Read our Privacy Policy | Male Childcare & Teaching Jobs

This Privacy Policy describes how Male Childcare and Teaching Jobs (the “Site” or “we”) collects, uses, and discloses your Personal Information when you visit or make a purchase from the Site.

Collecting Personal Information

When you visit the Site, we collect certain information about your device, your interaction with the Site, and information necessary to process your purchases. We may also collect additional information if you contact us for customer support.

In this Privacy Policy, we refer to any information that can uniquely identify an individual (including the information below) as “Personal Information”. See the list below for more information about what Personal Information we collect and why.

Device information:

Examples of Personal Information collected: version of web browser, IP address, time zone, cookie information, what sites or products you view, search terms, and how you interact with the Site.
Purpose of collection: to load the Site accurately for you, and to perform analytics on Site usage to optimize our Site.
Source of collection: Collected automatically when you access our Site using cookies, log files, web beacons, tags, or pixels.
Disclosure for a business purpose: shared with our processor WordPress.

Order information:

Examples of Personal Information collected: name, billing address, shipping address, payment information (including credit card numbers), email address, and phone number.
Purpose of collection: to provide products or services to you to fulfil our contract, to process your payment information, arrange for shipping, and provide you with invoices and/or order confirmations, communicate with you, screen our orders for potential risk or fraud, and when in line with the preferences you have shared with us, provide you with information or advertising relating to our products or services.
Source of collection: collected from you.
Disclosure for a business purpose: shared with our processor WordPress.

User Information:

Name, email, job role, telephone number, CV, workplace or learning provider, and location (where provided)
Collected via web forms, job applications, email registrations, and direct contact

Data Storage locations, access & controls

We store data securely across several platforms, each with its own robust access controls and security features:

Microsoft 365 (SharePoint & OneDrive): All internal documents are stored here with access restricted to named staff only. Access requires username, password, and multi-factor authentication (MFA). Files are encrypted at rest and in transit. Access is role-based, and all user activity is logged.
Thinkific (e-learning platform): User account information (e.g. name, email, learning progress) is stored within Thinkific, which hosts its data on secure cloud infrastructure with encryption at rest and in transit. Admin access is limited to key staff. Users log in via secure credentials, and Thinkific complies with SOC 2 and GDPR standards.
WordPress (website & job board): When users apply for jobs via our site, data is submitted through a secure form plugin and stored within our WordPress CMS, which is hosted on encrypted UK-based servers. Access to WordPress admin is limited to a small team, protected by strong passwords and two-factor authentication (2FA). Regular updates and firewall protection are in place.
Brevo (email communications and newsletters):
Contact details for users who opt in to receive emails (e.g. updates, event invites, onboarding information) are stored securely in Brevo’s GDPR-compliant infrastructure, hosted in the European Union. Access is restricted to authorised staff only, and two-factor authentication is enabled. All messages include an unsubscribe link, and data is never shared or sold to third parties.
Local devices: Some temporary extracts may be stored on encrypted laptops, accessible only by named staff, with auto-lock enabled and no USB export allowed.
All data access is governed by role-based principles – only those who need to see certain data can access it. We regularly review permissions and maintain a data access log.
Mentor-Mentee Communication (Outlook): As part of our mentoring programme, approved mentors receive their assigned mentees’ name and email address to allow for direct communication and virtual check-ins. This data is shared via secure Outlook email and not stored elsewhere. Mentors are required to complete a short data handling agreement and safeguarding briefing before receiving any personal data. They are instructed to store information securely, use it solely for mentoring purposes, and delete it once the mentoring relationship ends.

Sharing Personal Information

We do not sell personal information. However, we share it with GDPR-compliant third-party platforms strictly for service delivery:

We use WordPress to power our online store. You can read more about how WordPress uses your Personal Information here: https://en-gb.wordpress.org/about/privacy/~
Microsoft 365 (Outlook, OneDrive, SharePoint) – for internal communication and storage (UK/EU data centres)
Thinkific – to host and manage e-learning content (hosted in Canada – UK adequate jurisdiction)
WordPress CMS – for job board and website forms (UK-based servers with plugins that may use EU/US servers with SCCs)
Brevo – for onboarding, newsletters, and email campaigns (EU data centres, fully GDPR-compliant)
Contractors (e.g. website developers) – limited and monitored access for troubleshooting only

Mentor data access is limited, tracked, and subject to a Data Handling Agreement. Mentors are required to delete all personal information within 12 months of the mentoring conclusion.

Behavioural Advertising

As described above, we use your Personal Information to provide you with targeted advertisements or marketing communications we believe may be of interest to you. For example:

We use Google Analytics to help us understand how our customers use the Site. You can read more about how Google uses your Personal Information here: https://policies.google.com/privacy?hl=en. You can also opt out of Google Analytics here: https://tools.google.com/dlpage/gaoptout.
We share information about your use of the Site, your purchases, and your interaction with our ads on other websites with our advertising partners. We collect and share some of this information directly with our advertising partners, and in some cases through the use of cookies or other similar technologies (which you may consent to, depending on your location).

For more information about how targeted advertising works, you can visit the Network Advertising Initiative’s (“NAI”) educational page at https://www.networkadvertising.org/understanding-online-advertising/how-does-it-work.

You can opt-out of targeted advertising by:

FACEBOOK – https://www.facebook.com/settings/?tab=ads

Additionally, you can opt out of some of these services by visiting the Digital Advertising Alliance’s opt-out portal at: https://optout.aboutads.info/.

Using Personal Information

We use your personal information to provide our services to you, which includes: offering products for sale, processing payments, shipping and fulfilment of your order, and keeping you up to date on new products, services, and offers.

Lawful Basis

Pursuant to the General Data Protection Regulation (“GDPR”), if you are a resident of the European Economic Area (“EEA”), we process your personal information under the following lawful bases:

Your consent;
The performance of the contract between you and the Site;
Compliance with our legal obligations;
To protect your vital interests;
To perform a task carried out in the public interest;
For our legitimate interests, which do not override your fundamental rights and freedoms.

Data Retention

When you place an order through the Site, we will retain your Personal Information for our records unless and until you ask us to erase this information. For more information on your right of erasure, please see the ‘Your rights’ section below.

We retain different types of personal data for varying durations, depending on the purpose:

Mentee contact details: Retained for 12 months after mentoring ends.
Job applicant data (e.g. CVs): Retained for 12 months from the date of submission.
Webinar or event registrations: Retained for 6 months, to allow for issuing certificates and relevant follow-up.
Learning records on Thinkific: Retained for the duration of active membership, plus an additional 12 months for CPD tracking.
Emails and correspondence: Retained for 2 years before review or deletion.
Anonymised usage data: Retained indefinitely for reporting and evaluation purposes. This data contains no personally identifiable information.

In general, we do not routinely match or link personal data from Doncaster Council with other datasets. However, limited and purposeful linking may occur in specific, controlled circumstances to enhance the effectiveness of our mentoring, outreach, or engagement programmes.

Potential matching scenarios include:

Mentoring coordination:
Where a learner or mentee has been referred to us by a training provider, school, or local authority, we may match their name and email address against our internal contact lists to check for previous engagement and avoid duplication.
E-learning participation:
If a referred individual signs up to our CPD platform (Thinkific), we may link their name and email address to their learning progress within the platform to monitor engagement and provide completion data to the referring organisation — but only where agreed.
Career events and outreach tracking:
In collaboration with schools or local authorities (e.g. for careers fairs or apprenticeship campaigns), we may match basic referral information (e.g. first name, school/setting, email) with attendance records to ensure follow-up support can be provided.

Safeguards in place:

All linking is done manually or via secure, permission-based systems.
We do not use automated profiling or large-scale matching.
We do not match data with any external commercial or marketing databases.
Any personal data matched across collections is limited to what is necessary, with clear audit trails and access restrictions.

If any formal data matching is required in future beyond these scenarios, we would notify Doncaster Council and update our data sharing agreement accordingly.

Cloud-based platforms we use

Microsoft 365 (Outlook, SharePoint, OneDrive):
Data is primarily stored in UK and EU data centres. Compliant with UK GDPR and covered by Microsoft’s Data Protection Addendum and international data transfer safeguards.
Thinkific (e-learning platform):
Primarily hosted in Canada. Canada is recognised by the UK as an adequate jurisdiction under GDPR.
WordPress (website & job application system):
UK-based hosting provider. All plugins and form handlers are GDPR-compliant; any non-UK/EU processors are covered by Standard Contractual Clauses (SCCs).
Brevo (email marketing and communication tool):
Hosted in the European Union (primarily France and Germany). Fully compliant with UK GDPR and EU GDPR, with ISO 27001-certified infrastructure and no data transferred outside the EEA.

We take care to select platforms that offer data residency within the UK or EU wherever possible, and we ensure that appropriate transfer mechanisms (such as SCCs or adequacy decisions) are in place when data is stored outside the UK. No personal data is transferred to countries without adequate data protection standards, and we do not allow third parties to process data outside approved jurisdictions without explicit agreement and review.

Data Breach

As an independent organisation, we follow our own internal Data Breach Response Procedure, which is aligned with UK GDPR and ICO guidance. This includes:

Reporting the breach internally within 2 hours of discovery
Assessing the risk to individuals’ rights and freedoms
Informing any affected organisation without delay where shared data is involved
Documenting the breach and our response actions
Reporting to the ICO within 72 hours
Notifying affected individuals

Business Continuity Plan and Data Recovery Procedure

We have a Business Continuity Plan (BCP) and Data Recovery Procedure in place to ensure continuity of service and data protection in the event of disruption, including system failure, data breach, or loss of access to cloud-based platforms.

Our plans are proportionate to the size and nature of our organisation but still aligned with UK GDPR expectations and best practice.

Key features include:

Cloud-based systems
All key data (including files, contact details, training records, and email communications) is stored securely in the cloud via Microsoft 365, Thinkific, WordPress, and Brevo. These services include:
- Automated daily backups
- Geo-redundant storage
- Disaster recovery infrastructure built into the platforms
- 99.9%+ uptime SLAs from service providers
Internal recovery procedures
In the event of localised disruption (e.g. device loss, access issues, staff unavailability), we can:
- Restore access to key systems using secure backup devices
- Reassign critical roles within our small team to maintain essential operations
- Restore files via Microsoft’s built-in version history and recycle bin retention
Response timeframe targets (RTO/RPO):
- RTO (Recovery Time Objective): 4 hours for critical systems
- RPO (Recovery Point Objective): 15 minutes to 24 hours depending on system
Continuity of communication:
In the event of an extended outage, we can communicate with stakeholders via mobile, SMS, or alternative email accounts to ensure minimal disruption to mentoring, training, or partnership work.
Annual review and testing:
Our continuity procedures are reviewed annually and informally tested during scenario-based exercises.

Automatic Decision-Making

If you are a resident of the EEA, you have the right to object to processing based solely on automated decision-making (which includes profiling), when that decision-making has a legal effect on you or otherwise significantly affects you.

We do not engage in fully automated decision-making that has a legal or otherwise significant effect using customer data.

Our processor WordPress uses limited automated decision-making to prevent fraud that does not have a legal or otherwise significant effect on you.

Services that include elements of automated decision-making include:

Temporary denylist of IP addresses associated with repeated failed transactions. This denylist persists for a small number of hours.
Temporary denylist of credit cards associated with denylisted IP addresses. This denylist persists for a small number of days.

Your Rights

Data protection legislation gives you, the data subject, various rights in relation to your personal data that we hold and process. These rights are exercisable without charge, and we are subject to specific time limits in terms of how quickly we must respond to you. Those rights are, in the main, set out in Articles 12–23 of the GDPR. They are as follows:

Right of access—the right to obtain from us confirmation as to whether or not personal data concerning you is being processed, and, where that is the case, access to that personal data and various other information, including the purpose for the processing, with whom the data is shared, how long the data will be retained, and the existence of various other rights (see below).

Right to rectification—the right to obtain from us, without undue delay, the putting right of inaccurate personal data concerning you.

Right to erasure—sometimes referred to as the ‘right to be forgotten’, this is the right for you to request that, in certain circumstances, we delete data relating to you.

Right to restrict processing—the right to request that, in certain circumstances, we restrict the processing of your data.

Right to data portability—the right, in certain circumstances, to receive that personal data which you have provided to us in a structured, commonly used and machine-readable format, and the right to have that personal data transmitted to another controller.

Right to object—the right, in certain circumstances, to object to personal data being processed by us where it is in relation to direct marketing, or in relation to processing supported by the argument of legitimate interest.

Right not to be subject to automated decision making—the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you.

Full details of these rights can be found in the GDPR or by reference to guidance produced by the Information Commissioner’s Office.

In the event that you wish to exercise any of these rights you may do so by:

Contacting us using any medium you wish, including in writing, by telephone, by text, electronically, or using such social media as we employ for communication purposes;
By completing a form which we can supply to you for this purpose; or
Through a third-party whom you have authorised for this purpose.

Cookies

We use cookies in connection with the operation of our website. A cookie is a small file that is sent by a web server (where we host our website) to a web browser (from where you view our website) and which is then stored by the browser. The cookie contains an identifier which is stored in your browser and then sent back to our server each time your browser accesses our website. These cookies may either be ‘persistent cookies’ (in which case they will continue to be held by your browser until they are deleted, or until a specified event/date) or they will be ‘session cookies’ which expire when you close your browser.

Usually, cookies do not hold any data by which you can be identified, although if we do hold personal data about you (for example, because you have subscribed to a service that we offer) the cookie may be linked to that data.

You should be aware that if you block or delete cookies this may be to the detriment of your ability to access our website and the services that we provide. It may mean that not all of the facilities on our website will be accessible by you, or it may mean that you are unable to access any member services which we provide.

In addition to cookies used by us, our service providers may also use cookies, and those cookies may also be stored in your browser when you visit our website.

We use Google Analytics. This uses cookies to gather data about how users use our website. This data is used to create reports about that use. Further information about Google’s use of data may be obtained from Google’s website.

If you wish to do so then, usually, you can prevent cookies from being downloaded to your browser and can delete those that have already been downloaded. How this may be achieved varies between different browsers. We suggest that you consult the website of your browser provider for more details.

For further information about the cookies we use please email info@malechildcareandteachingjobs.co.uk

Changes

We may update this Privacy Policy from time to time in order to reflect, for example, changes to our practices or for other operational, legal, or regulatory reasons.

Contact

For more information about our privacy practices, if you have questions, or if you would like to make a complaint, please contact us by e-mail at info@malechildcareandteachingjobs.co.uk or by mail using the details provided below:

Male Childcare and Teaching Jobs, 15 Ethelbert Road, London SW20 8QD, United Kingdom

Policy Last updated: 17/07/2025

If you are not satisfied with our response to your complaint, you have the right to lodge your complaint with the relevant data protection authority. You can contact your local data protection authority, or our supervisory authority here:

https://ico.org.uk/make-a-complaint/