update this privacy policy from time to time to reflect changes in our practices or legal requirements. When we make changes:

• We will update the "Last Updated" date at the top of this page
• Significant changes will be prominently displayed on our homepage

We encourage you to review this policy periodically to stay informed about how we protect your data.

14. Contact Us

If you have any questions, concerns, or requests regarding this privacy policy or your data:

• Email: privacy@talentcircuit.co.uk
• Subject Line: "Privacy Request - [Your Request Type]"
• Response Time: Within 30 days (as required by GDPR)

15. Supervisory Authority

If you are not satisfied with our response to your privacy concerns, you have the right to lodge a complaint with the UK Information Commissioner's Office (ICO):

• Website: ico.org.uk
• Phone: 0303 123 1113
• Live Chat: Available on their website
• Address: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

---

Simplified Summary