Category of Information: Information you provide when registering for and using the 4Skills Work Experience Programme.

What we collect

To create your account and deliver the programme we collect the following:

• Required: your name, email address, date of birth, and school name and reference number (URN).
• Required: a secure password for your account.
• Optional: gender, postcode, phone number, employment status, and education level.
• Optional (special category data — explicit consent required): ethnicity, religion, sexual orientation, and disability or SEND information. This data is used only for anonymised diversity reporting and will never be used to identify you. You can withdraw consent at any time by contacting data@getmyfirstjob.co.uk.

We also collect your programme progress and the content of steps you complete (written answers, uploaded files, and AI feedback). This is necessary to deliver the programme, track your progress, and issue your certificate.

Lawful Basis for Processing

If you are registered at a school, your school's verified Careers Adviser has access to a dashboard showing students from their school who have enrolled on the programme. This access exists to allow them to support you through the programme. It is a core part of how the 4Skills programme operates.

Your Careers Adviser can see:

• Your name and email address
• Your enrolment date
• Your progress through the programme (module completion and step-level status)
• Your completion date, if applicable
• The full content of steps you have completed — including your written answers, any files you have uploaded, and the AI-generated feedback given to you on those steps
• Any feedback ratings or comments you have voluntarily submitted

Your Careers Adviser cannot see:

• Your date of birth
• Your gender, ethnicity, religion, sexual orientation, or disability information

Careers Advisers are DBS-checked and bound by their school's data protection obligations. Access is restricted to students at their registered school only.

The lawful basis for this sharing is Contractual Necessity (Art 6(1)(b)) — Careers Adviser oversight is an integral part of programme delivery.

What this covers: AI tools embedded within programme steps, including document feedback, questionnaire feedback, roleplay simulations, AI interaction steps, assessment scoring, and content moderation.

What is processed and how

• When you complete an AI-powered step, your input and your first name are sent to Azure OpenAI, which operates within a secure UK-based environment. Your first name may be used to personalise the feedback response.
• AI-generated feedback is stored securely against your progress record and is visible to you and to your Careers Adviser.
• Our AI tools do not train on your personal data. Models are static and pre-trained.
• AI does not make any decisions with legal or significant effects. It provides feedback only; all programme decisions are made by people.
• Content moderation checks your submissions for harmful content and inadvertent inclusion of personal information before processing. This is a safeguard, not a record-keeping activity.

Retention: AI step interaction records are stored for two years in line with our standard retention policy.

Lawful basis: Contractual Necessity (Art 6(1)(b)) — AI steps are a component of programme delivery.

The platform includes two optional AI chat assistants for users aged 13 and over: a Programme Chat Assistant available while you are working through the programme, and an Alumni Chat Assistant available once you have completed it. Both are powered by Azure OpenAI within our secure UK environment.

Important: chat conversations are not stored

• Any conversation you have with the chat assistant exists only for the duration of your browser session. It is not saved to our database and is not retained after you close or navigate away.
• The information sent to Azure OpenAI by the chat assistant contains only programme content (module names, step descriptions, skills, awards) — it does not include your name, email address, or any other personal data.
• Your chat conversations are not visible to your Careers Adviser or to Talent People staff.
• The chat assistant does not make decisions about you and is not connected to your progress record.

Lawful basis: Contractual Necessity (Art 6(1)(b)) — the chat assistant is a supplementary programme feature.

We use cookies — small text files stored on your device — to keep the platform working and to understand how it is used. Some cookies are strictly necessary; others are only active if you have accepted cookie consent.

Cookies we use

Your consent matters: The analytical cookies (Google Analytics and Mautic) are only loaded after you accept the cookie consent banner. If you decline, those scripts do not run. You can change your cookie preferences at any time by clearing your browser's local storage or contacting us.

Lawful basis: Legitimate Interests (Art 6(1)(f)), subject to your cookie consent for non-essential cookies.

Each time you use the platform, we automatically collect certain technical information. This is used to keep the platform running securely and to help us support you.

• IP address and approximate location: Your IP address is used to determine your approximate city-level location (accurate to within roughly 10–20 km). This is collected via a service called ipapi.co and is used for session management and security. We do not use it to determine your precise address.
• Device and browser information: We collect your browser type, operating system, screen resolution, and browser version. This helps us ensure the platform works correctly on your device.
• Referrer and navigation data: We record the URL you came from when you arrived at the platform and the pages you visit. This helps us understand how people find and use the programme.

This information is combined with that of other users and reported in statistical form. It cannot be used to identify you individually.

Lawful basis: Legitimate Interests (Art 6(1)(f)) — necessary for session management, security, and technical support.

We will send you transactional emails to support your use of the platform — such as account confirmation, password reset, progress updates, completion notifications, and your certificate. These are necessary service communications and do not require separate permission.

We may also ask if you would like to receive career and employment opportunity updates by email. These are marketing communications and require your separate opt-in. You can change your marketing preferences at any time by logging into your account or clicking 'unsubscribe' in any marketing email.

Marketing communications are only sent to users aged 13 and over who have opted in. If you are under 13, you will not receive marketing emails and will not be added to any marketing list under any circumstances.

Where it comes from: Emails you send to us for support or assistance.

When you contact us by email, any personal information you provide (your name, email address, and details of your enquiry) will be treated with the same level of protection as our commercial information.

We may create an electronic record of your enquiry, stored securely and used only to respond to you, resolve any issues, and maintain an audit trail for accountability and compliance.

We monitor incoming emails for viruses or malicious software and will promptly delete any email that is illegal or poses a security risk.

Lawful basis: Legitimate Interests (Art 6(1)(f)) — to deal with your enquiry and maintain service quality.

Retention: Support emails and related records are retained for two years from the date of last correspondence, after which they are securely deleted. You may request earlier deletion at any time.

If you contact us with an enquiry or to report a problem, we may ask for your name, email address, and account username so we can identify you and deal with your request.

We will only use this information to investigate and respond to you. It is in our legitimate business interests (Art 6(1)(f)) to process this information in order to handle your enquiry. We will only correspond with you in the way you have asked us to.

Do I have to provide this information?

Some information is required to deliver the 4Skills Work Experience Programme — your name, email address, date of birth, and programme progress data. Without this we cannot create your account or provide access to the programme. Optional information (gender, ethnicity, disability etc.) can be withheld without affecting your access, and you can withdraw consent for optional data at any time by contacting data@getmyfirstjob.co.uk.

Retention period

Your personal information is held for two years from the last date you used the platform, or (if later) the date you last contacted us. After this period your data is deleted. If you ask us to delete your data before this time we will do so unless we are required to keep it for legal reasons.

Where we store your data

All personal data is stored and processed within the United Kingdom, using UK-based Microsoft Azure data centres certified to ISO 27001:2022. We do not transfer your personal data outside the UK. Certain third-party processors (Google Analytics, Postmark) operate in the USA under EU Standard Contractual Clauses (SCCs) approved by the UK ICO.

Keeping your information up to date

If any personal data we hold about you is incorrect, please log in and update your profile, or contact us at data@getmyfirstjob.co.uk.

Your account

Keep your password confidential and do not share it with anyone. If you believe your account has been compromised, contact us immediately at data@getmyfirstjob.co.uk.

We do not make any automated decisions that have a legal or significant effect on you. AI tools on the platform are used only to provide feedback and support — all decisions about the programme are made by people.

Under UK data protection law, you have the following rights in relation to the personal data we hold about you:

• Right of access: Ask us for a copy of the personal data we hold about you.
• Right to rectification: Ask us to correct inaccurate or incomplete information.
• Right to erasure: Ask us to delete your personal data (subject to legal obligations).
• Right to restriction: Ask us to limit how we use your data in certain circumstances.
• Right to object: Object to our use of your personal data where we rely on legitimate interests. We will stop processing unless we can demonstrate compelling legitimate grounds that override your interests.
• Right to withdraw consent: Where you have given consent (e.g. for optional diversity data or marketing), you can withdraw it at any time. We will stop using personal identifiable data from that point. Any data already anonymised in reports cannot be removed, but cannot be linked back to you.
• Right to data portability: Request that we transfer your personal data to another service provider in a structured, machine-readable format.
• Right to complain: Lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.

To exercise any of these rights, contact us at data@getmyfirstjob.co.uk. We will respond within one month. In some cases an exception in law may prevent us from fully complying; we will explain if that applies.