Privacy Policy

1.1 Applicants and Account Holders

When you create an account and submit an application through our portal, we collect:

• Contact details (e.g., name, email address, and password)
• Education details (e.g., level of study, start and end dates, and degree course)
• Application details (e.g., CV, vacancy preferences, and responses to application questions)

1.1.1 Sensitive Personal Information

We collect the following sensitive personal information only if you voluntarily choose to provide it:

• Gender, sexual orientation, and ethnicity

These questions are optional, and you may select "Prefer not to say". Further details on how we use and store this data can be found in Section 2.1.1.

1.2 Clients

We only collect the information necessary to deliver consulting services:

• Organisation name, address, and industry
• Contact information of staff (including name, email address, and phone number)
• Project specifications, deliverables, and timelines
• Project communication and documentation, and other related project data

1.3 External Mentors

We only collect the information necessary for collaboration:

• Name and email address

We do not collect additional personal information unless necessary or legally required.

1.4 Information Automatically Collected

When you visit, use, or navigate our Services, we may automatically collect certain technical information from your device. This data may be personal data where it could be used to identify you (for example, when linked with your account or other information), and may include:

• IP address and approximate location
• Browser type and version
• Device type, operating system, and language preferences
• Dates, times, and pages accessed
• Referring and exit URLs
• Interaction data such as clicks, scroll events, and time spent on pages
• Session recordings and heatmaps collected through our analytics provider

For more information on cookies, tracking technologies, and how you can manage your preferences please see our Cookie Policy for full details on consent and controls.

1.5 Information Collected from Other Sources

We may occasionally collect limited information about you from publicly available or third-party sources to maintain the accuracy of our records and communications. These sources may include:

• Public databases
• Social media platforms
• Event or recruitment partners

The information obtained may include contact details such as name, email address, organisation or professional role. See Section 2.5 for how we process this information.

2.1 Applicants and Account Holders

We use the personal information you provide to:

• Facilitate account creation, management, and authentication
• Process and evaluate any applications you submit
• Communicate with you regarding your account status and application progress
• Maintain records for compliance, audit, and reporting purposes
• Improve our Services and user experience through feedback and usage analysis

We process this information based on the following legal grounds:

• Article 6(1)(b) of UK GDPR: Contract Performance
• Article 6(1)(f) of UK GDPR: Legitimate Interests

2.1.1 Sensitive Personal Information

We collect optional diversity and inclusion information to monitor and improve the fairness and inclusivity of our recruitment process. Providing this information is entirely optional and will not affect your application. As such, you may select "Prefer not to say" or leave the questions blank entirely.

When you submit a response, we immediately separate and anonymise it from your application data so they cannot be linked back to your identity or application, and we do not retain any keys or linkable identifiers that would enable re-identification. Once anonymised, this information is no longer personal data and cannot be accessed or erased at an individual level.

Purpose Limitation. We use this data solely for aggregate-level analysis and reporting to foster diversity and equity.

Safeguards. We implement strong data protection measures including minimisation, anonymisation from collection, limited access to data, and clear transparency regarding processing.

Before anonymisation, we process this information based on the following legal grounds:

• Article 6(1)(f) of UK GDPR: Legitimate Interests
• Article 9(2)(j) of UK GDPR: Archiving, research and statistics (with safeguards under the Data Protection Act 2018 and our Appropriate Policy Document).

2.2 Clients

We process client information to:

• Deliver consulting services according to agreed terms
• Manage projects, timelines, and communicate with stakeholders
• Maintain necessary records for compliance, audit, and accountability
• Improve the quality and delivery of our Services

We process this information based on the following legal grounds:

• Article 6(1)(b) of UK GDPR: Contract Performance

2.3 External Mentors

We use External Mentors' contact details to:

• Communicate about project work and related activities
• Coordinate mentoring support for our project teams

We process this information based on the following legal grounds:

• Article 6(1)(f) of UK GDPR: Legitimate Interests

2.4 Information Automatically Collected

We collect technical and usage information automatically to:

• Maintain the security, stability, and performance of our Services (for example, server logs and basic diagnostic information)
• Detect and prevent fraud, abuse, and security incidents
• Understand usage trends and improve user experience
• Conduct internal analytics and reporting
• Collect session recordings and user interaction heatmaps via our analytics provider, but only after you provide explicit consent for these optional analytics tools.

We process this information based on the following legal grounds:

• Article 6(1)(a) of UK GDPR: Explicit Consent - for non-essential analytics (including session recordings and heatmaps) which only run if you choose to accept them through our cookie preference banner, and which you can withdraw at any time.
• Article 6(1)(f) of UK GDPR: Legitimate Interests - for essential logging and security-related processing that is necessary to keep our Services secure and functioning properly.

2.5 Information Collected from Other Sources

We may process data obtained about you from third-party or publicly available sources to:

• Keep our contact records accurate and up to date
• Follow up on specific expressions of interest in our Services or events

We process this information based on the following legal grounds:

• Article 6(1)(f) of UK GDPR: Legitimate Interests

4.1 Applicants and Account Holders

For Unsuccessful Applicants. We will retain your personal information for 6 months post rejection, after which your information will be permanently anonymised. This allows us to respond to any queries or legal claims relating to our recruitment process.

For Successful Applicants. We will retain your personal information while you are actively employed by us, and then for a further 3 months, after which your information will be permanently anonymised. This allows us to maintain accurate records of your engagement with us and respond to any queries or legal claims relating to your employment.

For Account Holders. We will retain your personal information for as long as your account remains active, and for up to 2 years after your last activity, after which it will be deleted or anonymised unless we need to keep it for legal or security reasons.

For Sensitive (Diversity and Inclusion) Data. Your data is immediately anonymised at the point of submission, and retained indefinitely for aggregate data analytic purposes.

For Employment Verification Data. We will retain minimal personal information for as long as we reasonably need to be able to respond to verification requests. This includes basic information such as your name, your position, and your department whilst employed.

4.2 Clients

We will retain your data, including project information and communications, for a period of up to 7 years after the completion of your project for legal, audit, and compliance purposes. After this period, your data will be permanently deleted.

4.3 External Mentors

We will retain your contact details for as long as you remain actively involved with our projects or mentoring activities. When you cease to be involved with our Services, we will retain your information for a period of up to 1 year before permanently deleting such data.

4.4 Information Automatically Collected

For Server Logs. Our Website hosting provider retains all log data for a maximum of 1 week before permanently deleting such data.

For Analytics Data. Our Analytics provider retains all data for a maximum of 1 year before permanently deleting such data. In cases of session recordings and user interaction heatmaps, this data is retained for a maximum of 30 days before being permanently deleted.

4.5 Information Collected from Other Sources

For Personal Information. We will retain your data under the same conditions as laid out in Section 4.1.

For Newsletter Contact List Information. We will retain your data under the same conditions as laid out in Section 4.1, or until you unsubscribe from such emails.

5.1 How do we store your information?

All of your information is stored securely on encrypted servers hosted by our cloud service providers. Access to this information is restricted to authorised York Community Consulting employees on a need-to-know basis through role and time-based access controls, ensuring staff only have access to the data necessary to perform their specific role or function.

Our staff are trained on data protection and confidentiality practices to ensure they handle your information appropriately. We also regularly assess and evaluate the effectiveness of our security measures through regular reviews and testing.

5.2 International Data Transfers

Some of our Service Providers are based outside of the UK, or use sub-processors outside the UK (for example, global cloud infrastructure providers). Where this involves a transfer of personal data to a country without UK adequacy regulations, we rely on appropriate safeguards such as the UK International Data Transfer Addendum to the EU Standard Contractual Clauses, or, where the provider is certified, the UK extension to the EU-US Data Privacy Framework.

Where possible, we choose UK or EU data centre regions, but providers may still have limited access arrangements from other countries. In all cases, our providers are required to protect personal data to UK GDPR standards.

You can contact us if you would like more information about the specific safeguards we use for international transfers, or to request a copy of standard clauses where legally permissible.

7.1 Right to Access

You have the right to request access to the information we hold about you, including details about how we process and share your data.

7.2 Right to Rectification

If your information is inaccurate or incomplete, you have the right to ask us to correct or complete it.

7.3 Right to Erasure

You can request the deletion of your data in certain cases, such as when it is no longer needed or if you withdraw consent. However, some data may be retained to comply with our legal obligations or for legitimate business purposes. Note that anonymised data cannot be deleted as we cannot trace it back to a specific entity.

7.4 Right to Restrict Processing

You may request that we limit how we use your information in specific circumstances, for example if you contest its accuracy.

7.5 Right to Data Portability

Where applicable, you can request a copy of your data in a structured, machine-readable format and transfer it to another organisation.

7.6 Right to Object

You can object at any time to our use of your information where we rely on legitimate interests as our lawful basis. We will stop processing your data for that purpose unless we can demonstrate compelling legitimate grounds which override your interests, rights and freedoms, or if the processing is for the establishment, exercise, or defence of legal claims.

Where we use your data for direct marketing, you have an absolute right to object and we will stop using your data for this purpose when you ask us to.

7.7 Rights related to Automated Decision Making and Profiling

If automatic decisions significantly affect you, you have the right to human intervention, express your concerns, or challenge the decision.

7.8 Withdrawing your Consent

If we process your data based on your consent (expressed or implied), you can withdraw it at any time by contacting us. Withdrawal does not affect the lawfulness of processing before it was withdrawn and does not impact processing based on other lawful grounds.

7.9 Opting Out of Marketing and Promotional Communications

You can unsubscribe at any time by clicking the unsubscribe link in emails or by contacting us. We may still need to send service-related communications.

7.10 Account Information

You can review, update, or delete your account information by contacting us or by visiting your account page on the YCC Portal. Deletion requests will lead to the deletion of all your personal information from our active databases, with some data retained for fraud prevention, legal compliance, and troubleshooting purposes.

7.11 How to Exercise Your Rights

To exercise any of your privacy rights, you can contact us or visit your account page on the YCC Portal. We may need to verify your identity before processing certain requests to protect your privacy.

We aim to respond within one month to all requests, extending the period if required for complex matters per applicable legislation.

7.11.1 Filing a Complaint

If you believe we have not handled your information in accordance with this Privacy Policy or applicable Data Protection Laws, you have the right to lodge a complaint.

In the first instance, please contact us to give us the opportunity to resolve your concern directly. If you remain unsatisfied, you can complain to the appropriate regulatory authority.

For United Kingdom residents, you should complain to the Information Commissioner's Office (ICO).

• Website: https://ico.org.uk/make-a-complaint

• Email: icocasework@ico.org.uk

• Phone: 0303 123 1113

For European Economic Area residents, you should complain to your local data protection authority.

• Website: https://www.edpb.europa.eu/about-edpb/about-edpb/members_en

You have the right to lodge a complaint with a supervisory authority without prejudice to any other administrative or judicial remedy.