Last updated: 28 April 2026.

1. Who is the data controller?

The data controller for personal data processed on www.4skillsworkexperience.com is:

• GetMyFirstJob Ltd (trading as Talent People)
• Company number 06685719
• Registered office: 61 Westway, Caterham, Surrey, CR3 5TQ

2. Data Protection Officer

Our Data Protection Officer is Dan Czaicki, Head of PMO & Data Protection. You can contact the DPO at data@getmyfirstjob.co.uk for any question about how we use your data, to exercise any of your rights, or to raise a concern.

3. What this notice covers

The 4Skills Work Experience Programme is a virtual work experience and early-careers learning experience for young people aged 11 and over. To run the programme we collect and process personal data from learners, and (where they choose to use the platform) from verified Careers Advisers at participating schools.

Specific notices apply to particular audiences:

• If you are under 13, please read our Children's Privacy Notice, which is written in plain language and explains the enhanced protections that apply to you.
• If you are a Careers Adviser, please read our Careers Adviser Privacy Notice, which explains exactly what learner data you can see in your role.

4. Categories of personal data we process

Category	Examples	Who it applies to
Core personal data	Name, email address, date of birth, school name and URN, programme progress and step submissions	All learners
Technical / device data	IP address (city-level geolocation), browser type, user agent, screen resolution, referrer URL, session ID	All authenticated learners
Extended personal data	Gender, postcode, phone number, employment status, education level	Learners aged 13 and over only
Special category data	Ethnicity, religion, sexual orientation, disability or SEND	Learners aged 13 and over only, on the basis of explicit consent. These fields are not collected from under-13 users at all.
AI interaction data	Inputs you submit to AI-powered learning steps, and the AI feedback generated against your progress record. Your first name may be used to personalise feedback.	All learners using AI steps

5. Purposes and lawful bases

We only process personal data for the purposes listed below, and only on the lawful bases set out alongside each one.

Purpose	Lawful basis (UK GDPR Article 6)	Special category basis (Article 9), where relevant
Registering you for an account, signing you in, and giving you access to the platform	Performance of a contract (the platform terms)	—
Delivering the learning modules to you, recording your progress and submissions, and issuing certificates	Performance of a contract	—
Generating AI-assisted feedback on your submissions in a closed Microsoft Azure OpenAI environment	Performance of a contract	—
Sharing limited progress information with the verified Careers Adviser at your school, where one is using the platform	Legitimate interests (supporting learners through the programme). A Legitimate Interest Assessment is held on file.	—
Producing anonymised, aggregated reports for partner organisations on engagement, diversity, and impact	Legitimate interests (programme evaluation and improvement). Output is anonymised and does not identify any individual.	Explicit consent (where the underlying data includes diversity information)
Collecting optional diversity information (ethnicity, religion, sexual orientation, disability/SEND)	Explicit consent (Article 6(1)(a))	Explicit consent (Article 9(2)(a)) — 13+ users only
Sending transactional emails (account confirmation, password reset, security notifications)	Performance of a contract	—
Sending optional marketing communications	Consent. Marketing functions are blocked at the application level for users under 13.	—
Analysing how the platform is used (Google Analytics, Mautic CDP)	Consent (collected via the cookie banner). Analytics scripts only load when consent is given.	—
Maintaining platform security and investigating misuse	Legitimate interests (protecting the platform and its users)	—

6. Who we share data with

Personal data is shared with the following processors and recipients only for the purposes listed. Data Processing Agreements are in place with all processors. We do not sell personal data, and we do not share personally identifiable data with employer partners — only anonymised, aggregated impact reporting.

Recipient	Purpose	Location
Microsoft Azure	Cloud hosting, storage, and authentication (Microsoft Entra ID CIAM)	UK (UK South / UK West)
Azure OpenAI (Microsoft)	AI-powered feedback, roleplay, and interaction steps. No training is performed on user data. Chatbot conversations are ephemeral and not stored.	UK (closed Azure environment)
Google Analytics (GA4)	Web analytics. Only loaded when you accept the cookie banner.	USA (under EU Standard Contractual Clauses)
Mautic CDP (cdp.gmfj.co.uk)	Marketing automation, contact segmentation, and campaign management. Only loaded when you accept the cookie banner. Marketing functions are blocked at application level for under-13 users.	UK (self-hosted)
Postmark	Transactional email delivery (account confirmation, password reset, security notifications). Email scope is restricted for under-13 users.	USA (under EU Standard Contractual Clauses)
Google, Microsoft, Facebook, TikTok	Optional social login. Only the fact that you signed in with that provider is shared. No additional profile data is transferred. You may always sign in with email and password instead.	USA / Singapore (under EU Standard Contractual Clauses)
ipapi.co	City-level IP geolocation, used for analytics. Coordinates are truncated to 2 decimal places.	USA
Curatrix Technologies	Managed Service Provider — infrastructure and security support	UK
Verified Careers Advisers at your registered school	Limited learner data and progress, to support you through the programme. Detail in the Careers Adviser Privacy Notice.	UK

7. International transfers

Most of your data is stored and processed in the United Kingdom. Where data is transferred to processors based outside the UK (currently Google Analytics, Postmark, ipapi.co, and the social-login providers if used), those transfers are carried out under the UK International Data Transfer Agreement or equivalent EU Standard Contractual Clauses, with appropriate technical and organisational safeguards.

8. How long we keep your data

We retain personal data for a maximum of two years from your last interaction with the platform. After that point, your account and the personal data associated with it are deleted by an automated routine.

You can ask us to delete your account at any earlier point by emailing data@getmyfirstjob.co.uk. Your request will be processed through the same automated deletion routine. Some information may continue to exist briefly in encrypted backups before those backups are recycled.

9. Security

All personal data is stored in Microsoft Azure UK-based data centres. The infrastructure is ISO 27001:2022 certified and includes end-to-end encryption, geo-redundancy, secure authentication via Microsoft Entra ID CIAM, a zero-trust architecture, and regular penetration testing and malware screening.

10. Use of AI

Some learning steps use AI tools (Microsoft Azure OpenAI, operating within a closed environment) to give you feedback on what you submit, or to power short roleplay or chatbot interactions. Inputs you submit to AI steps and the feedback generated against your progress record are stored on the platform.

Chatbot conversations are ephemeral and are not stored. The AI tools are not used to make automated decisions about you, and they are not used to profile you. Microsoft does not use your data to train its underlying models. AI feedback is intended as guidance, not a definitive assessment.

11. Your rights

Under UK data protection law you have the following rights, which you can exercise by emailing data@getmyfirstjob.co.uk:

• Right of access — to ask for a copy of the personal data we hold about you.
• Right to rectification — to ask us to correct any data that is inaccurate or incomplete.
• Right to erasure — to ask us to delete your personal data (we will process this through our automated deletion routine).
• Right to restrict processing — to ask us to limit how we use your data in particular circumstances.
• Right to data portability — to ask for a copy of certain data in a structured, commonly used, machine-readable format.
• Right to object — to object to our processing on the basis of legitimate interests, or for marketing purposes.
• Right to withdraw consent — where we rely on consent (for diversity data, marketing, or analytics cookies), you can withdraw it at any time.
• Rights in relation to automated decision-making — we do not make automated decisions about you that have a legal or similarly significant effect.

We will respond to any request within one calendar month. If we cannot meet that timeframe, we will let you know and explain why.

12. Complaints

If you have a concern about how we are handling your data, please contact our Data Protection Officer first at data@getmyfirstjob.co.uk — we would always like the chance to put things right.

You also have the right to lodge a complaint with the Information Commissioner's Office (ICO), the UK supervisory authority for data protection:

• Website: ico.org.uk/make-a-complaint
• Helpline: 0303 123 1113
• Post: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

13. Changes to this notice

We keep this notice under regular review and may update it from time to time. Where changes are material we will notify users through the platform and, where appropriate, by email.