PRIVACY NOTICE
How we use your personal data
Please read this notice carefully. It explains what personal data we collect when you use this platform, why we collect it, who we share it with, and what rights you have.
Who we are
This platform (exeapprentices.co.uk) is operated by GetMyFirstJob Ltd, trading as Talent People on behalf of Exeter College. Talent People is the data controller for the candidate-facing journey on this platform.
| Organisation | GetMyFirstJob Ltd (trading as Talent People) |
| Registered address | 61 Westway, Caterham, Surrey, CR3 5TQ |
| Company number | 06685719 |
| ICO registration | ZA040618 |
| Data protection contact | [email protected] |
Exeter College is an independent data controller for their own institutional processing. Their data protection information is available at exe-coll.ac.uk/dataprotection/. This notice covers Talent People's processing only.
What data we collect
When you register and use this platform we may collect the following:
- Identity and contact data: full name, email address, phone number
- Personal data: date of birth, home address and postcode
- Educational data: current school or college (school URN where applicable)
- Application data: your responses to questions on opportunities you apply for
- Equality monitoring data (optional): ethnicity — only if you choose to provide it via the separate opt-in on the registration form
- Technical data: analytics and session data if you accept analytics cookies (see our Cookie Policy)
Why we collect it and our lawful basis
| Purpose | Lawful basis |
|---|---|
| Creating and managing your candidate profile so you can apply to apprenticeship opportunities | Article 6(1)(b) – Contractual necessity |
| Sending you transactional emails — for example to confirm when you have applied to an opportunity, or to notify you when a recruiter updates the status of your application | Article 6(1)(f) – Legitimate interests (keeping you informed about your own applications is a core part of the service you have signed up for) |
| Sending you marketing emails about other opportunities and services that may be of interest | Article 6(1)(a) – Consent (you can opt in or out during registration and withdraw at any time) |
| Collecting equality monitoring data (ethnicity) for diversity and inclusion reporting | Article 9(2)(a) – Explicit consent (separate opt-in on the registration form; entirely optional and never used in recruitment decisions) |
| Site analytics — understanding how the platform is used so we can improve it | Article 6(1)(a) – Consent (only if you accept analytics cookies via the cookie banner) |
| Platform security, session management and fraud prevention | Article 6(1)(f) – Legitimate interests |
| Emailing your application to the employer, for opportunities that ask for applications by email (see "Applications sent directly to employers" below) | Article 6(1)(b) – Contractual necessity (sending your application to the employer is the service you asked for) |
Sharing your data with third-party processors
We share data with the following third-party processors, each under a Data Processing Agreement. We do not sell your data.
| Processor | Purpose | Location |
|---|---|---|
| Microsoft Azure | Cloud hosting, database storage (Cosmos DB, SQL Server), file storage (CVs, uploaded documents), and authentication (Microsoft Entra ID) | UK |
| Mautic CDP (cdp.gmfj.co.uk) |
Two separate purposes:
|
UK (self-hosted) |
| Google Analytics (GA4) | Site analytics (page views, session data). Only loaded if you accept analytics cookies. | USA (UK IDTA / SCCs in place) |
| Postmark | Transactional email delivery (application confirmations, status notifications, account emails) | USA (UK IDTA / SCCs in place) |
| Twilio | SMS notifications (where applicable) | USA (UK IDTA / SCCs in place) |
Applications sent directly to employers
Some opportunities ask for applications to be emailed straight to the employer. When this is the case, we tell you before you apply which employer your application will go to. When you apply, we email that employer the role you applied for; your name, email address, phone number and the town you live in; your answers to the application questions (never your answers to equal-opportunities or positive-action questions); and a link to the CV and any other files you attach to that application. You choose which CV goes: the one on your profile, or one you upload just for that role. A CV is needed to apply for these opportunities.
Your files are not attached to the email. They stay in our secure storage, and the link only opens after the person using it proves, with a code we email to the employer's address, that they can read that mailbox, so a forwarded email does not give anyone else access. The link expires after 30 days and stops working straight away if you withdraw your application or ask us to delete your account.
The employer is not one of our processors: from the moment they receive your application they become a Controller of the information they receive, in their own right, and will explain how they use it. Your files are sent as they are, so please check they don't include anything you would rather an employer didn't see, such as information about your health or a disability.
Sharing your profile across the Talent People platform
Your profile is stored on a shared recruitment platform operated by Talent People. If you register on another service that uses the same platform (for example, another apprenticeship or early-careers site operated by Talent People on behalf of a different organisation), your profile information will be accessible to that service's administrators.
This means that the personal data you provide here — including your name, contact details, and any information you add to your profile — may be visible to recruiters at other partner organisations if you choose to use one of their services. You are in control of which services you register for.
How long we keep your data
We retain your profile for up to two years from your last activity on the platform, after which it is anonymised automatically. You can request deletion of your account and data at any time by contacting our DPO (see below).
Your rights
Under UK GDPR you have the following rights in relation to your personal data:
- Access — request a copy of the data we hold about you
- Rectification — ask us to correct inaccurate data
- Erasure — ask us to delete your data (subject to legal obligations)
- Restriction — ask us to limit how we use your data
- Objection — object to processing based on legitimate interests
- Portability — receive your data in a structured, machine-readable format
- Withdraw consent — where we rely on consent (marketing emails, analytics cookies, equality monitoring data), you can withdraw it at any time without affecting the lawfulness of processing before withdrawal
To exercise any of these rights, contact our data protection team at [email protected].
Right to complain
If you are unhappy with how we have handled your personal data, you have the right to lodge a complaint with the UK Information Commissioner's Office (ICO):
- Website: ico.org.uk
- Telephone: 0303 123 1113
We would, however, appreciate the opportunity to address your concern directly before you contact the ICO. Please contact our DPO in the first instance.
Cookies
For information about the cookies this site sets and how to manage your preferences, please see our Cookie Policy.
Changes to this notice
We may update this notice from time to time. The current version will always be available at this address. Last updated: October 2026.