Who is responsible for this
Assize Data Ltd is the controller for the personal data described here. It is a private limited company registered in England and Wales, company number 17510115, registered office c/o IWN Accountancy, The Echo Building, 18 Albert Road, Bournemouth BH1 1BZ, trading as Assize Careers.
Email dataprotection@assizedata.co.uk about anything on this page, or write to the address above marked “Data protection”. The company’s data protection page covers how to make a request, and its registration with the Information Commissioner’s Office. This notice covers assizecareers.co.uk; the company’s own privacy notice covers the rest of what it does.
If you only read the figures
You can read every published figure, every guide and the application calendar without an account, without a cookie and without telling us anything. There is no tracker on this site, no advertising and no third-party script watching you read.
Cloudflare hosts the site and processes the technical details of each request so it can serve the page and keep the site up: your IP address, your browser and device details, the page you asked for and the time. We keep no web server logs of our own.
We have not switched on any analytics. When we do it will be Cloudflare Web Analytics, which is cookieless, stores nothing on your device and gives us aggregate page counts rather than anything about a person. The cookie page says what will change when it is enabled, which is almost nothing.
Lawful basis: our legitimate interests in running a secure, working website.
When you create an account
We ask for an email address. That is the whole of the required sign-up.
There is no password, so we hold no password. You get a single-use sign-in link by email and we store only a one-way hash of its token; the token itself exists in that email and nowhere else. The link expires in 20 minutes and works once. When you follow it we set a session cookie and store only a hash of that too, so a stolen copy of our database cannot be replayed as a login. Five links per address per hour, which is generous for a mistyped address and useless for a flood.
The sign-in form answers identically whether or not an address has an account, so nobody can use it to find out who has signed up.
Two optional questions ask where you are now and what you are aiming at, so the site can show you the right deadlines and routes. Both have a “prefer not to say” and both can be changed or cleared on the account page. Marketing email is off unless you turn it on.
We ask for nothing that data protection law calls special category data. Not your ethnicity, not your health, not your religion, not your sexual orientation, not whether you went to a state school. Other people in this market ask. We do not need it to tell you what a register says.
The sign-in and join forms use Cloudflare Turnstile to tell a person from automated abuse. It assesses signals from your browser and device and we receive only a pass or a fail.
Lawful basis: performance of a contract with you, and steps taken at your request before it, for the account itself; our legitimate interests in keeping the forms free of abuse for the Turnstile check.
When you subscribe
We never see your card. Payment runs on Stripe’s own hosted pages, so the card number, the expiry date and the security code are given to Stripe and not to us, and the authentication your bank asks for is between you, your bank and Stripe.
What we store about a subscription is what we need to know what you are entitled to open:
- the Stripe customer and subscription identifiers
- which plan, monthly or yearly, and its status
- the amount charged, the current period’s start and end dates, and whether it is set to cancel
- a dated record of each change of entitlement and what caused it, so we can answer “why could this account open that page on that day”
- the identifiers of the Stripe notifications we have already processed, so a repeated one cannot charge you twice or grant twice
- the three statements you ticked at the checkout — the terms, your request that the subscription start straight away, and that you are 18 or over — with the version of the wording you were shown and the date and time, written before you are sent to Stripe and therefore kept whether or not the purchase completed
Lawful basis: performance of our contract with you.
What you make while using the site
All of this is yours, you choose whether to create any of it, and it is never shared with anyone:
- Tracked applications: the employer, the route, the stage it is at, deadlines, dates, what you plan to do next, the outcome and your own notes.
- A shortlist of courses and providers, with your notes against each.
- Practice attempts: which set, when you started and finished, how long you took, which answers you gave and which were right. That is what the diagnostics page reads to tell you where you are losing marks.
- Reminders you asked for: the subject, the date and how many days’ notice.
No employer, university, provider or recruiter is told that you have an account, what you have tracked, what you scored or what you looked at. There is nothing in this product that an employer can buy.
Your practice attempts are compared only with other people’s attempts at our own practice sets, in aggregate, to tell you where you sit. They are never converted into a test publisher’s score or percentile, because those are theirs and are not ours to convert.
Lawful basis: performance of our contract with you.
The CV checker does not keep your CV
You paste your CV, the Worker reads it from the request, applies its rules in memory and returns the findings. The text is not written to any database, any log or any file, and the response is marked not to be stored or cached. Reload the page and it is gone. There is no copy for us to lose, hand over or train anything on.
The checker produces findings, not a score, and nothing about it is an automated decision about you: it applies fixed rules written down in advance, and a person reads nothing unless you ask us to.
One thing to be careful of, which is as much about other people as about you: put your own CV in it. Not a friend’s, not a candidate’s.
On the Pro plan a human being does read what you send for the written review. You send it to us by email, a person reads it and replies with comments, and we delete our copy once those comments have gone back to you. That is the one place on this site where a person reads your work, and it happens only when you ask.
Email we send you
Service email: the sign-in link you asked for, confirmation when a subscription starts, a reminder 7 days before a monthly renewal and 28 days before a yearly one, confirmation when you cancel, and the deadline reminders you set up. These are part of selling you a subscription, so they are not a marketing list and there is nothing to unsubscribe from while a subscription is running.
We log that each one was sent — the address, what kind of message, when, and whether it got through — so that we can prove a renewal reminder went out and can tell when the mail is failing.
Marketing email is separate, off by default, a single unbundled tick, and off again in one click from the account page or from any message. When you tick it we store the date and the version of the wording you were shown beside the flag, because consent to a marketing email has to be demonstrable; when you untick it, both are cleared with the flag. We do not add free accounts to a marketing list on the quiet theory that signing up was a negotiation for a sale.
Lawful basis: performance of our contract for the service email; consent for marketing.
The figures have nothing to do with you
The numbers on this site are computed from public registers and official statistics in the company’s own warehouse, which is not connected to the internet. Every hour a job copies the published figures and the employer register rows into the database that serves the pages. Nothing about any member is in that pipeline, in either direction: the analytics database holds no personal data of any subscriber, and no subscriber data is ever copied into it.
The registers themselves name people and firms, because that is what a public register is for. The company’s data sources page sets out how it handles personal data in public records, and this site’s own sources page lists every source and licence.
Who else processes it
Two companies, both acting on our instructions:
- Cloudflare, Inc. — hosting, the databases, security, the Turnstile check, the email we send you and, when it is enabled, the cookieless analytics.
- Stripe (Stripe, Inc. and its group companies) — taking payments, holding the card details, the billing portal and the receipts.
That is the list. We do not sell personal data, we do not share it with employers, universities, recruiters or data brokers, we run no advertising and we use no advertising, session-replay or A/B-testing tag. We may share data with our professional advisers, or where the law requires it.
Where it goes
Cloudflare and Stripe may process personal data outside the UK, including in the United States. Where they do, we rely on UK adequacy regulations, including the UK Extension to the EU–US Data Privacy Framework for providers certified under it, or on the International Data Transfer Addendum approved by Parliament.
How long each thing is kept
| What | How long |
|---|---|
| A sign-in link | 20 minutes, or until used. Expired ones are deleted by a daily job. |
| A session | 30 days from signing in, and then you sign in again. Signing out revokes it at once, and expired and revoked sessions are deleted by the same daily job. |
| Your account | Until you close it. Closing deletes everything you made and clears the stage, the route and the marketing flag; the account row stays, closed and holding only the email address, so that a later sign-up cannot inherit an old subscription. |
| Applications, shortlist, practice attempts, reminders | Until you delete them, or immediately when you close the account. |
| CV text in the checker | Not stored at all. |
| Subscription and entitlement records | Six years after the end of the tax year of the last payment, because we must keep records of our own sales. |
| What you agreed to at the checkout | Six years, with the subscription record, whether or not the purchase completed. |
| The log that an email was sent | Two years. |
The first two lines are deleted by a job that runs every day. The rest we keep to, and anything you delete yourself — a tracked application, your whole account — goes at once rather than going into a queue.
If you are under 18
A site about getting into law will be read by people at school, so this is written for them too. The free plan is open to you and asks for an email address. The paid plans are sold only to people aged 18 or over, so a parent or guardian would be the one who subscribes and pays, in their own name and on their own account: the terms say why.
What that means in practice is the same for you as for everyone else, because the site does not do the things an age-appropriate design would have to switch off. There is no profiling, no behavioural advertising, no location data, no recommendation engine, nothing that nudges you to spend more by pretending to be scarce, and no feature that shares anything you write with another user. Marketing is off until you turn it on, and the optional questions can be left blank.
Before this site takes its first payment, the company will complete a data protection impact assessment covering under-18 users and the figure pipeline, as the Information Commissioner’s children’s code requires.
Your rights, and the two we have made into buttons
You can ask for a copy of what we hold, ask us to correct it, ask us to delete it, ask us to restrict how we use it, object to our using it where we rely on legitimate interests, and ask for data you gave us in a portable form. Some of those apply only in certain circumstances.
Two of them do not need a request at all, because the account page does them:
- A copy of everything, in a portable form. One button hands you a JSON file with your account details, your subscriptions, your applications, your shortlist, your practice attempts and your reminders.
- Deletion. Closing the account deletes everything you made, immediately, with a typed confirmation rather than a support ticket.
For anything else email dataprotection@assizedata.co.uk, or use the company’s data protection page. We reply within one month.
Complaints
Tell us first, at dataprotection@assizedata.co.uk. We acknowledge a data protection complaint within 30 days and say what we are doing about it. You can also complain to the Information Commissioner’s Office at ico.org.uk/make-a-complaint, or on 0303 123 1113.
Changes to this notice
We update it when what the code does changes, which is the only thing that should ever change it. The review date under the heading above shows when it last did.